Configuration

Requirements

To the Deckhouse Platform version: 1.68 and above.

Conversions

The module is configured using the ModuleConfig resource, the schema of which contains a version number. When you apply an old version of the ModuleConfig schema in a cluster, automatic transformations are performed. To manually update the ModuleConfig schema version, the following steps must be completed sequentially for each version:

• Updates from version 1 to 2:

  Remove deprecated monitoring.collector.inlet and ui.postgres.backup.dir fields. Normalize storage.traces.logLevel to lowercase.

• Updates from version 2 to 3:

  Convert old internal PostgreSQL resources settings to the predefined instanceSize.

• Updates from version 3 to 4:

  Remove the resources settings for the metrics, logs, and traces etcd, for the Ceph OSD, and the ingester CPU limits: the module manages these resources itself, and manually specified values had no effect.

Parameters

Schema version: 4

• settings

  object
  • settings.general

    object

    General configuration options.

    Default: {}

    • settings.general.baseDomain

      string

      Required value

      Base domain for all components of the Observability Platform.

      This domain is used to access the Observability Platform UI. There are also several subdomains which are used for certain components.

      Pattern: ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$

    • settings.general.clusterBaseDomain

      string

      The domain name of the cluster which is used to distinguish between clusters in multi-cluster environments.

      Pattern: ^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)?$

    • settings.general.clusterName

      string

      Required value

      The name of the cluster which is used to distinguish between clusters in multi-cluster environments.
    • settings.general.clusterNeighbors

      object

      Neighbor clusters clusters in disaster recovery mode in <clusterName>: <clusterDomain> format.

      Example:

      dc2: msk.example.com
      dc3: spb.example.com
      

    • settings.general.tls

      object

      Configuration options for specifying certificates for HTTPS connections across all components of the Deckhouse Observability Platform module.

      You can either provide your own certificates or use cert-manager to issue them.

      Default: {}

      • settings.general.tls.ca

        string

        The root certificate required if the certificate is issued by a non-public certification authority (CA).

        It is used to verify inter-service requests and requests to external resources over HTTPS where the certificates are issued by the same CA.

      • settings.general.tls.crt

        string

        The certificate provided for using a custom certificate on all domains of the Deckhouse Observability Platform.

        The certificate must present general.baseDomain (and, independently, general.clusterBaseDomain, if set) as DNS names in its Subject Alternative Name (SAN) extension: either the wildcard pair <domain> and *.<domain>, or the domain together with its api, update, logs, collector, and s3 subdomains. Otherwise, the module fails to start with an Error validating TLS-certificate: ... error. See SSL Certificate Requirements for the full list of names and an explanation. Specifying a Common Name is not required.

        This field is incompatible with the issuer field. You must specify either issuer or both crt and key.

      • settings.general.tls.issuer

        string

        The issuer of the certificate. For all domains of the Deckhouse Observability Platform, the certificate can be issued using cert-manager.

        This field is not compatible with the crt and key fields. You must specify either issuer or both crt and key.

        Default: letsencrypt

        Allowed values: letsencrypt, digitalocean, cloudflare

      • settings.general.tls.key

        string

        The private key associated with the certificate, used for setting up custom certificates in the Deckhouse Observability Platform.

        This field is incompatible with the issuer field. You must specify either issuer or both crt and key.

  • settings.ingressClass

    string

    The class of the Ingress controller used for the Observability Platform components.

    An optional parameter; by default, the modules.ingressClass global value is used.

    Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

  • settings.monitoring

    object

    Options related to the configuration of components responsible for monitoring.

    Default: {}

    • settings.monitoring.agent

      object

      Default: {}

      • settings.monitoring.agent.pgClientTableName

        string

        The table name used by the PostgreSQL client.

        Default: okmeter

      • settings.monitoring.agent.productName

        string

        The name of the monitoring agent product.

        Default: okagent

    • settings.monitoring.agentUpdater

      object

      Options related to the configuration of the component used for managing the update process of the Deckhouse Observability platform agent.

      Default: {}

      • settings.monitoring.agentUpdater.config

        object

        Configuration for the agent updater.

        Default: {}

    • settings.monitoring.collector

      object

      Options related to the configuration of the metrics collector.

      Default: {}

      • settings.monitoring.collector.maxConnectionAllow

        integer

        Maximum number of simultaneous agent connections a single metrics-collector pod accepts. Increase it when the collector HorizontalPodAutoscaler is already bounded by the number of nodes and connection utilization stays high.

        Default: 2000

        Allowed values: 100 <= X <= 100000

      • settings.monitoring.collector.storageClass

        string

        The StorageClass used to create volumes for the metrics collector. The volume lifetime is the same as the pod lifetime, so you can use the StorageClass from LocalPathProvisioner.
    • settings.monitoring.customDomain

      object

      Custom domain settings for the monitoring module.

      Default: {}

      • settings.monitoring.customDomain.baseDomain

        string

        Custom domain settings for the monitoring module.

        Default: ‘’

        Pattern: ^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)?$

      • settings.monitoring.customDomain.collectorDomain

        string

        Specify the domain for the metrics collector.

        Default: ‘’

        Pattern: ^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)?$

      • settings.monitoring.customDomain.tls

        object

        TLS certificate settings for the monitoring collector and related endpoints.

        Default: {}

        • settings.monitoring.customDomain.tls.ca

          string
        • settings.monitoring.customDomain.tls.crt

          string
        • settings.monitoring.customDomain.tls.issuer

          string
        • settings.monitoring.customDomain.tls.key

          string
    • settings.monitoring.dockerRegistry

      object

      Options related to the configuration of the container registry used for publishing new images with new versions of the Deckhouse observability platform agent.

      Default: {}

      • settings.monitoring.dockerRegistry.enabled

        boolean

        Indicates whether the Docker Registry components should be installed.

        Default: false

    • settings.monitoring.enabled

      boolean

      Allows enabling or disabling components necessary for collecting and displaying metrics using opAgent.

      Default: false

  • settings.storage

    object

    Options related to the configuration of components responsible for data ingestion and storage.

    Default: {}

    • settings.storage.ceph

      object

      Options related to the configuration of Ceph.

      Default: {}

      • settings.storage.ceph.configOverride

        string
      • settings.storage.ceph.mgr

        object

        Options related to the configuration of Ceph MGR.

        Default: {}

        • settings.storage.ceph.mgr.resources

          object

          Resource management options for the Ceph MGR pods.

          Default: {}

          Example:

          limits:
            memory: 1Gi
          requests:
            cpu: 500M
            memory: 1Gi
          

          • settings.storage.ceph.mgr.resources.limits

            object

            Resource limits options for Ceph MGR pods.
            • settings.storage.ceph.mgr.resources.limits.cpu

              Maximum amount of CPU per pod for Ceph MGR pods.
            • settings.storage.ceph.mgr.resources.limits.memory

              Maximum amount of memory per pod for Ceph MGR pods.
          • settings.storage.ceph.mgr.resources.requests

            object

            Resource requests options for Ceph MGR pods.
            • settings.storage.ceph.mgr.resources.requests.cpu

              Minimum amount of CPU per pod for Ceph MGR pods.
            • settings.storage.ceph.mgr.resources.requests.memory

              Minimum amount of memory per pod for the ceph-mgr.
      • settings.storage.ceph.mon

        object

        Options related to the configuration of Ceph monitors.

        Default: {}

        • settings.storage.ceph.mon.resources

          object

          Resource management options for the Ceph monitors pods.

          Default: {}

          Example:

          limits:
            cpu: 250m
            memory: 512Mi
          requests:
            cpu: 55m
            memory: 256Mi
          

          • settings.storage.ceph.mon.resources.limits

            object

            Configuring CPU and memory limits Ceph monitors pods.
            • settings.storage.ceph.mon.resources.limits.cpu

              Configuring CPU limits.
            • settings.storage.ceph.mon.resources.limits.memory

              Configuring memory limits.
          • settings.storage.ceph.mon.resources.requests

            object

            Resource requests options for Ceph monitors pods.
            • settings.storage.ceph.mon.resources.requests.cpu

              Configuring CPU requests.
            • settings.storage.ceph.mon.resources.requests.memory

              Configuring memory requests.
        • settings.storage.ceph.mon.storageClass

          string

          Specifies the StorageClass to be used for the persistent volume (PV). If not specified, the first available StorageClass from the list of StorageClasses applicable to the node group where the Ceph components will be deployed will be used.
        • settings.storage.ceph.mon.storageSize

          string

          Defines the size of the persistent volume (PV) to be created for Ceph monitor.

          The size should be specified using standard storage units (e.g., Gi for Gibibytes, Ti for Tebibytes, Mi for Mebibytes).

          Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|k|Ei|Pi|Ti|Gi|Mi|Ki)?$

      • settings.storage.ceph.objectStore

        object

        Options related to Ceph object store pools.

        Default: {}

        • settings.storage.ceph.objectStore.poolType

          string

          Specifies the data pool type for the Ceph object store.

          Supported values:

          • Replicated — store object data in a replicated pool.
          • ErasureCoded — store object data in a 3+2 erasure-coded pool. This mode requires at least 5 Ceph nodes.

          Default: Replicated

          Allowed values: Replicated, ErasureCoded

      • settings.storage.ceph.osd

        object

        Options related to the configuration of Ceph object storage daemons.

        Default: {}

        • settings.storage.ceph.osd.count

          integer

          Specifies the number of OSDs (Object Storage Daemons) to be created.
        • settings.storage.ceph.osd.storageClass

          string

          Required value

          Specifies the StorageClass to be used for the persistent volume (PV).

          If not specified, the first available StorageClass from the list of StorageClasses applicable to the node group where the Ceph components will be deployed will be used.

        • settings.storage.ceph.osd.storageSize

          string

          Defines the size of the persistent volume (PV) to be created for Ceph object storage daemons.

          The size should be specified using standard storage units (e.g., Gi for Gibibytes, Ti for Tebibytes, Mi for Mebibytes).

          Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|k|Ei|Pi|Ti|Gi|Mi|Ki)?$

      • settings.storage.ceph.rgw

        object

        Options related to the configuration of Ceph object gateway.

        Default: {}

        • settings.storage.ceph.rgw.resources

          object

          Resource management options for the Ceph RGW pods.

          Default: {}

          Example:

          resources:
            limits:
              cpu: 250m
              memory: 512Mi
            requests:
              cpu: 55m
              memory: 256Mi
          

          • settings.storage.ceph.rgw.resources.limits

            object

            Resource limits options for Ceph RGW pods.
            • settings.storage.ceph.rgw.resources.limits.cpu

              Configuring CPU limits.
            • settings.storage.ceph.rgw.resources.limits.memory

              Configuring memory limits.
          • settings.storage.ceph.rgw.resources.requests

            object

            Resource requests options for Ceph RGW pods.
            • settings.storage.ceph.rgw.resources.requests.cpu

              Configuring CPU requests.
            • settings.storage.ceph.rgw.resources.requests.memory

              Configuring memory requests.
    • settings.storage.logs

      object

      Options related to the configuration of components responsible for log collection and storage.

      Default: {}

      • settings.storage.logs.cacheSize

        string

        Size of your memcached servers.

        • Small - 1 Pod with 1Gi of Memory.
        • Medium - 3 Pods with 2Gi of Memory.
        • Large - 3 Pods with 4Gi of Memory.

        Default: Small

        Allowed values: Small, Medium, Large

      • settings.storage.logs.compactor

        object

        Options related to the configuration of the Compactor.

        Default: {}

        • settings.storage.logs.compactor.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the Compactor.
        • settings.storage.logs.compactor.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the Compactor.

          Default: 50Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.logs.defaultStorageClass

        string

        StorageClass that is used for all components involved in logs storage, unless a specific StorageClass is defined for a component.
      • settings.storage.logs.enabled

        boolean

        Enable or disable the log components.

        Default: false

      • settings.storage.logs.etcd

        object

        Options related to the configuration of etcd.

        Default: {}

        • settings.storage.logs.etcd.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the etcd.
        • settings.storage.logs.etcd.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the etcd.

          Default: 2Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.logs.indexCurator

        object

        Index Curator settings.

        Default: {}

        • settings.storage.logs.indexCurator.logLevel

          string

          The log level for index curator, which determines the verbosity of log messages.

          Default: info

          Allowed values: debug, info, warn, error

      • settings.storage.logs.indexGateway

        object

        Options related to the configuration of loki’s index gateway.

        Default: {}

        • settings.storage.logs.indexGateway.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the index gateway.
        • settings.storage.logs.indexGateway.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the index gateway.

          Default: 50Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.logs.ingester

        object

        Options related to the configuration of the Ingester.

        Default: {}

        • settings.storage.logs.ingester.resources

          object

          Resource management options for the Ingester pods.

          Default: {}

          • settings.storage.logs.ingester.resources.limits

            object

            Resource limits settings for the Ingester pods.

            Default: {}

            • settings.storage.logs.ingester.resources.limits.memory

              Configuring memory limits.

              Default: 4Gi

          • settings.storage.logs.ingester.resources.requests

            object

            Resource requests settings for the Ingester pods.

            Default: {}

            • settings.storage.logs.ingester.resources.requests.cpu

              Configuring CPU requests.

              Default: 50m

            • settings.storage.logs.ingester.resources.requests.memory

              Configuring memory requests.

              Default: 512Mi

        • settings.storage.logs.ingester.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the Ingester.
        • settings.storage.logs.ingester.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the Ingester.

          Default: 50Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.logs.logLevel

        string

        The log level for loki, which determines the verbosity of log messages.

        Default: info

        Allowed values: debug, info, warn, error

      • settings.storage.logs.ruler

        object

        Options related to the configuration of the ruler.

        Default: {}

        • settings.storage.logs.ruler.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the ruler.
        • settings.storage.logs.ruler.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the ruler.

          Default: 50Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

    • settings.storage.metrics

      object

      Options related to the configuration of components responsible for metrics collection and storage.

      Default: {}

      • settings.storage.metrics.alertmanager

        object

        Options related to the configuration of the Alertmanager.

        Default: {}

        • settings.storage.metrics.alertmanager.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the Alertmanager.
        • settings.storage.metrics.alertmanager.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the Alertmanager.

          Default: 2Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.metrics.cacheSize

        string

        Size of your memcached servers.

        • Small - 1 Pod with 1Gi of Memory.
        • Medium - 3 Pods with 2Gi of Memory.
        • Large - 3 Pods with 4Gi of Memory.

        Default: Small

        Allowed values: Small, Medium, Large

      • settings.storage.metrics.compactor

        object

        Options related to the configuration of the Compactor.

        Default: {}

        • settings.storage.metrics.compactor.concurrency

          integer

          Number of concurrent compaction jobs.

          Default: 1

        • settings.storage.metrics.compactor.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the Compactor.
        • settings.storage.metrics.compactor.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the Compactor.

          Default: 100Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.metrics.defaultStorageClass

        string

        StorageClass that is used for all components involved in metrics storage, unless a specific StorageClass is defined for a component.
      • settings.storage.metrics.etcd

        object

        Options related to the configuration of etcd used by metrics storage components.

        Default: {}

        • settings.storage.metrics.etcd.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the etcd.
        • settings.storage.metrics.etcd.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the etcd.

          Default: 2Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.metrics.ingester

        object

        Options related to the configuration of the Ingester.

        Default: {}

        • settings.storage.metrics.ingester.resources

          object

          Resource management options for the Ingester pods.

          Default: {}

          • settings.storage.metrics.ingester.resources.limits

            object

            Resource limits settings for Ingester pods.

            Default: {}

            • settings.storage.metrics.ingester.resources.limits.memory

              Maximum amount of memory per pod for the Ingester.

              Default: 4Gi

          • settings.storage.metrics.ingester.resources.requests

            object

            Resource requests settings for Ingester pods.

            Default: {}

            • settings.storage.metrics.ingester.resources.requests.cpu

              Minimum amount of cpu per pod for the Ingester.

              Default: 100m

            • settings.storage.metrics.ingester.resources.requests.memory

              Minimum amount of memory per pod for the Ingester.

              Default: 1Gi

        • settings.storage.metrics.ingester.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the Ingester.
        • settings.storage.metrics.ingester.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the Ingester.

          Default: 50Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.metrics.logLevel

        string

        The log level for metrics, which determines the verbosity of log messages.

        Default: info

        Allowed values: debug, info, warn, error

      • settings.storage.metrics.storeGateway

        object

        Options related to the configuration of the Store-gateway.

        Default: {}

        • settings.storage.metrics.storeGateway.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the Store-gateway.
        • settings.storage.metrics.storeGateway.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the Store-gateway.

          Default: 50Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

    • settings.storage.reconciler

      object

      Options related to the configuration of the reconciler.

      Default: {}

      • settings.storage.reconciler.logLevel

        string

        The log level for the reconciler, which determines the verbosity of log messages.

        Default: info

        Allowed values: debug, info, warn, error

    • settings.storage.traces

      object

      Options related to the configuration of components responsible for traces collection and storage.

      Default: {}

      • settings.storage.traces.cacheSize

        string

        Size of your memcached servers.

        • Small - 1 Pod with 1Gi of Memory.
        • Medium - 3 Pods with 2Gi of Memory.
        • Large - 3 Pods with 4Gi of Memory.

        Default: Small

        Allowed values: Small, Medium, Large

      • settings.storage.traces.compactor

        object

        Options related to the configuration of the Compactor.

        Default: {}

        • settings.storage.traces.compactor.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the Compactor.
        • settings.storage.traces.compactor.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the Compactor.

          Default: 50Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.traces.defaultStorageClass

        string

        StorageClass that is used for all components involved in traces storage, unless a specific StorageClass is defined for a component.
      • settings.storage.traces.enabled

        boolean

        Enable or disable the traces components.

        Default: false

      • settings.storage.traces.etcd

        object

        Options related to the configuration of etcd.

        Default: {}

        • settings.storage.traces.etcd.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the etcd.
        • settings.storage.traces.etcd.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the etcd.

          Default: 2Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.traces.ingester

        object

        Options related to the configuration of the Ingester.

        Default: {}

        • settings.storage.traces.ingester.resources

          object

          Resource management options for the Ingester pods.

          Default: {}

          • settings.storage.traces.ingester.resources.limits

            object

            Default: {}

            • settings.storage.traces.ingester.resources.limits.memory

              Configuring memory limits.

              Default: 4Gi

          • settings.storage.traces.ingester.resources.requests

            object

            Default: {}

            • settings.storage.traces.ingester.resources.requests.cpu

              Configuring CPU requests.

              Default: 50m

            • settings.storage.traces.ingester.resources.requests.memory

              Configuring memory requests.

              Default: 512Mi

        • settings.storage.traces.ingester.storageClass

          string

          The StorageClass used for PersistentVolumes (PV) by the Ingester.
        • settings.storage.traces.ingester.storageSize

          string

          The size of the PersistentVolume (PV) allocated for the Ingester.

          Default: 50Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(Ei|Pi|Ti|Gi|Mi)?$

      • settings.storage.traces.logLevel

        string

        The log level for traces, which determines the verbosity of log messages.

        Default: info

        Allowed values: debug, info, warn, error

    • settings.storage.usageCollector

      object

      Options related to the configuration of the usage collector.

      Default: {}

      • settings.storage.usageCollector.logLevel

        string

        The log level for the usage collector, which determines the verbosity of log messages.

        Default: info

        Allowed values: debug, info, warn, error

  • settings.ui

    object

    Options related to the configuration of user interface components.

    Default: {}

    • settings.ui.auth

      object

      Options related to the configuration of authentication components.

      Default: {}

      • settings.ui.auth.afterLogoutUrl

        string

        The URL to redirect to after the user logs out.
      • settings.ui.auth.clientId

        string

        The client ID registered with the OIDC provider.

        This ID is used to identify the client application during the authentication process.

      • settings.ui.auth.clientSecret

        string

        The client secret associated with the client ID, used for authenticating the client application with the OIDC provider.
      • settings.ui.auth.groupsParamName

        string

        The name of the parameter in the provider response containing the list of user groups, defaults to groups.
      • settings.ui.auth.issuer

        string

        The issuer URL for the OIDC provider.

        This is typically the base URL of the provider where the OIDC metadata can be found.

      • settings.ui.auth.mode

        string

        Authentication mode used for logging into the ui:

        • default - email address and password are used for authentication;
        • externalAuth - use an oidc provider for authentication.

        Default: default

        Allowed values: default, externalAuth

      • settings.ui.auth.provider

        string

        The oidc provider for the external auth mode. If option login is used, then Keycloak is used.

        Default: dex

        Allowed values: dex, okta, adfs, login

    • settings.ui.clusterBootstrapToken

      string

      Required value

      Token used for joining multiple deckhouse observability platform installations into a cluster.
    • settings.ui.configValidator

      object

      Options related to the configuration validator component that checks module configuration.

      Default: {}

      • settings.ui.configValidator.logLevel

        string

        The log level for the configuration validator, which determines the verbosity of log messages.

        Default: info

        Allowed values: info, warn, error, debug

    • settings.ui.grafana

      object

      Options related to the configuration of grafana.

      Default: {}

      • settings.ui.grafana.logLevel

        string

        The log level for Grafana, which determines the verbosity of log messages.

        Default: info

        Allowed values: info, warn, error, debug

    • settings.ui.locale

      string

      Language to use for the interface.

      Allowed values: ru, en

    • settings.ui.postgres

      object

      Settings for configuring the PostgreSQL database used by the UI component.

      Default: {}

      • settings.ui.postgres.backup

        object

        Settings related to database backups.

        Default: {}

        • settings.ui.postgres.backup.enabled

          boolean

          Enable or disable database backups.

          Default: true

        • settings.ui.postgres.backup.includeAuditLogs

          boolean

          Include audit logs in the backups.

          Default: false

        • settings.ui.postgres.backup.keepDays

          number

          Number of days to retain the backups.

          Default: 3

        • settings.ui.postgres.backup.s3

          object

          Configuration of the external s3 storage of the backup.

          Default: {}

          • settings.ui.postgres.backup.s3.accessKey

            string

            The access key used for authorization to the bucket.
          • settings.ui.postgres.backup.s3.bucket

            string

            The bucket name.
          • settings.ui.postgres.backup.s3.enabled

            boolean

            Enable or disable backups to an S3-compatible storage.

            Default: false

          • settings.ui.postgres.backup.s3.host

            string

            Url pointing to the bucket.
          • settings.ui.postgres.backup.s3.secretKey

            string

            The secret key used for authorization to the bucket.
        • settings.ui.postgres.backup.schedule

          string

          Define a schedule for the backups using a cron expression.

          Default: 0 * * * *

      • settings.ui.postgres.external

        object

        Credentials and connection details for using an external PostgreSQL database.
        • settings.ui.postgres.external.db

          string

          Name of the database on the external PostgreSQL server.
        • settings.ui.postgres.external.fromSecret

          boolean

          If set to true, credentials will be read from a Kubernetes Secret located in the d8-observability-platform namespace and named custom-postgres-credentials.

          Default: true

        • settings.ui.postgres.external.host

          string

          Host address of the external PostgreSQL server.
        • settings.ui.postgres.external.password

          string

          Password for authenticating with the external PostgreSQL server.
        • settings.ui.postgres.external.port

          string

          Port on which the external PostgreSQL server is listening.
        • settings.ui.postgres.external.sslmode

          string

          SSL mode used for connecting to the external PostgreSQL server.

          Default: require

          Allowed values: disable, allow, prefer, require, verify-ca, verify-full

        • settings.ui.postgres.external.user

          string

          Username for authenticating with the external PostgreSQL server.
      • settings.ui.postgres.internal

        object

        Configuration settings for the internal PostgreSQL cluster.

        Default: {}

        • settings.ui.postgres.internal.instanceSize

          string

          Size of PostgreSQL pods in cluster:

          • Light - 2 pods with 1 CPU and 2 GiB memory requests and limits.
          • Small - 2 pods with 2 CPU and 4 GiB memory requests and limits.
          • Medium - 2 pods with 4 CPU and 8 GiB memory requests and limits.
          • Large - 2 pods with 8 CPU and 16 GiB memory requests and limits.

          Default: Small

          Allowed values: Light, Small, Medium, Large

        • settings.ui.postgres.internal.storage

          object

          Storage configuration for the PostgreSQL cluster.

          Default: {}

          • settings.ui.postgres.internal.storage.class

            string

            StorageClass used by the PostgreSQL cluster.
          • settings.ui.postgres.internal.storage.size

            string

            Storage size allocated for the PostgreSQL cluster.

            Default: 50Gi

      • settings.ui.postgres.mode

        string

        Configure whether to use the internal or an external postgres server.

        When using an external postgres database the following extensions have to be enabled:

        • pgcrypto;
        • citext - for the Deckhouse observability platform database;
        • btree_gin - for the Deckhouse observability platform alertgate database.

        Default: Internal

        Allowed values: Internal, External

    • settings.ui.secretKeyBase

      string

      Required value

      Random string used for data encryption and verification.
    • settings.ui.secretsStore

      object

      Integration with a HashiCorp Vault-compatible secrets store (Deckhouse Stronghold or HashiCorp Vault) for web monitoring.

      Site configurations reference secrets as ${secret:<path>#<key>} instead of plain-text passwords and tokens. The backend reads the values from a KV v2 secrets engine only when it renders the configuration for gogomonia agents; values are never stored in the platform database, returned by the API or written to the audit log.

      A reference is resolved into a request the agents send, so being able to edit the sites of a project (roles user and admin, an API token with web monitoring access) is equivalent to being able to read every secret that project may reference.

      Default: {}

      • settings.ui.secretsStore.address

        string

        URL of the secrets store API, for example https://stronghold.d8-stronghold.svc:8200. Required when enabled is true.
      • settings.ui.secretsStore.auth

        object

        How the backend authenticates in the secrets store.

        Default: {}

        • settings.ui.secretsStore.auth.kubernetes

          object

          Settings of the Kubernetes auth method.

          Default: {}

          • settings.ui.secretsStore.auth.kubernetes.audience

            string

            Audience of the projected ServiceAccount token. Set it only if the auth role in the secrets store has an explicit audience; the values must match. Leave empty to use the default Kubernetes API server audience.
          • settings.ui.secretsStore.auth.kubernetes.grantTokenReview

            boolean

            Bind the ServiceAccount backend-secrets to the system:auth-delegator ClusterRole. Required when the secrets store validates client tokens with the token of the client itself (auth/<path>/config without token_reviewer_jwt), which is the usual case for an external HashiCorp Vault. Not needed for Deckhouse Stronghold running in the same cluster.

            Default: false

          • settings.ui.secretsStore.auth.kubernetes.path

            string

            Mount path of the Kubernetes auth method in the secrets store. Deckhouse Stronghold pre-configures kubernetes_local for the cluster it runs in; HashiCorp Vault uses kubernetes by default.

            Default: kubernetes_local

          • settings.ui.secretsStore.auth.kubernetes.role

            string

            Name of the Kubernetes auth role bound to the ServiceAccount backend-secrets of the d8-observability-platform namespace. Required when method is Kubernetes.
        • settings.ui.secretsStore.auth.method

          string

          Authentication method:

          • Kubernetes — Kubernetes auth method: the backend pod logs in with the projected token of its ServiceAccount backend-secrets;
          • Token — a static token stored in a Kubernetes Secret.

          Default: Kubernetes

          Allowed values: Kubernetes, Token

        • settings.ui.secretsStore.auth.token

          object

          Settings of the static token authentication.

          Default: {}

          • settings.ui.secretsStore.auth.token.secretName

            string

            Name of the Kubernetes Secret in the d8-observability-platform namespace holding the token in the token key.

            Default: secrets-store-token

      • settings.ui.secretsStore.caCert

        string

        PEM-encoded CA certificate used to verify the TLS certificate of the secrets store. Leave empty to use the system CA bundle.
      • settings.ui.secretsStore.enabled

        boolean

        Enable secret references in web monitoring configurations.

        Default: false

      • settings.ui.secretsStore.kv

        object

        Location of web monitoring secrets in the store. Only one KV v2 secrets engine is used.

        Default: {}

        • settings.ui.secretsStore.kv.mount

          string

          Mount path of the KV v2 secrets engine. All secret paths, relative and absolute, are resolved inside this engine.

          Default: secret

        • settings.ui.secretsStore.kv.pathPrefix

          string

          Prefix of per-project secret paths inside the engine. A relative reference ${secret:app/prod#key} of a project resolves to <mount>/<pathPrefix>/<space name>/<project name>/app/prod. Absolute references (${secret:/team/db#key}) ignore the prefix and are allowed only for the path prefixes listed in the project settings by a platform administrator.

          Default: dop/web-monitoring

      • settings.ui.secretsStore.namespace

        string

        Vault namespace sent in the X-Vault-Namespace header (Stronghold namespaces, Vault Enterprise). Leave empty for a single-namespace store or HashiCorp Vault OSS.
    • settings.ui.sentry

      object

      Options related to the configuration of sentry.

      Default: {}

      • settings.ui.sentry.dsn

        string

        The dsn for sentry.
      • settings.ui.sentry.env

        string

        The environment used by sentry.
    • settings.ui.smtp

      object

      Configuration for the SMTP server used to send authentication-related emails such as account verification and password resets.

      Default: {}

      • settings.ui.smtp.address

        string

        The address of the SMTP server. This could be an IP address or a domain name.
      • settings.ui.smtp.domain

        string

        The domain name that will be used as the sender’s email domain. This is the part that appears after the @ symbol in the email address.
      • settings.ui.smtp.enabled

        boolean

        Whether SMTP is enabled or disabled for the UI component. Set to true to enable SMTP functionality.
      • settings.ui.smtp.password

        string

        The password required to authenticate with the SMTP server.
      • settings.ui.smtp.port

        string

        The port on which the SMTP server is listening. Standard ports include 25, 465 (for SSL), and 587 (for TLS).
      • settings.ui.smtp.user

        string

        The username required to authenticate with the SMTP server.
    • settings.ui.tenantHashSalt

      string

      Required value

      Random string used for generating the tenant ID
    • settings.ui.webAppConfiguration

      object

      Additional configuration options passed to the user interface components.