About Configuring Cloudentity Platform
Configuration Reference
To learn about every available setting, see Cloudentity Configuration Reference.
Any of the reference options can be used in Helm Charts. Cloudentity provides an easy way to provide required parameters via dedicated keys as well as optional ones via the custom config. For secrets, there is a special secret config which could be used to store passwords.
Required parameters
Those parameters are required for Cloudentity to start succesfully. For datastores, any key from the reference configuration can be provided.
-
Server URL is a public address on which Cloudentity listens for incoming requests
serverURL: "https://acp.example.com:8443"
-
SQL database
sql: type: "postgresql" url: "postgres://root@cockroachdb-public.cockroachdb:26257/acp?sslcert=%2Ftls%2Ftls.crt&sslkey=%2Ftls%2Ftls.key&sslmode=verify-full&sslrootcert=%2Ftls%2Fca.crt"
-
Redis database
redis: addrs: - "redis-master.redis:6379" redis_search: true tls: enabled: true ca: "/tls/ca.crt" key: "/tls/tls.key" cert: "/tls/tls.crt"
Optional parameters
Any configuration option from the configuration reference can be provided in this config. It can be merged with default values and the ones provided in other configuration blocks defined here.
config:
create: true
name: acp-data
data:
logging:
level: debug
Secrets
It is the same as optional parameters section, but paremeters are saved to K8s Secret
instead of
the ConfigMap
.
secretConfig:
create: true
name: secret
data:
system:
secret: mysecret
Features
For convenience, Cloudentity feature flags are defined under seperate key. You can specify here any of the features from reference config.
features:
dev_mode: true
demo_app: true
Advanced parameters
Those paremeters are considered for advanced use case or developer mode.
-
Disable TLS in every Cloudentity component. This could be usefull in istio integration where TLS is already provided by envoy.
tlsDisabled: true
-
If you are using dedicated mTLS ingress, additional listen address must be provided.
serverURLMtls: "https://mtls.acp.example.com:8443"
-
Cloudentity startup command can be configured, full list of parameters is available here.
args: - server - start - --metrics
Paremeters Merge Order
Parameters are merged from each configuration file including reference config. The order of merge is as following with bottom one taking priority in case of conflict.
- reference config (part of Cloudentity docker)
- standalone parameters like redis, sql, features, and more (
/data/config.yaml
) - optional parameters config (
/data/extraconfig.yaml
) - secret config (
/secret/config.yaml
) - environment variables
This is controlled by the configPath
parameter with default value of /data/config.yaml,/data/extraconfig.yaml,/secret/config.yaml
Using External Config
In case where you would want to manage secrets on your own, you could do that by disabling secret
creation and providing secret name with key config.yaml
.
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: secret
stringData:
config.yaml: |
system:
secret: mysecret
secretConfig:
create: false
name: secret
You can customize secret keys or provide multiple keys, it will requires update of configPath
.
In this example system.yaml
secret will be used as Cloudentity config while
cert.key will be mounted under /secret/cert.key
for further use.
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: secret
stringData:
system.yaml: |
system:
secret: mysecret
cert.key: <data>
secretConfig:
create: false
name: secret
configPath: /data/config.yaml,/data/extraconfig.yaml,/secret/system.yaml