YAML syntax for Spicepod manifests
Spicepod manifests use YAML syntax. They are stored in the root directory of the application and must be named spicepod.yaml
or spicepod.yml
.
If you are new to YAML and want to learn more, see "Learn YAML in Y minutes."
version
​
The version of the Spicepod manifest. The current version is v1
.
kind
​
The kind of Spicepod manifest. The kind is Spicepod
.
name
​
The name of the Spicepod.
secrets
​
The secrets section in the Spicepod manifest is optional and is used to configure how secrets are stored and accessed by the Spicepod. For more information, see Secret Stores.
secrets.from
​
The from
field is a string that represents the Uniform Resource Identifier (URI) for the secret store. This URI is composed of two parts: a prefix indicating the Secret Store to use, and an optional selector that specifies the secret to retrieve.
The syntax for the from
field is as follows:
from: <secret_store>:<selector>
Where:
-
<secret_store>
: The Secret Store to useCurrently supported secret stores:
If no secret stores are explicitly specified, it defaults to
env
. -
<selector>
: The secret within the secret store to load.
The type of secret store for reading secrets.
Example
secrets:
- from: env
name: env
secrets.name
​
The name of the secret store. This is used to reference the store in the secret replacement syntax, ${<secret_store_name>:<key_name>}
.
runtime
​
runtime.dataset_load_parallelism
​
This configuration setting determines the maximum number of datasets that can be loaded in parallel during startup.
By default, the maximum number of parallel datasets is effectively unlimited.
runtime.results_cache
​
The results cache section specifies runtime cache configuration. Learn more.
runtime:
results_cache:
enabled: true
cache_max_size: 128MiB
eviction_policy: lru
item_ttl: 1s
enabled
- optional,true
by defaultcache_max_size
- optional, maximum cache size. Default is128MiB
eviction_policy
- optional, cache replacement policy when the cached data reaches thecache_max_size
. Default islru
- least-recently-used (LRU)item_ttl
- optional, cache entry expiration time, 1 second by default.
runtime.tls
​
The TLS section specifies the configuration for enabling Transport Layer Security (TLS) for all endpoints exposed by the runtime. Learn more about enabling TLS.
In addition to configuring TLS via the manifest, TLS can also be configured via spiced
command line arguments using with --tls-enabled true
and --tls-certificate
/--tls-certificate-file
and --tls-key
/--tls-key-file
flags.
runtime.tls.enabled
​
Enables or disables TLS for the runtime endpoints.
runtime:
tls:
...
enabled: true # or false
runtime.tls.certificate
​
The TLS certificate to use for securing the runtime endpoints. The certificate can also come from secrets.
runtime:
tls:
...
certificate: |
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
runtime:
tls:
...
certificate: ${secrets:tls_cert}
runtime.tls.certificate_file
​
The path to the TLS PEM-encoded certificate file. Only one of certificate
or certificate_file
must be used.
runtime:
tls:
...
certificate_file: /path/to/cert.pem
runtime.tls.key
​
The TLS key to use for securing the runtime endpoints. The key can also come from secrets.
runtime:
tls:
...
key: |
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
runtime:
tls:
...
key: ${secrets:tls_key}
runtime.tls.key_file
​
The path to the TLS PEM-encoded key file. Only one of key
or key_file
must be used.
runtime:
tls:
...
key_file: /path/to/key.pem