Configuration reference

Runtime environment

Variable	Default	Purpose
RECONCILE_INTERVAL	5m	Full observation, drift evaluation, and baseline monitoring
PROVISIONING_POLL_INTERVAL	15s	Safe follow-up while non-baseline provisioning work is active
RECONCILE_DRY_RUN	true	Deployment mutation gate
RECONCILE_DRY_RUN_UI_OVERRIDE	false	Unlock administrator Apply Live control
RECONCILE_LOCK_KEY	84190001	PostgreSQL advisory-lock key; keep identical across replicas
CLUSTER_PROBE_INTERVAL	90s	Read-only cluster reachability heartbeat
DEV_RESET_ENABLED	false	Unlock local destructive reset; never enable in production
TRUST_STORE_PATH	empty	Mounted Java trust-store path
TRUST_STORE_PASSWORD	empty	Trust-store password
CSRF_COOKIE_SECURE	true in production	Require HTTPS for the CSRF cookie

External services

Variable	Purpose
DB_URL, DB_USERNAME, DB_PASSWORD	PostgreSQL connection and Flyway migration identity
OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET	OIDC confidential browser client
VAULT_ADDR, VAULT_K8S_ROLE	Vault URL and Kubernetes-auth role
VAULT_TOKEN	Standalone direct token; do not use a fixed token in production

Secret-backed environment variables are read when a pod starts. After changing the Kubernetes Secret, restart or roll the Deployment; existing processes do not automatically reload them.

ONTAP client properties

Property	Default
ontap.max-records-per-page	100
ontap.connect-timeout	10s
ontap.read-timeout	30s
ontap.job-poll-interval	5s
ontap.job-poll-timeout	24h

The 24-hour job timeout exceeds the expected long-baseline window. Do not reduce it without reviewing unresolved-job recovery.

Helm chart 1.0.1

The chart and application image are independently versioned:

Chart: oci://registry-1.docker.io/saragihruben29/donkeyfleet-chart:1.0.1
Image: saragihruben29/donkeyfleet:<application-version>

Values	Purpose
image.*, imagePullSecrets	Application image and private-registry credentials
config.oidc.*	Issuer, client ID, roles, and shared session-encryption Secret key name
config.vault.*	Vault URL, KV mount, Kubernetes role/auth mount, and TLS behavior
config.database.url	External JDBC URL when postgres.enabled=false
config.reconcile.*	Normal/fast cadence, dry-run gates, and advisory-lock key
secret.*	Existing Secret, chart-created Secret, or External Secrets Operator mapping
postgres.*	Optional bundled single-replica PostgreSQL
vaultKubernetesAuth.*	Reviewer SA, client TokenReview grant, and optional legacy app token
replicaCount, updateStrategy, podDisruptionBudget	Application availability and rollout behavior
ingress.*	Standard Ingress or Gateway API HTTPRoute; no controller is installed
nodeSelector, tolerations, affinity	Scheduler placement

For multi-replica deployments, set config.oidc.sessionEncryptionSecretKey to the name of a key in secret.existingSecret containing at least 32 characters. No ingress sticky session is needed.

The chart's values.yaml remains the exhaustive Helm reference. Automation and replication parameters are database policy, not deployment variables; see Protection policy.