Configuration Reference¶

Key	Description	Required	Values
schema	Manifest schema version	✓	“1.0”
name	Unique deployment name	✓	`[a-zA-Z0-9_-]+`
version	Domino version to install	✓	Supported versions: 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6 4.1.7.
hostname	Hostname Domino will be accessible at	✓	Valid FQDN
pod_cidr	If network policies are enabled, allow external access from this CIDR.		Valid CIDR range, e.g. `10.0.0.0/8`
ssl_enabled	Should Domino only be accessible using HTTPS	✓	`true` `false`
ssl_redirect	Should Domino automatically redirect to HTTPS on HTTP requests	✓	`true` `false`
create_ingress_controller	Create an NGINX ingress controller	✓	`true` `false`
request_resources	Create Kubernetes resource requests and limits for services	✓	`true` `false`
enable_network_policies	Use network policies for fine-grained service access	✓	`true` `false` Note: requires a compatible CNI plugin e.g. Calico
enable_pod_security_policies	Enables pod security policies for locked down system capabilities	✓	`true` `false`
create_restricted_pod_security_policy	Creates pod security policies for locked down system capabilities	✓	`true` `false`

Ingress Controller¶

blurb

Key	Description	Required	Values
ingress_controller.create	blurb.	✓	`true` `false`
ingress_controller.gke_cluster_uuid	blurb.	✓

Namespaces¶

Namespaces are a way to virtually segment Kubernetes executions. Domino will create namespaces according to the specifications in this section, and the installer requires that these namespaces not already exist at installation time.

Key	Description	Required	Values
namespaces.platform.name	Namespace to place Domino services	✓	Kubernetes Name
namespaces.compute.name	Namespace for user executions	✓	Kubernetes Name Note: may be the same as the platform namespace
namespaces.system.name	Namespace for deployment metadata	✓	Kubernetes Name
namespaces.*.annotations	Optional annotations to apply to each namespace		Kubernetes Annotation

Storage Classes¶

Storage Classes are a way to abstract the dynamic provisioning of volumes in Kubernetes.

Domino requires two storage classes:

block storage for Domino services and user executions that need fast I/O
shared storage that can be shared between multiple executions

Domino supports pre-created storage classes, although the installer can create a shared storage class backed by NFS or a cloud NFS analog as long as the cluster can access the NFS system for read and write, and the installer can create several types of block storage classes backed cloud block storage systems like Amazon EBS.

Key	Description	Required	Values
storage_classes.block.create	Whether to create the block storage class	✓	`true` `false`
storage_classes.block.name		✓	Kubernetes Name Note: always required due to platform limitations, cannot be “” which indicates the default storage class
storage_classes.block.type	Name of the block storage class to utilize	✓	`ebs` `hostpath` `gce` `azure-disk`
storage_classes.block.base_path	Base path to use on nodes as a base when using `hostpath` volumes
storage_classes.block.default	Whether to set this storage class as the default	✓	`true` `false`
storage_classes.shared.create	Whether to create the shared storage class	✓	`true` `false`
storage_classes.shared.name		✓	Kubernetes Name
storage_classes.shared.type	Type of the shared storage class to utilize	✓	`efs` `nfs` `azure-file` Note that Azure File requires outbound port 445 to be open from your Azure cluster
storage_classes.shared.efs.region	EFS store AWS region		e.g. `us-west-2`
storage_classes.shared.efs.filesystem_id	EFS filesystem ID		e.g. `fs-7a535bd1`
storage_classes.shared.nfs.server	NFS server IP or hostname
storage_classes.shared.nfs.mount_path	Base path to use on the server when creating shared storage volumes
storage_classes.shared.nfs.mount_options	YAML List of additional NFS mount options		e.g. `- mfsymlinks`
storage_classes.shared.azure_file.storage_account	Azure storage account to create filestores

Blob Storage¶

Domino can store long-term, unstructed data in “blob storage” buckets. Currently, only the shared storage class described above (NFS) and S3 are supported.

To apply a default S3 bucket or shared storage type to all use-cases of blob storage, it is only necessary to fill out the default setting and make sure enabled is true. Otherwise, all other blob storage uses (projects, logs, and backups) should be filled out.

Key	Description	Required	Values
blob_storage.default.enabled	Whether the `default` configuration should take precedence over individual config keys	✓	`true` `false`
blob_storage.*.type	Which type of blob storage to use	✓	`shared` `s3`
blob_storage.*.s3.region	AWS region of the S3 bucket store		e.g. `us-west-2`
blob_storage.*.s3.bucket	S3 bucket name		e.g. `domino-bucket-1`

Autoscaler¶

For Kubernetes clusters without native cluster scaling in response to new user executions, Domino supports the use of the cluster autoscaler.

Key	Description	Required	Values
autoscaler.enabled	Enable cluster autoscaling	✓	`true` `false`
autoscaler.cloud_provider	Cloud provider Domino is deployed with		`aws` `azure`
autoscaler.aws.region	AWS region Domino is deployed into		e.g. `us-west-2`
autoscaler.azure.resource_group	Azure resource group Domino is deployed into		Azure resource group
autoscaler.azure.subscription_id	Azure subscription ID Domino is deployed with		Azure subscription ID

Groups¶

Autoscaling groups are not dynamically discovered. Each autoscaling group must be individually specified including the minimum and maximum scaling size.

Key	Description	Values
autoscaler.groups.*.name	Autoscaling group name	Must exactly match the name in the cloud provider
autoscaler.groups.*.min_size		e.g. `0`
autoscaler.groups.*.max_size		e.g. `10`

External DNS¶

Domino can automatically configure your cloud DNS provider. More extensive documentation can be found on the external-dns homepage.

Key	Description	Required	Values
external_dns.enabled	Whether Domino should configure cloud DNS	✓	`true` `false`
external_dns.provider	Cloud DNS provider		e.g. `aws`
external_dns.domain_filters	Only allow access to domains that match this filter		e.g. `my-domain.example.com`
external_dns.zone_id_filters	Only allow updates to specific Route53 hosted zones

Email Notifications¶

Domino supports SMTP for sending email notifications in response to user actions and run results.

Key	Description	Required	Values
email_notifications.enabled	Whether Domino should send email notifications	✓	`true` `false`
email_notifications.server	SMTP server hostname or IP
email_notifications.port	SMTP server port
email_notifications.encryption	Whether the SMTP server uses SSL encryption
email_notifications.from_address	Email address to send emails from Domino with		e.g. `domino @example.com`
email_notifications.authentication.username	If using SMTP authentication, the username
email_notifications.authentication.password	If using SMTP authentication, the password

Monitoring¶

Domino supports in-cluster monitoring with Prometheus as well as more detailed, external monitoring through NewRelic APM and Infrastructure.

Key	Description	Required	Values
monitoring.prometheus_metrics	Install Prometheus monitoring	✓	`true` `false`
monitoring.newrelic.apm	Enable NewRelic APM	✓	`true` `false`
monitoring.newrelic.infrastructure	Enable NewRelic Infrastructure	✓	`true` `false`
monitoring.newrelic.license_key	NewRelic account license key

Helm¶

Configuration for the Helm repository that stores Domino’s charts.

Key	Description	Required	Values
helm.tiller_image	Unversioned Tiller Docker image reference	✓	`gcr.io/kubernetes-helm/tiller` `mirrors.domino.tech/kubernetes-helm/tiller`
helm.appr_registry	Quay Application Registry host	✓	`quay.io` `mirrors.domino.tech`
helm.appr_insecure	Allow insecure application registry references	✓	`true` `false`
helm.appr_username	Username for Quay AppR	✓
helm.appr_password	Password for Quay AppR	✓

Private Docker Registry¶

Configuration for the Docker repository that stores Domino’s images.

Key	Description	Required	Values
private_docker_registry.server	Docker registry host	✓	`quay.io` `mirrors.domino.tech`
private_docker_registry.username	Docker registry username	✓
private_docker_registry.password	Docker registry password	✓

Internal Docker Registry¶

Configuration for the internal Docker registry deployed with Domino. Override values are to allow the registry to use S3, GCS, or Azure blob store as a backend store. GCS requires a service account already be bound into the Kubernetes cluster with configuration to ensure the docker-registry service account is properly mapped.

Key	Description	Values
internal_docker_registry.s3_override.region	AWS region of the S3 bucket store	e.g. `us-wes t-2`
internal_docker_registry.s3_override.bucket	S3 bucket name	e.g. `domino -bucket-1`
internal_docker_registry.gcs_override.bucket	GCS bucket name	e.g. `domino -bucket-1`
internal_docker_registry.gcs_override.service_account_name	GCS service account with access to the bucket
internal_docker_registry.gcs_override.project_name	GCP project name that Domino is deployed into
internal_docker_registry.azure_blobs_override.account_name	Azure blobstore account name
internal_docker_registry.azure_blobs_override.account_key	Azure blobstore account key
internal_docker_registry.azure_blobs_override.container	Azure blobstore container name

Telemetry¶

Domino supports user telemetry data to help improve the product.

Key	Description	Required	Values
intercom.enabled	Enable Intercom onboarding	✓	`true\|false`
mixpanel.enabled	Enable MixPanel	✓	`true\|false`
mixpanel.token	MixPanel API token

GPU¶

If using GPU compute nodes, enable the following configuration setting to install the required components.

Key	Description	Required	Values
gpu.enabled	Enable GPU support	✓	`true\|false`

Fleetcommand¶

Domino supports minor patches through an internal tool named Fleetcommand.

Key	Description	Required	Values
fleetcommand.enabled	Enable ability for Domino staff to apply minor patches	✓	`true\|false`
fleetcommand.api_token	Server API token

Full configuration¶

schema: '1.0'
name: domino-deployment
version: 4.1.7
hostname: domino.example.org
pod_cidr: ''
ssl_enabled: true
ssl_redirect: true
request_resources: true
enable_network_policies: true
enable_pod_security_policies: true
create_restricted_pod_security_policy: true
namespaces:
  platform:
    name: domino-platform
    annotations: {}
    labels:
      domino-platform: 'true'
  compute:
    name: domino-compute
    annotations: {}
    labels: {}
  system:
    name: domino-system
    annotations: {}
    labels: {}
ingress_controller:
  create: true
  gke_cluster_uuid: ''
storage_classes:
  block:
    create: true
    name: dominodisk
    type: ebs
    base_path: ''
    default: false
  shared:
    create: true
    name: dominoshared
    type: efs
    efs:
      region: ''
      filesystem_id: ''
    nfs:
      server: ''
      mount_path: ''
      mount_options: []
    azure_file:
      storage_account: ''
blob_storage:
  projects:
    type: s3
    s3:
      region: ''
      bucket: ''
      sse_kms_key_id: ''
    azure:
      account_name: ''
      account_key: ''
      container: ''
    gcs:
      bucket: ''
      service_account_name: ''
      project_name: ''
  logs:
    type: s3
    s3:
      region: ''
      bucket: ''
      sse_kms_key_id: ''
    azure:
      account_name: ''
      account_key: ''
      container: ''
    gcs:
      bucket: ''
      service_account_name: ''
      project_name: ''
  backups:
    type: s3
    s3:
      region: ''
      bucket: ''
      sse_kms_key_id: ''
    azure:
      account_name: ''
      account_key: ''
      container: ''
    gcs:
      bucket: ''
      service_account_name: ''
      project_name: ''
  default:
    type: s3
    s3:
      region: ''
      bucket: ''
      sse_kms_key_id: ''
    azure:
      account_name: ''
      account_key: ''
      container: ''
    gcs:
      bucket: ''
      service_account_name: ''
      project_name: ''
    enabled: false
autoscaler:
  enabled: false
  cloud_provider: aws
  groups:
  - name: ''
    min_size: 0
    max_size: 0
  aws:
    region: ''
  azure:
    resource_group: ''
    subscription_id: ''
spotinst_controller:
  enabled: false
  token: ''
  account: ''
external_dns:
  enabled: false
  provider: aws
  domain_filters: []
  zone_id_filters: []
email_notifications:
  enabled: false
  server: smtp.customer.org
  port: 465
  encryption: ssl
  from_address: domino@customer.org
  authentication:
    username: ''
    password: ''
monitoring:
  prometheus_metrics: true
  newrelic:
    apm: false
    infrastructure: false
    license_key: ''
helm:
  tiller_image: gcr.io/kubernetes-helm/tiller
  appr_registry: quay.io
  appr_insecure: false
  appr_username: ''
  appr_password: ''
private_docker_registry:
  server: quay.io
  username: ''
  password: ''
internal_docker_registry:
  s3_override:
    region: ''
    bucket: ''
    sse_kms_key_id: ''
  gcs_override:
    bucket: ''
    service_account_name: ''
    project_name: ''
  azure_blobs_override:
    account_name: ''
    account_key: ''
    container: ''
telemetry:
  intercom:
    enabled: false
  mixpanel:
    enabled: false
    token: ''
gpu:
  enabled: false
fleetcommand:
  enabled: false
  api_token: ''
teleport:
  acm_arn: arn:aws:acm:<region>:<account>:certificate/<id>
  enabled: false
  hostname: teleport-domino.example.org