BAAS configuration

Scope of this page

The chart exposes almost all of Dgraph’s configuration: two components (zero and alpha), a backup system, and every Dgraph flag through extraFlags and configFile. This page documents the OIDC settings, the scope map, and the chart values likely to need changing.

For everything else — Dgraph flags, cluster sizing, sharding, enterprise features — see the Dgraph documentation:

• Dgraph deployment and configuration
• Dgraph CLI reference
• Encryption at rest

Application configuration

baas has no single configuration value: each section below says which chart value its settings go into.

OIDC authentication

How baas validates users’ OIDC tokens and decides what each user may do from the scope map. Set these through the chart’s alpha.extraEnvs.

alpha.scopemap

The scope map defines who may do what, and is the one piece of this chart you are most likely to edit. The scope map is a single JSON document, rendered into an …-alpha-scopemap ConfigMap and mounted at /dgraph/additional-config.

The document has three top-level fields:

Each rule has these fields:

The default scope map groups the types as follows. Each group also lists the matching …AggregateResult types, and most include Comment and HierarchyScope.

The default scope map contains one rule: admin can do everything everywhere. Anything more granular has to be added. Adding a new GraphQL type to the schema also means adding it to a group here, or no rule can reach it.

A scope map with one rule, letting the operator role query the types grouped under resources:

alpha:
  scopemap:
    scopemap.json: |
      {
        "rules": [
          {
            "id": "rule-001",
            "description": "Operators can read resources",
            "roles": ["operator"],
            "resources": ["resources.*"],
            "actions": ["query"],
            "jurisdictions": ["*"]
          }
        ],
        "jurisdictions": ["default"],
        "resources": {
          "resources": ["Equipment", "EquipmentClass"]
        }
      }

alpha.cdc

Change data capture, which publishes every mutation to one destination, chosen by alpha.cdc.sink.

Mutations published to Kafka with SASL:

alpha:
  cdc:
    enabled: true
    sink: kafka
    topic: dgraph-cdc
    kafka:
      brokers: redpanda:9092
      saslUser: cdc
      saslPassword: ExamplePassword123
      saslMechanism: SCRAM-SHA-256

Helm chart values

The shared values documented in shared-helm-values.md do not apply to this chart, which nests everything under zero, alpha, backups, and global. The values below are the ones likely to need changing.

Image

Alpha

An alpha sized for a larger data set, the OIDC endpoint it needs, and one setting passed through its own config file. The environment variables the chart ships are repeated here, since the list replaces them:

alpha:
  configFile:
    config.yaml: |
      lru_mb: 2048
  extraEnvs:
    - name: DGRAPH_ALPHA_WHITELIST
      value: 0.0.0.0:255.255.255.255
    - name: BAAS_OIDC_URL
      value: "http://keycloak:80"
    - name: BAAS_OIDC_REALM
      value: "libre"
    - name: BAAS_OIDC_CLIENT_ID
      value: "libreBaas"
    - name: BAAS_OIDC_SCOPEMAP
      value: /dgraph/additional-config/scopemap.json
  extraEnvFrom:
    - secretRef:
        name: my-secret
  resources:
    requests:
      memory: 8Gi
      cpu: 2

Zero

A zero with a larger memory request:

zero:
  resources:
    requests:
      memory: 1Gi

Backups

Dgraph enterprise backups, run as Kubernetes CronJobs that call the alpha admin endpoint.

Global

One Ingress for alpha, terminating TLS with an existing Secret:

global:
  ingress:
    tls:
      - hosts:
          - baas.example.libremfg.ai
        secretName: baas-tls
    annotations:
      kubernetes.io/ingress.class: traefik