Lux: Helm Configuration Reference

Lux Overrides

The following table shows a configuration option’s name, type, and the default value:

restart

Due to the way kubernetes handles updates to configmaps and secrets pods have to be restarted to read the new values.

One way is to scale the pods down and then do the lux deployment,

kubectl rollout restart deployment/cloud deployment/api deployment/auth deployment/logs-monitor deployment/data deployment/logs-grpc deployment/logs-worker deployment/metrics deployment/metricsapi deployment/oauth

There are other alternatives such as using reloader. In the upcoming release, lux will also provide a flag that can be used to force a rolling update of the above services.

saml request signing certs configuration

The below snippet is to be added to the overrides file, this assumes the certs are available in the kubernetes cluster under a secret named secrets,

auth:
  additionalEnv: |
    - name: SAML_SIGNING_KEY
      value: "/etc/ssl/saml-certs/private-key.pem"     
    - name: SAML_SIGNING_CERT
      value: "/etc/ssl/saml-certs/cert.pem"         
  extraVolumes: |
    - name: saml-certs
      secret:
        secretName: secrets    
  extraVolumeMounts: |     
    - name: saml-certs
      mountPath: "/etc/ssl/saml-certs/private-key.pem"
      readOnly: true    
      subPath: private-key.pem
    - name: saml-certs
      mountPath: "/etc/ssl/saml-certs/cert.pem"
      readOnly: true    
      subPath: cert.pem  

connect to database with cert auth

The below snippet is to be added to the overrides files, this assumes the certs are available in the kubernetes cluster under a secret named secrets,

data:
  extraVolumes: |
    - name: certs
      secret:
        defaultMode: 0600
        secretName: secrets
        items:
        - key: STAGE_PGSSLCERT
          path: certs/client-cert.pem
        - key: STAGE_PGSSLKEY
          path: certs/client-key.pem
        - key: STAGE_PGSSLROOTCERT
          path: certs/server-ca.pem    
  extraVolumeMounts: |     
    - name: certs
      mountPath: "/etc/pgcerts"
      readOnly: true
  additionalEnv: |
    - name: PGSSLMODE
      value: "verify-ca"   
    - name: PGSSLCERT
      value: "/etc/pgcerts/certs/client-cert.pem"   
    - name: PGSSLKEY
      value: "/etc/pgcerts/certs/client-key.pem"   
    - name: PGSSLROOTCERT
      value: "/etc/pgcerts/certs/server-ca.pem"      

configure prometheus exporter

You can configure prometheus exporter by adding the below snippet to enable it (disabled by default). Prometheus integration can be added to a project to export its metrics, in the EE dashboard.

prometheus-exporter:
    enabled: true

configure datadog trace exporter

Datadog integration can be configured to publish traces (in addition to logs and metrics, which are exported by default when the integration is configured) by adding the below snippet to enable it (disabled by default).

ddtrace:
    enabled: true

configure self-hosted Github EE for OAuth2 login

Self-Hosted Github EE can be configured to be used for OAuth2 login (by default, public Github is used) by adding the below snippet. Replace the values of the below ENV vars with self-hosted Github URLs. The example values are that of public Github.

auth:
  additionalEnv: |
    - name: GITHUB_AUTH_URL
      value: https://github.com/login/oauth/authorize
    - name: GITHUB_TOKEN_URL
      value: https://github.com/login/oauth/access_token
    - name: GITHUB_INFO_ENDPOINT
      value: https://api.github.com/user
    - name: GITHUB_EMAIL_ENDPOINT
      value: https://api.github.com/user/emails    

configure rate-limit redis

You can configure the rate limit redis on the graphql engine pro [if using provided helm chart] using the following snippet in the override file,

hge-pro:
  additionalEnv: |  
    - name: HASURA_GRAPHQL_RATE_LIMIT_REDIS_URL
      value: "redis://username:password@hostwithport"

configure caching redis

You can configure the caching redis on the graphql engine pro [if using provided helm chart] using the following snippet in the override file,

hge-pro:
  additionalEnv: |  
    - name: HASURA_GRAPHQL_REDIS_URL
      value: "redis://username:password@hostwithport"

Common Overrides

The below configs can be used to override per service configs and is applicable to all lux services; for example, using the below snippet in the override file we can override various aspects of the hge-pro service,

hge-pro:
  tag: "v1.3.3-pro.3"
  additionalEnv: |
    - name: HASURA_GRAPHQL_ENABLED_APIS
      value: "graphql,metadata,config,developer,pgdump"    
  resources: |
    requests:
      cpu: 200m
      memory: 1Gi
    limits:
      cpu: 1000m 
      memory: 1Gi