Helm configuration
Standardized Helm configuration parameters
This module in general follows the general IAS Operations Manual and the helm parameters that are described there e.g. for logging, databases, messaging, ..
Information Router Helm configuration parameters
Helm Parameter |
Description |
Mandatory |
Default Value |
|---|---|---|---|
local.logging.framework |
The log level for logging everything under the Microsoft namespace |
Yes |
WARN |
local.logging.elastic |
The log level for logging everything under the Microsoft namespace for Application Performance Monitoring |
No |
WARN |
local.publishRawMessages |
Feature flag that governs whether to publish Raw OPP messages or not |
No |
"false" |
local.checkWatchdogsInterval |
The interval at which Watchdogs are checked by the WatchdogProcessor |
No |
"00:00:01" |
local.updateWatchdogsInterval |
The interval at which Watchdogs are updated / re-synced with the MDM device they are created from by the WatchdogProcessor |
No |
"00:00:30" |
local.rexrothToPpmpConverterIgnoreSpecialValues |
Feature flag that when enabled the Rexroth to PPMP converter ignores special values in the Rexroth and doesn’t add them to the PPMP |
No |
"false" |
local.auth.tokenUseMinimumRemaining |
The minimum time a token has to be still valid for to be used instead of getting a new one. Valid range: 1 second to 1 minute (60 seconds), Default=5s. Longer is safer though wasting some validity time. Shorter values risk expiry before use. If you encounter unexpected (with valid credentials) authorization failures, try increasing this. |
No |
"00:00:05" |
local.auth.tokenRefreshMinimumRemaining |
The minimum time a refresh token has to be still valid for to be used instead of getting a completely new token. This scales with the number of the tokens in the cache and the percentage of expired tokens. We measure the actual time it takes for the refresh loop using OpenTelemetry Histogram: auth.token_refresh_job.duration. Valid range: 1 second to 1 minute (60 seconds), Default=10s. Longer is safer though wasting some validity time. Shorter values risk expiry before refresh. If you encounter unexpected (with valid credentials) authorization failures (evtl. due to user session not found), try increasing this. |
No |
"00:00:10" |
local.auth.tokenRefreshInterval |
The interval at which the background service checks for tokens that need to be refreshed. This controls how frequently the token cache background service wakes up to scan for expiring tokens and perform refresh operations.Valid range: 1 second to 30 seconds, Default=5s. If you increase this, increase TokenRefreshMinimumRemaining accordingly. |
No |
"00:00:05" |
local.resiliencyConfiguration.maxDelay |
Maximum cumulative backoff delay between retries of HTTP clients |
No |
"00:00:15" |
local.resiliencyConfiguration.delay |
Base delay between retries for HTTP clients |
No |
"00:00:02" |
local.resiliencyConfiguration.maxRetryAttempts |
Maximum number of retry attempts for HTTP clients |
No |
"3" |
local.resiliencyConfiguration.totalRequestTimeout |
Overall timeout for the entire request including retries. |
No |
"00:00:30" |
local.resiliencyConfiguration.attemptTimeout |
Timeout for a single attempt of a HTTP client (per try). |
No |
"00:00:10" |
local.kafka.enabled |
The flag needs to be set to true if the Kafka connector should be used |
Yes |
"false" |
local.kafka.hostname |
The hostname of the Kafka broker |
Yes |
|
local.kafka.port |
The port of the Kafka broker |
Yes |
|
local.kafka.userName |
The username to authenticate with the Kafka broker |
Yes |
|
local.kafka.password |
The password to authenticate with the Kafka broker |
Yes |
|
local.kafka.sslEnabled |
The flag to enable SSL/TLS encrypted communication with the Kafka broker |
Yes |
|
local.kafka.useFailOver |
The flag to enable failover for the Kafka broker |
Yes |
|
local.kafka.failOverServers |
The list of the failover servers for the Kafka broker |
Yes |
|
local.kafka.sslCaCertificateLocation |
The path to the CA certificate used to verify Kafka server SSL certificates. This parameter is only used if |
Yes |
|
local.kafka.clientCertificateLocation |
The path to the client certificate file |
Yes |
|
local.kafka.clientCertificateKeyLocation |
The path to the client certificate key file for authenticating Kafka connections |
Yes |
|
local.kafka.clientCertificateKeyPassword |
The password used during key generation, required if the key is password-protected |
Yes |
|
local.kafka.topicTenant |
The tenant id of the customer which is being used in the automatically generated topic names |
Yes |
|
local.mqtt.enabled |
The flag needs to be set to true if the MQTT connector should be used |
Yes |
"false" |
local.mqtt.hostname |
The hostname of the MQTT broker |
Yes |
|
local.mqtt.port |
The port of the MQTT broker |
Yes |
|
local.mqtt.userName |
The username to authenticate with the MQTT broker |
Yes |
|
local.mqtt.password |
The password to authenticate with the MQTT broker |
Yes |
|
local.mqtt.oppRequestTopic |
The MQTT topic OPP requests are sent on |
No |
|
local.mqtt.oppResponseTopic |
The MQTT topic OPP responses are sent on |
No |
|
local.mqtt.oppSendResponse |
The flag to enable or disable sending MQTT OPP responses. |
No |
"false" |
local.mqtt.oppSendErrorResponse |
The flag to enable or disable if OPP errors should be published as responses |
No |
"false" |
local.conditionMonitoringOption |
The option to configure the condition monitoring setup for message destinations. Possible values are |
Yes |
oppOverAmqp |
local.webUi.enabled |
The flag to enable or disable message forwarding from information router to the UI |
No |
false |
local.webUi.maxMessageCount |
The total amount of messages the UI stores based on a first in first out principle. Increase this value to get a longer message history. |
No |
"1000" |
local.webUi.messageInterval |
The interval in milliseconds in which the information router sends queued messages to the UI. Setting this higher will reduce the load on the information router but will also increase the time until messages are displayed in the UI. |
No |
"1000" |
local.webUi.maxQueueSize |
The amount of messages the information router queues based on a first in first out principle. To avoid message loss, the queue size should be larger than the message count expected to be received within the interval defined by |
No |
"1000" |
local.masterData.enabled |
The flag to enable or disable the master data synchronization. |
Yes |
true |
local.masterData.productName |
The product name for the master data identification. |
Yes |
connectivity |
local.masterData.macmaRetryPeriodInSeconds |
The retry period for MACMA operation in seconds. |
Yes |
10 |
local.masterData.resyncPeriodinMinutes |
The resynchronization period in minutes. |
Yes |
1 |
local.masterData.fullResyncEnabled |
The flag to enable or disable full resynchronization. |
No |
true |
local.masterData.fullResyncTimeSpan |
The time span for full resynchronization. |
No |
"0.12:00:00" |
local.masterData.orpahnedSynchronizationLimitInMinutes |
The time limit in minutes for orphaned synchronization operations. |
Yes |
10 |
local.masterData.cacheExpirationPeriodInMinutes |
Cache expiration period in minutes. |
Yes |
1 |
local.masterData.connectionAndSubscriptionRetryPeriodInSeconds |
The retry period for connection and subscription operations in seconds. |
Yes |
10 |
local.observability.otelAutoInjectEnvParams |
The flag to enable or disable if OpenTelemetry environment parameters are automatically injected. |
No |
true |
export.contextPath |
The context path for the connectivity module |
Yes |
connectivity |
export.databases.masterdata.name |
Name of masterdata database |
Yes |
connectivity_masterdata |
export.databases.masterdata.userName |
Username for masterdata |
Yes |
connectivity_masterdata |
export.databases.masterdata.secretUserKey |
Username of database user |
Yes |
|
export.databases.masterdata.secretPasswordKey |
Key of database user |
Yes |
|
export.databases.masterdata.type |
Database type (MSSQL or ORACLE) |
Yes |
|
export.databases.masterdata.programmingLanguage |
Key of database user |
Yes |
NET |
export.databases.masterdata.roles |
List of database roles |
Yes |
- db_owner |
export.databases.masterdata.permissions |
Array of database permissions |
Yes |
[ ] |
export.databases.masterdata.secretName |
Name of the database secret |
Yes |
masterdata-sql-data-source-secret |
export.databases.connectivity.name |
Name of connectivity database |
Yes |
connectivity |
export.databases.connectivity.userName |
Username for masterdata |
Yes |
connectivity |
export.databases.connectivity.secretUserKey |
Username of database user |
Yes |
|
export.databases.connectivity.secretPasswordKey |
Key of database user |
Yes |
|
export.databases.connectivity.type |
Database type (MSSQL or ORACLE) |
Yes |
|
export.databases.connectivity.programmingLanguage |
Key of database user |
Yes |
NET |
export.databases.connectivity.roles |
List of database roles |
Yes |
- db_owner |
export.databases.connectivity.permissions |
Array of database permissions |
Yes |
[ ] |
export.databases.connectivity.secretName |
Name of the database secret |
Yes |
connectivity-sql-data-source-secret |
export.namespaceSuffix |
The suffix to be appended to the namespace |
Yes |
connectivity |
export.messaging.connectivity.type |
The type of messaging system used for connectivity |
Yes |
RABBITMQ |
export.messaging.connectivity.userName |
The username for the messaging system |
Yes |
connectivity |
export.messaging.connectivity.vhost |
The virtual host for the messaging system |
Yes |
|
export.messaging.connectivity.module |
The module name for the messaging system |
Yes |
connectivity |
export.messaging.connectivity.tag |
The tag for the messaging system. |
Yes |
policymaker |
export.messaging.connectivity.secretUserKey |
The key used to store the database username for the module |
Yes |
RABBITMQ_USERNAME |
export.messaging.connectivity.secretPasswordKey |
The key used to store the database password for the module |
Yes |
RABBITMQ_PASSWORD |
export.messaging.connectivity.secretName |
The name of the secret containing the messaging system credentials |
Yes |
rabbitmq-secret |
export.macmaConfiguration.display_name |
The display name of the module |
Yes |
"Information Router" |
export.macmaConfiguration.public_client |
Whether a public client is created for the module |
Yes |
True |
export.macmaConfiguration.direct_access_grants_enabled |
Whether direct access grants are enabled |
Yes |
True |
export.macmaConfiguration.use_single_audience_tokens |
Whether to enforce usage of single audience tokens |
Yes |
False |
export.macmaConfiguration.service_account_roles |
Service account roles for the module |
Yes |