Configuring- Understanding values.yaml

Edit online

Following table describes conﬁguration parameters listed in values.yamlﬁle in Helm charts and are used to complete installation. Use the following steps to complete this action:

Specify parameters that need to be overridden using the --set key=value[,key=value]argument at Helm install.

Configuration Manager Example

helm install <release-name> \
--set service.externalIP=172.20.185.196 \
...
ibm-ssp-cm-1.2.x.tgz

Engine Example

helm install <release-name> \
--set service.externalIP=172.20.185.196 \
...
ibm-ssp-engine-1.2.x.tgz

Perimeter Server (Less Secure) Example

helm install <release-name> \
--set --set image.repository \
...
ibm-ssp-ps-1.2.x.tgz

Perimeter Server (More Secure) Example

helm install <release-name> \
--set --set image.repository \
...
ibm-ssp-ps-1.2.x.tgz

Alternatively, provide a YAML ﬁle with values speciﬁed for these parameters when you install a Chart. Create a copy of values.yaml ﬁle such as, my-values.yaml and edit the values that you would like to override. Use the my-values.yamll ﬁle for installation.
Configuration Manager Example
```
helm install <release-name> -f my-values.yaml ... ibm-ssp-cm-1.2.x.tgz
```
Engine Example
```
helm install <release-name> -f my-values.yaml ... ibm-ssp-engine-1.2.x.tgz
```
Perimeter Server Example
```
helm install <release-name> -f my-values.yaml ... ibm-ssp-ps-1.2.x.tgz
```

Configuration Manager Parameters

Summary for complex table
Parameter	Description	Default Value
licenseType	Specify prod or non-prod for production or non-production license type respectively	non-prod
license	License agreement. Set true to accept the license.	false
image.repository	Image full name including repository	cp.icr.io/cp/ibm-ssp-cm/ssp-cm-docker-image
image.tag	Image tag	6.0.3.0
digest.enabled	Enable/disable digest to be used for image	false
digest.value	The digest value for the image.	sha256:c497035c7255431e6f95b58cf51f0e17e70e14b21c459bc192a5b21939ec8284
image.imageSecrets	Image pull secrets
image.pullPolicy	Image pull policy	IfNotPresent
storageSecurity.supplementalGroupId	Group ID for Supplemental group
cmArgs.keyCertExport	Set the value "true" to Generate Key Certificate. If you are installing Secure Proxy CM first, then you need to supply the following key certificate details: keyCertAliasName keyCertStorePassphrase(secret) and keyCertEncryptPassphrase(secret). Set the value "false" to import key cert, which was exported from Secure Proxy Engine. If you have installed Secure Proxy Engine first, then you need supply the following key certificate details: keyCertEncryptPassphrase(secret).	true
cmArgs.keyCertAliasName	AliasName Certificate alias value (CM and Engine both key cert alias name must be same)	Keycert
cmArgs.maxHeapSize	JVM heap size - do not set more than container limit resource memory	2048m
persistentVolume.enabled	To use persistent volume	true
persistentVolume.useDynamicProvisioning	To use storage classes to dynamically create PV	false
persistentVolume.storageClassName	Storage class of the PVC	manual
persistentVolume.size	Size of PVC volume	2Gi
persistentVolume.labelName	PV label key to bind this PVC	app.kubernetes.io/name
persistentVolume.labelValue	PV label value to bind this PVC	ibm-ssp-cm-pv
persistentVolume.accessMode	Access mode of the PVC	ReadWriteOnce
service.type	Kubernetes service type exposing ports	LoadBalancer
service.loadBalancerIP	Provide the static LoadBalancer IP
service.annotations	Provide the annotations for service
service.externalTrafficPolicy	Provide the external traffic policy
service.sessionAffinity	Provide the session affinity	ClientIP
service.jetty.servicePort	CM web application is accessed by using below mentioned service port, so add as per the requirement else it would be set 8443 as default port.	8443
service.jetty.containerPort	If traditional jetty port is different from 8443 while migrating from traditional to container environment then in this case we need to change container port as traditional jetty port value else It is not required to change the container port value.	8443
service.cm.servicePort	CM listens on the below mentioned service port, so add as per the requirement else it would be set 62366 as default port.	62366
service.cm.containerPort	If traditional CM listen port is different from 62366 while migrating from traditional to container environment then in this case we need to change container port as traditional CM listen port value else It is not required to change the container port value.	62366
service.externalIP	External IP for service discovery
secret.secretName	Secret name for Configuration Manager
resources.limits.cpu	Container CPU limit	1000m
resources.limits.memory	Container memory limit	2Gi
secret.keyCertSecretName	Secret name for Key Certificate
resources.requests.cpu	Container CPU requested	1000m
resources.requests.memory	Container Memory requested	2Gi
serviceAccount.create	Enable/disable service account creation true - Manage by helm chart false - Manage by deployment user If you are changing from true to false then in this case you need to provide service account name. It is recommended to use true value.	true
serviceAccount.name	Name of Service Account to use for container
afﬁnity.nodeAfﬁnity.required DuringSchedulingIgnoredDuring Execution	k8sPodSpec.nodeAfﬁnity.require d DuringSchedulingIgnoredDuring Execution
afﬁnity.nodeAfﬁnity.preferred DuringSchedulingIgnoredDuring Execution	k8sPodSpec.nodeAfﬁnity.preferr ed DuringSchedulingIgnoredDuring Execution
afﬁnity.podAfﬁnity.required DuringSchedulingIgnoredDuring Execution	k8s PodSpec.podAntiAfﬁnity. requiredDuringSchedulingIgnore d
	DuringExecution
afﬁnity.podAfﬁnity.preferred DuringSchedulingIgnoredDuring Execution	k8sPodSpec.podAntiAfﬁnity. preferredDuringScheduling IgnoredDuringExecution
afﬁnity.podAntiAfﬁnity.required DuringSchedulingIgnoredDuring Execution	k8sPodSpec.podAntiAfﬁnity. requiredDuringSchedulingIgnore d
	DuringExecution
afﬁnity.podAntiAfﬁnity.preferred DuringSchedulingIgnoredDuring Execution	k8sPodSpec.podAntiAfﬁnity. preferredDuringSchedulingIgnor ed DuringExecution
livenessProbe.initialDelaySecond s	Initial delay for liveness	200
livenessProbe.timeoutSeconds	Timeout for liveness	30
livenessProbe.periodSeconds	Time period for liveness	60
livenessProbe.failureThreshold	Failure threshold for liveness	10
readinessProbe.initialDelaySecon ds	Initial delays for readiness	190
readinessProbe.timeoutSeconds	Timeout for readiness	5
readinessProbe.periodSeconds	Time period for readiness	60
readinessProbe.failureThreshold	Failure threshold for readiness	10
route.enabled	Route for OpenShift Enabled/ Disabled	false
route.dashboard	Monitor Dashboard Enabled/Disabled	false
customProperties	Customize the properties files – The following files can be customized using key value pair in the list format: `conf/log4j.properties, bin/log.properties, bin/security.properties, bin/vendor.properties` Add/Update: Key and Value both must be provided in the below format: <File Name Without Extension>_<Property Name>=<Property Value>
vmArguments	Provide the VM arguments – Add/Update VM arguments in the list format:<Key as Java property name>=<value>
customFiles	Map the custom directories/files – The custom directories/files can be mapped using the list format. For mapping, we need to provide full path of the file or directory. First, we need to create the directory with 'CM_RESOURCES' name if it is not available into PV and keep the custom directories/files into created directory.
networkPolicy	Configure network policy
customCertificate.commonCert.enabled	Enable/Disable key-certificate for all components of SSP. The Engine, CM, web server, and servlet will use this key-certificate	false
customCertificate.commonCert.secretName	Provide secret name of common certificate and for that first we need to create secret for common key certificate file which we wants to update and the certificate password needs to add in CM secret
customCertificate.commonCert.alias	Alias name for common certificate
customCertificate.commonCert.exportFileName	Common key certificate file will be exported with name provided under container and it will be imported into the Engine	exportCommonCert.txt
customCertificate.cmCert.enabled	Enable/Disable Key-certificate for CM, web server, and servlet	false
customCertificate.cmCert.secretName	Provide secret name of CM certificate and for that first we need to create secret for key certificate file which we want to update and the certificate password needs to add in CM secret
customCertificate.cmCert.alias	Alias name for CM certificate
customCertificate.cmServerCert.enabled	Enable/Disable Key-certificate for CM server connection to servlet	false
customCertificate.cmServerCert.secretName	Provide secret name of CM server certificate and for that first we need to create secret for key certificate file which we want to update, and the certificate password needs to add in CM secret
customCertificate.cmServerCert.alias	Alias name for CM server certificate
customCertificate.engCert.enabled	Enable/Disable Key-certificate for Engine and Use this option when the Engine should use its own key-certificate	false
customCertificate.engCert.secretName	Provide secret name of engine certificate and for that first we need to create secret for key certificate file which we want to update, and the certificate password needs to add in CM secret
customCertificate.engCert.alias	Alias name for engine certificate
customCertificate.engCert.exportFileName	Engine key certificate file will be exported with name provided under container and it will be imported into the Engine	exportEngineCert.txt
customCertificate.cmClientCert.enabled	Enable/Disable Key-certificate for CM client connection to Engine	false
customCertificate.cmClientCert.secretName	Provide secret name of CM client certificate and for that first we need to create secret for key certificate file which we want to update, and the certificate password needs to add in CM secret
customCertificate.cmClientCert.alias	Alias name for CM client certificate
customCertificate.cmClientCert.exportFileName	CM client key certificate file will be exported with name provided under container and it will be imported into the Engine	exportCMClientCert.txt
customCertificate.webCert.enabled	Enable/Disable Key-certificate for Jetty web	false
customCertificate.webCert.secretName	Provide secret name of Jetty web certificate and for that first we need to create secret for key certificate file which we want to update, and the certificate password needs to add in CM secret
customCertificate.webCert.alias	Alias name for Jetty web certificate
customCertificate.clientAuth.enabled	Enable client authentication for Jetty web	false
customCertificate.clientAuth.disabled	Disable client authentication for Jetty web	false
customCertificate.clientAuth.trustedCertSecretName	Provide secret name of web trusted certificate and for that first we need to create secret for trusted certificate file which we want to update
customCertificate.clientAuth.certCAAlias	Alias name for Jetty web server trusted certificate
customCertificate.cmSSL.enabled	Enable/Disable protocol and cipher suites update for CM	false
customCertificate.cmSSL.protocol	Protocol name	TLSv1.2
customCertificate.cmSSL.ciphers	Cipher suites list	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;TLS_RSA_WITH_AES_256_GCM_SHA384;TLS_RSA_WITH_AES_128_GCM_SHA256
customCertificate.cmSSL.exportFileName	Key certificate file will be exported with name provided under container and it will be imported into the Engine	exportCMSSLCert.txt
customCertificate.webSSL.enabled	Enable/Disable protocol and cipher suites update for Jetty web server	false
customCertificate.webSSL.protocol	Protocol name	TLSv1.2
customCertificate.webSSL.ciphers	Cipher suites list	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;TLS_RSA_WITH_AES_256_GCM_SHA384;TLS_RSA_WITH_AES_128_GCM_SHA256

Engine Parameters

Summary for complex table
Parameter	Description	Default Value
licenseType	Specify prod or non-prod for production or non-production license type respectively	non-prod
license	License agreement. Set true to accept the license.	false
image.repository	Image full name including repository	cp.icr.io/cp/ibm-ssp-engine/ssp-engine-docker-image
image.tag	Image tag	6.0.3.0
digest.enabled	Enable/disable digest to be used for image	false
digest.value	The digest value for the image.	sha256:08defbb0a8fa7376b7bd074577d06d250764feddd639fca94fb6b806a922aa07
image.imageSecrets	Image pull secrets
image.pullPolicy	Image pull policy	IfNotPresent
storageSecurity.supplementalGroupId	Group ID for Supplemental group
engineArgs.keyCertExport	Set the value "true" to Generate Key Certificate. If you are installing Secure Proxy Engine before CM then you need to supply the following key certificate details: keyCertAliasName, keyCertStorePassphrase(secret) and keyCertEncryptPassphrase(secret). Set the value "false" to import key cert, which was exported from Secure Proxy CM. If you have installed Secure Proxy CM first then you need to supply the following key certificate details: keyCertAliasName and keyCertEncryptPassphrase(secret).	false
engineArgs.keyCertAliasName	AliasName Certificate alias value (CM and Engine both key cert alias name must be the same)	Keycert
engineArgs.signOnDirName	Change SSP brand name if required else keep it as it is.	Signon
engineArgs.maxHeapSize	JVM heap size - do not set more than container limit resource memory	2048m
persistentVolume.enabled	To use persistent volume	true
persistentVolume.useDynamicProvisioning	To use storage classes to dynamically create PV	false
persistentVolume.storageClassName	Storage class of the PVC	manual
persistentVolume.size	Size of PVC volume	2Gi
persistentVolume.labelName	PV label key to bind this PVC	app.kubernetes.io/name
persistentVolume.labelValue	PV label value to bind this PVC	ibm-ssp-engine -pv
persistentVolume.accessMode	Access mode of the PVC	ReadWriteOnce
service.type	Kubernetes service type exposing ports	LoadBalancer
service.loadBalancerIP	Provide the static LoadBalancer IP
service.annotations	Provide the annotations for service
service.externalTrafficPolicy	Provide the external traffic policy
service.sessionAffinity	Provide the session affinity
service.engine.servicePort	Engine application is accessed by using below mentioned service port, so add port as per the requirement else it would be set 63366 as default port	63366
service.engine.containerPort	If traditional engine port is different from 63366 while migrating from traditional to container environment then in this case we need to change container port as traditional engine port value else It is not required to change the container port value.	63366
service.psMoreSecure.servicePort	More Secure Perimeter Server application is accessed by using below mentioned service port, so add the port number as per the requirement. The mentioned service port must be used as remote port while configuring more secure perimeter server
service.externalIP	External IP for service discovery
service2.type	Kubernetes service type exposing ports	LoadBalancer
service2.loadBalancerIP	Static LoadBalancer IP
service2.annotations	Service annotations
service.externalTrafficPolicy	Provide the external traffic policy
service.sessionAffinity	Provide the session affinity	ClientIP
service2.externalIP	External IP for service discovery
service2.ports	Adapter ports
service2.portRanges	Adapter ports in range format
secret.secretName	Secret name for Engine
secret.keyCertSecretName	Secret name for Key Certificate
resources.limits.cpu	Container CPU limit	1000m
resources.limits.memory	Container memory limit	3Gi
resources.requests.cpu	Container CPU requested	1000m
resources.requests.memory	Container Memory requested	3Gi
serviceAccount.create	Enable/disable service account creation true - Manage by helm chart false - Manage by deployment user If you are changing from true to false then in this case you need to provide service account name. It is recommended to use true value.	true
serviceAccount.name	Name of Service Account to use for container
afﬁnity.nodeAfﬁnity.required DuringSchedulingIgnoredDuring Execution	k8sPodSpec.nodeAfﬁnity.require d DuringSchedulingIgnoredDuring Execution
afﬁnity.nodeAfﬁnity.preferred DuringSchedulingIgnoredDuring Execution	k8sPodSpec.nodeAfﬁnity.preferr ed DuringSchedulingIgnoredDuring Execution
afﬁnity.podAfﬁnity.required DuringSchedulingIgnoredDuring Execution	k8s PodSpec.podAntiAfﬁnity. requiredDuringSchedulingIgnore d
	DuringExecution
afﬁnity.podAfﬁnity.preferred DuringSchedulingIgnoredDuring Execution	k8sPodSpec.podAntiAfﬁnity. preferredDuringScheduling IgnoredDuringExecution
afﬁnity.podAntiAfﬁnity.required DuringSchedulingIgnoredDuring Execution	k8sPodSpec.podAntiAfﬁnity. requiredDuringSchedulingIgnore d
	DuringExecution
afﬁnity.podAntiAfﬁnity.preferred DuringSchedulingIgnoredDuring Execution	k8sPodSpec.podAntiAfﬁnity. preferredDuringSchedulingIgnor ed DuringExecution
livenessProbe.initialDelaySecond s	Initial delay for liveness	200
livenessProbe.timeoutSeconds	Timeout for liveness	30
livenessProbe.periodSeconds	Time period for liveness	60
livenessProbe.failureThreshold	Failure threshold for liveness	10
readinessProbe.initialDelaySecon ds	Initial delays for readiness	190
readinessProbe.timeoutSeconds	Timeout for readiness	5
readinessProbe.periodSeconds	Time period for readiness	60
readinessProbe.failureThreshold	Failure threshold for readiness	10
route.enabled	Route for OpenShift Enabled/ Disabled	false
route.dashboard	Monitor Dashboard Enabled/Disabled	false
customProperties	Customize the properties files – The following files can be customized using key value pair in the list format: `bin/log.properties, bin/security.properties, bin/perimeter.properties, bin/cdsp.properties, bin/portal/mediatypes.properties, bin/portal/pages.properties, conf/log4j.properties` Add/Update: Key and Value both must be provided in the below format: <File Name Without Extension>_<Property Name>=<Property Value>
vmArguments	Provide the VM arguments – Add/Update VM arguments in the list format:<Key as Java property name>=<value>
customFiles	Map the custom directories/files – The custom directories/files can be mapped using the list format. For mapping, we need to provide full path of the file or directory. First, we need to create the directory with 'ENG_RESOURCES' name if it is not available into PV and keep the custom directories/files into created directory.
networkPolicy	Configure network policy
customCertificate.engineCert.enabled	Enable/Disable custom import certificate which was exported from the CM	false
customCertificate.engineCert.secretName	Provide secret name of custom certificate and for that first we need to create secret for custom key certificate file which we want to import, and the certificate password needs to add in engine secret
customCertificate.engineCert.alias	Alias for engine certificate
customCertificate.engineCert.clientAlias	Client alias for engine certificate

Perimeter Server Parameters

Summary for complex table
Parameter	Description	Default Value
licenseType	Specify prod or non-prod for production or non-production license type respectively	non-prod
license	License agreement. Set true to accept the license.	false
image.repository	Image full name including repository	cp.icr.io/cp/ibm-ssp-ps/ssp-ps-docker-image
image.tag	Image tag	6.0.3.0
digest.enabled	Enable/disable digest to be used for image	false
digest.value	The digest value for the image.	sha256:08defbb0a8fa7376b7bd074577d06d250764feddd639fca94fb6b806a922aa07
image.imageSecrets	Image pull secrets
image.pullPolicy	Image pull policy	IfNotPresent
psArgs.networkZoneSecure	true - The Perimeter Server will be installed in more-secure zone false - The Perimeter Server will be installed in less-secure zone	false
psArgs.secureInterface	Secure Network Interface - The perimeter server to use to communicate with the Secure Proxy engine	*
psArgs.externalInterface	External Network Interface - The perimeter server to use to communicate with the backend serve / trading partners	*
psArgs.remote	Port Remote port number - The Secure Proxy engine will listen on for requests from the perimeter server. Required for More secure Perimeter Server	30900
psArgs.remoteAddress	Remote HostName/IP address - The Secure Proxy engine host that will be connected to this perimeter server. Required for More secure Perimeter Server
psArgs.maxAllocation	Limits the amount of memory used for network buffers	768
psArgs.maxHeapSize	JVM heap size - do not set more than container limit resource memory	2048
psArgs.restricted	Set to true to enable restricted network access, controlled by restricted.policy. Required for More secure Perimeter Server	false
psArgs.receiveBufferSize	Socket receive buffer size for persistent connection	131072
psArgs.sendBufferSize	Socket send buffer size for persistent connection	131072
psArgs.logLevel	May have values of (ERROR,WARN,INFO,COMMTRACE,DEBUG or ALL)	ERROR
psArgs.rotateLogs	Enables log rotation when maxLogSize is reached	true
psArgs.maxLogSize	Log output will roll over when this many record have been written	100000
psArgs.maxnumLogs	After this many log are written, old logs will be deleted.	10
service.type	Kubernetes service type exposing ports	LoadBalancer
service.loadBalancerIP	Provide the static LoadBalancer IP
service.annotations	Provide the annotations for service
service.externalTrafficPolicy	Provide the external traffic policy
service.sessionAffinity	Provide the session affinity	ClientIP
service.psLessSecure.servicePort	Less Secure Perimeter Server application is accessed by using below mentioned service port so add port as per the requirement else it would be set 30800 as default port.	30800
service.psLessSecure.containerPort	It is not required to change the container port value	30800
service.externalIP	External IP for service discovery
resources.limits.cpu	Container CPU limit	1000m
resources.limits.memory	Container memory limit	1Gi
service2.type	Kubernetes service type exposing ports	LoadBalancer
service2.loadBalancerIP	Static LoadBalancer IP
service2.annotations	Service annotation
service.externalTrafficPolicy	Provide the external traffic	ClientIP
service2.externalIP	External IP for service discovery
service2.ports	Adapter Ports
service2.portRanges	Adapter ports in range format
service.sessionAffinity	Provide the session affinity	ClientIP
resources.requests.cpu	Container CPU requested	1000m
resources.requests.memory	Container Memory requested	1Gi
serviceAccount.create	Enable/disable service account creation true - Manage by helm chart false - Manage by deployment user If you are changing from true to false then in this case you need to provide service account name. It is recommended to use true value.	true
serviceAccount.name	Name of Service Account to use for container
afﬁnity.nodeAfﬁnity.required DuringSchedulingIgnoredDuring Execution	k8sPodSpec.nodeAfﬁnity.require d DuringSchedulingIgnoredDuring Execution
afﬁnity.nodeAfﬁnity.preferred DuringSchedulingIgnoredDuring Execution	k8sPodSpec.nodeAfﬁnity.preferr ed DuringSchedulingIgnoredDuring Execution
afﬁnity.podAfﬁnity.required DuringSchedulingIgnoredDuring Execution	k8s PodSpec.podAntiAfﬁnity. requiredDuringSchedulingIgnore d
	DuringExecution
afﬁnity.podAfﬁnity.preferred DuringSchedulingIgnoredDuring Execution	k8sPodSpec.podAntiAfﬁnity. preferredDuringScheduling IgnoredDuringExecution
afﬁnity.podAntiAfﬁnity.required DuringSchedulingIgnoredDuring Execution	k8sPodSpec.podAntiAfﬁnity. requiredDuringSchedulingIgnore dDuringExecution
afﬁnity.podAntiAfﬁnity.preferred DuringSchedulingIgnoredDuring Execution	k8sPodSpec.podAntiAfﬁnity. preferredDuringSchedulingIgnor ed DuringExecution
livenessProbe.initialDelaySecond s	Initial delay for liveness	150
livenessProbe.timeoutSeconds	Timeout for liveness	30
livenessProbe.periodSeconds	Time period for liveness	60
livenessProbe.failureThreshold	Failure threshold for liveness	10
readinessProbe.initialDelaySecon ds	Initial delays for readiness	140
readinessProbe.timeoutSeconds	Timeout for readiness	5
readinessProbe.periodSeconds	Time period for readiness	60
readinessProbe.failureThreshold	Failure threshold for readiness	10
route.enabled	Route for OpenShift Enabled/ Disabled	false
route.dashboard	Monitor Dashboard Enabled/Disabled	false
networkPolicy	Configure network policy

Note:

OpenShift: To preserve the client source IP for adapter ports (Engine / Perimeter Server) deploy service type as "NodePort" and external traffic policy as "Local".
Kubernetes: To preserve the client source IP for adapter ports (Engine / Perimeter Server) deploy service type as "LoadBalancer / NodePort" and external traffic policy as "Local".

Affinity

The chart provides ways in form of node afﬁnity, pod afﬁnity and pod anti-afﬁnity to conﬁgure advance pod scheduling in Kubernetes. See, Kubernetes documentation for details.

Network Policies

The chart provides ways to control ingress and egress traffic flow. For more information, refer to Kubernetes Documentation for Network Policies.

By default, the chart deny all ingress and egress traffic. So, we need to configure all ingress and egress traffic ports during deployment.