Nifi Docker container startup with Vault parameter retrieval

Learn about how to start the Nifi Docker container by specifying CONFIGURE_MODE=Vault.

Mandatory environment variables

These are the mandatory environment variables that you must specify to configure the Nifi Docker container to retrieve additional parameters from Vault.

The /SETUP/bin/vaultConfigure.sh script retrieves the values from Vault.
Table 1.
Environment variable name Description Comments
TENANT The name of the group that contains your set of environments. For example, MyCompany. Container environment variable. This can be specified in the values.yaml configuration file under common.tenant.
ENVIRONMENT The name of the environment. For example, Non-production. Container environment variable. This can be specified in the values.yaml configuration file under common.environmentName.
VAULT_TOKEN The Vault token to use to connect to Vault and request certification from Vault PKI. Container environment variable. This can be specified in the values.yaml configuration file under common.vaultToken.
VAULT_URL The Vault URL to use to connect to Vault and request certification from Vault PKI. Container environment variable. This can be specified in the values.yaml configuration file under common.vaultUrl.

Mandatory Vault configuration variables

These are the mandatory Vault key values that you must specify within Vault to configure the Nifi Docker container to use the Vault configuration mode.

Vault path Description Reference Environment Variable
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/elasticSearchHost Specify the elastic search host. ELASTICSEARCH_HOST
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/elasticSearchPort Specify the elastic search port. ELASTICSEARCH_PORT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/spiUserName Your SPIUSER name. The default value is spiuser.
Note: The SPIUSER_NAME parameter is optional. If it is not specified, then the default value is assumed.
 SPIUSER_NAME
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/adminSpiUserPwd The ADMIN_SPIUSER_PWD must be the same value as SPIUSER_PWD and kept as plain text. ADMIN_SPIUSER_PWD
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/zookeeper Specify the zookeeper host. ZOOKEEPER_HOST

Optional Vault configuration variables

These are the optional Vault key values that you can specify within Vault to configure the NiFi Docker container when used with the Vault configuration mode.

Vault path Description Reference Environment Variable
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/domainName The internal service domain name.

The default value is : default.svc.cluster.local.

If the deployed environment is on a special namespace on Kubernetes, the domain name should be .svc.cluster.local.

 DOMAIN_NAME
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/elasticSearchScheme The Elasticsearch service scheme.

The default value is http.

 ELASTICSEARCH_SCHEME
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/elasticSearchShardCount The number of shards to store the authoring indexes in, within the Elasticsearch service.

The default value is 1.

 AUTH_ELASTICSEARCH_SHARD_COUNT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/elasticSearchReplicaCount The number of replicas for authoring indexes, within the Elasticsearch service.

The default value is 0.

 AUTH_ELASTICSEARCH_REPLICA_COUNT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/live/elasticSearchShardCount The number of shards to store live indexes in, within the Elasticsearch service.

The default value is 1.

 LIVE_ELASTICSEARCH_SHARD_COUNT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/live/elasticSearchReplicaCount The number of replicas for live indexes, within the Elasticsearch service.

The default value is 0.

 LIVE_ELASTICSEARCH_REPLICA_COUNT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/zookeeperPort The Zookeeper service port.

The default value is 2181.

 ZOOKEEPER_PORT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/zookeeperScheme The Zookeeper service scheme.

The default value is http.

 ZOOKEEPER_SCHEME
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiWebHttpPort The Nifi web service http port.

The default value is 30600.

 NIFI_WEB_HTTP_PORT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiClusterIsNode The default value is false. NIFI_CLUSTER_IS_NODE
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiClusterNodeProtocalPort The default value is 8082. NIFI_CLUSTER_NODE_PROTOCOL_PORT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiElectionMaxWait The maximum wait time for the Nifi election node service.

The default value is 1 min.

 NIFI_ELECTION_MAX_WAIT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiJvmHeapInit The JVM initial heap size for Nifi.

The default value is 1024m.

 NIFI_JVM_HEAP_INIT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiJvmHeapMax The JVM maximum heap size for Nifi.

The default value is 4096m.

 NIFI_JVM_HEAP_MAX
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiHost The Nifi container host name.

The default value is nifi.

 NIFI_HOST
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiPort The Nifi service port.

The default value is 30600.

 NIFI_PORT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiScheme The Nifi service scheme.

The default value is http.

 NIFI_SCHEME
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/queryHost The Data Query container host name.

The default value is data-query.

 QUERY_HOST
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/queryPort The Data Query service port.

The default value is 30900.

 QUERY_PORT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/queryScheme The Data Query service scheme.

The default value is http.

 QUERY_SCHEME

Search configuration

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/indexingModel Optional The indexing model for the NiFi server is optional. By default, it is set to empty. The following options are available:
  • empty: It is applied for both CAS and eSite indexing models.
  • CAS: Uses the CAS indexing model.
  • eSite: Uses the eSite indexing model.
    Note: Ensure that the wc.search.CASIndexModel value for store 0 in the storeconf table is set correctly based on the indexing model.
  • If the indexing model is empty: Both esite and cas Ingest Connectors will be created in NiFi. In this case, wc.search.CASIndexModel for store 0 can be set to either true or false.
  • If the indexing model is set to esite: Only esite Ingest Connectors will be created in NiFi. The wc.search.CASIndexModel for store 0 must be set to false (default). If set to true, the build index will fail because cas Ingest Connectors are not created.
  • If the indexing model is set to cas: Only cas Ingest Connectors will be created in NiFi. The wc.search.CASIndexModel for store 0 must be set to true (default). If set to false, the build index will fail because esite Ingest Connectors are not created.