apiVersion: v1
data:
  athenz.properties: |
    # Athenz Jetty Container properties file.
    # If there is a value specified in the commented property line,
    # then it indicates the default value

    # The TLS port that Jetty will listen on for HTTPS connection
    athenz.tls_port=8443

    # The standard HTTP port for Jetty - disabled by default
    athenz.port=0

    # Set the number of days before rotated access log files are deleted
    #athenz.access_log_retain_days=31

    # Format of the access log filename
    #athenz.access_log_name=access.yyyy_MM_dd.log

    # If specified, the server will use SLF4J logger with the specified name
    # to log events instead of using Jetty's NCSARequestLog class.
    # The administrator then must configure the specified logger in the logback.xml
    #athenz.access_slf4j_logger=

    # Directory to store access log files
    athenz.access_log_dir=/opt/athenz/zts/logs/zts_server

    # Key Manager password
    #athenz.ssl_key_manager_password=

    # The path to the keystore file that contains the server's certificate
    athenz.ssl_key_store=/opt/athenz/zts/var/certs/zts_keystore.pkcs12

    # Specifies the type for the keystore specified in the
    # athenz.ssl_key_store property
    athenz.ssl_key_store_type=PKCS12

    # Password for the keystore specified in the athenz.ssl_key_store property
    #athenz.ssl_key_store_password=athenz

    # The path to the trust store file that contains CA certificates
    # trusted by this Jetty instance
    athenz.ssl_trust_store=/opt/athenz/zts/var/certs/zts_truststore.jks

    # Specifies the type for the truststore specified in the
    # athenz.ssl_trust_store property
    athenz.ssl_trust_store_type=JKS

    # Password for the truststore specified in the athenz.ssl_trust_store property
    #athenz.ssl_trust_store_password=athenz

    # List of excluded cipher suites from TLS negotiation
    #athenz.ssl_excluded_cipher_suites=

    # List of cipher suites supported for TLS negotiation
    #athenz.ssl_included_cipher_suites=

    # Comma separated list of excluded ssl protocols
    #athenz.ssl_excluded_protocols=SSLv2,SSLv3

    # Specifies whether or not for data requests the server
    # would require TLS client authentication rather than
    # just wanting it
    #athenz.ssl_need_client_auth=

    # In milliseconds how long that connector will be allowed to
    # remain idle with no traffic before it is shutdown
    #athenz.http_idle_timeout=30000

    # Boolean setting to specify whether or not the server should
    # send the Server header in response
    #athenz.http_send_server_version=false

    # Boolean setting to specify whether or not the server should
    # include the Date in HTTP headers
    #athenz.http_send_date_header=false

    # The size in bytes of the output buffer used to aggregate HTTP output
    #athenz.http_output_buffer_size=32768

    # The maximum allowed size in bytes for a HTTP request header
    #athenz.http_request_header_size=8192

    # The maximum allowed size in bytes for a HTTP response header
    #athenz.http_response_header_size=8192

    # For HTTP access specifies the IP address/Host for service to listen on.
    # This could be necessary, for example, if the system administrator
    # wants some proxy server (e.g. ATS) to handle TLS traffic and configure
    # Jetty to listen on 127.0.0.1 loopback address only for HTTP connections
    # from that proxy server
    #athenz.listen_host=

    # Boolean flag to indicate whether or not the container should honor
    # the Keep Alive connection option or just connections right away
    #athenz.keep_alive=false

    # Max number of threads Jetty is allowed to spawn to handle incoming requests
    #athenz.http_max_threads=1024

    # Specify the FQDN/hostname of the server. This value will be used as the
    # h parameter in the ZMS generated UserTokens. It is also reported as part
    # of the server banner notification in logs
    #athenz.hostname=

    # Default home directory for embedded Jetty Deployer. The container will look
    # for any webapps in the webapps subdirectory of the configured directory
    athenz.jetty_home=/opt/athenz/zts

    # Boolean flag to enable debug log entries when deploying webapps
    #athenz.debug=false

    # Comma separated list of uris that are accessed by health check
    # system. Used by the simple file based health check filter that
    # returns 200/404 if the file exists or not
    #athenz.health_check_uri_list=

    # Directory name where the files specified in the athenz.health_check_uri_list
    # setting are checked for
    #athenz.health_check_path=

    # Enable Proxy Protocol (used by HAProxy and environments such as Amazon Elastic Cloud)
    # for the jetty container.
    #athenz.proxy_protocol=false

    # Enable graceful shutdown in the Jetty
    athenz.graceful_shutdown=true

    # How long to wait for the Jetty server to shutdown, in milliseconds
    # If the athenz.graceful_shutdown is not true, this setting is invalid.
    athenz.graceful_shutdown_timeout=30000
  athenz_conf.json: |
    {
      "zmsUrl": "https://my-release-athenz-zms.default.svc.cluster.local:4443/",
      "ztsUrl": "https://my-release-athenz-zts.default.svc.cluster.local:8443/",
      "zmsPublicKeys": [
        {
          "id": "0",
          "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFRWt3RmdZQ3AzNzRaOUp0VVBPaUlUMmQzb1VxUQpDUHVhM3dOeXhHdXQrQ01xZUVWWlNHY1VjcHBwQlhpY3k4UmVPaXByUGJ2RFZqNzRJTHY3R1R6Z1ZnPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg--"
        }
      ],
      "ztsPublicKeys": [
        {
          "id": "0",
          "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFdG9mTlg2VUxOS1h0c2pXaGxBZ295M2RTVytWbwp5cUJnaitVb2Y3YnRKZmw5bEEwTk9aYzB2MXMrc2tmWlppeGhOY0FHcUtnM0R3MVQyNDl0NTA2ZW9RPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg--"
        }
      ]
    }
  authorized_client_ids.txt: ""
  logback.xml: |
    <?xml version="1.0" encoding="UTF-8" ?>
    <configuration scan="true">

      <property name="LOG_DIR" value="logs/zts_server" />

      <!--Daily rolling file appender -->
      <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">

        <file>${LOG_DIR}/server.log</file>
        <append>true</append>

        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
          <fileNamePattern>${LOG_DIR}/server.%d.log</fileNamePattern>
          <maxHistory>7</maxHistory>
          <cleanHistoryOnStart>true</cleanHistoryOnStart>
        </rollingPolicy>

        <encoder>
          <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n</pattern>
        </encoder>
      </appender>

      <!-- Logger used exclusively for audit logging -->
      <appender name="AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">

        <file>${LOG_DIR}/audit.log</file>
        <append>true</append>

        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
          <fileNamePattern>${LOG_DIR}/audit.%d.log</fileNamePattern>
          <maxHistory>30</maxHistory>
          <cleanHistoryOnStart>true</cleanHistoryOnStart>
        </rollingPolicy>

        <encoder>
          <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n</pattern>
        </encoder>
      </appender>

      <logger name="org.eclipse" level="INFO"/>
      <logger name="AuditSoxLogger" level="INFO" additivity="false">
        <appender-ref ref="AUDIT" />
      </logger>

      <root>
        <level value="DEBUG" />
        <appender-ref ref="FILE" />
      </root>
    </configuration>
  zts.properties: |
    # Athenz ZTS Servlet properties file.
    # If there is a value specified in the commented property line,
    # then it indicates the default value

    # Default root directory for ZTS Server. This must be passed as
    # part of the startup script since it is used before the
    # properties file is accessed.
    #athenz.zts.root_dir=/opt/athenz/zts

    # Comma separated list of authority implementation classes to support
    # authenticating principals in ZTS
    athenz.zts.authority_classes=com.yahoo.athenz.auth.oauth.OAuthCertBoundJwtAccessTokenAuthority,com.yahoo.athenz.auth.impl.CertificateAuthority

    # If File Private Key store implementation is used in the Server,
    # this setting specifies the path to the PEM encoded ZTS Server
    # private key file (both RSA and EC privates keys are supported)
    athenz.auth.private_key_store.private_key=/opt/athenz/zts/var/keys/zts_private.pem

    # If File Private Key store implementation is used in the Server,
    # this setting specifies the key identifier for the private key
    # configured by the athenz.auth.private_key_store.private_key
    # property
    athenz.auth.private_key_store.private_key_id=0

    # Key Manager password
    #athenz.zts.ssl_key_manager_password=

    # The path to the keystore file that contains the client's private key
    # and certificate. Currently this is only used by the HttpCertSigner
    # class implementation.
    athenz.zts.ssl_key_store=/opt/athenz/zts/var/certs/zts_signer_keystore.pkcs12

    # Specifies the type for the keystore specified in the
    # athenz.zts.ssl_key_store property
    athenz.zts.ssl_key_store_type=PKCS12

    # Password for the keystore specified in the athenz.zts.ssl_key_store property
    #athenz.zts.ssl_key_store_password=athenz

    # The path to the trust store file that contains CA certificates
    # trusted by the http client running within this ZTS instance
    athenz.zts.ssl_trust_store=/opt/athenz/zts/var/certs/zts_signer_truststore.jks
    javax.net.ssl.trustStore=/opt/athenz/zts/var/certs/zts_signer_truststore.jks

    # Type for the truststore specified in the athenz.zts.ssl_trust_store property
    athenz.zts.ssl_trust_store_type=JKS
    javax.net.ssl.trustStoreType=JKS

    # Password for the truststore specified in the athenz.zts.ssl_trust_store property
    #athenz.zts.ssl_trust_store_password=athenz
    #javax.net.ssl.trustStorePassword=athenz

    # Specifies the location for the athenz.conf file used by the ZMS Client
    # library to determine what ZMS server to contact to.
    athenz.athenz_conf=/opt/athenz/zts/conf/zts_server/athenz_conf.json

    # If specified, this setting overrides the ZMS Server url value for the
    # ZMS Client as retrieved from the athenz.conf file
    #athenz.zts.zms_url=

    # SelfCertSignerFactory implementation - if this factory class is used
    # is used for the CertSigner implementation (athenz.zts.cert_signer_factory_class
    # property), this setting specifies the private key filename that is used to sign
    # certificate requests.
    # athenz.zts.self_signer_private_key_fname=/opt/athenz/zts/var/certs/zts_signer_key.pem

    # SelfCertSignerFactory implementation - if this factory class is used
    # is used for the CertSigner implementation (athenz.zts.cert_signer_factory_class
    # property), this setting specifies the private key password that is used to sign
    # certificate requests.
    #athenz.zts.self_signer_private_key_password=

    # SelfCertSignerFactory implementation - if this factory class is used
    # is used for the CertSigner implementation (athenz.zts.cert_signer_factory_class
    # property), this setting specifies the dn for the CA certificate that ZTS
    # will use
    # athenz.zts.self_signer_cert_dn=cn=Sample Self Signed Athenz CA,o=Athenz,c=US

    # HttpCertSignerFactory implementation - if this factory class is used
    # for the CertSigner implementation (athenz.zts.cert_signer_factory_class
    # property), this setting specifies the base uri for the Certificate Signer Service
    #athenz.zts.certsign_base_uri=

    # HttpCertSignerFactory implementation - if this factory class is used
    # for the CertSigner implementation (athenz.zts.cert_signer_factory_class
    # property), this setting specifies in seconds the connect timeout
    #athenz.zts.certsign_connect_timeout=10

    # HttpCertSignerFactory implementation - if this factory class is used
    # for the CertSigner implementation (athenz.zts.cert_signer_factory_class
    # property), this setting specifies in seconds the request timeout.
    # We're setting the initial value to a small on so we know right away
    # if our idle connection has been been closed by cert signer and we'll
    # use our retry setting to retry with a max timeout of 30 seconds.
    #athenz.zts.certsign_request_timeout=5

    # HttpCertSignerFactory implementation - if this factory class is used
    # for the CertSigner implementation (athenz.zts.cert_signer_factory_class
    # property), this setting specifies the number of times the request
    # should be retried if it's not completed with the requested timeout value
    #athenz.zts.certsign_retry_count=3

    # Specifies the factory class that implements the Metrics interface
    # used by the ZTS Server to report stats
    athenz.zts.metric_factory_class=com.yahoo.athenz.common.metrics.impl.prometheus.PrometheusMetricFactory
    # enable PrometheusMetric class
    athenz.metrics.prometheus.enable=true
    # export JVM metrics
    athenz.metrics.prometheus.jvm.enable=true
    # the Prometheus /metrics endpoint
    athenz.metrics.prometheus.http_server.enable=true
    athenz.metrics.prometheus.http_server.port=8181
    # Prometheus metric prefix
    athenz.metrics.prometheus.namespace=athenz_zts
    # for dev. env. ONLY, record Athenz domain data as label
    athenz.metrics.prometheus.label.request_domain_name.enable=false
    athenz.metrics.prometheus.label.principal_domain_name.enable=false

    # Specifies the factory class that implements the AuditLoggerFactory
    # interface used by the ZTS Server to log all changes to domain
    # data for auditing purposes
    #athenz.zts.audit_logger_factory_class=com.yahoo.athenz.common.server.log.impl.DefaultAuditLoggerFactory

    # Specifies the factory class that implements the HostnameResolverFactory
    # interface used by the ZTS Server to validate that the hostname field
    # requested to be added to the X.509 certificate SAN dnsName field is
    # a valid hostname (A/AAAA type) and not other type of dns record.
    #athenz.zts.hostname_resolver_factory_class=

    # Specifies the factory class that implements the PrivateKeyStoreFactory
    # interface used by the ZTS Server to get access to its host specific
    # private key
    #athenz.zts.private_key_store_factory_class=com.yahoo.athenz.auth.impl.FilePrivateKeyStoreFactory

    # Specifies the factory class that implements CertSignerFactory
    # interface used by the ZTS Server to sign any certificate requests
    athenz.zts.cert_signer_factory_class=com.yahoo.athenz.zts.cert.impl.KeyStoreCertSignerFactory
    # athenz.zts.keystore_signer.keystore_password=athenz
    athenz.zts.keystore_signer.keystore_path=/opt/athenz/zts/var/certs/zts_signer_keystore.pkcs12
    athenz.zts.keystore_signer.keystore_type=PKCS12
    athenz.zts.keystore_signer.keystore_ca_alias=1
    athenz.zts.certsign_max_expiry_time=43200

    # Specifies the factory class that implements ChangeLogStoreFactory
    # interface used by the ZTS Server to retrieve the latest changes
    # from the ZMS Server and save them locally
    athenz.zts.change_log_store_factory_class=com.yahoo.athenz.common.server.store.impl.ZMSFileChangeLogStoreFactory

    # ZMSClient config for ZMSFileChangeLogStoreFactory
    athenz.zms.client.keystore_path=/opt/athenz/zts/var/certs/zms_client_keystore.pkcs12
    athenz.zms.client.keystore_type=PKCS12
    # athenz.zms.client.keystore_password=athenz
    athenz.zms.client.truststore_path=/opt/athenz/zts/var/certs/zms_client_truststore.jks
    athenz.zms.client.truststore_type=JKS
    # athenz.zms.client.truststore_password=athenz
    athenz.zms.client.keymanager_password=dummy

    # Specifies the directory for storing zms domain json documents when
    # ZMSFileChangeLogStoreFactory is configured for the change log factory
    # class (athenz.zts.change_log_store_factory_class property)
    athenz.zts.change_log_store_dir=/opt/athenz/zts/var

    # Boolean setting to force users to request role tokens for specific
    # roles rather than for domain which will includes all the roles the
    # given principal has access in that domain
    #athenz.zts.least_privilege_principle=false

    # Specifies the maximum expiry timeout that a client can ask for when
    # requesting a role token. If the client asks for a longer timeout, the
    # server will automatically replace the value with this one
    #athenz.zts.role_token_max_timeout=2592000

    # Specifies the default expiry timeout for role tokens when the client
    # does not specify any timeout parameters
    #athenz.zts.role_token_default_timeout=7200

    # Specifies the maximum expiry timeout that a client can ask for when
    # requesting a oauth2 id token. If the client asks for a longer timeout, the
    # server will automatically replace the value with this one
    #athenz.zts.id_token_max_timeout=43200

    # Specifies the expiry timeout for signed policy documents that
    # ZTS Server signs and returns to ZPU clients
    #athenz.zts.signed_policy_timeout=604800

    # Specifies timeout in seconds for NTokens issued by ZTS
    # Server as part of the Instance bootstrap request
    #athenz.zts.instance_token_timeout=86400

    # Comma separated list of authorized proxy principals
    #athenz.zts.authorized_proxy_users=

    # If the ZTS servlet is deployed along other servlets that may
    # run on non-TLS ports, this setting forces that requests to
    # ZTS are only accepted on secure TLS ports.
    #athenz.zts.secure_requests_only=true

    # Comma separated list of hostname suffixes that providers
    # are allowed to use for their verifiers
    #athenz.zts.provider_endpoints=

    # Specifies in seconds how often to query ZMS Server for updates
    # The default value is 60 seconds
    #athenz.zts.zms_domain_update_timeout

    # Specifies in seconds how often to query ZMS Server for the full
    # list of domains to determine the deleted domains
    # The default value is 3600 seconds
    #athenz.zts.zms_domain_delete_timeout

    # Specifies the factory class that implements the CertRecordStore
    # interface used by the ZTS Server to store certificate data. In production,
    # this is typically the jdbc/mysql cert record store while for tests it's
    # the file cert record store
    athenz.zts.cert_record_store_factory_class=com.yahoo.athenz.zts.cert.impl.JDBCCertRecordStoreFactory

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the file cert record store factory, then this setting specifies
    # the subdirectory name where record files will be stored.
    #athenz.zts.cert_file_store_path=/opt/athenz/zts/var

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the file cert record store factory, then this setting specifies
    # the directory name where file store subdirectory will
    # be created to store cert record files.
    #athenz.zts.cert_file_store_name=zts_cert_records

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the jdbc cert record store factory identified with
    # com.yahoo.athenz.zts.cert.impl.JDBCCertRecordStoreFactory, then
    # this setting specifies the JDBC URL where the ZTS Server will store
    # certificate records for revocation checks
    # jdbc:mysql://localhost:3306/zts - specifies MySQL instance
    athenz.zts.cert_jdbc_store=jdbc:mysql://<your_db_host>:3306/zts_store

    # If the jdbcstore is pointing to a MySQL server then this specifies
    # the name of the user that has full access to the zts database
    athenz.zts.cert_jdbc_user=zts_admin

    # If the jdbcstore is pointing to a MySQL server then this specifies
    # the password for the jdbc user that has been granted full access
    # to the configured zts database
    #athenz.zts.cert_jdbc_password=mariadb

    # If using the jdbc connector (either mysql or aws) for zts
    # certificate data storage, this property specifies if the jdbc client
    # should establish an SSL connection to the database server or not
    #athenz.zts.cert_jdbc_use_ssl=false

    # if using the jdbc connector (either mysql or aws) for zms
    # certificate data storage and the athenz.zts.cert_jdbc_use_ssl property
    # is set to true, this property specifies whether or not the jdbc client
    # must verify the server certificate or not
    #athenz.zts.cert_jdbc_verify_server_certificate=false

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the aws rds mysql object store factory identified with
    # com.yahoo.athenz.zts.cert.impl.AWSObjectStoreFactory, then
    # this setting specifies AWS RDS instance hostname.
    # The database server must be initialized with the ZTS
    # server schema.
    #athenz.zts.aws_rds_master_instance=

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the database user configured with IAM Role AWS authentication
    # and full access to the zms store database
    #athenz.zts.aws_rds_user=

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the IMA role that has been enabled for authentication
    #athenz.zts.aws_rds_iam_role=

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the port number for the RDL database instance
    #athenz.zts.aws_rds_master_port=3306

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the database engine used in rds
    #athenz.zts.aws_rds_engine=mysql

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the database name in rds
    #athenz.zts.aws_rds_database=zts_store

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # in seconds how often to update the aws credentials for the IAM role
    #athenz.zts.aws_rds_creds_refresh_time=300

    # The maximum number of seconds that the server should wait
    # for the certificate store connection object to return its results
    #athenz.zts.cert_op_timeout=60

    # When requesting TLS certificates for their corresponding NTokens,
    # services must this dns suffix in their CSRs
    #athenz.zts.cert_dns_suffix=.athenz.cloud

    # Kerberos Authority Service Principal
    #athenz.auth.kerberos.service_principal=

    # Kerberos Authority location of keytab file
    #athenz.auth.kerberos.keytab_location=

    # Kerberos Authority debug boolean state
    #athenz.auth.kerberos.debug=false

    # Kerberos Authority - if there is a jaas.conf whose path is specified by
    # the system property java.security.auth.login.config then this setting
    # specifies the config section name to be used for the authority
    #athenz.auth.kerberos.jaas_cfg_section=

    # Kerberos Authority - login callback handler class
    #athenz.auth.kerberos.login_callback_handler_class=

    # Kerberos Authority - boolean flag whether or not to renew TGT
    #athenz.auth.kerberos.renewTGT=true

    # Kerberos Authority - boolean flag whether or not using ticket cache
    #athenz.auth.kerberos.use_ticket_cache=true

    # Kerberos Authority - file path for the ticket cache data
    #athenz.auth.kerberos.ticket_cache_name=

    # Kerberos Authority - in milliseconds the login window time for re-logins
    #athenz.auth.kerberos.login_window=60000

    # Kerberos Authority - privileged action class name
    #athenz.auth.kerberos.krb_privileged_action_class=

    # Kerberos Authority - the realm for kerberos users (this could be a realm
    # that regular users (also authenticated as part of UserAuthority) are part of
    #athenz.auth.kerberos.user_realm=

    # Kerberos Authority - the domain name for users that are only authenticated
    # by this authority
    #athenz.auth.kerberos.krb_user_domain=krb

    # Kerberos Authority - the realm name for users that are only authenticated
    # by this authority
    #athenz.auth.kerberos.krb_user_realm=

    # ZTS is running within AWS so enable features such as getting temporary
    # credentials, etc.
    #athenz.zts.aws_enabled=false

    # If ZTS is running within AWS, this setting specifies path a file that includes
    # the AWS Public certificate that is needed to verify host identity documents
    # provided by AWS.
    #athenz.zts.aws_public_cert

    # If ZTS is running within AWS and we need to validate the host identity document
    # before we issue a TLS certificate for a service identified by its IAM role,
    # the server verifies that the instance was booted within the configured number
    # of seconds
    #athenz.zts.aws_boot_time_offset=300

    # Comma separated list of URIs that require authentication according to the RDL
    # but we want the server to make the authentication as optional. The URI can
    # include regex values based on + character to match resource URIs
    # for example, /zts/v1/domain/.+/service
    athenz.zts.no_auth_uri_list=/zts/v1/status

    # Boolean flag to control whether or not to include c=1 component in the issued
    # role token when the rolename argument passed to the api is null. The presence
    # of the c=1 in the role token then would indicate that the token contains all
    # the roles that the principal has access in the domain
    #athenz.zts.role_complete_flag=true

    # If configured, specifies whether or not the server should send
    # back the x.509 signer certificate in the response. It's possible
    # that the environment already has an external way of distributing
    # signer certificates
    #athenz.zts.resp_x509_signer_certs=true

    # If configured, specifies whether or not the server should send
    # back the ssh signer certificate in the response. It's possible
    # that the environment already has an external way of distributing
    # signer certificates
    #athenz.zts.resp_ssh_signer_certs=true

    # If configured, specifies a file name that contains the bundle of Athenz
    # CA certificates. This is useful when there are multiple Athenz instances
    # running in different regions/locations and each region/location has its own
    # CA certificate and during instance register/refresh operation we want to
    # return the full set of CA certs
    #athenz.zts.x509_ca_cert_fname=

    # If configured, specifies a file name that contains the SSH Host certificate
    # Signer certificates. This is useful when there are multiple Athenz instances
    # running in different regions/locations and each region/location has its own
    # Signer certificate and during instance register/refresh operation we want to
    # return the full set of certs
    #athenz.zts.ssh_host_ca_cert_fname=

    # If configured, specifies a file name that contains the SSH User certificate
    # Signer certificates. This is useful when there are multiple Athenz instances
    # running in different regions/locations and each region/location has its own
    # Signer certificate and during instance register/refresh operation we want to
    # return the full set of certs
    #athenz.zts.ssh_user_ca_cert_fname=

    # The number of milliseconds to sleep between runs of the idle object
    # evictor thread. When non-positive, no idle object evictor thread
    # will be run. The pool default is -1, but we're using 30 minutes to
    # make sure the evictor thread is running |
    #athenz.db.pool_evict_idle_interval=1800000

    # The minimum amount of time (in milliseconds) an object may sit
    # idle in the pool before it is eligible for eviction by the idle
    # object evictor (if any)
    #athenz.db.pool_evict_idle_timeout=1800000

    # The maximum number of connections that can remain idle in the pool,
    # without extra ones being released, or negative for no limit
    #athenz.db.pool_max_idle=8

    # The maximum number of active connections that can be allocated
    # from this pool at the same time, or negative for no limit
    #athenz.db.pool_max_total=8

    # The maximum lifetime in milliseconds of a connection. After this
    # time is exceeded the connection will fail the next activation,
    # passivation or validation test. A value of zero or less means the
    # connection has an infinite lifetime
    #athenz.db.pool_max_ttl=600000

    # The maximum number of milliseconds that the pool will wait
    # (when there are no available connections) for a connection to be
    # returned before throwing an exception, or -1 to wait indefinitely
    #athenz.db.pool_max_wait=-1

    # The minimum number of connections that can remain idle in the pool,
    # without extra ones being created, or zero to create none
    #athenz.db.pool_min_idle=0

    # The validation query used by the pool to determine if the connection
    # is valid before returning it to the caller. The default value
    # is the recommended query for the Mysql/J Connector
    #athenz.db.pool_validation_query=/* ping */ SELECT 1

    # List of valid values separated by | that a certificate
    # request can include in the Subject O field. For example, if
    # you allow to create certs with c=US,o=Company,cn=athenz.api
    # and c=US,o=Company Inc.,cn=athenz.api, then the value for
    # this property would be set to "Company|Company Inc.". If
    # the property is not set, then no validation is carried out.
    #athenz.zts.cert_allowed_o_values=

    # If enabled, ZTS server will validate the OU field in
    # any certificate request if one is specified. If the
    # certificate is requested from a Copper Argos provider, the provider
    # service name is automatically allowed as one of the valid OU
    # values. Otherwise, the list of values can be configured using
    # the athenz.zts.cert_allowed_ou_values property.
    #athenz.zts.cert_request_verify_subject_ou=false

    # List of valid values separated by | that a certificate
    # request can include in the Subject OU field. For example, if
    # you allow to create certs with c=US,o=Company,OU=Athenz,cn=athenz.api
    # and c=US,o=Company Inc.,ou=Yahoo,cn=athenz.api, then the value for
    # this property would be set to "Athenz|Yahoo". In case the
    # certificate is requested from a Copper Argos provider, the provider
    # service name is automatically allowed as one of the valid OU
    # values. The validation is carried out only if the
    # setting is enabled (set to true).
    #athenz.zts.cert_allowed_ou_values=

    # During certificate refresh operations zts server looks up
    # the original certificate details (serial number, timestamp, etc)
    # to detect compromise. If this database is lost, then server
    # will not be able to refresh any certs, so we provide an option
    # to regenerate the db based on requests rather than rejecting
    # all. So while the certs are refreshed, compromise will not be
    # detected during the first refresh, but during the second one
    # it will be detected. The value of the setting is the number
    # of milliseconds since epoch. Any refresh request where the cert
    # has a timestamp before this date will be handled successfully
    # if the db record is not found.
    #athenz.zts.cert_refresh_reset_time=0

    # When requesting role and service certificates not through
    # Copper Argos providers, the server can verify that the IP
    # address in the request indeed matches to the connection
    # IP address. Typically this should be enabled by default
    # but keeping it false for now for backward compatibility
    # reasons.
    #athenz.zts.cert_request_verify_ip=false

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the dynamodb cert record store factory identified with
    # com.yahoo.athenz.zts.cert.impl.DynamoDBCertRecordStoreFactory, then
    # this setting specifies the table name where the ZTS Server will store
    # certificate records for revocation checks. The table must be created
    # with the following requirements: primary field - primaryKey.
    # Enable TTL and call the attribute as ttl.
    #athenz.zts.cert_dynamodb_table_name=

    # If the athenz.zts.cert_record_store_factory_class property is using
    # the dynamodb cert record store factory identified with
    # com.yahoo.athenz.zts.cert.impl.DynamoDBCertRecordStoreFactory, then
    # this setting specifies the current-time index used to query records by time of update
    # on the table specified in athenz.zts.cert_dynamodb_table_name
    # The index must be created using the currentDate as partition key
    # and project all attributes.
    #athenz.zts.cert_dynamodb_index_current_time_name=

    # When using the DynamoDB certificate record store factory (see
    # property athenz.zts.cert_dynamodb_table_name) this setting specifies
    # the configured number of hours that DynamoDB will purge expired
    # records. Default value is 30 days.
    #athenz.zts.cert_dynamodb_item_ttl_hours=720

    # Athenz ZTS Service Health Check file path. If configured, the
    # /zts/v1/status command would return failure if the file setting
    # is configured but the file is not present. The idea is that once
    # the server is started, an external process will verify that
    # the server is running correctly by running some checks and if
    # successful, it will create that file so that the server can
    # now report that the server is ready to accept production traffic
    #athenz.zts.health_check_path=

    # Path to the json configuration file that specifies the certificate
    # bundles that can be requested from the ZTS server. An example
    # of the config file available in src/test/resources/ca-bundle-file.json
    # If the bundle type is x509 then the server will parse all the
    # certificates and generate their PEM representation again in order
    # to remove any comments present in the file thus reducing the
    # content size when requested
    #athenz.zts.cert_authority_bundles_fname

    # Specifies the factory class that implements the StatusChecker interface
    # Used to check the status of the ZTS server
    athenz.zts.status_checker_factory_class=com.yahoo.athenz.zts.cert.impl.JDBCCertRecordStoreStatusCheckerFactory

    # If the athenz.zts.change_log_store_factory_class change log factory class
    # is set to com.yahoo.athenz.common.server.store.impl.ZMSFileChangeLogStoreFactory and
    # the client wants to use mtls authentication when talking to ZMS Server
    # instead of private key based service this tokens then this setting specifies
    # the path to the zts server private key
    # athenz.common.server.clog.zts_server_key_path=

    # If the athenz.zts.change_log_store_factory_class change log factory class
    # is set to com.yahoo.athenz.common.server.store.impl.ZMSFileChangeLogStoreFactory and
    # the client wants to use mtls authentication when talking to ZMS Server
    # instead of private key based service this tokens then this setting specifies
    # the path to the zts server x.509 certificate
    #athenz.common.server.clog.zts_server_cert_path=

    # If the athenz.zts.change_log_store_factory_class change log factory class
    # is set to com.yahoo.athenz.common.server.store.impl.ZMSFileChangeLogStoreFactory and
    # the client wants to use mtls authentication when talking to ZMS Server
    # instead of private key based service this tokens then this setting specifies
    # the path to the trust store jks file that the client will use to validate
    # the ZMS Server certificate
    #athenz.common.server.clog.zts_server_trust_store_path=

    # If the athenz.zts.change_log_store_factory_class change log factory class
    # is set to com.yahoo.athenz.common.server.store.impl.ZMSFileChangeLogStoreFactory and
    # the client wants to use mtls authentication when talking to ZMS Server
    # instead of private key based service this tokens then this setting specifies
    # the key name that stores the password for the trust store. This requires that
    # a private key store factory class is set and configured. If this value is
    # not set, then the default jdk password of changeit will be used.
    #athenz.common.server.clog.zts_server_trust_store_password_name=

    # If the athenz.zts.change_log_store_factory_class change log factory class
    # is set to com.yahoo.athenz.common.server.store.impl.ZMSFileChangeLogStoreFactory and
    # the client wants to use mtls authentication when talking to ZMS Server
    # instead of private key based service this tokens then this setting specifies
    # the app name that is used to retrieve the trust store password set by
    # the athenz.common.server.clog.zts_server_trust_store_password_name setting.
    #athenz.common.server.clog.zts_server_trust_store_password_app=

    # Comma separated list of domain that have dynamic services. For example,
    # screwdriver domain has dynamic projects for CI/CD and we need to give
    # identity without creating a service. These services will be automatically
    # skipped from validation before certs are issued.
    #athenz.zts.validate_service_skip_domains=
kind: ConfigMap
metadata:
  labels:
    app: athenz-zts
    chart: athenz-zts-1.0.0
    heritage: Helm
    release: RELEASE-NAME
  name: RELEASE-NAME-athenz-zts-config
