June, 2025 release

Plugin server Docker container startup with Vault parameter retrieval

Learn about how to start the Plugin server Docker container by specifying CONFIGURE_MODE=Vault.

Mandatory environment variables

These are the mandatory parameters that you must specify to configure the Plugin server Docker container to retrieve more parameters from Vault. You can pass these parameters only as container environment variables.

Environment variable name Description Comments
TENANT The name of the group that contains your set of environments. For example, MyCompany. Container environment variable. This can be specified in the values.yaml configuration file under common.tenant.
ENVIRONMENT The name of the environment. For example, Non-production. Container environment variable. This can be specified in the values.yaml configuration file under common.environmentName.
VAULT_TOKEN The Vault token to use to connect to Vault and request certification from Vault PKI. Container environment variable. This can be specified in the values.yaml configuration file under common.vaultToken.
VAULT_URL The Vault URL to use to connect to Vault and request certification from Vault PKI. Container environment variable. This can be specified in the values.yaml configuration file under common.vaultUrl.
ENVTYPE The environment type. Accepted values are auth and live. Container environment variable. This can be specified in the values.yaml configuration file under common.environmentType.

Mandatory Vault key values

These are the mandatory Vault key values that you must specify within Vault to configure the Plugin server Docker container to use the Vault configuration mode.

Vault path Description Reference Environment Variable
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/spiUserName The spiuser user name.

If the value is not defined, then spiuser is used.

SPIUSER_NAME
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/spiUserPwd

The ASCII encrypted spiuser user password.

To set the password in your custom Docker containers, see Setting the spiuser password in your Docker images.

SPIUSER_PWD
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/sessionKeyEncrypt

The encrypted session key value is generated using wcs_encrypt.sh utility to encrypt 32 random hexadecimal characters.

Note: Do not specify an encryption key when running wcs_encrypt.sh.

The Session key is used to encrypt cookies and sensitive customer facing data. For example, the krypto URL parameter.

Important: You must specify your own session key for the security of your HCL Commerce installation. Do not use the default value contained within the provided sample configuration files and documentation examples.

SESSION_KEY_ENCRYPT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/adminUser The Administrator user. ADMIN_USER
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/adminPassword The Administrator password. ADMIN_PASSWORD
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/keycloakHost Specify keycloak host. KEYCLOAK_HOST
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/keycloakPort Specify keycloak port. KEYCLOAK_PORT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/keycloakScheme Specify Keycloak scheme. KEYCLOAK_SCHEME

Optional Vault key values

These are the optional Vault key values that you can specify within Vault to configure the Plugin server Docker container when used with the Vault configuration mode.

Vault path Description Reference Environment Variable
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/domainName

Specify the internal service domain name. If the deployed environment is on a special namespace on Kubernetes, then the domain name should be .svc.cluster.local.

If no value is specified, then the default, default.svc.cluster.local, is used.

DOMAIN_NAME
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/toolingOrigin Specify Tooling origin URL.

Example: https://tooling.demoqa.mycompany.com.

TOOLING_ORIGIN
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/externalDomainName

This value specifies the store-web external domain name, which can be recognized by your browser.

For example, in the hostname store.demo4qaauth.hcl.com, hcl.com is the external domain name.

EXTERNAL_DOMAIN_NAME
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/extraAllowedOrigins/plugin Extra allowed origins for plugins. EXTRA_ALLOWED_ORIGINS
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/plugin-app Logging level specifications. LOGGING_LEVEL_SPECS
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/authJWKS

Specify a value to set the JSON Web Key Set (JWKS) and key ID on the Plugin server. This is used to sign and validate the JSON Web Token (JWT).

To generate a JWKS, see the generateJWKS utility.

JWKS
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/xcHost Specify a value if you want to set a host name for the Customization server, instead of using the default value.

External customization service host

Default:{TENANT}{ENVIRONMENT}{ENVTYPE}xc−app.{ENVTYPE}xc−app.{DOMAIN_NAME}

XC_HOST
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/xcPort Specify a value if you want to set a port number for the Customization server, instead of using the default value.

External customization service port

Default: 9443

XC_PORT
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/redisPasswordEncrypt The encrypted Redis password REDIS_PASSWORD_ENCRYPT