teleport-plugin-msteams Chart Reference

The teleport-plugin-msteams Helm chart is used to configure the MsTeams Teleport plugin, which allows users to receive Access Requests via channels or direct messages in MsTeams.

You can browse the source on GitHub.

This reference details available values for the teleport-plugin-msteams chart.

teleport

teleport contains the configuration describing how the plugin connects to your Teleport cluster.

teleport.address

teleport.address is the address of the Teleport cluster the plugin connects to. The address must contain both the domain name and the port of the Teleport cluster. It can be either the address of the auth servers or the proxy servers.

For example:

• joining a Proxy: teleport.example.com:443 or teleport.example.com:3080
• joining an Auth: teleport-auth.example.com:3025

teleport.identitySecretName

teleport.identitySecretName is the name of the Kubernetes secret that contains the credentials for the connection to your Teleport cluster.

The secret should be in the following format:

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: teleport-plugin-identity
data:
  auth_id: #...

Check out the Access Requests with Microsoft Teams guide for more information about how to acquire these credentials.

teleport.identitySecretPath

teleport.identitySecretPath is the key in the Kubernetes secret specified by teleport.identitySecretName that holds the credentials for the connection to your Teleport cluster. If the secret has the path, "auth_id", you can omit this field.

msTeams

msTeams contains the configuration used by the plugin to authenticate to MsTeams.

You can pass the MsTeams appSecret:

• via the chart Values by setting msTeams.appSecret
• via an existing Kubernetes Secret by setting msTeams.appSecretFromSecret

msTeams.appID

msTeams.appID is the Azure app ID used by the plugin. See the MsTeams guide to know how to get this value.

This value is mandatory.

msTeams.tenantID

msTeams.tenantID is the Azure tenant ID used by the plugin and Microsoft Teams. See the MsTeams guide to know how to get this value.

This value is mandatory.

msTeams.teamsAppID

msTeams.teamsAppID is the MsTeams app ID used by the plugin. See the MsTeams guide to know how to get this value.

This value is mandatory.

msTeams.appSecret

msTeams.appSecret is the MsTeams appSecret used by the plugin to interact with MsTeams. When set, the Chart creates a Kubernetes Secret for you.

This value has no effect if msTeams.appSecretFromSecret is set.

msTeams.appSecretFromSecret

msTeams.appSecretFromSecret is the name of the Kubernetes Secret containing the MsTeams appSecret. When this value is set, you must create the Secret before creating the chart release.

msTeams.appSecretFromSecretKey

msTeams.appSecretFromSecretKey is the Kubernetes Secret key containing the MsTeams appSecret. The secret name is set via msTeams.appSecretFromSecret.

roleToRecipients

roleToRecipients is mapping the requested role name to a list of recipients the plugin will notify. Recipients can be user IDs, user emails, and channel URLs. The map must contain a mapping for * in case no matching roles are found.

Example value:

roleToRecipients:
 "*": "admin@example.com"
 dev:
   - "https://teams.microsoft.com/l/channel/19%3ae06a7383ed98468f90217a35fa1980d7%40thread.tacv2/Approval%2520Channel%25202?groupId=f2b3c8ed-5502-4449-b76f-dc3acea81f1c&tenantId=ff882432-09b0-437b-bd22-ca13c0037ded"
   - "devops@example.com"

log

log controls the plugin logging.

log.severity

log.severity is the log level for the Teleport process. Available log levels are: DEBUG, INFO, WARN, ERROR.

The default is INFO, which is recommended in production. DEBUG is useful during first-time setup or to see more detailed logs for debugging.

log.output

log.output sets the output destination for the Teleport process. This can be set to any of the built-in values: stdout, stderr.

The value can also be set to a file path (such as /var/log/teleport.log) to write logs to a file. Bear in mind that a few service startup messages will still go to stderr for resilience.

annotations

annotations contains annotations to apply to the different Kubernetes objects created by the chart. See the Kubernetes annotation documentation for more details.

annotations.config

annotations.config contains the Kubernetes annotations put on the ConfigMap resource created by the chart.

annotations.deployment

annotations.deployment contains the Kubernetes annotations put on the Deployment or StatefulSet resource created by the chart.

annotations.pod

annotations.pod contains the Kubernetes annotations put on the Pod resources created by the chart.

annotations.secret

annotations.secret contains the Kubernetes annotations put on the Secret resource created by the chart. This has no effect when joinTokenSecret.create is false.

image

image sets the container image used for plugin pods created by the chart.

You can override this to use your own plugin image rather than a Teleport-published image.

image.repository

image.repository is the image repository.

image.pullPolicy

image.pullPolicy is the Kubernetes image pull policy.

image.tag

image.tag Overrides the image tag whose default is the chart appVersion.

Normally, the version of the Teleport plugin matches the version of the chart. If you install chart version 15.0.0, you'll use the plugin version 15.0.0. Upgrading the plugin is done by upgrading the chart.

imagePullSecrets

imagePullSecrets is a list of secrets containing authorization tokens which can be optionally used to access a private Docker registry.

See the Kubernetes reference for more details.

podSecurityContext

podSecurityContext sets the pod security context for any pods created by the chart. See the Kubernetes documentation for more details.

To unset the security context, set it to null or ~.

securityContext

securityContext sets the container security context for any pods created by the chart. See the Kubernetes documentation for more details.

To unset the security context, set it to null or ~.

resources

resources sets the resource requests/limits for any pods created by the chart. See the Kubernetes documentation for more details.

nodeSelector

nodeSelector sets the node selector for any pods created by the chart. See the Kubernetes documentation for more details.

tolerations

tolerations sets the tolerations for any pods created by the chart. See the Kubernetes documentation for more details.

affinity

affinity sets the affinities for any pods created by the chart. See the Kubernetes documentation for more details.