Configuration Reference¶
Key | Description | Required | Values |
---|---|---|---|
schema | Manifest schema version | ✓ | “1.0” |
name | Unique deployment name | ✓ | [a-zA-Z0-9_-]+ |
version | Domino version to install | ✓ | Supported versions: 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6 4.1.7. |
hostname | Hostname Domino will be accessible at | ✓ | Valid FQDN |
pod_cidr | If network policies are enabled, allow external access from this CIDR. | Valid CIDR
range,
e.g. 10.0.0.0/8 |
|
ssl_enabled | Should Domino only be accessible using HTTPS | ✓ |
|
ssl_redirect | Should Domino automatically redirect to HTTPS on HTTP requests | ✓ |
|
create_ingress_controller | Create an NGINX ingress controller | ✓ |
|
request_resources | Create Kubernetes resource requests and limits for services | ✓ |
|
enable_network_policies | Use network policies for fine-grained service access | ✓ |
Note: requires a compatible CNI plugin e.g. Calico |
enable_pod_security_policies | Enables pod security policies for locked down system capabilities | ✓ |
|
create_restricted_pod_security_policy | Creates pod security policies for locked down system capabilities | ✓ |
|
Ingress Controller¶
blurb
Key | Description | Required | Values |
---|---|---|---|
ingress_controller.create | blurb. | ✓ |
|
ingress_controller.gke_cluster_uuid | blurb. | ✓ |
Namespaces¶
Namespaces are a way to virtually segment Kubernetes executions. Domino will create namespaces according to the specifications in this section, and the installer requires that these namespaces not already exist at installation time.
Key | Description | Required | Values |
---|---|---|---|
namespaces.platform.name | Namespace to place Domino services | ✓ | Kubernetes Name |
namespaces.compute.name | Namespace for user executions | ✓ | Kubernetes Name Note: may be the same as the platform namespace |
namespaces.system.name | Namespace for deployment metadata | ✓ | Kubernetes Name |
namespaces.*.annotations | Optional annotations to apply to each namespace | Kubernetes Annotation |
Storage Classes¶
Storage Classes are a way to abstract the dynamic provisioning of volumes in Kubernetes.
Domino requires two storage classes:
block
storage for Domino services and user executions that need fast I/Oshared
storage that can be shared between multiple executions
Domino supports pre-created storage classes, although the installer can create a shared
storage class backed by NFS
or a cloud NFS analog as long as the cluster can access the NFS system for read and write, and the installer can create
several types of block
storage classes backed cloud block storage systems like Amazon EBS.
Key | Description | Required | Values |
---|---|---|---|
storage_classes.block.create | Whether to create the block storage class | ✓ |
|
storage_classes.block.name | ✓ | Kubernetes Name Note: always required due to platform limitations, cannot be “” which indicates the default storage class | |
storage_classes.block.type | Name of the block storage class to utilize | ✓ |
|
storage_classes.block.base_path | Base path to
use on nodes as
a base when
using
hostpath
volumes |
||
storage_classes.block.default | Whether to set this storage class as the default | ✓ |
|
storage_classes.shared.create | Whether to create the shared storage class | ✓ |
|
storage_classes.shared.name | ✓ | Kubernetes Name | |
storage_classes.shared.type | Type of the shared storage class to utilize | ✓ |
|
storage_classes.shared.efs.region | EFS store AWS region | e.g. us-west-2 |
|
storage_classes.shared.efs.filesystem_id | EFS filesystem ID | e.g. fs-7a535bd1 |
|
storage_classes.shared.nfs.server | NFS server IP or hostname | ||
storage_classes.shared.nfs.mount_path | Base path to use on the server when creating shared storage volumes | ||
storage_classes.shared.nfs.mount_options | YAML List of additional NFS mount options | e.g. - mfsymlinks |
|
storage_classes.shared.azure_file.storage_account | Azure storage account to create filestores |
Blob Storage¶
Domino can store long-term, unstructed data in “blob storage”
buckets. Currently, only the shared
storage class described above (NFS) and S3 are supported.
To apply a default S3 bucket or shared storage type to all use-cases of
blob storage, it is only necessary to fill out the default
setting
and make sure enabled
is true. Otherwise, all other blob storage
uses (projects
, logs
, and backups
) should be filled out.
Key | Description | Required | Values |
---|---|---|---|
blob_storage.default.enabled | Whether the
default
configuration
should take
precendence
over individual
config keys |
✓ |
|
blob_storage.*.type | Which type of blob storage to use | ✓ |
|
blob_storage.*.s3.region | AWS region of the S3 bucket store | e.g. us-west-2 |
|
blob_storage.*.s3.bucket | S3 bucket name | e.g. domino-bucket-1 |
Autoscaler¶
For Kubernetes clusters without native cluster scaling in response to new user executions, Domino supports the use of the cluster autoscaler.
Key | Description | Required | Values |
---|---|---|---|
autoscaler.enabled | Enable cluster autoscaling | ✓ |
|
autoscaler.cloud_provider | Cloud provider Domino is deployed with |
|
|
autoscaler.aws.region | AWS region Domino is deployed into | e.g. us-west-2 |
|
autoscaler.azure.resource_group | Azure resource group Domino is deployed into | Azure resource group | |
autoscaler.azure.subscription_id | Azure subscription ID Domino is deployed with | Azure subscription ID |
Groups¶
Autoscaling groups are not dynamically discovered. Each autoscaling group must be individually specified including the minimum and maximum scaling size.
Key | Description | Required | Values |
---|---|---|---|
autoscaler.groups.*.name | Autoscaling group name | Must exactly match the name in the cloud provider | |
autoscaler.groups.*.min_size | e.g. 0 |
||
autoscaler.groups.*.max_size | e.g. 10 |
External DNS¶
Domino can automatically configure your cloud DNS provider. More extensive documentation can be found on the external-dns homepage.
Key | Description | Required | Values |
---|---|---|---|
external_dns.enabled | Whether Domino should configure cloud DNS | ✓ |
|
external_dns.provider | Cloud DNS provider | e.g. aws |
|
external_dns.domain_filters | Only allow access to domains that match this filter | e.g. my-domain.example.com |
|
external_dns.zone_id_filters | Only allow updates to specific Route53 hosted zones |
Email Notifications¶
Domino supports SMTP for sending email notifications in response to user actions and run results.
Key | Description | Required | Values |
---|---|---|---|
email_notifications.enabled | Whether Domino should send email notifications | ✓ |
|
email_notifications.server | SMTP server hostname or IP | ||
email_notifications.port | SMTP server port | ||
email_notifications.encryption | Whether the SMTP server uses SSL encryption | ||
email_notifications.from_address | Email address to send emails from Domino with | e.g. domino
@example.com |
|
email_notifications.authentication.username | If using SMTP authentication, the username | ||
email_notifications.authentication.password | If using SMTP authentication, the password |
Monitoring¶
Domino supports in-cluster monitoring with Prometheus as well as more detailed, external monitoring through NewRelic APM and Infrastructure.
Key | Description | Required | Values |
---|---|---|---|
monitoring.prometheus_metrics | Install Prometheus monitoring | ✓ |
|
monitoring.newrelic.apm | Enable NewRelic APM | ✓ |
|
monitoring.newrelic.infrastructure | Enable NewRelic Infrastructure | ✓ |
|
monitoring.newrelic.license_key | NewRelic account license key |
Helm¶
Configuration for the Helm repository that stores Domino’s charts.
Key | Description | Required | Values |
---|---|---|---|
helm.tiller_image | Unversioned Tiller Docker image reference | ✓ |
|
helm.appr_registry | Quay Application Registry host | ✓ |
|
helm.appr_insecure | Allow insecure application registry references | ✓ |
|
helm.appr_username | Username for Quay AppR | ✓ | |
helm.appr_password | Password for Quay AppR | ✓ |
Private Docker Registry¶
Configuration for the Docker repository that stores Domino’s images.
Key | Description | Required | Values |
---|---|---|---|
private_docker_registry.server | Docker registry host | ✓ |
|
private_docker_registry.username | Docker registry username | ✓ | |
private_docker_registry.password | Docker registry password | ✓ |
Internal Docker Registry¶
Configuration for the internal Docker registry deployed with Domino.
Override values are to allow the registry to use S3, GCS, or Azure blob store as a backend
store. GCS requires a service account already be bound into the
Kubernetes cluster with configuration to ensure the docker-registry
service account is properly mapped.
Key | Description | Required | Values |
---|---|---|---|
internal_docker_registry.s3_override.region | AWS region of the S3 bucket store | e.g. us-wes
t-2 |
|
internal_docker_registry.s3_override.bucket | S3 bucket name | e.g. domino
-bucket-1 |
|
internal_docker_registry.gcs_override.bucket | GCS bucket name | e.g. domino
-bucket-1 |
|
internal_docker_registry.gcs_override.service_account_name | GCS service account with access to the bucket | ||
internal_docker_registry.gcs_override.project_name | GCP project name that Domino is deployed into | ||
internal_docker_registry.azure_blobs_override.account_name | Azure blobstore account name | ||
internal_docker_registry.azure_blobs_override.account_key | Azure blobstore account key | ||
internal_docker_registry.azure_blobs_override.container | Azure blobstore container name |
Telemetry¶
Domino supports user telemetry data to help improve the product.
Key | Description | Required | Values |
---|---|---|---|
intercom.enabled | Enable Intercom onboarding | ✓ | true|false |
mixpanel.enabled | Enable MixPanel | ✓ | true|false |
mixpanel.token | MixPanel API token |
GPU¶
If using GPU compute nodes, enable the following configuration setting to install the required components.
Key | Description | Required | Values |
---|---|---|---|
gpu.enabled | Enable GPU support | ✓ | true|false |
Fleetcommand¶
Domino supports minor patches through an internal tool named Fleetcommand.
Key | Description | Required | Values |
---|---|---|---|
fleetcommand.enabled | Enable ability for Domino staff to apply minor patches | ✓ | true|false |
fleetcommand.api_token | Server API token |
Full configuration¶
schema: '1.0'
name: domino-deployment
version: 4.1.7
hostname: domino.example.org
pod_cidr: ''
ssl_enabled: true
ssl_redirect: true
request_resources: true
enable_network_policies: true
enable_pod_security_policies: true
create_restricted_pod_security_policy: true
namespaces:
platform:
name: domino-platform
annotations: {}
labels:
domino-platform: 'true'
compute:
name: domino-compute
annotations: {}
labels: {}
system:
name: domino-system
annotations: {}
labels: {}
ingress_controller:
create: true
gke_cluster_uuid: ''
storage_classes:
block:
create: true
name: dominodisk
type: ebs
base_path: ''
default: false
shared:
create: true
name: dominoshared
type: efs
efs:
region: ''
filesystem_id: ''
nfs:
server: ''
mount_path: ''
mount_options: []
azure_file:
storage_account: ''
blob_storage:
projects:
type: s3
s3:
region: ''
bucket: ''
sse_kms_key_id: ''
azure:
account_name: ''
account_key: ''
container: ''
gcs:
bucket: ''
service_account_name: ''
project_name: ''
logs:
type: s3
s3:
region: ''
bucket: ''
sse_kms_key_id: ''
azure:
account_name: ''
account_key: ''
container: ''
gcs:
bucket: ''
service_account_name: ''
project_name: ''
backups:
type: s3
s3:
region: ''
bucket: ''
sse_kms_key_id: ''
azure:
account_name: ''
account_key: ''
container: ''
gcs:
bucket: ''
service_account_name: ''
project_name: ''
default:
type: s3
s3:
region: ''
bucket: ''
sse_kms_key_id: ''
azure:
account_name: ''
account_key: ''
container: ''
gcs:
bucket: ''
service_account_name: ''
project_name: ''
enabled: false
autoscaler:
enabled: false
cloud_provider: aws
groups:
- name: ''
min_size: 0
max_size: 0
aws:
region: ''
azure:
resource_group: ''
subscription_id: ''
spotinst_controller:
enabled: false
token: ''
account: ''
external_dns:
enabled: false
provider: aws
domain_filters: []
zone_id_filters: []
email_notifications:
enabled: false
server: smtp.customer.org
port: 465
encryption: ssl
from_address: domino@customer.org
authentication:
username: ''
password: ''
monitoring:
prometheus_metrics: true
newrelic:
apm: false
infrastructure: false
license_key: ''
helm:
tiller_image: gcr.io/kubernetes-helm/tiller
appr_registry: quay.io
appr_insecure: false
appr_username: ''
appr_password: ''
private_docker_registry:
server: quay.io
username: ''
password: ''
internal_docker_registry:
s3_override:
region: ''
bucket: ''
sse_kms_key_id: ''
gcs_override:
bucket: ''
service_account_name: ''
project_name: ''
azure_blobs_override:
account_name: ''
account_key: ''
container: ''
telemetry:
intercom:
enabled: false
mixpanel:
enabled: false
token: ''
gpu:
enabled: false
fleetcommand:
enabled: false
api_token: ''
teleport:
acm_arn: arn:aws:acm:<region>:<account>:certificate/<id>
enabled: false
hostname: teleport-domino.example.org