Skip to main content
Version: 3.5 (unsupported)
    Features and pricing

    Configure a custom values file for ScalarDL Auditor

    This document explains how to create your custom values file for the ScalarDL Auditor chart. If you want to know the details of the parameters, please refer to the README of the ScalarDL Auditor chart.

    Required configurations​

    Scalar Envoy configurations​

    You must set the Scalar Envoy configurations in the custom values file for ScalarDL Auditor. This is because client requests are sent to ScalarDL Auditor via Scalar Envoy as the load balancer of gRPC requests if you deploy ScalarDL Auditor on a Kubernetes environment.

    Please refer to the document Configure a custom values file for Scalar Envoy for more details on the Scalar Envoy configurations.

    envoy:
      configurationsForScalarEnvoy: 
        ...

    auditor:
      configurationsForScalarDLAuditor: 
        ...

    Image configurations​

    You must set auditor.image.repository. Be sure to specify the ScalarDL Auditor container image so that you can pull the image from the container repository.

    auditor:
      image:
        repository: <SCALARDL_AUDITOR_CONTAINER_IMAGE>

    For more details on the container repository for Scalar products, see How to get the container images of Scalar products.

    Auditor/Database configurations​

    You must set auditor.auditorProperties. Please set your auditor.properties to this parameter. Please refer to the auditor.properties for more details on the configuration of ScalarDL Auditor.

    auditor:
      auditorProperties: |
        scalar.db.contact_points=localhost
        scalar.db.username=cassandra
        scalar.db.password=cassandra
        scalar.db.storage=cassandra
        scalar.dl.auditor.ledger.host=<Host name to access ScalarDL Ledger pods>
        scalar.dl.auditor.private_key_path=/keys/auditor-key-file
        scalar.dl.auditor.cert_path=/keys/auditor-cert-file

    Key/Certificate configurations​

    You must set a private key file to scalar.dl.auditor.private_key_path and a certificate file to scalar.dl.auditor.cert_path.

    You must also mount the private key file and the certificate file on the ScalarDL Auditor pod.

    For more details on how to mount the private key file and the certificate file, refer to Mount key and certificate files on a pod in ScalarDL Helm Charts.

    Optional configurations​

    If you want to control pod resources using the requests and limits of Kubernetes, you can use auditor.resources.

    Note that the resources for one pod of Scalar products are limited to 2vCPU / 4GB memory from the perspective of the commercial license. Also, when you get the pay-as-you-go containers provided from AWS Marketplace, you cannot run those containers with more than 2vCPU / 4GB memory configuration in the resources.limits. When you exceed this limitation, pods are automatically stopped.

    You can configure them using the same syntax as the requests and limits of Kubernetes. So, please refer to the official document Resource Management for Pods and Containers for more details on the requests and limits of Kubernetes.

    auditor:
      resources:
        requests:
          cpu: 2000m
          memory: 4Gi
        limits:
          cpu: 2000m
          memory: 4Gi

    Secret configurations​

    If you want to use environment variables to set some properties (e.g., credentials) in the auditor.auditorProperties, you can use auditor.secretName to specify the Secret resource that includes some credentials.

    For example, you can set credentials for a backend database (scalar.db.username and scalar.db.password) using environment variables, which makes your pods more secure.

    Please refer to the document How to use Secret resources to pass the credentials as the environment variables into the properties file for more details on how to use a Secret resource.

    auditor:
      secretName: "auditor-credentials-secret"

    If you want to control pod deployment using the affinity and anti-affinity of Kubernetes, you can use auditor.affinity.

    You can configure them using the same syntax as the affinity of Kubernetes. So, please refer to the official document Assigning Pods to Nodes for more details on the affinity configuration of Kubernetes.

    auditor:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app.kubernetes.io/name
                      operator: In
                      values:
                        - scalardl-audit
                    - key: app.kubernetes.io/app
                      operator: In
                      values:
                        - auditor
                topologyKey: kubernetes.io/hostname
              weight: 50

    If you want to monitor ScalarDL Auditor pods using kube-prometheus-stack, you can deploy a ConfigMap, a ServiceMonitor, and a PrometheusRule resource for kube-prometheus-stack using auditor.grafanaDashboard.enabled, auditor.serviceMonitor.enabled, and auditor.prometheusRule.enabled.

    auditor:
      grafanaDashboard:
        enabled: true
        namespace: monitoring
      serviceMonitor:
        enabled: true
        namespace: monitoring
        interval: 15s
      prometheusRule:
        enabled: true
        namespace: monitoring

    If you want to set SecurityContext and PodSecurityContext for ScalarDL Auditor pods, you can use auditor.securityContext and auditor.podSecurityContext.

    You can configure them using the same syntax as SecurityContext and PodSecurityContext of Kubernetes. So, please refer to the official document Configure a Security Context for a Pod or Container for more details on the SecurityContext and PodSecurityContext configurations of Kubernetes.

    auditor:
      podSecurityContext:
        seccompProfile:
          type: RuntimeDefault
      securityContext:
        capabilities:
          drop:
            - ALL
        runAsNonRoot: true
        allowPrivilegeEscalation: false

    TLS configurations (optional based on your environment)​

    You can enable TLS in all ScalarDL Auditor connections by using the following configurations:

    auditor:
      auditorProperties: |
        scalar.dl.auditor.server.tls.enabled=true
        scalar.dl.auditor.server.tls.cert_chain_path=/tls/certs/cert-chain.pem
        scalar.dl.auditor.server.tls.private_key_path=/tls/certs/private-key.pem
        scalar.dl.auditor.tls.enabled=true
        scalar.dl.auditor.tls.ca_root_cert_path=/tls/certs/ca-root-cert-for-ledger.pem
        scalar.dl.auditor.tls.override_authority=envoy.scalar.example.com
      tls:
        enabled: true
        overrideAuthority: "auditor.scalardl.example.com"
        caRootCertSecret: "scalardl-auditor-tls-ca"
        certChainSecret: "scalardl-auditor-tls-cert"
        privateKeySecret: "scalardl-auditor-tls-key"
        caRootCertForLedgerSecret: "scalardl-auditor-tls-ca-for-ledger"

    In this case, you have to create secret resources that include private key and certificate files for ScalarDL Ledger and ScalarDL Auditor as follows:

    kubectl create secret generic scalardl-auditor-tls-ca --from-file=ca-root-cert=/path/to/your/ca/certificate/file/for/auditor -n <NAMESPACE>
    kubectl create secret generic scalardl-auditor-tls-cert --from-file=cert-chain=/path/to/your/auditor/certificate/file -n <NAMESPACE>
    kubectl create secret generic scalardl-auditor-tls-key --from-file=private-key=/path/to/your/auditor/private/key/file -n <NAMESPACE>
    kubectl create secret generic scalardl-auditor-tls-ca-for-ledger --from-file=ca-root-cert-for-ledger=/path/to/your/ca/certificate/file/for/ledger -n <NAMESPACE>

    For more details on how to prepare private key and certificate files, see How to create private key and certificate files for Scalar products.

    Also, you can set the custom authority for TLS communication by using auditor.tls.overrideAuthority. This value doesn't change what host is actually connected. This value is intended for testing but may safely be used outside of tests as an alternative to DNS overrides. For example, you can specify the hostname presented in the certificate chain file that you set by using auditor.tls.certChainSecret. This chart uses this value for startupProbe and livenessProbe.

    Replica configurations (Optional based on your environment)​

    You can specify the number of replicas (pods) of ScalarDL Auditor using auditor.replicaCount.

    auditor:
      replicaCount: 3

    Logging configurations (Optional based on your environment)​

    If you want to change the log level of ScalarDL Auditor, you can use auditor.scalarAuditorConfiguration.auditorLogLevel.

    auditor:
      scalarAuditorConfiguration:
        auditorLogLevel: INFO

    Taint and toleration configurations (Optional based on your environment)​

    If you want to control pod deployment by using the taints and tolerations in Kubernetes, you can use auditor.tolerations.

    You can configure taints and tolerations by using the same syntax as the tolerations in Kubernetes. For details on configuring tolerations in Kubernetes, see the official Kubernetes documentation Taints and Tolerations.

    auditor:
      tolerations:
        - effect: NoSchedule
          key: scalar-labs.com/dedicated-node
          operator: Equal
          value: scalardl-auditor