Canonical Livepatch Server K8S

Learn about configurations >

• auth.basic.enabled | boolean

  Whether basic auth should be used.

• auth.basic.users | string

  A comma separated list of "user:password" pairs used for authentication.

• auth.oauth.allowed-cidp-groups | string

  Comma separated list of CIdP group names allowed to access the admin API when OAuth is enabled.

• auth.oauth.audience | string

  Expected JWT audience claim value for OAuth authentication.

• auth.oauth.enabled | boolean

  Whether OAuth 2.0 bearer token authentication backed by Canonical IdP should be enabled for admin API access.

• auth.oauth.issuer | string

  Expected JWT issuer claim value for OAuth authentication.

• auth.oauth.jwks.refresh-interval | string

  Default: 1h

  Interval for refreshing the JWKS key set.

• auth.oauth.jwks.refresh-unknown-kid | boolean

  Default: True

  Refresh JWKS on-demand when a token contains an unknown key ID (kid).

• auth.oauth.jwks.refresh-unknown-kid-limit | string

  Default: 10m

  Minimum interval between on-demand JWKS refresh attempts for unknown key IDs.

• auth.oauth.jwks.refresh-unknown-kid-max-wait | string

  Default: 1m

  Maximum time to wait for an in-flight on-demand JWKS refresh.

• auth.oauth.jwks.url | string

  URL of the JWKS endpoint used to fetch signing keys for JWT verification.

• auth.oauth.proxy.enabled | boolean

  Whether or not to use proxy for requests to OAuth provider.

• auth.oauth.proxy.http | string

  A comma separated list HTTP proxies to query the OAuth provider.

• auth.oauth.proxy.https | string

  A comma separated list HTTPS proxies to query the OAuth provider.

• auth.oauth.proxy.no-proxy | string

  A comma separated list of domains, IP CIDRs and/or ports to block when querying the OAuth provider.

• auth.oauth.sig-algs | string

  Default: RS256

  Comma separated list of accepted JWT signature algorithms. Supported values: RS256, RS384, RS512, ES256, ES384, ES512.

• auth.sso.enabled | boolean

  Note: Currently not available for on-prem users!

  Whether or not OIDCSSO authentication should be enabled.

• auth.sso.public-key | string

  Public key for the auth server

• auth.sso.teams | string

  Note: Currently not available for on-prem users!

  A list of comma separated launchpad teams that are allowed access when connecting to the admin tool by SSO authentication.

• auth.sso.url | string

  URL to access for SSO auth.

• cloud_delay.default_delay_hours | int

  [DEPRECATED] Default delay hours for clouds/regions/azs without predefined delay hours. The cloud delay feature is deprecated and is no longer supported.

• cloud_delay.enabled | boolean

  [DEPRECATED] Whether to enable the delayed roll-out of patches based on a client's cloud. The cloud delay feature is deprecated and is no longer supported.

• contracts.ca | string

  A certificate of the CA that issued the certificate of the contracts service. Use 'include-base64://' in a bundle to include a certificate. Otherwise, pass a base64-encoded certificate (base64 of "-----BEGIN" to "-----END") as a config option in a Juju CLI invocation.

• contracts.enabled | boolean

  Whether use of the contracts service is enabled.

• contracts.password | string

  Password to authenticate with backend contracts service.

• contracts.url | string

  Default: https://contracts.canonical.com

  URL to hit for the contracts service

• contracts.user | string

  Username to authenticate with backend contracts service.

• cve-lookup.auth-required | boolean

  Whether or not requests to retrieve fixed CVEs should be authenticated.

• cve-lookup.enabled | boolean

  Whether or not if this instance of Livepatch Server should lookup fixed CVEs in response to client requests.

• cve-sync.enabled | boolean

  Whether or not if this instance of Livepatch Server should sync fixed CVEs data.

• cve-sync.interval | string

  Default: 1h

  Period between automatic refreshing of fixed CVE data.

• cve-sync.proxy.enabled | boolean

  Whether or not to proxy fixed CVE data syncs.

• cve-sync.proxy.http | string

  A comma separated list HTTP proxies to query fixed CVE data.

• cve-sync.proxy.https | string

  A comma separated list HTTPS proxies to query fixed CVE data.

• cve-sync.proxy.no-proxy | string

  A comma separated list of domains, IP CIDRs and/or ports to block when querying fixed CVE data.

• cve-sync.source-url | string

  Address of Livepatch CVE service to sync fixed CVEs data from.

• cve-sync.timeout | string

  Default: 5m

  Timeout for the CVE sync client. The CVE sync will timeout if the CVE service takes longer than the timeout defined, to send the CVE data.

• database.connection-lifetime-max | string

  Default: 10m

  The lifespan of an idle PostgreSQL connection.

• database.connection-pool-max | int

  Default: 10

  The maximum pool of connections to PostgreSQL.

• database.work_mem | int

  The PostgreSQL work_mem parameter for connections with the database. The value is specified as an integer number of MegaBytes (MB), matching the unit semantics of PostgreSQL's work_mem setting. This option is optional: when left unset, the charm does not override PostgreSQL's work_mem, and the server's own default value is used.

• influx.bucket | string

  InfluxDB bucket to write general metrics data to.

• influx.enabled | boolean

  Whether to enable InfluxDB support for time-series metrics reporting.

• influx.organization | string

  InfluxDB organization name.

• influx.ping_bucket | string

  InfluxDB bucket for ping data (may use a different retention policy).

• influx.token | string

  Authentication token for InfluxDB.

• influx.url | string

  URL of the InfluxDB instance to connect to.

• ingress-interface | string

  Default: legacy-nginx-route

  Select the ingress integration. Defaults to "legacy-nginx-route" for backward compatibility. Use "ingress" for new deployments.

• kpi-reports.enabled | string

  Note: Currently not available for on-prem users!

  Key performance index: Metrics. Enables KPI worker - sends metrics to Influx.

• kpi-reports.interval | string

  Default: 5m

  Note: Currently not available for on-prem users!

  Specifies KPI worker frequency.

• lsn-sync.enabled | boolean

  Whether or not if this instance of Livepatch Server should sync LSN data.

• lsn-sync.interval | string

  Default: 1h

  Period between automatic refreshing of LSN data.

• lsn-sync.proxy.enabled | boolean

  Whether or not to proxy LSN data syncs.

• lsn-sync.proxy.http | string

  A comma separated list HTTP proxies to query LSN data.

• lsn-sync.proxy.https | string

  A comma separated list HTTPS proxies to query LSN data.

• lsn-sync.proxy.no-proxy | string

  A comma separated list of domains, IP CIDRs and/or ports to block when querying LSN data.

• lsn-sync.source-url | string

  Address of Livepatch CVE service to sync LSN data from.

• lsn-sync.timeout | string

  Default: 5m

  Timeout for the LSN sync client. The LSN sync will timeout if the CVE service takes longer than the timeout defined, to send the LSN data.

• machine-reports.database.cleanup-interval | string

  Default: 6h

  Time between report cleanup runs.

• machine-reports.database.cleanup-row-limit | int

  Default: 1000

  Maximum number of rows to remove in a single report cleanup run.

• machine-reports.database.enabled | boolean

  Whether or not to enabled machine reports writes to PostgreSQL.

• machine-reports.database.retention-days | int

  Default: 10

  Number of days to retain machine reports in the database before cleanup.

• otel-metrics.enabled | boolean

  Whether to enable OpenTelemetry metrics export. This is a manual toggle and is independent of any charm relation.

• otel-metrics.export-interval | string

  Default: 60s

  How often metrics are exported (e.g. "60s", "1m").

• otel-metrics.export-timeout | string

  Default: 30s

  Timeout for each metrics export attempt (e.g. "30s").

• otel-metrics.service-name | string

  Default: livepatch-server

  Service name reported in OTLP metrics.

• patch-blocklist.enabled | boolean

  Whether or not to enable patch blocklist functionality for the admin tool.

• patch-blocklist.refresh-interval | string

  Default: 5m

  How often to check for new blocklist entries.

• patch-cache.cache-size | int

  Default: 128

  The size of the cache in patches.

• patch-cache.cache-ttl | string

  Default: 10m

  How long to persist a patch in cache whilst it has not been actively retrieved.

• patch-cache.enabled | boolean

  Whether or not to cache patches.

• patch-storage.azure-account-key | string

  The Azure Storage account key, used together with patch-storage.azure-account-name for shared key authentication.

• patch-storage.azure-account-name | string

  The Azure Storage account name. Required unless patch-storage.azure-connection-string is set, which already carries the account name and key.

• patch-storage.azure-client-id | string

  The Entra ID (Azure AD) service principal's client ID.

• patch-storage.azure-client-secret | string

  The Entra ID (Azure AD) service principal's client secret.

• patch-storage.azure-connection-string | string

  An Azure Storage connection string. When set, this is used instead of patch-storage.azure-account-name/patch-storage.azure-account-key for authentication.

• patch-storage.azure-container | string

  The Azure Blob Storage container to store patches within.

• patch-storage.azure-managed-identity-client-id | string

  When patch-storage.azure-account-name, patch-storage.azure-connection-string, and the service principal fields are all omitted, a managed identity is used instead. Note that this workload runs in a pod, not a VM, so a VM-bound managed identity is not available unless Entra Workload ID federation has been configured separately for the workload's service account; this option then selects the user-assigned identity's client ID to use.

• patch-storage.azure-tenant-id | string

  The Entra ID (Azure AD) tenant ID, used together with patch-storage.azure-client-id and patch-storage.azure-client-secret for service principal authentication.

• patch-storage.filesystem-path | string

  Default: /var/lib/livepatch/patches

  The filesystem path to store patches.

• patch-storage.gcs-bucket | string

  The Google Cloud Storage bucket to store patches within.

• patch-storage.gcs-credentials-file | string

  Path to a Google Cloud service account credentials JSON file. When omitted (along with patch-storage.gcs-credentials-json), Application Default Credentials are used instead. Note that this workload runs in a pod, not a VM, so ambient credentials (e.g. the GCE metadata service) are not available unless GKE Workload Identity has been configured separately for the workload's service account; otherwise, credentials must be set.

• patch-storage.gcs-credentials-json | string

  Google Cloud service account credentials, as a JSON string. When omitted (along with patch-storage.gcs-credentials-file), Application Default Credentials are used instead.

• patch-storage.gcs-impersonate-service-account | string

  An optional service account email to impersonate. When set, the resolved credentials are used to impersonate this service account instead of being used directly.

• patch-storage.ibm-api-key | string

  IAM API key. Must be set together with patch-storage.ibm-service-instance-id.

• patch-storage.ibm-bucket | string

  The IBM Cloud Object Storage bucket to store patches within.

• patch-storage.ibm-endpoint | string

  The IBM Cloud Object Storage API endpoint.

• patch-storage.ibm-region | string

  The IBM Cloud region for this Object Storage instance.

• patch-storage.ibm-service-instance-id | string

  IBM Cloud service instance ID, used together with patch-storage.ibm-api-key.

• patch-storage.ibm-trusted-profile-id | string

  When an IAM API key is not configured, the ambient VPC Instance Metadata Service is used instead. Note that this workload runs in a pod, not a VM, so this ambient service is not available unless a Trusted Profile bound to the underlying compute resource has been configured separately; this option then selects which profile to assume.

• patch-storage.oracle-bucket | string

  The Oracle Cloud Infrastructure Object Storage bucket to store patches within.

• patch-storage.oracle-config-file | string

  Path to an OCI config file for authentication. When omitted (along with patch-storage.oracle-profile), instance principal authentication is used instead, bound to the OCI compute instance the server runs on.

• patch-storage.oracle-namespace | string

  The Oracle Cloud Infrastructure Object Storage namespace.

• patch-storage.oracle-profile | string

  The profile name to use from the OCI config file.

• patch-storage.oracle-region | string

  The Oracle Cloud Infrastructure region for this Object Storage instance.

• patch-storage.postgres-connection-string | string

  A connection string URI to a PostgreSQL database for patch storage.

  When set to an empty string, it is handled by relation and uses the same database cluster that livepatch server uses for state. The database name is 'livepatch'.

  If this is to be changed, it is expected that the database you wish to connect to is created manually.

• patch-storage.s3-access-key | string

  AWS programmatic API access key. Must be set together with patch-storage.s3-secret-key. When both are omitted, the AWS SDK's default credential chain is used instead. Note that this workload runs in a pod, not a VM, so ambient credentials (e.g. an EC2 instance role) are not available unless IAM Roles for Service Accounts (IRSA) has been configured separately for the workload's service account; otherwise, these keys must be set.

• patch-storage.s3-assume-role-arn | string

  An optional IAM role ARN to assume via STS. When set, the resolved AWS credentials are used to assume this role via STS instead of being used directly.

• patch-storage.s3-bucket | string

  The S3 bucket to store patches within.

• patch-storage.s3-endpoint | string

  The S3 API presigned endpoint.

• patch-storage.s3-region | string

  The AWS region for this S3 storage.

• patch-storage.s3-secret-key | string

  AWS programmatic API secret key, used together with patch-storage.s3-access-key.

• patch-storage.s3-secure | boolean

  Whether or not to perform TLS.

• patch-storage.s3-use-path-style | boolean

  Whether to use path-style S3 URLs (https://s3.amazonaws.com/BUCKET/KEY) instead of virtual-hosted-style URLs (https://BUCKET.s3.amazonaws.com/KEY). Required for some S3-compatible services (e.g. MinIO), and not needed for AWS S3.

• patch-storage.swift-api-key | string

  An authorisation API key for swift.

• patch-storage.swift-auth-url | string

  The authorisation URL for swift.

• patch-storage.swift-container | string

  The swift blob storage location for storing patches.

• patch-storage.swift-domain | string

  The domain the containers reside under in swift for storing patches.

• patch-storage.swift-region | string

  The region assigned to this domain and tenant.

• patch-storage.swift-tenant | string

  The tenant account name for your container and API service user to connect under.

• patch-storage.swift-username | string

  The Swift username to login against when using API key authorisation.

• patch-storage.type | string

  Default: filesystem

  The storage backend type for patches. Available options are:

  • filesystem
  • swift
  • postgres
  • s3
  • gcs
  • azure
  • ibm
  • oracle

  When using "postgres" for storage, the charm uses the database relation automatically with the default database name "livepatch". A custom database may be specified via patch-storage.postgres-connection-string but must be created manually.

  When using "filesystem", patches are stored at the path configured in patch-storage.filesystem-path.

• patch-sync.architectures | string

  Comma-separated list of architectures to download patches for. When no value is present, all are synced. If this field is empty, the patch sync will gather all architectures.

• patch-sync.enabled | boolean

  Whether or not if this instance of Livepatch Server should sync patches from another instance.

  A sync is effectively a "shared" storage, having access to the same pool of patches as the upstream services patch storage.

• patch-sync.flavors | string

  Default: generic,lowlatency,aws

  A comma separated list of kernel flavors to download patches for. If this field is empty, the patch sync will gather all flavors.

• patch-sync.interval | string

  Default: 1h

  Period between automatic patch snapshot downloads.

• patch-sync.machine-count-strategy | string

  Default: bucket

  The strategy to use when counting machines in a set.

• patch-sync.minimum-kernel-version | string

  A minimum kernel version of format "0.0.0" denoting the lowest kernel version to download patches for. When no value is present, all are synced. For example, "5.4.0" will sync "5.4.0" and up.

• patch-sync.proxy.enabled | boolean

  Whether or not to proxy patch syncs.

• patch-sync.proxy.http | string

  A comma separated list HTTP proxies to query for patches.

• patch-sync.proxy.https | string

  A comma separated list HTTPS proxies to query for patches.

• patch-sync.proxy.no-proxy | string

  A comma separated list of domains, IP CIDRs and/or ports to block.

• patch-sync.send-machine-reports | boolean

  Enable sending reports from local machines during patch synchronisation.

• patch-sync.sync-tiers | boolean

  Mirror patch tier information from the upstream server. WARNING: Enabling this feature will modify existing tier information in order to match the upstream server's tier structure. Avoid this if you already have tiers setup.

• patch-sync.token | string

  Token generated from the admin-tool to authenticate machine to machine.

• patch-sync.upstream-url | string

  Default: https://livepatch.canonical.com

  Livepatch server to download patch snapshots from.

• profiler.block_profile_rate | int

  Default: 50000

  this is the sampling average of one blocking event per BlockProfileRate nanoseconds spent blocked. For example, set rate to 1000000000 (aka int(time.Second.Nanoseconds())) to record one sample per second a goroutine is blocked. It is recommended to set this to values greater than 10,000. For more info, visit this: https://github.com/DataDog/go-profiler-notes/blob/main/block.md#benchmarks

• profiler.enabled | boolean

  Whether to enable or disable continuous profiling on the server or not.

• profiler.hostname | string

  the hostname of the server the profiler is running on. This is used as a tag to group metrics by the server it is running on.

• profiler.mutex_profile_fraction | int

  Default: 5

  this turns on mutex profiles with rate indicating the fraction of mutex contention events reported in the mutex profile. On average, 1/rate events are reported. Setting an aggressive rate can hurt performance. ProfileMutexes must be True

• profiler.profile_allocations | boolean

  this will profile the memory for allocated space as well as allocated objects

• profiler.profile_blocks | boolean

  would profile blocking events (channels, select, etc) with the BlockProfileRate frequency.

• profiler.profile_goroutines | boolean

  would profile separate concurrent running gorountines.

• profiler.profile_inuse | boolean

  this will profile the overall used memory as well as the memory used by objects

• profiler.profile_mutexes | boolean

  this turns on profiling for mutexes

• profiler.sample_rate | int

  Default: 100

  sample rate for the profiler in Hz. 100 means reading 100 times per second.

• profiler.server_address | string

  The pyroscope server address to send the metrics to.

• profiler.upload_rate | int

  The frequency of upload to the profiling server

• server.burst-limit | int

  Default: 500

  The maximum number of concurrently incoming requests.

  After this limit, requests are queued according to the following: concurrency-limit - burst_limit

  For defaults, this is: 1000 - 500 = 500 (Maximum queue).

  Once the queue is reached, subsequent requests are rejected.

• server.concurrency-limit | int

  Default: 1000

  Maximum number of API requests being served concurrently.

• server.is-hosted | boolean

  Defines whether the server will act as an on-prem server (i.e. fetching patches from the hosted server), or will act as a hosted server.

• server.log-level | string

  Default: info

  The server's log level (e.g., debug, info, warning, error).

• server.redirect-downloads | boolean

  When true, the server will redirect downloads directed at its /v1/patches/{filename} endpoint to the endpoint defined in the server.url-template config option. This is useful if you want patch downloads to be redirected to a fileserver fronting patches. Note: Do not enable this option if the server.url-template is configured as the Livepatch-server as this will result in a redirect loop.

• server.url-template | string

  Template string to use when making URLs for giving back to the client.

  e.g. https://livepatch-hosting.com/v1/patches/{filename}

  This will need to be configured once the url or ip address of the service is known.

• timescale_db.connection_lifetime_max | string

  Default: 10m

  The lifespan of an idle TimescaleDB connection.

• timescale_db.connection_pool_max | int

  Default: 10

  The maximum pool of connections to TimescaleDB.

• timescale_db.enabled | boolean

  Whether or not to enable TimescaleDB for time series data storage.

• timescale_db.flush_timeout | string

  Default: 1m

  The maximum time to wait for a flush to complete when flushing time series data to TimescaleDB.

• timescale_db.work_mem | int

  Default: 16

  The PostgreSQL work_mem parameter (in MB) for connections with TimescaleDB.

• tracing.enabled | boolean

  Whether to enable OpenTelemetry tracing. This is a manual toggle and is independent of any charm relation.

• tracing.sample-rate | float

  Default: 1.0

  Fraction of traces to sample (0.0 to 1.0).

• tracing.service-name | string

  Default: livepatch-server

  Service name reported in traces.