Platform Base configuration reference
This page lists the most important options and their defaults. The complete
schema, with comments, is
vendor/github.com/RocketPadPlatforms/base/config.libsonnet in your
repository, for the release you vendored. You override an option in your
cluster/config.libsonnet, use +: for nested options, see
Install Platform Base.
Top-level options
| Option | Purpose |
|---|---|
baseDomains | Mandatory list of base domains. The first entry is the default for all hostnames. |
argocd | Argo CD: repository credentials, SSO, RBAC, SSH known hosts, ConfigMaps, plugins. |
traefik | traefik.values is merged into the Helm values of Traefik. |
tls | Certificate issuer, selfSigned or acme. |
iam | Keycloak ingress and the identity providers of the realms. |
observability | Collector and storage roles, profile, retention, alerting. |
alloy | alloy.livedebugging.enabled and alloy.values for Alloy. |
grafana | Grafana base domain and single sign-on. |
loki | Loki ingress, storage backend, retention and loki.values. |
mimir | Mimir ingress, storage backend, retention and mimir.values. |
Notable defaults
| Option | Default |
|---|---|
argocd.baseDomain | baseDomains[0] |
argocd.platformRepoCreds.enabled | false |
argocd.rbac.defaultRole | role:readonly |
argocd.rbac.scopes | ['groups'] |
argocd.sso.enabled | true |
argocd.sso.keycloakClient.enabled | true |
tls.issuer.type | selfSigned |
iam.ingress.enabled | true |
iam.ingress.baseDomain | baseDomains[0] |
grafana.baseDomain | baseDomains[0] |
grafana.sso.enabled | true |
grafana.sso.roleAttributeStrict | false |
observability.clusterName | baseDomains[0] |
observability.profile | small |
observability.selfMonitoring.enabled | true |
observability.retention | enabled: true, period: '720h' |
observability.collector.enabled | true |
observability.collector.logs.allPods | false |
observability.collector.metrics.controlPlane.* | false |
observability.storage.enabled | true |
observability.storage.backend.type | minio |
observability.storage.backend.s3.region | us-east-1 |
observability.storage.storageClass | null, the default class |
observability.alerting.email.enabled | false |
alloy.livedebugging.enabled | false |
loki.ingress.enabled | false |
mimir.ingress.enabled | false |
Hostnames
| Hostname | Serves | Enabled | Base domain option |
|---|---|---|---|
argocd.<baseDomain> | Argo CD | Always | argocd.baseDomain |
grafana.<baseDomain> | Grafana | With observability.storage.enabled | grafana.baseDomain |
iam.<baseDomain> | Keycloak | iam.ingress.enabled, on by default | iam.ingress.baseDomain |
loki.<baseDomain> | Loki | loki.ingress.enabled, off by default | loki.ingress.baseDomain |
mimir.<baseDomain> | Mimir | mimir.ingress.enabled, off by default | mimir.ingress.baseDomain |
All base domain options default to baseDomains[0].
Secret values
Options that take a credential use the same shape:
{ secretRef: { name: 'my-secret', key: 'my-key' }, value: null }
Set exactly one of secretRef and value. With secretRef, the Secret has
to exist in the namespace where the component reads it. With value, Platform
Base puts the value into the rendered manifests.
| Option | Namespace of the Secret |
|---|---|
tls.issuer.acme.route53.secretAccessKey | traefik |
tls.issuer.acme.cloudflare.apiToken | traefik |
tls.issuer.acme.cloudDNS.serviceAccount | traefik |
iam.realms.<realm>.identityProviders.<key>.oidc.clientSecret | iam |
observability.storage.backend.s3.secretAccessKey | mimir and loki |
observability.alerting.email.smtp.authPassword | grafana-alloy |
observability.collector.logs.externalTarget.auth | grafana-alloy |
observability.collector.metrics.externalTarget.auth | grafana-alloy |
The argocd.platformRepoCreds fields are plain values. When enabled, they end
up in a Secret in the argocd namespace.
An inline value is not only in your Git repository, if you commit it there.
It is also written into the spec of Argo CD Applications, for example into
the bootstrap Application when you pass it through dynamicConfig, and into
the Application of the component that uses it. Anyone who can read
Applications in the cluster can read it. The same applies to
argocd.platformRepoCreds, whose values end up in the argo-cd-core
Application. Prefer secretRef.
cert-manager, kube-state-metrics, node-exporter and the operators have no
options of their own, see Applications.