Helm Values (4.1)

These are the helm values supported in this release of Usage Engine Private Edition.

## Default values for Usage Engine Private Edition. ## This is a YAML-formatted file. ## Declare variables to be passed into your templates. ## Pure documentation comments are prefixed with ## (double hash) ## Commented out values are prefixed with # (single hash) ## Only on-premise, aws and gcp supported for now environment: on-premise global: ## The domain value is used when a hostname ingress is configured. #domain: my.domain.com ## The region that the kubernetes cluster belongs to #region: west1 ## Service Account used to apply the objects #serviceAccountName: default ## Whether this installation is part of a multi-tenant installation or not. ## Please refer to the InfoZone documentation on the topic of Multi Tenancy for details. multiTenant: false ## If the container images shall be pulled from a private registry, ## then uncomment this section and specify the name of the secret ## containing the credentials for that registry. #imagePullSecrets: #- name: regcred ## Performance metrics are generated and exposed by default. metrics: ## Monitor resources (PodMonitor / ServiceMonitor) are setup automatically if those resource definitions exist in the cluster, ## thereby making the metrics automatically discoverable by your Prometheus resource. monitor: ## Set the label(s) required by your Prometheus resource. If any. ## For details refer to the serviceMonitorSelector.matchLabels and podMonitorSelector.matchLabels fields in the Prometheus documentation: ## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md labels: {} ## Set to true to force roll of all deployments and statefulsets in this chart forceRoll: false namespace: ## Enables namespace if you have multiple Usage Engine Private Edition installations in multiple namespaces in EKS/GKE cluster ## When setting global.namespace.enabled to false: ## - Resulting domain name to be <function>.<domain name>, e.g. desktop-online.uepe-eks.example.com ## - [postgres | oracle | saphana].db as per value ## When setting global.namespace.enabled to true: ## - "-<namespace>" will be added into domain name, resulting <function>-<namespace>.<domain name>, e.g. desktop-online-namespace1.uepe-eks.example.com ## - If [postgres | oracle | saphana].db is empty, a suffix "<namespace>" will be added to [postgres | oracle | saphana].db value, e.g. namespace1 ## Note that if you are using GCP managed certificate, before enable this property you need to remove the existing certificate enabled: false ingressController: ## The name of the nginx ingress controller service, this was used by the alb ingress resource serviceName: "{{ .Release.Name }}-ingress-nginx-v4-controller" debug: script: enabled: false log: level: codeserver: info jetty: 'off' others: warn jmx: ## Legacy configuration to expose metrics for scraping by prometheus. ## This is deprecated in favor of using the automatic service discovery capabilites of the prometheus stack. ## Refer to the global.metrics values. export: ## Set to true to expose platform metrics for scraping by prometheus. enabled: false ## The port on which the platform metrics are exposed. port: 8888 log: ## Format can be "json" or "raw". Default is "raw" format: raw ## Pattern is only for raw format, refer to log4j standard pattern: '%d: %5p: %m%n' ## Paste the license key here, otherwise use the option '--set-file licenseKey=<licenseKey_file>' when running helm install. licenseKey: ' ' ## Timezone MediationZone should run as, e.g. 'Europe/Stockholm' timezone: UTC ## Schedule downtime for all ECDs for the purpose of cold backup. suspend: ## The time when the downtime shall begin. Needs to be specified on crontab format. #from: "0 3 * * *" ## The time when the downtime shall end. Needs to be specified on crontab format. #until: "10 3 * * *" persistence: enabled: false ## A manually managed Persistent Volume and Claim ## If defined, the PVC must be created manually before the volume will be bound ## The value is evaluated as a template, so, for example, the name can depend on .Release or .Chart #existingClaim: ## If existingClaim is not defined, it will fallback to a bundled PVC based on the current environment. ## Currently only aws environment has a bundled PVC associated with it. #bundledClaim: ## The amount of storage to request. Default is 1Gi. #storageRequest: "10Gi" ## See https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes for the available access modes. ## aws default is "ReadWriteMany", others default to "ReadWriteOnce". #accessModes: [] ## Specify the storage class to be used in the bundled PVC. ## If this is not set, default storage class name will be used. aws defaults to "aws-efs". #storageClassName: platform: metadata: annotations: {} labels: {} replicaCount: 1 repository: 462803626708.dkr.ecr.eu-west-1.amazonaws.com/usage-engine-private-edition tag: 4.1.0 pullPolicy: IfNotPresent ## Add/override jvm arguments jvmArgs: - XX:MaxMetaspaceSize=512m - Xms256m - Xmx2g ## Add/override system properties ## It is possible to refer to another system property by wrapping it in ${...} systemProperties: #- someotherprop=${mz.home}/someothervalue init: ## Platform init container resources ## Set this if you need to specify resource requests and/or limits ## Reference: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} db: ## derby, postgresql, oracle or saphana type: derby ## The credentials of the jdbc user. I.e. the user that is used in runtime to connect to the system database. ## It is not recommended to provide the password in this way since it is a potential security risk. ## Refer to the Bootstrapping System Credentials section in the installation guide on InfoZone for additional information about this. jdbcUser: mzadmin #jdbcPassword: bXo= ## Keystore is stored in /opt/mz/persistent/keys even if persistence is disabled. tls: enabled: false cert: ## Method to provide certificate. ## Supported values are: ## 'certManager' - Generation and renewal of cert is managed by cert-manager (needs to be installed separately). ## 'secret' - A keystore is manually stored in a K8s secret with the specified name ## 'key' A self signed certificate is generated and stored on disk - this is deprecated and will be removed in a future release. public: key ## Used when "platform.tls.cert.public=certManager" to automate certificate management using cert-manager ## Requires an Issuer or ClusterIssuer to be created separately ## See details in https://infozone.atlassian.net/wiki/spaces/UEPE4D/pages/107217404/Bootstrapping+System+Certificates+and+Secrets+-+Private+Cloud+4.0 #certManager: # public: # issuer: # name: letsencrypt-prod # kind: ClusterIssuer ## This value is deprecated, please use global.domain instead. ## domain: xxx.xxx.xxx ## Used when "platform.tls.cert.public=secret" to configure manually provisioned keystore and certificate ## See details in https://infozone.atlassian.net/wiki/spaces/UEPE4D/pages/107217404/Bootstrapping+System+Certificates+and+Secrets+-+Private+Cloud+4.0 #secret: # public: # name: mz-cert key: ## Uncomment if credentials are not already provided through secret "env-secrets" ## Note that when cert-manager is used, password and storepassword must have the same values! #password: RGVmYXVsdEtleXN0b3JlUFdE #storepassword: RGVmYXVsdEtleXN0b3JlUFdE alias: certificate ## Platform container resources ## Set this if you need to specify resource requests and/or limits ## Reference: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} probes: ## If the platform takes a very long time to start it ## might get restarted because the thresholds have been reached. ## If a pod does not reach ready state (readiness probe success) it will be restarted. ## If a pod's liveness probe fails for X times, the pod will be restarted. liveness: initialDelaySeconds: 300 periodSeconds: 15 timeoutSeconds: 10 successThreshold: 1 failureThreshold: 3 readiness: initialDelaySeconds: 10 periodSeconds: 5 timeoutSeconds: 10 successThreshold: 1 failureThreshold: 120 ## Node, affinity, tolerations for pod assignment ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature nodeSelector: {} affinity: {} tolerations: [] service: metadata: annotations: {} type: NodePort ports: - name: http port: 9000 #nodePort: 30900 # Use this to explicitly set the external port targetPort: 9000 protocol: TCP - name: rcp port: 6790 #nodePort: 30679 # Use this to explicitly set the external port targetPort: 6790 protocol: TCP ## Use the configMaps field to mount configuration files ## like external references files ## into /opt/mz/etc #configMaps: #- file: extrefs.txt # data: | # parameter1=value1 # parameter2=value2 ## Metrics configuration specific to the platform. metrics: podMonitor: ## Relabeling to apply to the platform podMonitor resource. ## Need to be given as an array of RelabelConfig. ## Refer to the prometheus documentation for details: ## https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md relabelings: [] ## Defines additional secret mounts. Secrets must be manually created in the namespace. extraSecretMounts: [] #- name: secret-files # mountPath: /etc/secrets # subPath: "" # secretName: my-secret-files # readOnly: true ## Defines additional config map mounts. Config maps must be manually created in the namespace. extraConfigmapMounts: [] #- name: my-configmap # mountPath: /etc/config # subPath: "" # configMap: my-configmap # readOnly: true ## Extra general purpose volume mounts extraVolumeMounts: [] #- name: example # mountPath: /example ## Extra general purpose volumes extraVolumes: [] #- name: example # emptyDir: {} ## Optional sidecar containers. ## The items in this list must be specified according the Kubernetes Container API. sidecars: [] #- name: example # image: example/example # imagePullPolicy: IfNotPresent # resources: {} # ports: # - name: example # containerPort: 8080 # protocol: TCP # env: # - name: EXAMPLE # value: example # volumeMounts: # - name: example # mountPath: /example postgres: ## The PostgreSQL database administrator username. ## Only required if the Usage Engine Private Edition system database is to be automatically created. ## Refer to the System Database section in the installation guide on InfoZone additional information about this. adminUsername: postgres ## The PostgreSQL database administrator password. ## Only required if the Usage Engine Private Edition system database is to be automatically created. ## Refer to the System Database section in the installation guide on InfoZone for additional information about this. ## Also, it is not recommended to provide the password in this way since it is a potential security risk. ## Refer to the Bootstrapping System Credentials section in the installation guide on InfoZone for additional information about this. #adminPassword: dGVzdA== ## The password of the mzowner user. I.e. the user that is the owner of the system database schema. ## It is not recommended to provide the password in this way since it is a potential security risk. ## Refer to the Bootstrapping System Credentials section in the installation guide on InfoZone for additional information about this. #mzownerPassword: bXpwb3N0Z3Jlcw== ## If postgres.db is set, db name will be created as per value ## Else if global.namespace.enabled is true and env is "aws" or "gcp", default to mz<namespace>, e.g. mznamespace1 ## Else default to "mz" db: port: 5432 host: postgresql saphana: ## The SAP HANA database administrator username. ## Only required if the Usage Engine Private Edition system database is to be automatically created. ## Refer to the System Database section in the installation guide on InfoZone additional information about this. adminUsername: SYSTEM ## The SAP HANA database administrator password. ## Only required if the Usage Engine Private Edition system database is to be automatically created. ## Refer to the System Database section in the installation guide on InfoZone for additional information about this. ## Also, it is not recommended to provide the password in this way since it is a potential security risk. ## Refer to the Bootstrapping System Credentials section in the installation guide on InfoZone for additional information about this. #adminPassword: dGVzdA== ## The name of the Usage Engine Private Edition system database. db: MZ ports: ## The port that will be used in runtime for jdbc connections towards the Usage Engine Private Edition system database. jdbc: 39041 ## The port that will be used by the hdbsql client when first creating the Usage Engine Private Edition system database. hdbsql: 39013 ## The host of the SAP HANA database service. host: saphana ## The name of the SAP HANA System Database systemDb: SYSTEMDB ## The SAP HANA instance number instance: 90 oracle: ## The Oracle database administrator username. ## Only required if the Usage Engine Private Edition system database is to be automatically created (only supported for Oracle Expresse Edition - see the expressEdition value below). ## Refer to the System Database section in the installation guide on InfoZone additional information about this. adminUsername: sys ## The Oracle database administrator password. ## Only required if the Usage Engine Private Edition system database is to be automatically created (only supported for Oracle Expresse Edition - see the expressEdition value below). ## Refer to the System Database section in the installation guide on InfoZone additional information about this. ## Also, it is not recommended to provide the password in this way since it is a potential security risk. ## Refer to the Bootstrapping System Credentials section in the installation guide on InfoZone for additional information about this. #adminPassword: T3JhY2xlMTg= ## The password of the mzowner user. I.e. the user that is the owner of the system database schema. ## It is not recommended to provide the password in this way since it is a potential security risk. ## Refer to the Bootstrapping System Credentials section in the installation guide on InfoZone for additional information about this. #mzownerPassword: ZHI= ## The oracle home. Needs to correspond to the ORACLE_HOME env var on the database server. ## Not required when using Oracle Expresse Edition (see the expressEdition value below). home: ## The host and domain of the database server. host: oracle18xe ## The port. port: 1521 ## The name of the database. Translates to the SID (or pluggable database name if using Oracle Expresse Edition). db: MZ ## The database size (small, medium or large). size: small ## The path where the data files should be located. data: /opt/oracle/oradata/XE ## Set to true when using an Oracle Express Edition (XE) installation. Only for dev/test purposes. expressEdition: true ## The Oracle client version to use. Should be specified on <major>.<minor> format. ## Currently, only version 19.x is supported. ## Needs to correspond with the basicLiteRpm and sqlPlusRpm values below. clientVersion: 19.9 ## The name of the basic lite rpm file corresponding with the Oracle client version specified above. ## This file will have to be added through an extension image. ## See the documentation on the extensions.* values elsewhere in this values file for further details. basicLiteRpm: oracle-instantclient19.9-basiclite-19.9.0.0.0-1.x86_64.rpm ## The name of the sqlplus rpm file corresponding with the Oracle client version specified above. ## This file will have to be added through an extension image. ## See the documentation on the extensions.* values elsewhere in this values file for further details. sqlPlusRpm: oracle-instantclient19.9-sqlplus-19.9.0.0.0-1.x86_64.rpm ## Operator deployment. operator: metadata: annotations: {} labels: {} ## Enable/disable the operator. Setting this to false means the operator related kubernetes resources will not be created. enabled: true ## Set to false if you do not want to install the CRDs that are part of this helm chart. ## One reason for doing this is in the situation where the user installing the helm chart does not have permissions ## to create/update CRDs in the cluster. ## In this situation a cluster admin will have to manually install/update the CRDs. ## See the documentation for further details. installCRDs: true ## Set a specific namespace that the operator *listens* on. ## Ie. If you have a non-clusterwide operator it will only act ## on resources deployed to this namespace. ## Defaults to the helm release namespace! #namespace: operatornamespace repository: 462803626708.dkr.ecr.eu-west-1.amazonaws.com/usage-engine-private-edition tag: 4.1.0-operator pullPolicy: IfNotPresent ## The auth proxy protects the /metrics endpoint rbacAuthProxy: enabled: true webhook: enabled: false tls: cert: ## Delegate certificate management to either certManager or internal. ## Selecting certManager requires cert-manager (https://cert-manager.io) to have been deployed priorly. ## Selecting internal means basic self-signed certificate management without auto-renewal. delegate: certManager ## Node, affinity, tolerations for pod assignment ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature nodeSelector: {} affinity: {} tolerations: [] ## Common config for the resources that the operator is managing common: ## List of common config for the ECDs that the operator manages ## This enables configuring common annotations, labels and serviceAccount on groups of ECDs. ## The grouping is achieved via the nameRegex. ## ## If you specify that an ECD shall be using a custom serviceAccount here, ## then you need to make sure that it has permissions to perform get and patch operation on the pods/status resource. ## This is an example rule specification to achieve this: ## kind: Role ## apiVersion: rbac.authorization.k8s.io/v1 ## metadata: ## name: my-ecd-role ## rules: ## - apiGroups: [""] ## resources: ["pods/status"] ## verbs: ["get", "patch"] ## ecd: #- nameRegex: ecd1-.* # annotations: # annotation1: some-annotation-value # annotation2: some-other-annotation-value # labels: # label1: some-label-value # label2: some-other-label-value # serviceAccount: serviceAccount1 #- nameRegex: ecd2-.* # annotations: # annotation3: some-annotation-value # annotation4: some-other-annotation-value # labels: # label3: some-label-value # label4: some-other-label-value # serviceAccount: serviceAccount2 ## Debug logging for operator debug: enabled: false ## Should only be changed if deploying to an environment with an offline network kubeRbacProxyImageRepository: gcr.io/kubebuilder/kube-rbac-proxy ## Resources for the operator pod. Uncomment to use custom resources. #resources: #limits: #cpu: 100m #memory: 300Mi #requests: #cpu: 100m #memory: 200Mi ## The syncPeriod is the time the operator waits in between each reconcile loop. ## For large systems (i.e. with many ECDs and many workflows) it may be required to ## increase this in order to prevent the reconcile loops from from piling up. ## Default is 300 s. #syncPeriod: 300s ## The time to wait before requeuing a previously failed reconciliation. ## The value must be a parseable duration (see golang time package). ## Default is 2 seconds. #requeueAfter: 2s ## The timeout value used when the operator places http requests against the platform as part of the process ## of reconciling workflows. ## If you see errors like "context deadline exceeded" in the operator log when reconciling workflows, ## then you can try to increase this timeout. httpTimeout: 20s ## The password of the mzk8soperator user. ## This user is used for internal communication between the operator and the platform. ## It is not recommended to provide the password in this way since it is a potential security risk. ## Refer to the Bootstrapping System Credentials section in the installation guide on InfoZone for additional information about this. #operatorPassword: ## aws setup ## Setup aws load balancers and route53 records for the hosted zones and ## control allowed cidrs to access the platform services aws: ## This value is deprecated, please use global.namespace.enabled instead. #namespace: ## Enables namespace if you have multiple Usage Engine Private Edition installations in multiple namespaces in EKS cluster ## When setting aws.namespace.enabled to false: ## - Resulting domain name to be <function>.<domain name>, e.g. desktop-online.uepe-eks.example.com ## - [postgres | oracle | saphana].db as per value ## When setting aws.namespace.enabled to true: ## - "-<namespace>" will be added into domain name, resulting <function>-<namespace>.<domain name>, e.g. desktop-online-namespace1.uepe-eks.example.com ## - If [postgres | oracle | saphana].db is empty, a suffix "<namespace>" will be added to [postgres | oracle | saphana].db value, e.g. namespace1 #enabled: false ## The certificate to use for ingress traffic. ## Check the AWS Certificate Manager in the AWS Management Console to find out which certificates that are available. acm_certificate: arn:aws:acm:eu-west-1:1234567890:certificate/xxxxxxxx-xxxx-xxxx-xxxxxxxxxxxxxxxxx ## This list of values controls from which network ranges ingress traffic is accepted. Use CIDR notation when setting this value. access_cidr_blocks: - 0.0.0.0/0 ingress: metadata: ## Annotations for the ingress-alb ingress. annotations: alb.ingress.kubernetes.io/scheme: internet-facing alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]' alb.ingress.kubernetes.io/ssl-policy: "ELBSecurityPolicy-FS-1-2-Res-2019-08" alb.ingress.kubernetes.io/successCodes: "200-404" alb.ingress.kubernetes.io/success-codes: "200-404" ## This value is deprecated, please use global.ingressController.serviceName instead. ## The name of the ingress controller service to use #serviceName: "{{ .Release.Name }}-ingress-nginx-v4-controller" platform: service: metadata: ## Annotations for the platform service. annotations: service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "9000,443" service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: "ELBSecurityPolicy-TLS-1-2-2017-01" service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "True" service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "3600" service.beta.kubernetes.io/aws-load-balancer-type: external service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip external-dns.alpha.kubernetes.io/ttl: "60" ## This helm chart sets some aws related annotations by default on the platform service and the ingress-alb ingress. ## If this is not suitable for one reason or another, they can be excluded by adding the annotation name to this list. excludeDefaultAnnotations: [] ## gcp setup ## This helm chart by default is using GCP CRDs (ManagedCertificate, FrontendConfig and BackendConfig) to setting up ## load balancer certificate, ingress HTTP-to-HTTPS redirect and custom health check. If they are not suitable for the setup, ## you can disable them by adding the associated ingress alb or platform service annotation to "gcp.excludeDefaultAnnotations". gcp: managedCert: ## If this is enabled, a Google managed certificate (ManagedCertificate CRD) will be created. ## While the certificate is being provision, certificate can take considerable amount of time to be validated. ## Note that the issued certificate will not be overwritten or removed by the subsequent helm chart install or uninstall. ## To regenerate the certificate, you need to manually delete the ManagedCertificate CRD object and install helm chart again. enabled: true name: managed-cert ingress: metadata: ## Annotations for the ingress-alb ingress. annotations: {} platform: service: metadata: ## Annotations for the platform service. annotations: cloud.google.com/l4-rbs: "enabled" external-dns.alpha.kubernetes.io/ttl: "60" ## This helm chart sets some gcp related annotations by default on the platform service and the ingress-alb ingress. ## If this is not suitable for one reason or another, they can be excluded by adding the annotation name to this list. excludeDefaultAnnotations: [] portal: ## Configuration of the apps that shall be present on the portal page. ## The portal page is accessible at: http(s)://<desktop online host>/desktop/portal ## If hostname ingress is setup, the $(domain) token can be used to have the domain automatically resolved based on the global.domain value. apps: - name: Desktop Online url: https://desktop-online$(domain) - name: InfoZone url: https://infozone.atlassian.net/wiki/spaces/UEPE4D - name: mzcli url: https://platform$(domain)/download/mzcli - name: Desktop Client url: https://platform$(domain)/launch/desktop/ - name: Grafana url: https://grafana$(domain) - name: Kubernetes Dashboard url: https://dashboard$(domain) security: password: control: ## Set this to true to enforce stricter password requirements and mandate a password change upon the first login. enabled: true auth: oidc: rp: ## Activate/deactivate Usage Engine Private Edition as OIDC Relying Party enabled: false auth: ## Available auth methods is CLIENT_SECRET_BASIC and PRIVATE_KEY_JWT method: "CLIENT_SECRET_BASIC" client: ## Client id id: "" ## Client secret is only used when the method is CLIENT_SECRET_BASIC ## Uncomment if credentials are not already provided through secret "oidc-rp-secret" #secret: "" ## JWT section only used when method is PRIVATE_KEY_JWT jwt: ## Opional ID Provider KeyId keyId: jks: secret: ## Name of secret to store jks name: ## Key Alias alias: ## Key password ## Uncomment if credentials are not already provided through secret "oidc-rp-secret" #password: ## Keystore password ## Uncomment if credentials are not already provided through secret "oidc-rp-secret" #storePassword: provider: ## Base URL for Identity Provider ## URL before /.well-known/openid-configuration ## Eg. https://login.microsoftonline.com/<tenant_ID>/v2.0 url: ## Name of Provider, eg. Azure name: "" group: ## Path in UserInfo or ID Token to find access groups mapping, separated by dot (.) ## The groups should be a array of Strings. ## *** Exampel *** ## Here is the groups array inside a object. ## { myObject : { myGroups : [ "myGroup1", "mygroup2" ] } } ## The path should then be: ## groupPath: myObject.myGroups ## When the groups array is direct under UserInfo then groupPath is just the ## name of the groups array. path: ## Disable group syncronization from Identity Provider. ## When this is true groups is set manually on SSO Users syncDisabled: false ## When Group Sync is disabled a defualt group can be added to users logged in through SSO defaultGroup: "" ## Claim to use for Username userNameClaim: ## Additional scopes scopes: ## Set this to true during implementation of SSO Access to get more information. debug: false ip: ## Activate/deactivate Usage Engine Private Edition as OIDC Identity Provider enabled: false ## The oidc base url. Needs to be usable by clients to reach the platform webserver. ## The $(domain) token can be used to have the domain automatically resolved based on the global.domain value. ## The default value is set based on the assumption that hostname ingress is used. If not using hostname ingress, ## the value should point to the ip address and port of the desktop app instead. ## Example: https://192.168.205.5:31327 oidcBaseUrl: https://platform$(domain) ## Whether to use helm generated secrets or not. ## When this is true, the client id and client secret for each client in the list of clients below will be auto-generated by helm. ## When this is false, the client id:s and client secrets have to be specified explicitly. useHelmGeneratedSecrets: true ## List of clients that are granted to use MediationZone as OIDC provider when authenticating clients: ## ----------------------------------------------- ## Example client using helm generated secrets ## ----------------------------------------------- #- clientName: Some Application ## The clientId value is just an arbitrary name of the secret in env-secrets that will hold the real clientId. ## Just make sure that it is unique related to any other client id in this list. ## If the secret does not already exists it will be automatically generated. # clientId: someAppClientId ## The clientSecret value is just an arbitrary name of the secret in env-secrets that will hold the real clientSecret. ## Just make sure that it is unique related to any other client secret in this list. ## If the secret does not already exists it will be automatically generated. # clientSecret: someAppClientSecret ## The list of roles associated with the client. ## This controls what level of access that can be provisioned for a given client in the Access Controller. # roles: # - Editor # - Viewer ## ----------------------------------------------- ## Example client NOT using helm generated secrets ## ----------------------------------------------- #- clientName: Some Application ## The clientId value is expected to be a UUID. # clientId: 123e4567-e89b-12d3-a456-426614174000 ## The clientSecret value is expected to be a cryptographically secure random. # clientSecret: 33v1rxwAtBhFTl9SLtQ2lqeCAigN798cUJpZIFFMCz3Nf9PSeVd3ze4MsPMrrNSP ## The list of roles associated with the client. ## This controls what level of access that can be provisioned for a given client in the Access Controller. # roles: # - Editor # - Viewer ## PCC backend configuration. ## Supported production grade storages are Couchbase and Redis. ## The memory/directory storage is only meant for development and testing purposes. pcc: ## Set to true to enable the PCC backend configuration. ## In addition to this, an ECDeployment having system property mz.pcc.properties=/etc/pcc/pcc.properties will have to be created. ## This ECDeployment will automatically handle the communication with the PCC backend storage. enabled: false properties: ## PCC Config Storage Class # mz.pcc.config.storage.class: com.digitalroute.pcc.storage.config.mysqlc.MySQLClusterStorage mz.pcc.config.storage.class: com.digitalroute.pcc.storage.config.directory.DirectoryStorage #mz.pcc.config.storage.class: com.digitalroute.pcc.storage.config.couchbase.CouchbaseConfigStorage #mz.pcc.config.storage.class: com.digitalroute.pcc.storage.config.redis.RedisConfigStorage ## Directory Config Storage Properties (if used) mz.pcc.directorystorage.directory: ${mz.home}/tmp/pcc ## PCC Bucket Storage Class # mz.pcc.bucket.storage.class: com.digitalroute.pcc.buckets.storage.mysqlc.MySQLClusterBucketStorage mz.pcc.bucket.storage.class: com.digitalroute.pcc.buckets.storage.memory.MemoryBucketStorage #mz.pcc.bucket.storage.class: com.digitalroute.pcc.buckets.storage.couchbase.CouchbaseBucketStorage #mz.pcc.bucket.storage.class: com.digitalroute.pcc.buckets.storage.redis.RedisBucketStorage ## Timeout bucket data storage locks (transactions) after timeout milliseconds mz.pcc.storage.lock.timeout: 3000 ## Couchbase Storage Properties (if used) ## The qualified name of the couchbase profile representing the storage area of products and rules. #mz.pcc.storage.couchbase.config.profile: ## The qualified name of the couchbase profile representing the storage area of buckets. #mz.pcc.storage.couchbase.buckets.profile: ## Redis Storage Properties (if used) ## The qualified name of the redis profile representing the storage area of products and rules. #mz.pcc.storage.redis.config.profile: ## The qualified name of the redis profile representing the storage area of buckets. #mz.pcc.storage.redis.buckets.profile: ## MySQL Cluster Storage Properties (if used) #mz.pcc.storage.mysqlc.host: #mz.pcc.storage.mysqlc.port: 1186 #mz.pcc.storage.mysqlc.database: pcc #mz.pcc.storage.mysqlc.clusterj.retries: 4 #mz.pcc.storage.mysqlc.clusterj.delay: 5 #mz.pcc.storage.mysqlc.clusterj.verbose: 1 #mz.pcc.storage.mysqlc.clusterj.timeout.before: 30 #mz.pcc.storage.mysqlc.clusterj.timeout.after: 20 #mz.pcc.storage.mysqlc.clusterj.max.transactions: 1024 #mz.pcc.storage.mysqlc.clusterj.connection.pool.size: 2 ## If the connection to MySQL Cluster is detected as down ## it will try to reconnect ## Set to false to disable reconnect #mz.pcc.storage.mysqlc.auto.reconnect: true ## If MySQL Cluster key should support string, set this to true and ## make sure to create the commented table schema in pcc_bucket_mysqlc.sql. #mz.pcc.storage.mysqlc.stringkey: false ## PCC Batch Storage Class (used for Batch Counting) mz.pcc.batch.storage.class: com.digitalroute.pcc.batch.storage.directory.DirectoryBatchStorage mz.pcc.batchdirectorystorage.directory: ${mz.home}/tmp/pccbatch ## Toggle for the system log trace (one log per action) ## Valid values are enabled or disabled #mz.system.log.trace: enabled authorizationServer: enabled: false storage: # The storage type can be either "file-based" or "database" type: file-based database: # Only used when storage type is "database". PostgreSQL or Oracle DB only profile-name: <Path.DBProfileName> poolsize: 8 file-based: # Only used when storage type is "file-based" storage-location: /opt/mz/persistent/auth-server/storage management-api: # HTTP Basic Authentication enable-basic-auth: true ## Uncomment if credentials are not already provided through secret "authorization-server-secrets" ## If the username does not already exist mzadmin will be the default value. #username: mzadmin ## If the password does not already exist it will be automatically generated. #password: jwt: # Only RS256, RS384 and RS512 are supported signature-algorithm: RS256 ## Uncomment if credentials are not already provided through secret "authorization-server-secrets" ## Keystore is the base64 encoded string from local keystore file, it can be generated through command below: ## 'base64 -i /path/to/keystore.jks -o keystore_b64Encoded.txt' #keystore: #key-id: #key-password: #keystore-password: server: # Validity period in seconds for access token generated access-token-expiry: 1800 ## Optionally deploy DTK mzp:s. ## This is done from a custom container image that you need to build and maintain. ## The only requirement on this container image is that it contains one specific folder holding the DTK mzp:s to deploy ## (it needs to be a flat list of mzp:s - i.e. nested folders are not supported). ## This is a minimal Dockerfile example that can be used to build such a container image: ## ---------------------------------------- ## FROM alpine:latest ## ARG DTK_MZP_DIR ## RUN mkdir -p /opt/my-dtk-mzps/ ## COPY $DTK_MZP_DIR/* /opt/my-dtk-mzps/ ## ---------------------------------------- ## Here the DTK_MZP_DIR argument is expected to be the local folder holding the DTK mzp:s to deploy. ## Using a container image built using the above Dockerfile would mean ## that the dtk.path value should be set to "/opt/my-dtk-mzps". #dtk: ## The container image containing the DTK mzp:s #image: <container repo>:<container version> ## The path of the folder within the container image that contains the DTK mzp:s #path: /opt/my-dtk-mzps ## Values related to desktop online desktopOnline: ## Config for the desktop online container image repository: 462803626708.dkr.ecr.eu-west-1.amazonaws.com/usage-engine-private-edition tag: 4.1.0-ui pullPolicy: IfNotPresent ## Add/override jvm arguments jvmArgs: - XX:MaxMetaspaceSize=512m - Xms256m - Xmx2g ## Add/override system properties systemProperties: # - someprop=somevalue ## Configure pod resources (limits and/or requests) here if needed resources: {} ## Allows for the configuration of the liveness and readiness probes respectively probes: liveness: initialDelaySeconds: 300 periodSeconds: 15 timeoutSeconds: 10 successThreshold: 1 failureThreshold: 3 readiness: initialDelaySeconds: 10 periodSeconds: 15 timeoutSeconds: 10 successThreshold: 1 failureThreshold: 10 ecd: ## Allows for tying a given ECD to specific node in the cluster. ## Enabling this will result in the necessary ClusterRoles being created. ## If ClusterRoles are not allowed this feature must therefore be disabled. nodeHostSelectionEnabled: true ## Node, affinity, tolerations for pod assignment ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature ## nodeSelector: {} affinity: {} tolerations: [] service: ## Uncomment to set an explicit node port #nodePort: 30000 ## The desktop online web server base url. This is used to locate the desktop online app. ## The $(domain) token can be used to have the domain automatically resolved based on the global.domain value. ## The default value is set based on the assumption that hostname ingress is used. If not using hostname ingress, ## the value should point to the ip address and port of the desktop app instead. ## Example: https://192.168.205.5:31327 baseUrl: https://desktop-online$(domain) utils: kubectl: ## The kubectl container image repo ## Should only be changed if deploying to an environment with an offline network repository: "bitnami/kubectl" ## The tag of the kubectl container image tag: "1.29.3-debian-12-r0" ## Optionally add extensions. ## An extension can be an arbitrary third party product (3pp) such as a jar file, a shared library or any file really. ## This is done via a custom container image that you need to build and maintain. ## The only requirement on this container image is that it contains two specific folders, namely: ## ## "/opt/uepe/3pp": This folder can be used for adding arbitrary 3pp(s). ## 3pp(s) in the form of jar files that are added to this folder will be added to the runtime classpath automatically. ## ## "/opt/uepe/jni": This folder must be used for adding shared libraries required for JNI, such as a .so file. ## ## This is a minimal Dockerfile example that can be used to build such a container image: ## ---------------------------------------- ## FROM alpine:latest ## COPY 3pp /opt/uepe/3pp/ ## COPY jni /opt/uepe/jni/ ## ---------------------------------------- ## Here the 3pp and jni folders are expected to be local folders holding the 3pp(s) and shared libraries respectively. ## Note that Usage Engine Private Edition supports both amd64 and arm64 platform architecture. ## When building the extension image, you need to make sure to use the same architecture that Usage Engine Private Edition is running on. ## For more info about building multiple architecture images, please refer to https://docs.docker.com/build/building/multi-platform/. extensions: ## Whether to enable extensions or not. enabled: false ## The container image containing the extensions. image: my-uepe-extensions:1.0.0