apiVersion: v1
data:
  athenz.properties: |
    # Athenz Jetty Container properties file.
    # If there is a value specified in the commented property line,
    # then it indicates the default value

    # The TLS port that Jetty will listen on for HTTPS connection
    athenz.tls_port=4443

    # The standard HTTP port for Jetty - disabled by default
    athenz.port=0

    # Set the number of days before rotated access log files are deleted
    #athenz.access_log_retain_days=31

    # Format of the access log filename
    #athenz.access_log_name=access.yyyy_MM_dd.log

    # If specified, the server will use SLF4J logger with the specified name
    # to log events instead of using Jetty's NCSARequestLog class.
    # The administrator then must configure the specified logger in the logback.xml
    #athenz.access_slf4j_logger=

    # Directory to store access log files
    athenz.access_log_dir=/opt/athenz/zms/logs/zms_server

    # Key Manager password
    #athenz.ssl_key_manager_password=

    # The path to the keystore file that contains the server's certificate
    athenz.ssl_key_store=/opt/athenz/zms/var/certs/zms_keystore.pkcs12

    # Specifies the type for the keystore specified in the
    # athenz.ssl_key_store property
    athenz.ssl_key_store_type=PKCS12

    # Password for the keystore specified in the athenz.ssl_key_store property
    #athenz.ssl_key_store_password=athenz

    # The path to the trust store file that contains CA certificates
    # trusted by this Jetty instance
    athenz.ssl_trust_store=/opt/athenz/zms/var/certs/zms_truststore.jks

    # Specifies the type for the truststore specified in the
    # athenz.ssl_trust_store property
    athenz.ssl_trust_store_type=JKS

    # Password for the truststore specified in the athenz.ssl_trust_store property
    #athenz.ssl_trust_store_password=athenz

    # List of excluded cipher suites from TLS negotiation
    #athenz.ssl_excluded_cipher_suites=

    # List of cipher suites supported for TLS negotiation
    #athenz.ssl_included_cipher_suites=

    # Comma separated list of excluded ssl protocols
    #athenz.ssl_excluded_protocols=SSLv2,SSLv3

    # Specifies whether or not for data requests the server
    # would require TLS client authentication rather than
    # just wanting it
    #athenz.ssl_need_client_auth=

    # In milliseconds how long that connector will be allowed to
    # remain idle with no traffic before it is shutdown
    #athenz.http_idle_timeout=30000

    # Boolean setting to specify whether or not the server should
    # send the Server header in response
    #athenz.http_send_server_version=false

    # Boolean setting to specify whether or not the server should
    # include the Date in HTTP headers
    #athenz.http_send_date_header=false

    # The size in bytes of the output buffer used to aggregate HTTP output
    #athenz.http_output_buffer_size=32768

    # The maximum allowed size in bytes for a HTTP request header
    #athenz.http_request_header_size=8192

    # The maximum allowed size in bytes for a HTTP response header
    #athenz.http_response_header_size=8192

    # For HTTP access specifies the IP address/Host for service to listen on.
    # This could be necessary, for example, if the system administrator
    # wants some proxy server (e.g. ATS) to handle TLS traffic and configure
    # Jetty to listen on 127.0.0.1 loopback address only for HTTP connections
    # from that proxy server
    #athenz.listen_host=

    # Boolean flag to indicate whether or not the container should honor
    # the Keep Alive connection option or just connections right away
    #athenz.keep_alive=false

    # Max number of threads Jetty is allowed to spawn to handle incoming requests
    #athenz.http_max_threads=1024

    # Specify the FQDN/hostname of the server. This will be reported as part
    # of the server banner notification in logs
    #athenz.hostname=

    # Default home directory for embedded Jetty Deployer. The container will look
    # for any servlets in the webapps subdirectory of the configured directory
    athenz.jetty_home=/opt/athenz/zms

    # Boolean flag to enable debug log entries when deploying webapps
    #athenz.debug=false

    # Comma separated list of uris that are accessed by health check
    # system. Used by the simple file based health check filter that
    # returns 200/404 if the file exists or not
    #athenz.health_check_uri_list=

    # Directory name where the files specified in the athenz.health_check_uri_list
    # setting are checked for
    #athenz.health_check_path=

    # Enable Proxy Protocol (used by HAProxy and environments such as Amazon Elastic Cloud)
    # for the jetty container.
    #athenz.proxy_protocol=false

    # Enable graceful shutdown in the Jetty
    athenz.graceful_shutdown=true

    # How long to wait for the Jetty server to shutdown, in milliseconds
    # If the athenz.graceful_shutdown is not true, this setting is invalid.
    athenz.graceful_shutdown_timeout=30000
  authorized_client_ids.txt: ""
  authorized_services.json: |
    {
        "services" : {
            "athenz.ci-test": {
                "allowedOperations": [
                    { "name": "putrole" },
                    { "name": "putmembership",
                      "items": {
                        "role" : [
                            "athenz_dev_test_role",
                            "athenz_eng_test_role"
                        ]
                      }
                    }
                ]
            },
            "athenz.ui-server": {
                "allowedOperations": [
                    { "name":"putmembership" },
                    { "name":"deletemembership" },
                    { "name":"posttopleveldomain" },
                    { "name":"postuserdomain" },
                    { "name":"postsubdomain" },
                    { "name":"deletesubdomain" },
                    { "name":"deleterole" },
                    { "name":"putrole" },
                    { "name":"putpolicy" },
                    { "name":"deletepolicy" },
                    { "name":"putassertion" },
                    { "name":"deleteassertion" },
                    { "name":"putserviceidentity" },
                    { "name":"deleteserviceidentity" },
                    { "name":"putpublickeyentry" },
                    { "name":"deletepublickeyentry" },
                    { "name":"putdomainmeta" }
                ]
            }
        }
    }
  logback.xml: |
    <?xml version="1.0" encoding="UTF-8" ?>
    <configuration scan="true">

      <property name="LOG_DIR" value="logs/zms_server" />

      <!--Daily rolling file appender -->
      <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">

        <file>${LOG_DIR}/server.log</file>
        <append>true</append>

        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
          <fileNamePattern>${LOG_DIR}/server.%d.log</fileNamePattern>
          <maxHistory>7</maxHistory>
          <cleanHistoryOnStart>true</cleanHistoryOnStart>
        </rollingPolicy>

        <encoder>
          <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n</pattern>
        </encoder>
      </appender>

      <!-- Logger used exclusively for audit logging -->
      <appender name="AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">

        <file>${LOG_DIR}/audit.log</file>
        <append>true</append>

        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
          <fileNamePattern>${LOG_DIR}/audit.%d.log</fileNamePattern>
          <maxHistory>30</maxHistory>
          <cleanHistoryOnStart>true</cleanHistoryOnStart>
        </rollingPolicy>

        <encoder>
          <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n</pattern>
        </encoder>
      </appender>

      <logger name="org.eclipse" level="INFO"/>
      <logger name="AuditSoxLogger" level="INFO" additivity="false">
        <appender-ref ref="AUDIT" />
      </logger>

      <root>
        <level value="DEBUG" />
        <appender-ref ref="FILE" />
      </root>
    </configuration>
  solution_templates.json: |
    {
        "templates" : {
            "user_provisioning": {
                "roles": [
                    {
                        "name": "_domain_:role.user",
                        "modified": "1970-01-01T00:00:00.000Z"
                    },
                    {
                        "name": "_domain_:role.superuser",
                        "modified": "1970-01-01T00:00:00.000Z"
                    },
                    {
                        "name": "_domain_:role.builders",
                        "roleMembers": [
                            {
                                "memberName": "sys.builder"
                            }
                        ],
                        "modified": "1970-01-01T00:00:00.000Z"
                    }
                ],
                "policies": [
                    {
                        "name": "_domain_:policy.user",
                        "modified": "1970-01-01T00:00:00.000Z",
                        "assertions": [
                            {
                                "resource": "_domain_:node.*",
                                "role": "_domain_:role.user",
                                "action": "node_user"
                            }
                        ]
                    },
                    {
                        "name": "_domain_:policy.superuser",
                        "modified": "1970-01-01T00:00:00.000Z",
                        "assertions": [
                            {
                                "resource": "_domain_:node.*",
                                "role": "_domain_:role.superuser",
                                "action": "node_sudo"
                            }
                        ]
                    },
                    {
                        "name": "_domain_:policy.builders",
                        "modified": "1970-01-01T00:00:00.000Z",
                        "assertions": [
                            {
                                "resource": "_domain_:build",
                                "role": "_domain_:role.builders",
                                "action": "read"
                            },
                            {
                                "resource": "_domain_:build",
                                "role": "_domain_:role.builders",
                                "action": "delete"
                            }
                        ]
                    }
                ]
            }
        }
    }
  zms.properties: |
    # Athenz ZMS Servlet properties file.
    # If there is a value specified in the commented property line,
    # then it indicates the default value

    # Default root directory for ZMS Server. This must be passed as
    # part of the startup script since it is used before the
    # properties file is accessed.
    #athenz.zms.root_dir=/opt/athenz/zms

    # Comma separated list of authority implementation classes to support
    # authenticating principals in ZMS
    athenz.zms.authority_classes=com.yahoo.athenz.auth.oauth.OAuthCertBoundJwtAccessTokenAuthority,com.yahoo.athenz.auth.impl.CertificateAuthority

    # Principal Authority class. If defined and the caller asks for the header
    # name for the getUserToken api, the header from this authority will be
    # returned in the response. This class must be one of the classes listed
    # in the athenz.zms.authority_classes setting
    #athenz.zms.principal_authority_class=

    # User Authority class. If defined and the server is configured to validate
    # all user principals when adding them as members in a role (this is configured
    # with athenz.zms.validate_user_members property), the ZMS Server will call
    # the authority isValidUser api method for validation. This class must be one of
    # the classes listed in the athenz.zms.authority_classes setting
    #athenz.zms.user_authority_class=

    # Specifies the user domain name for the current installation
    athenz.user_domain=user

    # Specifies the factory class that implements the Metrics interface
    # used by the ZMS Server to report stats
    athenz.zms.metric_factory_class=com.yahoo.athenz.common.metrics.impl.prometheus.PrometheusMetricFactory
    # enable PrometheusMetric class
    athenz.metrics.prometheus.enable=true
    # export JVM metrics
    athenz.metrics.prometheus.jvm.enable=true
    # the Prometheus /metrics endpoint
    athenz.metrics.prometheus.http_server.enable=true
    athenz.metrics.prometheus.http_server.port=8181
    # Prometheus metric prefix
    athenz.metrics.prometheus.namespace=athenz_zms
    # for dev. env. ONLY, record Athenz domain data as label
    athenz.metrics.prometheus.label.request_domain_name.enable=false
    athenz.metrics.prometheus.label.principal_domain_name.enable=false

    # Specifies the factory class that implements the AuditLoggerFactory
    # interface used by the ZMS Server to log all changes to domain
    # data for auditing purposes
    #athenz.zms.audit_logger_factory_class=com.yahoo.athenz.common.server.log.impl.DefaultAuditLoggerFactory

    # Specifies the factory class that implements the PrivateKeyStoreFactory
    # interface used by the ZMS Server to get access to its host specific
    # private key
    #athenz.zms.private_key_store_factory_class=com.yahoo.athenz.auth.impl.FilePrivateKeyStoreFactory

    # If the datastore does not contain any domains during startup,
    # the server will automatically create sys, sys.auth and user
    # domains and assign the specified users (comma separated list)
    # as the administrator for those domains
    athenz.zms.domain_admin=user.github-1234567

    # If File Private Key store implementation is used in the Server,
    # this setting specifies the path to the PEM encoded ZMS Server
    # private key file (both RSA and EC privates keys are supported)
    athenz.auth.private_key_store.private_key=/opt/athenz/zms/var/keys/zms_private.pem

    # If File Private Key store implementation is used in the Server,
    # this setting specifies the key identifier for the private key
    # configured by the athenz.auth.private_key_store.private_key
    # property
    athenz.auth.private_key_store.private_key_id=0

    # Specify the FQDN/hostname of the server. This value will be used as the
    # h parameter in the ZMS generated UserTokens
    #athenz.zms.hostname=

    # If enabled, ZMS will be in maintenance read only mode where only
    # get operations will succeed and all other put, post and delete
    # operations will be rejected with invalid request error.
    athenz.zms.read_only_mode=false

    # Specifies the authorized service json configuration file path.
    athenz.zms.authz_service_fname=/opt/athenz/zms/conf/zms_server/authorized_services.json

    # Specifies the path to the solution templates json document
    athenz.zms.solution_templates_fname=/opt/athenz/zms/conf/zms_server/solution_templates.json

    # In case there is a concurrent update conflict, the server will retry
    # the operation multiple times until this timeout is reached before
    # returning a conflict status code back to the client
    #athenz.zms.conflict_retry_timeout=60

    # When ZMS determines that updating a domain data tables will cause a
    # concurrent update issue and needs to retry the operation, it will sleep
    # configured number of milliseconds before retrying
    #athenz.zms.retry_delay_timeout=50

    # This setting specifies the number of seconds how long the signed
    # policy documents are valid for
    #athenz.zms.signed_policy_timeout=604800

    # The number of milliseconds to sleep between runs of the idle object
    # evictor thread. When non-positive, no idle object evictor thread
    # will be run. The pool default is -1, but we're using 30 minutes to
    # make sure the evictor thread is running |
    #athenz.db.pool_evict_idle_interval=1800000

    # The minimum amount of time (in milliseconds) an object may sit
    # idle in the pool before it is eligible for eviction by the idle
    # object evictor (if any)
    #athenz.db.pool_evict_idle_timeout=1800000

    # The maximum number of connections that can remain idle in the pool,
    # without extra ones being released, or negative for no limit
    #athenz.db.pool_max_idle=8

    # The maximum number of active connections that can be allocated
    # from this pool at the same time, or negative for no limit
    #athenz.db.pool_max_total=8

    # The maximum lifetime in milliseconds of a connection. After this
    # time is exceeded the connection will fail the next activation,
    # passivation or validation test. A value of zero or less means the
    # connection has an infinite lifetime
    #athenz.db.pool_max_ttl=600000

    # The maximum number of milliseconds that the pool will wait
    # (when there are no available connections) for a connection to be
    # returned before throwing an exception, or -1 to wait indefinitely
    #athenz.db.pool_max_wait=-1

    # The minimum number of connections that can remain idle in the pool,
    # without extra ones being created, or zero to create none
    #athenz.db.pool_min_idle=0

    # The validation query used by the pool to determine if the connection
    # is valid before returning it to the caller. The default value
    # is the recommended query for the Mysql/J Connector
    #athenz.db.pool_validation_query=/* ping */ SELECT 1

    # The maximum number of seconds that the server should wait
    # for the store connection object to return its results
    #athenz.zms.store_operation_timeout=60

    # Specifies the factory class that implements the ObjectStoreFactory
    # interface used by the ZMS Server to store its data. In production,
    # this is typically the jdbc/mysql object store while for tests it's
    # the file object store
    athenz.zms.object_store_factory_class=com.yahoo.athenz.zms.store.impl.JDBCObjectStoreFactory

    # If the athenz.zms.object_store_factory_class property is using
    # the file object store factory, then this setting specifies
    # the subdirectory name where domain files will be stored.
    # The parent directory is identified by the athenz.zms.file_store_path
    # property
    #athenz.zms.file_store_path=/opt/athenz/zms/var

    # If the athenz.zms.object_store_factory_class property is using
    # the file object store factory, then this setting specifies
    # the directory name where file store subdirectory will
    # be created to store domain files. The subdirectory is identified
    # by the athenz.zms.file_store_name property
    #athenz.zms.file_store_name=zms_root

    # If the athenz.zms.object_store_factory_class property is using
    # the jdbc object store factory identified with
    # com.yahoo.athenz.zms.store.impl.JDBCObjectStoreFactory, then
    # this setting specifies JDBC URL where the ZMS Server will store its data.
    # The database server must be initialized with the ZMS
    # server schema. For example, jdbc:mysql://localhost:3306/zms
    # specifies a database called zms configured within a
    # MySQL instance
    athenz.zms.jdbc_store=jdbc:mysql://<your_db_host>:3306/zms_server

    # If the athenz.zms.object_store_factory_class property is using
    # the jdbc/mysql object store factory then this setting
    # specifies the name of the user that has full access to the configured
    # ZMS server database
    athenz.zms.jdbc_user=zms_admin

    # If the athenz.zms.object_store_factory_class property is using
    # the jdbc/mysql object store factory then this setting
    # specifies the password key for the jdbc user that has been granted full
    # access to the configured ZMS server database. The configured
    # private key store will be called with the value of the key to
    # retrieve the password to authenticate requests against the
    # configured MySQL server.
    #athenz.zms.jdbc_password=mariadb

    # If the athenz.zms.object_store_factory_class property is using
    # the jdbc/mysql object store factory then this setting specifies
    # JDBC URL for slave databases that replicate ZMS Server's
    # domain data. If configured, ZMS Server will use this database
    # instance for any read only operation. It has the same syntax
    # as the athenz.zms.jdbc_store property.
    athenz.zms.jdbc_ro_store=jdbc:mysql://<your_rodb_host>:3306/zms_server

    # If the athenz.zms.jdbc_ro_store is configured then this property is
    # the name of the user that has full access to the zms database
    # if this property is not specified but athenz.zms.jdbc_ro_store
    # is configured, the server will use the value of the
    # athenz.zms.jdbc_user property.
    athenz.zms.jdbc_ro_user=zms_admin

    # If the athenz.zms.jdbc_ro_store is configured then this property
    # specifies the password key for the jdbc user that has been granted
    # full access to the configured zms database. If this property is not
    # specified but athenz.zms.jdbc_ro_store is configured, the server
    # will use the value of the athenz.zms.jdbc_password property.
    # The configured private key store will be called with the value of
    # the key to retrieve the password to authenticate requests against
    # the configured MySQL server.
    #athenz.zms.jdbc_ro_password=

    # If using the jdbc connector (either mysql or aws) for zms
    # data storage, this property specifies if the jdbc client
    # should establish an SSL connection to the database server or not
    #athenz.zms.jdbc_use_ssl=false

    # if using the jdbc connector (either mysql or aws) for zms
    # data storage and the athenz.zms.jdbc_use_ssl property is set
    # to true, this property specifies whether or not the jdbc client
    # must verify the server certificate or not
    #athenz.zms.jdbc_verify_server_certificate=false

    # If the athenz.zms.object_store_factory_class property is using
    # the aws rds mysql object store factory identified with
    # com.yahoo.athenz.zms.store.impl.AWSObjectStoreFactory, then
    # this setting specifies AWS RDS instance hostname.
    # The database server must be initialized with the ZMS
    # server schema.
    #athenz.zms.aws_rds_master_instance=

    # If the athenz.zms.object_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the database user configured with IAM Role AWS authentication
    # and full access to the zms store database
    #athenz.zms.aws_rds_user=

    # If the athenz.zms.object_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the IMA role that has been enabled for authentication
    #athenz.zms.aws_rds_iam_role=

    # If the athenz.zms.object_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the port number for the RDL database instance
    #athenz.zms.aws_rds_master_port=3306

    # If the athenz.zms.object_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the database engine used in rds
    #athenz.zms.aws_rds_engine=mysql

    # If the athenz.zms.object_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # the database name in rds
    #athenz.zms.aws_rds_database=zms_store

    # If the athenz.zms.object_store_factory_class property is using
    # the aws rds mysql object store then this setting specifies
    # in seconds how often to update the aws credentials for the IAM role
    #athenz.zms.aws_rds_creds_refresh_time=300

    # The number of seconds ZMS issued User Tokens are valid for
    #athenz.zms.user_token_timeout=3600

    # Boolean setting to configure whether or not virtual domains are
    # supported or not. These are domains created in the user's own
    # "user" namespace
    #athenz.zms.virtual_domain_support=true

    # If virtual domain support is enabled, this setting specifies the
    # number of sub domains in the user's virtual namespace that are
    # allowed to be created. Value of 0 indicates no limit
    #athenz.zms.virtual_domain_limit=5

    # Number of bytes allowed to be specified in a domain name.
    # This limit includes all subdomains as well. For example,
    # athenz.storage.mysql domains length is 20.
    #athenz.zms.domain_name_max_len=128

    # Boolean setting to configure whether or not unique product
    # IDs are required for top level domains
    #athenz.zms.product_id_support=false

    # Number of seconds the authentication library will honor
    # token's expiration timeout.
    #athenz.token_max_expiry=2592000

    # User Authority - if UserAuthority is enabled as one of the authenticating
    # authorities in the ZMS Server, this setting provides the pam service
    # name used when validating the user specified password
    #athenz.auth.user.pam_service_name=login

    # Role Authority - when validating Role Tokens, this setting specifies the
    # number seconds the library will allow the token to have a creation time
    # in the future to accommodate time differences between server and client.
    #athenz.auth.role.token_allowed_offset=300

    # Role Authority - when authenticating principals based on the Role Token
    # this setting specifies what HTTP header name in the request contains
    # the token
    #athenz.auth.role.header=Athenz-Role-Auth

    # Principal Authority - when validating User/Service Tokens, this setting
    # specifies the number seconds the library will allow the token to have
    # a creation time in the future to accommodate time differences between
    # server and client.
    #athenz.auth.principal.token_allowed_offset=300

    # Principal Authority - when authenticating principals based on their
    # User/Service Tokens, this setting specifies what HTTP header name in
    # the request contains the token
    #athenz.auth.principal.header=Athenz-Principal-Auth

    # Principal Authority - when authenticating principals based on their
    # User/Service Tokens. this setting specifies whether or not to validate
    # if the IP address of the incoming connection matches to the IP address
    # in the token. The possible values are: OPS_ALL, OPS_NONE, OPS_WRITE
    # OPS_WRITE indicates that only write/update operation will enforce
    # this check.
    #athenz.auth.principal.remote_ip_check_mode=OPS_WRITE

    # If the ZMS webapp is deployed along other webapps that may
    # run on non-TLS ports, this setting forces that requests to
    # ZMS are only accepted on secure TLS ports.
    #athenz.zms.secure_requests_only=true

    # Quota Support: boolean value defining whether or not quota
    # check is enabled.
    #athenz.zms.quota_check=true

    # Quota Support: default number of roles allowed to be created
    # in a given domain.
    #athenz.zms.quota_role=1000

    # Quota Support: default number of members a single role may have
    #athenz.zms.quota_role_member=100

    # Quota Support: default number of polices allowed to be created
    # in a given domain.
    #athenz.zms.quota_policy=1000

    # Quota Support: default number of assertions each policy may have
    #athenz.zms.quota_assertion=100

    # Quota Support: default number of services allowed to be created
    # in a given domain.
    #athenz.zms.quota_service=250

    # Quota Support: default number of hosts each service may have
    #athenz.zms.quota_service_host=10

    # Quota Support: default number of public keys each service may have
    #athenz.zms.quota_public_key=100

    # Quota Support: default number of entities allowed to be created
    # in a given domain
    #athenz.zms.quota_entity=100

    # Quota Support: default number of sub-domains each top level
    # domain allowed to have.
    #athenz.zms.quota_subdomain=100

    # Comma separated list of URIs that require authentication according to the RDL
    # but we want the server to make the authentication as optional. The URI can
    # include regex values based on + character to match resource URIs
    # for example, /zms/v1/domain/.+/service
    athenz.zms.no_auth_uri_list=/zms/v1/status

    # Comma separated list of http origin values that are whitelisted
    # to request authorize service tokens. This is only used for the
    # optionsUserToken method where we return CORS headers
    #athenz.zms.cors_origin_list

    # Comma separated list of service names that are reserved. The default
    # list includes most common gTLDs so a service cannot obtain an identity
    # x.509 certificate with a name that matches an actual domain e.g. yahoo.com
    #athenz.zms.reserved_service_names=com,net,org,edu,biz,gov,mil,info,name,mobi,cloud

    # Integer value specifying the min length of any service names. The default
    # value of 3 is configured to prevent a service from obtaining an identity
    # x.509 certificate with a name that matches country gTLD - e.g. yahoo.us
    #athenz.zms.service_name_min_length=3

    # Athenz ZMS Service Health Check file path. If configured, the
    # /zms/v1/status command would return failure if the file setting
    # is configured but the file is not present. The idea is that once
    # the server is started, an external process will verify that
    # the server is running correctly by running some checks and if
    # successful, it will create that file so that the server can
    # now report that the server is ready to accept production traffic
    #athenz.zms.health_check_path=

    # Boolean value indicating whether or not the ZMS server should
    # call the configured user authority and verify if the given
    # user is valid or not before adding the user to a role. The
    # user authority is responsible for validating any usernames
    # that might include wildcards (e.g. user.*).
    #athenz.zms.validate_user_members=false

    # If the athenz.zms.validate_user_members property is enabled
    # then this setting provides additional set of comma separated
    # domains that the system might be using referencing accounts
    # that can be validated with the user authority
    #athenz.zms.addl_user_check_domains=

    # Boolean value indicating whether or not the ZMS server should
    # verify if the given service exists in the given domain
    # before adding the service to a role. The ZMS Service will
    # automatically skip any service names that include wildcards
    # (e.g. coretech.api*).
    #athenz.zms.validate_service_members=false

    # If athenz.zms.validate_service_members property is enabled
    # then this setting includes comma separated list of domains
    # that should be skipped from the service member validation
    # checks. These could include CI/CD domains, for example,
    # that include dynamic services that are not registered.
    #athenz.zms.validate_service_members_skip_domains=

    # Boolean value indicating whether or not the zms server
    # should contact the master storage copy when returning
    # data for signed domains api. In multi region environments
    # this could generate large latency since the server
    # needs to contact most likely a server (e.g. mysql instance)
    # running in a different region.
    #athenz.zms.master_copy_for_signed_domains=false

    # Set the timezone of the database
    # when retrieving the modified domain.
    #athenz.zms.athenz.zms.mysql_server_timezone=

    # Specifies the factory class that implements the StatusChecker interface
    # Used to check the status of the ZMS server
    #athenz.zms.status_checker_factory_class=

    # Boolean property to enable the periodic update of Principal state from Authority.
    # Default value is false.
    #athenz.zms.enable_principal_state_updater=
kind: ConfigMap
metadata:
  labels:
    app: athenz-zms
    chart: athenz-zms-1.0.0
    heritage: Helm
    release: RELEASE-NAME
  name: RELEASE-NAME-athenz-zms-config
