---
title: Charmhub | Deploy Tenant Service Operator using Charmhub - The Open Operator
  Collection
description: Deploy the latest version of Tenant Service Operator as a Kubernetes
  Operator on any cloud.
url: https://charmhub.io/tenant-service/configurations
---

# Tenant Service Operator

[prod-identity-charmhub-bot-2](https://charmhub.io/publisher/prod-identity-charmhub-bot-2 "View all packages from prod-identity-charmhub-bot-2")

* [prod-identity-charmhub-bot-2](https://charmhub.io/publisher/prod-identity-charmhub-bot-2 "View all packages from prod-identity-charmhub-bot-2")

Platform:

edge 5

```
juju deploy tenant-service --channel edge
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

* [authn\_allowed\_scope](https://charmhub.io/tenant-service/configurations#authn_allowed_scope)
* [authn\_allowed\_subjects](https://charmhub.io/tenant-service/configurations#authn_allowed_subjects)
* [authn\_issuer](https://charmhub.io/tenant-service/configurations#authn_issuer)
* [authn\_jwks\_url](https://charmhub.io/tenant-service/configurations#authn_jwks_url)
* [authorization\_enabled](https://charmhub.io/tenant-service/configurations#authorization_enabled)
* [cpu](https://charmhub.io/tenant-service/configurations#cpu)
* [http\_proxy](https://charmhub.io/tenant-service/configurations#http_proxy)
* [https\_proxy](https://charmhub.io/tenant-service/configurations#https_proxy)
* [invitation\_lifetime](https://charmhub.io/tenant-service/configurations#invitation_lifetime)
* [log\_level](https://charmhub.io/tenant-service/configurations#log_level)
* [memory](https://charmhub.io/tenant-service/configurations#memory)
* [no\_proxy](https://charmhub.io/tenant-service/configurations#no_proxy)

[Learn about configurations >](https://juju.is/docs/juju/configuration#heading--application-configuration)

* authn\_allowed\_scope | string

  The allowed OAuth2 scopes that are allowed to access the Group/Authz management APIs.
* authn\_allowed\_subjects | string

  Comma separated list of allowed subject IDs that are allowed to access the Group/Authz management APIs.
* authn\_issuer | string

  The expected issuer of incoming tokens to the Group/Authz management APIs.

  This configuration cannot be used with when the oauth integration exists.
* authn\_jwks\_url | string

  The URL to fetch JWKS keys for validating incoming tokens to the Group/Authz management APIs.

  This configuration cannot be used with when the oauth integration exists.
* authorization\_enabled | boolean

  Default: True

  Whether the access control authorization integration is enabled.
* cpu | string

  K8s cpu resource limit, e.g. "1" or "500m". Default is unset (no limit). This value is used
  for the "limits" portion of the resource requirements (the "requests" portion is
  automatically deduced from it).
  See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
* http\_proxy | string

  URL of the HTTP proxy eg http://proxy.internal:6666, it will set the HTTP\_PROXY var in the workload environment
* https\_proxy | string

  URL of the HTTPS proxy eg http://proxy.internal:6666, it will set the HTTPS\_PROXY var in the workload environment
* invitation\_lifetime | string

  Default: 24h

  Duration an invitation/recovery link remains valid. E.g. "24h", "48h".
* log\_level | string

  Default: info

  Configures the log level.

  Acceptable values are: "info", "debug", "warning", "error" and "critical"
* memory | string

  K8s memory resource limit, e.g. "1Gi". Default is unset (no limit). This value is used
  for the "limits" portion of the resource requirements (the "requests" portion is
  automatically deduced from it).
  See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
* no\_proxy | string

  Domains that need to be excluded from proxying no\_proxy="test.com,test.co.uk", it is a comma separate list