Chart Values
Overview
Section titled “Overview”As you provision external resources (storage, key management, authentication), save the configuration in two files:
- values.yaml - Non-sensitive configuration (domains, regions, feature flags)
- secrets.yaml - Sensitive credentials (passwords, API keys, access keys)
These files are used together when deploying the Governance Platform Helm chart.
Important: Never commit secrets.yaml to version control. The Helm chart will automatically create Kubernetes secrets from the values in this file.
Configuration File (values.yaml)
Section titled “Configuration File (values.yaml)”Create a values.yaml file with platform configuration. Replace REPLACE_* placeholders with values from the setup guides.
# Governance Platform Configuration
# Replace all REPLACE_* placeholders with actual values
global
:
domain
:
"
REPLACE_DOMAIN
"
# e.g., governance.example.com
# =============================================================================
# Auth Service
# =============================================================================
auth-service
:
image
:
tag
:
"
latest
"
# Use latest stable image
ingress
:
enabled
:
true
className
:
"
nginx
"
annotations
:
cert-manager.io/cluster-issuer
:
"
letsencrypt-prod
"
nginx.ingress.kubernetes.io/use-regex
:
"
true
"
nginx.ingress.kubernetes.io/rewrite-target
:
"
/$2
"
hosts
:
-
host
:
REPLACE_DOMAIN
paths
:
-
path
:
"
/authService(/|$)(.*)
"
pathType
:
ImplementationSpecific
tls
:
-
secretName
:
governance-tls
hosts
:
-
REPLACE_DOMAIN
config
:
# Identity Provider - From Auth0 or Entra ID setup guide
idp
:
provider
:
"
REPLACE_IDP_PROVIDER
"
# "auth0" or "entra"
# For Auth0 - from Auth0 setup guide
# issuer: "https://REPLACE_AUTH0_DOMAIN/"
# auth0:
# domain: "REPLACE_AUTH0_DOMAIN"
# managementAudience: "https://REPLACE_AUTH0_DOMAIN/api/v2/"
# apiIdentifier: "https://REPLACE_DOMAIN"
# For Entra ID - from Entra ID setup guide
# issuer: "https://login.microsoftonline.com/REPLACE_TENANT_ID/v2.0"
# entra:
# tenantId: "REPLACE_TENANT_ID"
# defaultRoles: "user"
# Key Management - From AWS KMS or Azure Key Vault setup guide
keyManagement
:
provider
:
"
REPLACE_KMS_PROVIDER
"
# "azure_key_vault" or "aws_kms"
# For Azure Key Vault - from Azure Key Vault setup guide
# azure_key_vault:
# vaultUrl: "https://REPLACE_KEYVAULT.vault.azure.net/"
# tenantId: "REPLACE_AZURE_TENANT_ID"
# For AWS KMS - from AWS KMS setup guide
# aws_kms:
# region: "REPLACE_AWS_REGION"
# aliasPrefix: "alias/eqtylab/did"
# deletionWindowDays: 7
# =============================================================================
# Governance Service
# =============================================================================
governance-service
:
image
:
tag
:
"
latest
"
# Use latest stable image
ingress
:
enabled
:
true
className
:
"
nginx
"
annotations
:
cert-manager.io/cluster-issuer
:
"
letsencrypt-prod
"
nginx.ingress.kubernetes.io/use-regex
:
"
true
"
nginx.ingress.kubernetes.io/rewrite-target
:
"
/$2
"
hosts
:
-
host
:
REPLACE_DOMAIN
paths
:
-
path
:
"
/governanceService(/|$)(.*)
"
pathType
:
ImplementationSpecific
tls
:
-
secretName
:
governance-tls
hosts
:
-
REPLACE_DOMAIN
config
:
# Storage Provider - From object storage setup guide
storageProvider
:
"
REPLACE_STORAGE_PROVIDER
"
# "azure_blob", "aws_s3", or "gcs"
# For Azure Blob - from Azure Blob Storage setup guide
# azureStorageAccountName: "REPLACE_STORAGE_ACCOUNT"
# azureStorageContainerName: "REPLACE_GOVERNANCE_CONTAINER"
# For AWS S3 - from AWS S3 setup guide
# awsS3Region: "REPLACE_AWS_REGION"
# awsS3BucketName: "REPLACE_GOVERNANCE_BUCKET"
# For GCS - from GCS setup guide
# gcsBucketName: "REPLACE_GOVERNANCE_BUCKET"
# Auth Provider - From authentication setup guide
# For Auth0
# authProvider: "auth0"
# auth0Domain: "REPLACE_AUTH0_DOMAIN"
# For Entra ID
# entraTenantId: "REPLACE_TENANT_ID"
# =============================================================================
# Governance Studio
# =============================================================================
governance-studio
:
image
:
tag
:
"
latest
"
# Use latest stable image
ingress
:
enabled
:
true
className
:
"
nginx
"
annotations
:
cert-manager.io/cluster-issuer
:
"
letsencrypt-prod
"
hosts
:
-
host
:
REPLACE_DOMAIN
paths
:
-
path
:
/
pathType
:
Prefix
tls
:
-
secretName
:
governance-tls
hosts
:
-
REPLACE_DOMAIN
config
:
# Auth Provider - From authentication setup guide
# For Auth0
# authProvider: "auth0"
# auth0Domain: "REPLACE_AUTH0_DOMAIN"
# auth0ClientId: "REPLACE_SPA_CLIENT_ID"
# auth0Audience: "https://REPLACE_AUTH0_DOMAIN/api/v2/"
# For Entra ID
# entraTenantId: "REPLACE_TENANT_ID"
# entraClientId: "REPLACE_SPA_CLIENT_ID"
# entraScopes: "openid profile email offline_access api://REPLACE_BACKEND_CLIENT_ID/access_as_user"
# =============================================================================
# Integrity Service
# =============================================================================
integrity-service
:
image
:
tag
:
"
latest
"
# Use latest stable image
ingress
:
enabled
:
true
className
:
"
nginx
"
annotations
:
cert-manager.io/cluster-issuer
:
"
letsencrypt-prod
"
nginx.ingress.kubernetes.io/use-regex
:
"
true
"
nginx.ingress.kubernetes.io/rewrite-target
:
"
/$2
"
hosts
:
-
host
:
REPLACE_DOMAIN
paths
:
-
path
:
"
/integrityService(/|$)(.*)
"
pathType
:
ImplementationSpecific
tls
:
-
secretName
:
governance-tls
hosts
:
-
REPLACE_DOMAIN
config
:
# Storage Provider - From object storage setup guide
integrityAppBlobStoreType
:
"
REPLACE_STORAGE_PROVIDER
"
# "azure_blob", "aws_s3", or "gcs"
# For Azure Blob - from Azure Blob Storage setup guide
# integrityAppBlobStoreAccount: "REPLACE_STORAGE_ACCOUNT"
# integrityAppBlobStoreContainer: "REPLACE_INTEGRITY_CONTAINER"
# For AWS S3 - from AWS S3 setup guide
# integrityAppBlobStoreAwsRegion: "REPLACE_AWS_REGION"
# integrityAppBlobStoreAwsBucket: "REPLACE_INTEGRITY_BUCKET"
# integrityAppBlobStoreAwsFolder: "rootstore"
# For GCS - from GCS setup guide
# integrityAppBlobStoreGcsBucket: "REPLACE_INTEGRITY_BUCKET"
# integrityAppBlobStoreGcsFolder: "rootstore"
# =============================================================================
# PostgreSQL
# =============================================================================
postgresql
:
enabled
:
true
primary
:
persistence
:
enabled
:
true
size
:
10Gi
Secrets File (secrets.yaml)
Section titled “Secrets File (secrets.yaml)”Create a secrets.yaml file with sensitive credentials. The Helm chart will automatically create Kubernetes secrets from these values.
Before starting the setup guides: Generate the platform secrets listed first (imageRegistry, database, encryption, authService, governanceWorker). The remaining secrets will be obtained from the setup guides.
# WARNING: Never commit this file to version control
# WARNING: Replace all placeholders with actual credentials
global
:
secrets
:
# Enable automatic secret creation
create
:
true
# =========================================================================
# IMAGE REGISTRY
# =========================================================================
imageRegistry
:
secretName
:
"
platform-image-pull-secret
"
registry
:
"
ghcr.io
"
values
:
username
:
"
REPLACE_GITHUB_USERNAME
"
password
:
"
REPLACE_GITHUB_PAT
"
# GitHub PAT with read:packages scope
email
:
"
REPLACE_EMAIL
"
# =========================================================================
# DATABASE CREDENTIALS
# =========================================================================
database
:
secretName
:
"
platform-database
"
values
:
username
:
"
postgres
"
password
:
"
GENERATE_SECURE_PASSWORD
"
# Generate with: openssl rand -hex 32
# =========================================================================
# ENCRYPTION KEY
# =========================================================================
encryption
:
secretName
:
"
platform-encryption-key
"
values
:
key
:
"
GENERATE_ENCRYPTION_KEY
"
# Generate with: openssl rand -base64 32
# =========================================================================
# AUTH SERVICE
# =========================================================================
authService
:
secretName
:
"
platform-auth-service
"
values
:
apiSecret
:
"
GENERATE_API_SECRET
"
# Generate with: openssl rand -base64 32
jwtSecret
:
"
GENERATE_JWT_SECRET
"
# Generate with: openssl rand -base64 32
# =========================================================================
# GOVERNANCE WORKER
# =========================================================================
governanceWorker
:
secretName
:
"
platform-governance-worker
"
values
:
encryptionKey
:
"
GENERATE_WORKER_KEY
"
# Generate with: openssl rand -base64 32
clientId
:
"
REPLACE_WORKER_M2M_CLIENT_ID
"
clientSecret
:
"
REPLACE_WORKER_M2M_CLIENT_SECRET
"
# =========================================================================
# AUTHENTICATION PROVIDER
# =========================================================================
# Configure ONE provider: auth0 or entra
auth
:
provider
:
"
REPLACE_AUTH_PROVIDER
"
# "auth0" or "entra"
# For Auth0 - From Auth0 setup guide
# auth0:
# secretName: "platform-auth0"
# values:
# clientId: "REPLACE_PLATFORM_API_CLIENT_ID"
# clientSecret: "REPLACE_PLATFORM_API_CLIENT_SECRET"
# mgmtClientId: "REPLACE_AUTH_SERVICE_CLIENT_ID"
# mgmtClientSecret: "REPLACE_AUTH_SERVICE_CLIENT_SECRET"
# For Entra ID - From Entra ID setup guide
# entra:
# secretName: "platform-entra"
# values:
# clientId: "REPLACE_BACKEND_CLIENT_ID"
# clientSecret: "REPLACE_BACKEND_CLIENT_SECRET"
# tenantId: "REPLACE_TENANT_ID"
# graphClientId: "REPLACE_GRAPH_CLIENT_ID"
# graphClientSecret: "REPLACE_GRAPH_CLIENT_SECRET"
# =========================================================================
# STORAGE CREDENTIALS
# =========================================================================
storage
:
# For AWS S3 - From AWS S3 setup guide
# aws_s3:
# secretName: "platform-aws-s3"
# values:
# accessKeyId: "REPLACE_AWS_ACCESS_KEY_ID"
# secretAccessKey: "REPLACE_AWS_SECRET_ACCESS_KEY"
# For Azure Blob - From Azure Blob Storage setup guide
# azure_blob:
# secretName: "platform-azure-blob"
# values:
# accountKey: "REPLACE_AZURE_STORAGE_KEY"
# connectionString: "DefaultEndpointsProtocol=https;AccountName=...;AccountKey=...;EndpointSuffix=core.windows.net"
# For GCS - From GCS setup guide
# gcs:
# secretName: "platform-gcs"
# values:
# serviceAccountJson: |
# {
# "type": "service_account",
# ...
# }
# =========================================================================
# KEY MANAGEMENT
# =========================================================================
# Configure ONE provider: azure_key_vault or aws_kms
keyManagement
:
provider
:
"
REPLACE_KMS_PROVIDER
"
# "azure_key_vault" or "aws_kms"
# For Azure Key Vault - From Azure Key Vault setup guide
# azure_key_vault:
# secretName: "platform-azure-key-vault"
# values:
# clientId: "REPLACE_AZURE_CLIENT_ID"
# clientSecret: "REPLACE_AZURE_CLIENT_SECRET"
# tenantId: "REPLACE_AZURE_TENANT_ID"
# vaultUrl: "https://REPLACE_VAULT.vault.azure.net/"
# For AWS KMS - From AWS KMS setup guide
# aws_kms:
# secretName: "platform-aws-kms"
# values:
# accessKeyId: "REPLACE_KMS_ACCESS_KEY_ID"
# secretAccessKey: "REPLACE_KMS_SECRET_ACCESS_KEY"
# sessionToken: ""
Customer Guidance
Section titled “Customer Guidance”- Prefer global values for shared settings.
- Use component overrides only when the customer deployment requires them.
- Store sensitive values in a secrets file or approved secret-management system.
- Use registry override values for mirrored or air-gapped installs.
- Use the chart version recorded in the release manifest.
Next Steps
Section titled “Next Steps”After creating both configuration files:
- Generate platform secrets (imageRegistry, database, encryption, authService, governanceWorker)
- Follow the setup guides to obtain provider-specific credentials
- Uncomment and fill in sections for chosen providers (Auth0/Entra, S3/Blob/GCS, KMS/Key Vault)
- Replace all REPLACE_* and GENERATE_* placeholders with actual values
- Proceed to the Helm Deployment guide