Plugin server Docker container startup with Vault parameter retrieval
Learn about how to start the Plugin server Docker container by specifying
CONFIGURE_MODE=Vault.
Mandatory environment variables
These are the mandatory parameters that you must specify to configure the Plugin server Docker container to retrieve more parameters from Vault. You can pass these parameters only as container environment variables.
| Environment variable name | Description | Comments |
|---|---|---|
| TENANT | The name of the group that contains your set of environments. For example, MyCompany. | Container environment variable. This can be specified in the
values.yaml configuration file under
common.tenant. |
| ENVIRONMENT | The name of the environment. For example, Non-production. | Container environment variable. This can be specified in the
values.yaml configuration file under
common.environmentName. |
| VAULT_TOKEN | The Vault token to use to connect to Vault and request certification from Vault PKI. | Container environment variable. This can be specified in the
values.yaml configuration file under
common.vaultToken. |
| VAULT_URL | The Vault URL to use to connect to Vault and request certification from Vault PKI. | Container environment variable. This can be specified in the
values.yaml configuration file under
common.vaultUrl. |
| ENVTYPE | The environment type. Accepted values are auth and live. | Container environment variable. This can be specified in the
values.yaml configuration file under
common.environmentType. |
Mandatory Vault key values
These are the mandatory Vault key values that you must specify within Vault to configure the Plugin server Docker container to use the Vault configuration mode.
| Vault path | Description | Reference Environment Variable |
|---|---|---|
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/spiUserName
|
The spiuser user name. If the value is not defined, then spiuser is used. |
SPIUSER_NAME |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/spiUserPwd |
The ASCII encrypted spiuser user password. To set the password in your custom Docker containers, see Setting the spiuser password in your Docker images. |
SPIUSER_PWD |
| ${VAULT_URL}/${TENANT}/${ENVIRONMENT}/sessionKeyEncrypt |
The encrypted session key value is generated using
Note: Do not specify an encryption key
when running
wcs_encrypt.sh.The Session key is used to encrypt cookies and sensitive customer facing data. For example, the krypto URL parameter. Important: You must specify your own session key for the security of your HCL Commerce installation. Do not use the default value contained within the provided sample configuration files and documentation examples. |
SESSION_KEY_ENCRYPT |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/adminUser |
The Administrator user. | ADMIN_USER |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/adminPassword |
The Administrator password. | ADMIN_PASSWORD |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/keycloakHost
|
Specify keycloak host. | KEYCLOAK_HOST |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/keycloakPort
|
Specify keycloak port. | KEYCLOAK_PORT |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/keycloakScheme
|
Specify Keycloak scheme. | KEYCLOAK_SCHEME |
Optional Vault key values
These are the optional Vault key values that you can specify within Vault to configure the Plugin server Docker container when used with the Vault configuration mode.
| Vault path | Description | Reference Environment Variable |
|---|---|---|
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/domainName
|
Specify the internal service domain name. If the deployed environment is on a special namespace on Kubernetes, then the domain name should be .svc.cluster.local. If no value is specified, then the default, default.svc.cluster.local, is used. |
DOMAIN_NAME |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/toolingOrigin
|
Specify Tooling origin URL. Example: https://tooling.demoqa.mycompany.com. |
TOOLING_ORIGIN |
| ${VAULT_URL}/${TENANT}/${ENVIRONMENT}/externalDomainName |
This value specifies the store-web external domain name, which can be recognized by your browser. For example, in the hostname store.demo4qaauth.hcl.com, hcl.com is the external domain name. |
EXTERNAL_DOMAIN_NAME |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/extraAllowedOrigins/plugin
|
Extra allowed origins for plugins. | EXTRA_ALLOWED_ORIGINS |
| ${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/plugin-app | Logging level specifications. | LOGGING_LEVEL_SPECS |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/authJWKS |
Specify a value to set the JSON Web Key Set (JWKS) and key ID on the Plugin server. This is used to sign and validate the JSON Web Token (JWT). To generate a JWKS, see the generateJWKS utility. |
JWKS |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/xcHost
|
Specify a value if you want to set a host name for the Customization
server, instead of using the default value. External customization service host Default: |
XC_HOST |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/xcPort
|
Specify a value if you want to set a port number for the
Customization server, instead of using the default value. External customization service port Default: 9443 |
XC_PORT |
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/redisPasswordEncrypt |
The encrypted Redis password | REDIS_PASSWORD_ENCRYPT |