How to install Terrakube using minikube with HTTPS support

[alfespa17]

The following will show how easy is to install Terrakube in minikube with all the features like terraform registry and remote state enable by default.

Requirements:

Install mkcert to generate the local certificates.

We will be using following domains in our test installation:

terrakube-api.minikube.net
terrakube-ui.minikube.net
terrakube-reg.minikube.net

Generate local CA certificate

$ mkcert -install

Created a new local CA 💥
The local CA is now installed in the system trust store! ⚡️
The local CA is now installed in the Firefox trust store (requires browser restart)! 🦊

Local CA certificate path

$ mkcert -CAROOT
/home/myuser/.local/share/mkcert

Local CA certificate content

$ cat /home/myuser/.local/share/mkcert/rootCA.pem

Generate certificate for *.minikube.net

$ mkcert -key-file key.pem -cert-file cert.pem minikube.net *.minikube.net

Created a new certificate valid for the following names 📜
 - "minikube.net"
 - "*.minikube.net"

Reminder: X.509 wildcards only go one level deep, so this won't match a.b.minikube.net ℹ️

The certificate is at "cert.pem" and the key at "key.pem" ✅

It will expire on 19 January 2026 🗓

Now we have all the necessary to install Terrakube with HTTPS

Setup Helm Repository

helm repo add terrakube-repo https://AzBuilder.github.io/terrakube-helm-chart
helm repo update

Setup Minikube

minikube start
minikube addons enable ingress
minikube addons enable storage-provisioner
minikube ip 

Copy the minikube ip address ( Example: 192.168.59.100)

Create Kubernetes secret with local certificate

kubectl -n kube-system create secret tls mkcert --key key.pem --cert cert.pem

Setup Terrakube namespace

kubectl create namespace terrakube

Setup DNS records

sudo nano /etc/hosts

192.168.59.100 terrakube-ui.minikube.net
192.168.59.100 terrakube-api.minikube.net
192.168.59.100 terrakube-reg.minikube.net

Setup Ingress Certificates

$ minikube addons configure ingress

-- Enter custom cert(format is "namespace/secret"): kube-system/mkcert
✅  ingress was successfully configured

minikube addons disable ingress

🌑  "The 'ingress' addon is disabled

minikube addons enable ingress

🔎  Verifying ingress addon...
🌟  The 'ingress' addon is enabled

Helm Values

We need to generate a file called value.yaml with the following using the content of our rootCa.pem from the previous step:

security:
  caCerts:
    rootCA.pem: |
      -----BEGIN CERTIFICATE-----
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      -----END CERTIFICATE-----

## API properties
api:
  env:
  - name: SERVICE_BINDING_ROOT
    value: /mnt/platform/bindings
  volumes:
    - name: ca-certs
      secret:
        secretName: terrakube-ca-secrets
        items:
        - key: "rootCA.pem"
          path: "rootCA.pem"
        - key: "type"
          path: "type"
  volumeMounts:
  - name: ca-certs
    mountPath: /mnt/platform/bindings/ca-certificates
    readOnly: true
  properties:
    databaseType: "H2"

executor:
  env:
  - name: SERVICE_BINDING_ROOT
    value: /mnt/platform/bindings
  volumes:
    - name: ca-certs
      secret:
        secretName: terrakube-ca-secrets
        items:
        - key: "rootCA.pem"
          path: "rootCA.pem"
        - key: "type"
          path: "type"
  volumeMounts:
  - name: ca-certs
    mountPath: /mnt/platform/bindings/ca-certificates
    readOnly: true

## Registry properties
registry:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  env:
  - name: SERVICE_BINDING_ROOT
    value: /mnt/platform/bindings
  volumes:
    - name: ca-certs
      secret:
        secretName: terrakube-ca-secrets
        items:
        - key: "rootCA.pem"
          path: "rootCA.pem"
        - key: "type"
          path: "type"
  volumeMounts:
  - name: ca-certs
    mountPath: /mnt/platform/bindings/ca-certificates
    readOnly: true

dex:
  config:
    issuer: https://terrakube-api.minikube.net/dex

    storage:
      type: memory
    web:
      http: 0.0.0.0:5556
      allowedOrigins: ['*']
      skipApprovalScreen: true
    oauth2:
      responseTypes: ["code", "token", "id_token"]

    connectors:
    - type: ldap
      name: OpenLDAP
      id: ldap
      config:
        # The following configurations seem to work with OpenLDAP:
        #
        # 1) Plain LDAP, without TLS:
        host: terrakube-openldap-service:1389
        insecureNoSSL: true
        #
        # 2) LDAPS without certificate validation:
        #host: localhost:636
        #insecureNoSSL: false
        #insecureSkipVerify: true
        #
        # 3) LDAPS with certificate validation:
        #host: YOUR-HOSTNAME:636
        #insecureNoSSL: false
        #insecureSkipVerify: false
        #rootCAData: 'CERT'
        # ...where CERT="$( base64 -w 0 your-cert.crt )"

        # This would normally be a read-only user.
        bindDN: cn=admin,dc=example,dc=org
        bindPW: admin

        usernamePrompt: Email Address

        userSearch:
          baseDN: ou=users,dc=example,dc=org
          filter: "(objectClass=person)"
          username: mail
          # "DN" (case sensitive) is a special attribute name. It indicates that
          # this value should be taken from the entity's DN not an attribute on
          # the entity.
          idAttr: DN
          emailAttr: mail
          nameAttr: cn

        groupSearch:
          baseDN: ou=Groups,dc=example,dc=org
          filter: "(objectClass=groupOfNames)"

          userMatchers:
            # A user is a member of a group when their DN matches
            # the value of a "member" attribute on the group entity.
          - userAttr: DN
            groupAttr: member

          # The group name should be the "cn" value.
          nameAttr: cn

    staticClients:
    - id: example-app
      redirectURIs:
      - 'https://terrakube-ui.minikube.net'
      - '/device/callback'
      - 'http://localhost:10000/login'
      - 'http://localhost:10001/login'
      name: 'example-app'
      public: true

## Ingress properties
ingress:
  useTls: true
  includeTlsHosts: true
  ui:
    enabled: true
    domain: "terrakube-ui.minikube.net"
    path: "/"
    pathType: "Prefix"
    tlsSecretName: tls-secret-ui-terrakube
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
  api:
    enabled: true
    domain: "terrakube-api.minikube.net"
    path: "/"
    pathType: "Prefix"
    tlsSecretName: tls-secret-api-terrakube
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
  registry:
    enabled: true
    domain: "terrakube-reg.minikube.net"
    path: "/"
    pathType: "Prefix"
    tlsSecretName: tls-secret-reg-terrakube
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
  dex:
    enabled: true
    path: "/dex/"
    pathType: "Prefix"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"

Install Terrakube with local HTTPS support

helm install terrakube terrakube-repo/terrakube -n terrakube --values values.yaml 

Using Terrakube

The environment has some users, groups and sample data so you can test it quickly.

Visit https://terrakube-ui.minikube.net and login using admin@example.com with password admin

We should be able to use the UI using a valid certificate.

Connect to Terrakube

Using terraform we can connect to the terrakube api and the private registry using the following command with the same credentials that we used to login to the UI.

terraform login terrakube-api.minikube.net
terraform login terrakube-reg.minikube.net

Terraform Remote State.

Lets create a simple Terraform file.

terraform {
  cloud {
    organization = "simple"
    hostname = "terrakube-api.minikube.net"

    workspaces {
      tags = ["myplayground", "example"]
    }
  }
}

# This resource will destroy (potentially immediately) after null_resource.next
resource "null_resource" "previous" {}

resource "time_sleep" "wait_5_seconds" {
  depends_on = [null_resource.previous]

  create_duration = "5s"
}

# This resource will create (at least) 30 seconds after null_resource.previous
resource "null_resource" "next" {
  depends_on = [time_sleep.wait_5_seconds]
}

Execute Terraform Remotely

terraform Init

$ terraform init

Initializing Terraform Cloud...

No workspaces found.
  
  There are no workspaces with the configured tags (example, myplayground)
  in your Terraform Cloud organization. To finish initializing, Terraform needs at
  least one workspace available.
  
  Terraform can create a properly tagged workspace for you now. Please enter a
  name to create a new Terraform Cloud workspace.

  Enter a value: simple


Initializing provider plugins...
- Finding latest version of hashicorp/null...
- Finding latest version of hashicorp/time...
- Installing hashicorp/null v3.2.1...
- Installed hashicorp/null v3.2.1 (signed by HashiCorp)
- Installing hashicorp/time v0.9.1...
- Installed hashicorp/time v0.9.1 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

terraform apply

$ terraform apply

Running apply in Terraform Cloud. Output will stream here. Pressing Ctrl-C
will cancel the remote apply if it's still pending. If the apply started it
will stop streaming the logs, but will not stop the apply running remotely.

Preparing the remote apply...

To view this run in a browser, visit:
https://terrakube-api.minikube.net/app/simple/simple/runs/40

Waiting for the plan to start...

***************************************
Running Terraform PLAN
***************************************

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # null_resource.next will be created
  + resource "null_resource" "next" {
      + id = (known after apply)
    }

  # null_resource.previous will be created
  + resource "null_resource" "previous" {
      + id = (known after apply)
    }

  # time_sleep.wait_5_seconds will be created
  + resource "time_sleep" "wait_5_seconds" {
      + create_duration = "5s"
      + id              = (known after apply)
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + creation_time = "5s"

Do you want to perform these actions in workspace "simple"?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

null_resource.previous: Creating...
null_resource.previous: Creation complete after 0s [id=6182221597368620892]
time_sleep.wait_5_seconds: Creating...
time_sleep.wait_5_seconds: Creation complete after 5s [id=2023-10-19T20:25:22Z]
null_resource.next: Creating...
null_resource.next: Creation complete after 0s [id=9093191930998774410]

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

Checking UI.

[atrares]

I followed the instructions to the letter.

I am operating on a windows host using WSL2 as a back-end for docker. I have updated the hosts file on the wsl distro (ubuntu) and turned off the generate hosts conf option for wsl, as well as the hosts file on the windows machine.

I try to hit the ui endpoint, and timeout.

The issue seems to be the ingress addon is having some trouble with certs and endpoints.

These logs are from the ingress-nginx-controller pod

Taking a look at one of the services mentioned in the logs:

[alfespa17]

You need to create the secret using the following

kubectl -n kube-system create secret tls mkcert --key key.pem --cert cert.pem

[atrares]

I have done this step already, I followed the instructions in order several times to sanity check.

[atrares]

does it need to be propagated to the other namespaces like ingress-nginx & terrakube?

[atrares]

I am sanity checking on my mac at the moment.

[alfespa17]

You use this command to select the ingress cert secret and re-enable the ingress

$ minikube addons configure ingress

-- Enter custom cert(format is "namespace/secret"): kube-system/mkcert
✅  ingress was successfully configured

$ minikube addons disable ingress

🌑  "The 'ingress' addon is disabled

$ minikube addons enable ingress

🔎  Verifying ingress addon...
🌟  The 'ingress' addon is enabled

The above should work

[atrares]

same issue on mac (arm64)

[alfespa17]

Can you try using the following values for the ingress config

## Ingress properties
ingress:
  useTls: true
  includeTlsHosts: true
  ui:
    enabled: true
    domain: "terrakube-ui.minikube.net"
    path: "/"
    pathType: "Prefix"
    tlsSecretName: tls-secret-ui-terrakube
    ingressClassName: "nginx"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
  api:
    enabled: true
    domain: "terrakube-api.minikube.net"
    path: "/"
    pathType: "Prefix"
    tlsSecretName: tls-secret-api-terrakube
    ingressClassName: "nginx"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/proxy-set-headers: "terrakube/custom-headers"
  registry:
    enabled: true
    domain: "terrakube-reg.minikube.net"
    path: "/"
    pathType: "Prefix"
    tlsSecretName: tls-secret-reg-terrakube
    ingressClassName: "nginx"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/proxy-set-headers: "terrakube/custom-headers"
  dex:
    enabled: true
    path: "/dex/"
    pathType: "Prefix"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/proxy-set-headers: "terrakube/custom-headers"

[atrares]

I stopped minikube and deleted the cluster, started over fresh with the updated config. Seems there are still issues with the certs.

[alfespa17]

The cert issue should no impact you because ngnix Ingress will use the default cert that you previously added, try launching the UI after using the ingress config that I added above

[atrares]

tested on both systems, still timeout

[alfespa17]

Not sure why is not working for you, I have the same cert error but I am able to connect:

Cert Secret

user@pop-os:~/git/terrakube-helm-chart$ minikube version
minikube version: v1.35.0
commit: dd5d320e41b5451cdf3c01891bc4e13d189586ed-dirty

user@pop-os:~/git/terrakube-helm-chart$ minikube addons list
|-----------------------------|----------|--------------|--------------------------------|
|         ADDON NAME          | PROFILE  |    STATUS    |           MAINTAINER           |
|-----------------------------|----------|--------------|--------------------------------|
| ambassador                  | minikube | disabled     | 3rd party (Ambassador)         |
| amd-gpu-device-plugin       | minikube | disabled     | 3rd party (AMD)                |
| auto-pause                  | minikube | disabled     | minikube                       |
| cloud-spanner               | minikube | disabled     | Google                         |
| csi-hostpath-driver         | minikube | disabled     | Kubernetes                     |
| dashboard                   | minikube | disabled     | Kubernetes                     |
| default-storageclass        | minikube | enabled ✅   | Kubernetes                     |
| efk                         | minikube | disabled     | 3rd party (Elastic)            |
| freshpod                    | minikube | disabled     | Google                         |
| gcp-auth                    | minikube | disabled     | Google                         |
| gvisor                      | minikube | disabled     | minikube                       |
| headlamp                    | minikube | disabled     | 3rd party (kinvolk.io)         |
| inaccel                     | minikube | disabled     | 3rd party (InAccel             |
|                             |          |              | [info@inaccel.com])            |
| ingress                     | minikube | enabled ✅   | Kubernetes                     |
| ingress-dns                 | minikube | disabled     | minikube                       |
| inspektor-gadget            | minikube | disabled     | 3rd party                      |
|                             |          |              | (inspektor-gadget.io)          |
| istio                       | minikube | disabled     | 3rd party (Istio)              |
| istio-provisioner           | minikube | disabled     | 3rd party (Istio)              |
| kong                        | minikube | disabled     | 3rd party (Kong HQ)            |
| kubeflow                    | minikube | disabled     | 3rd party                      |
| kubevirt                    | minikube | disabled     | 3rd party (KubeVirt)           |
| logviewer                   | minikube | disabled     | 3rd party (unknown)            |
| metallb                     | minikube | disabled     | 3rd party (MetalLB)            |
| metrics-server              | minikube | disabled     | Kubernetes                     |
| nvidia-device-plugin        | minikube | disabled     | 3rd party (NVIDIA)             |
| nvidia-driver-installer     | minikube | disabled     | 3rd party (NVIDIA)             |
| nvidia-gpu-device-plugin    | minikube | disabled     | 3rd party (NVIDIA)             |
| olm                         | minikube | disabled     | 3rd party (Operator Framework) |
| pod-security-policy         | minikube | disabled     | 3rd party (unknown)            |
| portainer                   | minikube | disabled     | 3rd party (Portainer.io)       |
| registry                    | minikube | disabled     | minikube                       |
| registry-aliases            | minikube | disabled     | 3rd party (unknown)            |
| registry-creds              | minikube | disabled     | 3rd party (UPMC Enterprises)   |
| storage-provisioner         | minikube | enabled ✅   | minikube                       |
| storage-provisioner-gluster | minikube | disabled     | 3rd party (Gluster)            |
| storage-provisioner-rancher | minikube | disabled     | 3rd party (Rancher)            |
| volcano                     | minikube | disabled     | third-party (volcano)          |
| volumesnapshots             | minikube | disabled     | Kubernetes                     |
| yakd                        | minikube | disabled     | 3rd party (marcnuri.com)       |
|-----------------------------|----------|--------------|--------------------------------|

user@pop-os:~/git/terrakube-helm-chart$ minikube ip
192.168.59.105

user@pop-os:~/git/terrakube-helm-chart$ cat /etc/hosts | grep minikube.net
192.168.59.105 terrakube-api.minikube.net
192.168.59.105 terrakube-reg.minikube.net
192.168.59.105 terrakube-ui.minikube.net

Example:

Ingress Logs:

-------------------------------------------------------------------------------
NGINX Ingress controller
  Release:       v1.11.3
  Build:         0106de65cfccb74405a6dfa7d9daffc6f0a6ef1a
  Repository:    https://github.com/kubernetes/ingress-nginx
  nginx version: nginx/1.25.5

-------------------------------------------------------------------------------

W0313 18:09:28.767700       7 client_config.go:659] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I0313 18:09:28.767994       7 main.go:205] "Creating API client" host="https://10.96.0.1:443"
I0313 18:09:28.824181       7 main.go:248] "Running in Kubernetes cluster" major="1" minor="32" git="v1.32.0" state="clean" commit="70d3cc986aa8221cd1dfb1121852688902d3bf53" platform="linux/amd64"
I0313 18:09:28.913181       7 main.go:101] "SSL fake certificate created" file="/etc/ingress-controller/ssl/default-fake-certificate.pem"
I0313 18:09:28.957655       7 ssl.go:535] "loading tls certificate" path="/usr/local/certificates/cert" key="/usr/local/certificates/key"
I0313 18:09:28.994879       7 nginx.go:271] "Starting NGINX Ingress controller"
I0313 18:09:29.004793       7 event.go:377] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"ingress-nginx", Name:"ingress-nginx-controller", UID:"c4e04221-19e5-4342-bf2c-8cf9311b3e2e", APIVersion:"v1", ResourceVersion:"2218", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap ingress-nginx/ingress-nginx-controller
I0313 18:09:29.005203       7 event.go:377] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"ingress-nginx", Name:"tcp-services", UID:"dc814d24-6d76-48c1-9a62-44b271d25100", APIVersion:"v1", ResourceVersion:"2219", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap ingress-nginx/tcp-services
I0313 18:09:29.005545       7 event.go:377] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"ingress-nginx", Name:"udp-services", UID:"c7eab3d9-999b-44a0-b505-3f92da6fffa1", APIVersion:"v1", ResourceVersion:"2220", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap ingress-nginx/udp-services
I0313 18:09:29.012029       7 backend_ssl.go:67] "Adding secret to local store" name="kube-system/mkcert"
I0313 18:09:30.098910       7 store.go:440] "Found valid IngressClass" ingress="terrakube/terrakube-api-ingress" ingressclass="nginx"
W0313 18:09:30.099323       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "terrakube/tls-secret-api-terrakube" in local store
I0313 18:09:30.099391       7 store.go:440] "Found valid IngressClass" ingress="terrakube/terrakube-registry-ingress" ingressclass="nginx"
W0313 18:09:30.099610       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "terrakube/tls-secret-reg-terrakube" in local store
I0313 18:09:30.100220       7 store.go:440] "Found valid IngressClass" ingress="terrakube/terrakube-ui-ingress" ingressclass="nginx"
W0313 18:09:30.101634       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "terrakube/tls-secret-ui-terrakube" in local store
I0313 18:09:30.100438       7 event.go:377] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"terrakube", Name:"terrakube-api-ingress", UID:"12072c58-9608-4a54-9fd9-7e51e3ca8d74", APIVersion:"networking.k8s.io/v1", ResourceVersion:"5257", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I0313 18:09:30.102251       7 event.go:377] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"terrakube", Name:"terrakube-registry-ingress", UID:"50cbe749-e714-43df-9774-f6baa456fc6a", APIVersion:"networking.k8s.io/v1", ResourceVersion:"5258", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I0313 18:09:30.102398       7 event.go:377] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"terrakube", Name:"terrakube-ui-ingress", UID:"b4d2427a-8ab9-47e1-904d-88d01b9a0b12", APIVersion:"networking.k8s.io/v1", ResourceVersion:"5256", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I0313 18:09:30.197790       7 nginx.go:317] "Starting NGINX process"
I0313 18:09:30.198088       7 leaderelection.go:254] attempting to acquire leader lease ingress-nginx/ingress-nginx-leader...
I0313 18:09:30.198162       7 nginx.go:337] "Starting validation webhook" address=":8443" certPath="/usr/local/certificates/cert" keyPath="/usr/local/certificates/key"
W0313 18:09:30.199964       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:09:30.200059       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:09:30.200121       7 controller.go:1216] Service "terrakube/terrakube-dex" does not have any active Endpoint.
W0313 18:09:30.200205       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:09:30.200251       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:09:30.200312       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
I0313 18:09:30.200421       7 controller.go:193] "Configuration changes detected, backend reload required"
I0313 18:09:30.207733       7 leaderelection.go:268] successfully acquired lease ingress-nginx/ingress-nginx-leader
I0313 18:09:30.207893       7 status.go:85] "New leader elected" identity="ingress-nginx-controller-6c7f486757-2dsl6"
I0313 18:09:30.212775       7 status.go:219] "POD is not ready" pod="ingress-nginx/ingress-nginx-controller-6c7f486757-2dsl6" node="minikube"
I0313 18:09:30.215036       7 status.go:304] "updating Ingress status" namespace="terrakube" ingress="terrakube-ui-ingress" currentValue=[{"ip":"192.168.59.105"}] newValue=[]
I0313 18:09:30.215380       7 status.go:304] "updating Ingress status" namespace="terrakube" ingress="terrakube-registry-ingress" currentValue=[{"ip":"192.168.59.105"}] newValue=[]
I0313 18:09:30.215579       7 status.go:304] "updating Ingress status" namespace="terrakube" ingress="terrakube-api-ingress" currentValue=[{"ip":"192.168.59.105"}] newValue=[]
W0313 18:09:30.225000       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "terrakube/tls-secret-reg-terrakube" in local store
I0313 18:09:30.225356       7 event.go:377] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"terrakube", Name:"terrakube-registry-ingress", UID:"50cbe749-e714-43df-9774-f6baa456fc6a", APIVersion:"networking.k8s.io/v1", ResourceVersion:"9118", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
W0313 18:09:30.229981       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "terrakube/tls-secret-api-terrakube" in local store
W0313 18:09:30.230243       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "terrakube/tls-secret-ui-terrakube" in local store
I0313 18:09:30.230335       7 event.go:377] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"terrakube", Name:"terrakube-api-ingress", UID:"12072c58-9608-4a54-9fd9-7e51e3ca8d74", APIVersion:"networking.k8s.io/v1", ResourceVersion:"9119", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I0313 18:09:30.230394       7 event.go:377] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"terrakube", Name:"terrakube-ui-ingress", UID:"b4d2427a-8ab9-47e1-904d-88d01b9a0b12", APIVersion:"networking.k8s.io/v1", ResourceVersion:"9120", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I0313 18:09:30.279546       7 controller.go:213] "Backend successfully reloaded"
I0313 18:09:30.279667       7 controller.go:224] "Initial sync, sleeping for 1 second"
I0313 18:09:30.279772       7 event.go:377] Event(v1.ObjectReference{Kind:"Pod", Namespace:"ingress-nginx", Name:"ingress-nginx-controller-6c7f486757-2dsl6", UID:"369ff04a-8c97-41dd-a12d-644fa93e7d74", APIVersion:"v1", ResourceVersion:"9081", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
W0313 18:09:33.955655       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:09:33.955904       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:09:33.956014       7 controller.go:1216] Service "terrakube/terrakube-dex" does not have any active Endpoint.
W0313 18:09:33.956107       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:09:33.956192       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:09:33.956252       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
W0313 18:09:37.291814       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:09:37.291864       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:09:37.291876       7 controller.go:1216] Service "terrakube/terrakube-dex" does not have any active Endpoint.
W0313 18:09:37.291897       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:09:37.291913       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:09:37.291921       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
W0313 18:09:40.627461       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:09:40.627714       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:09:40.627827       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:09:40.627882       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:09:40.627917       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
W0313 18:09:43.957614       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:09:43.957778       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:09:43.957868       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:09:43.957927       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:09:43.958012       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
W0313 18:09:50.755966       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:09:50.756050       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:09:50.756098       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:09:50.756140       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:09:50.756154       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
W0313 18:09:54.090399       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:09:54.090603       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:09:54.090743       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:09:54.090804       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:09:54.090834       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
I0313 18:10:30.218561       7 status.go:304] "updating Ingress status" namespace="terrakube" ingress="terrakube-ui-ingress" currentValue=null newValue=[{"ip":"192.168.59.105"}]
I0313 18:10:30.219208       7 status.go:304] "updating Ingress status" namespace="terrakube" ingress="terrakube-api-ingress" currentValue=null newValue=[{"ip":"192.168.59.105"}]
I0313 18:10:30.219521       7 status.go:304] "updating Ingress status" namespace="terrakube" ingress="terrakube-registry-ingress" currentValue=null newValue=[{"ip":"192.168.59.105"}]
W0313 18:10:30.225820       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "terrakube/tls-secret-api-terrakube" in local store
W0313 18:10:30.226042       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "terrakube/tls-secret-ui-terrakube" in local store
I0313 18:10:30.226250       7 event.go:377] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"terrakube", Name:"terrakube-api-ingress", UID:"12072c58-9608-4a54-9fd9-7e51e3ca8d74", APIVersion:"networking.k8s.io/v1", ResourceVersion:"9194", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I0313 18:10:30.226549       7 event.go:377] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"terrakube", Name:"terrakube-ui-ingress", UID:"b4d2427a-8ab9-47e1-904d-88d01b9a0b12", APIVersion:"networking.k8s.io/v1", ResourceVersion:"9195", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I0313 18:10:30.226585       7 event.go:377] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"terrakube", Name:"terrakube-registry-ingress", UID:"50cbe749-e714-43df-9774-f6baa456fc6a", APIVersion:"networking.k8s.io/v1", ResourceVersion:"9196", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
W0313 18:10:30.226524       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "terrakube/tls-secret-reg-terrakube" in local store
W0313 18:10:30.227208       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:10:30.227248       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:10:30.227295       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:10:30.227315       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:10:30.227319       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
W0313 18:10:33.561727       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:10:33.561804       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:10:33.561892       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:10:33.561907       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:10:33.561914       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
192.168.59.1 - - [13/Mar/2025:18:10:39 +0000] "GET / HTTP/2.0" 200 372 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" 288 0.002 [terrakube-terrakube-ui-service-8080] [] 10.244.0.44:8080 384 0.002 200 1089e62913286ef5d13941a7dd473d7f
192.168.59.1 - - [13/Mar/2025:18:10:39 +0000] "GET /env-config.js HTTP/2.0" 200 248 "https://terrakube-ui.minikube.net/" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" 86 0.000 [terrakube-terrakube-ui-service-8080] [] 10.244.0.44:8080 259 0.001 200 ba76641140e3e7ab913542cadcb3770f
192.168.59.1 - - [13/Mar/2025:18:10:39 +0000] "GET /static/css/main.047b6d01.css HTTP/2.0" 200 9925 "https://terrakube-ui.minikube.net/" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" 58 0.003 [terrakube-terrakube-ui-service-8080] [] 10.244.0.44:8080 9938 0.002 200 c029efd876d5dd0965485219c4bea0d0
192.168.59.1 - - [13/Mar/2025:18:10:39 +0000] "GET /static/js/main.15756a57.js HTTP/2.0" 200 4824469 "https://terrakube-ui.minikube.net/" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" 34 0.174 [terrakube-terrakube-ui-service-8080] [] 10.244.0.44:8080 4825746 0.173 200 5c995528ffe7b6371853409b0ba14839
192.168.59.1 - - [13/Mar/2025:18:10:39 +0000] "GET /static/media/logo.f74ebc9581aafb402a6c.jpg HTTP/2.0" 200 97535 "https://terrakube-ui.minikube.net/" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" 114 0.002 [terrakube-terrakube-ui-service-8080] [] 10.244.0.44:8080 97535 0.002 200 d1328fe8cd73903a28633ca9ce78bdf2
192.168.59.1 - - [13/Mar/2025:18:10:40 +0000] "GET /favicon.ico HTTP/2.0" 200 1150 "https://terrakube-ui.minikube.net/" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" 25 0.001 [terrakube-terrakube-ui-service-8080] [] 10.244.0.44:8080 1150 0.002 200 1952478260dfa018b3812f6b3144d81d
192.168.59.1 - - [13/Mar/2025:18:10:40 +0000] "GET /logo192.png HTTP/2.0" 200 1377 "https://terrakube-ui.minikube.net/" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" 30 0.001 [terrakube-terrakube-ui-service-8080] [] 10.244.0.44:8080 1377 0.002 200 c28b8c78f83cdbcd528472bb82e297d2
W0313 18:11:26.032331       7 controller.go:1216] Service "terrakube/terrakube-registry-service" does not have any active Endpoint.
W0313 18:11:26.032367       7 controller.go:1216] Service "terrakube/terrakube-api-service" does not have any active Endpoint.
W0313 18:11:26.032402       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:11:26.032801       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:11:26.033029       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
W0313 18:11:29.366277       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:11:29.366409       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:11:29.366454       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate
W0313 18:11:32.702291       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-ui-terrakube": local SSL certificate terrakube/tls-secret-ui-terrakube was not found. Using default certificate
W0313 18:11:32.702326       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-reg-terrakube": local SSL certificate terrakube/tls-secret-reg-terrakube was not found. Using default certificate
W0313 18:11:32.702333       7 controller.go:1438] Error getting SSL certificate "terrakube/tls-secret-api-terrakube": local SSL certificate terrakube/tls-secret-api-terrakube was not found. Using default certificate

Helm values:

security:
  caCerts:
    rootCA.pem: |
      -----BEGIN CERTIFICATE-----
     XXXXX
      -----END CERTIFICATE-----

## API properties
api:
  version: "2.25.0"
  defaultRedis: true
  defaultDatabase: true
  loadSampleData: true
  env:
  - name: SERVICE_BINDING_ROOT
    value: /mnt/platform/bindings
  - name: JAVA_TOOL_OPTIONS
    value: "-Dlogging.level.org.terrakube.api.plugin.scheduler.module=DEBUG"
  serviceAccountName: "terrakube-api-service-account"
  rbac:
    create: true
    roleName: "terrakube-api-role"
    roleBindingName: "terrakube-api-role-binding"
  volumes:
    - name: ca-certs
      secret:
        secretName: terrakube-ca-secrets
        items:
        - key: "rootCA.pem"
          path: "rootCA.pem"
        - key: "type"
          path: "type"
    - name: cache-volume
      emptyDir: 
        sizeLimit: 1024Mi
  volumeMounts:
  - name: ca-certs
    mountPath: /mnt/platform/bindings/ca-certificates 
    readOnly: true
  - mountPath: /home/cnb/.terraform.d/plugin-cache
    name: cache-volume

ui:
  version: "2.25.0"

executor:
  version: "2.25.0"
  env:
  - name: SERVICE_BINDING_ROOT
    value: /mnt/platform/bindings
  volumes:
    - name: ca-certs
      secret:
        secretName: terrakube-ca-secrets
        items:
        - key: "rootCA.pem"
          path: "rootCA.pem"
        - key: "type"
          path: "type"
  volumeMounts:
  - name: ca-certs
    mountPath: /mnt/platform/bindings/ca-certificates
    readOnly: true
  properties:
    toolsRepository: "https://github.com/AzBuilder/terrakube-extensions"
    toolsBranch: "main"

## Registry properties
registry:
  version: "2.25.0"
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  env:
  - name: SERVICE_BINDING_ROOT
    value: /mnt/platform/bindings
  volumes:
    - name: ca-certs
      secret:
        secretName: terrakube-ca-secrets
        items:
        - key: "rootCA.pem"
          path: "rootCA.pem"
        - key: "type"
          path: "type"
  volumeMounts:
  - name: ca-certs
    mountPath: /mnt/platform/bindings/ca-certificates
    readOnly: true

dex:
  enabled: true
  existingSecret: false
  config:
    issuer: https://terrakube-api.minikube.net/dex

    storage:
      type: memory
    web:
      http: 0.0.0.0:5556
      allowedOrigins: ['*']
      skipApprovalScreen: true
    oauth2:
      responseTypes: ["code", "token", "id_token"]

    connectors:
    - type: ldap
      name: OpenLDAP
      id: ldap
      config:
        # The following configurations seem to work with OpenLDAP:
        #
        # 1) Plain LDAP, without TLS:
        host: terrakube-openldap-service:1389
        insecureNoSSL: true
        #
        # 2) LDAPS without certificate validation:
        #host: localhost:636
        #insecureNoSSL: false
        #insecureSkipVerify: true
        #
        # 3) LDAPS with certificate validation:
        #host: YOUR-HOSTNAME:636
        #insecureNoSSL: false
        #insecureSkipVerify: false
        #rootCAData: 'CERT'
        # ...where CERT="$( base64 -w 0 your-cert.crt )"

        # This would normally be a read-only user.
        bindDN: cn=admin,dc=example,dc=org
        bindPW: admin

        usernamePrompt: Email Address

        userSearch:
          baseDN: ou=users,dc=example,dc=org
          filter: "(objectClass=person)"
          username: mail
          # "DN" (case sensitive) is a special attribute name. It indicates that
          # this value should be taken from the entity's DN not an attribute on
          # the entity.
          idAttr: DN
          emailAttr: mail
          nameAttr: cn

        groupSearch:
          baseDN: ou=Groups,dc=example,dc=org
          filter: "(objectClass=groupOfNames)"

          userMatchers:
            # A user is a member of a group when their DN matches
            # the value of a "member" attribute on the group entity.
          - userAttr: DN
            groupAttr: member

          # The group name should be the "cn" value.
          nameAttr: cn

    staticClients:
    - id: example-app
      redirectURIs:
      - 'https://terrakube-ui.minikube.net'
      - '/device/callback'
      - 'http://localhost:10000/login'
      - 'http://localhost:10001/login'
      name: 'example-app'
      public: true

## Ingress properties
ingress:
  useTls: true
  includeTlsHosts: true
  ui:
    enabled: true
    domain: "terrakube-ui.minikube.net"
    path: "/"
    pathType: "Prefix"
    tlsSecretName: tls-secret-ui-terrakube
    ingressClassName: "nginx"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
  api:
    enabled: true
    domain: "terrakube-api.minikube.net"
    path: "/"
    pathType: "Prefix"
    tlsSecretName: tls-secret-api-terrakube
    ingressClassName: "nginx"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/proxy-set-headers: "terrakube/custom-headers"
  registry:
    enabled: true
    domain: "terrakube-reg.minikube.net"
    path: "/"
    pathType: "Prefix"
    tlsSecretName: tls-secret-reg-terrakube
    ingressClassName: "nginx"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/proxy-set-headers: "terrakube/custom-headers"
  dex:
    enabled: true
    path: "/dex/"
    pathType: "Prefix"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/proxy-set-headers: "terrakube/custom-headers"