ISA-95 configuration

This document covers how to configure the ISA-95 service through its Helm Chart.

Application configuration

isa95 is configured entirely through environment variables, set in the chart’s envVars. There is no configuration file, so any setting left unset takes its default value.

General settings

Value	Description
`port`	Port isa95 listens on, serving the Restate handler, `/healthz`, `/metrics`, and the custom GraphQL endpoint. Keep this in step with the chart’s container port and probes, which both use the default value. Environment variable: `RHIZE_ISA95_PORT` Default: `8081` Example: `8081` Type: string
`servicename`	Name Restate is told to call this service back on, combined with `port` to form the registered deployment URI. Derived from the pod hostname, so override it when the Kubernetes Service name differs from the Deployment name. Environment variable: `RHIZE_ISA95_SERVICENAME` Default: the Deployment name Example: `isa95` Type: string
`baas.url` [Required]	URL of the BAAS GraphQL endpoint, used for all GraphQL queries, GraphQL mutations, and DQL transactions. Environment variable: `RHIZE_ISA95_BAAS_URL` Default: `http://baas-alpha:8080/graphql` Example: `http://baas-alpha:8080/graphql` Type: string
`secret.key` [Required when a secret value is written or read]	Passphrase used to derive the `age` scrypt identity that encrypts and decrypts secret values. Creating or reading a secret fails with “LIBRE_SECRET_KEY is not configured” when empty. Must be the same passphrase used by other services that read the same secrets. Supply from a Kubernetes Secret. Environment variable: `RHIZE_ISA95_SECRET_KEY` Example: `ExamplePassphrase-Rhize-2026` Type: string
`logging.level`	Lowest severity that reaches the log, one of `trace`, `debug`, `info`, `warn`, `error`, `fatal`, `panic`, or `disabled`. Each level lets through itself and everything more severe, so `info` keeps informational messages, warnings, and errors but drops trace and debug, and `disabled` stops isa95 logging at all. Environment variable: `RHIZE_ISA95_LOGGING_LEVEL` Default: `trace` Example: `info` Type: string
`logging.type`	Output format. `json` writes structured JSON to stderr, for collection by a log aggregator. `multi` writes human-readable lines to stderr and JSON to stdout at the same time. Left unset, as the chart leaves it, logs are written as human-readable lines to stderr. Environment variable: `RHIZE_ISA95_LOGGING_TYPE` Example: `json` Type: string

`oidc`

At startup isa95 fetches the provider’s .well-known/openid-configuration and public keys and then obtains an access token; failure at either step exits the process. isa95 signs in as a user rather than as the client, so it takes a username and password alongside the client id and secret.

Value	Description
`oidc.serverUrl` [Required]	Base URL of the OIDC provider. isa95 appends the realm path. Environment variable: `RHIZE_ISA95_OIDC_SERVERURL` Default: `http://localhost:8090` Example: `http://keycloak:80` Type: string
`oidc.realm` [Required when `oidc.enableGenericOidc` is `false`]	Keycloak realm, appended to `oidc.serverUrl`. Environment variable: `RHIZE_ISA95_OIDC_REALM` Default: `libre` Example: `libre` Type: string
`oidc.clientId` [Required]	Client ID isa95 authenticates as. Environment variable: `RHIZE_ISA95_OIDC_CLIENTID` Example: `libreISA95` Type: string
`oidc.clientSecret` [Required]	Client secret paired with `oidc.clientId`. Supply from a Kubernetes Secret. Environment variable: `RHIZE_ISA95_OIDC_CLIENTSECRET` Example: `Qm7xT2vLp9RcW4nZk8HbY3jDf6sGa1Ue` Type: string
`oidc.username` [Required]	Service account isa95 signs in as. Environment variable: `RHIZE_ISA95_OIDC_USERNAME` Example: `libreisa95@libremfg.ai` Type: string
`oidc.password` [Required]	Password for `oidc.username`. Supply from a Kubernetes Secret. Environment variable: `RHIZE_ISA95_OIDC_PASSWORD` Example: `ExamplePassword123` Type: string
`oidc.enableGenericOidc`	Switches from Keycloak-specific token handling to generic OIDC. Environment variable: `RHIZE_ISA95_OIDC_ENABLEGENERICOIDC` Default: `false` Example: `false` Type: boolean
`oidc.customRolesKey`	JWT claim holding roles under generic OIDC. Environment variable: `RHIZE_ISA95_OIDC_CUSTOMROLESKEY` Default: `rhize.com/roles` Example: `rhize.com/roles` Type: string
`oidc.customAudienceKey`	JWT claim holding the audience under generic OIDC. Falls back to the standard `aud` claim when empty. Environment variable: `RHIZE_ISA95_OIDC_CUSTOMAUDIENCEKEY` Default: `rhize.com/aud` Example: `rhize.com/aud` Type: string
`libreDataStoreGraphQl.caFile`	Path to a PEM CA certificate isa95 trusts in addition to the system roots when making outbound HTTPS calls. Empty means system roots only. Set it to the path the certificate is mounted at, which is `/certs/graphql_ca.crt` for a certificate supplied through the chart’s `graphqlCA` value. Environment variable: `RHIZE_ISA95_LIBREDATASTOREGRAPHQL_CAFILE` Example: `/certs/graphql_ca.crt` Type: string

`restate`

Value	Description
`restate.admin` [Required]	Restate admin API. Used at startup to register this deployment with `force: true`, and by the admin API service. A trailing slash is stripped. Registration failure is logged as a warning, but an unregistered service never receives work. Environment variable: `RHIZE_ISA95_RESTATE_ADMIN` Default: `http://localhost:9070` Example: `http://restate:9070` Type: string
`restate.serverurl` [Required]	Restate ingress URL used when isa95 invokes handlers itself. Environment variable: `RHIZE_ISA95_RESTATE_SERVERURL` Default: `http://localhost:18080` Example: `http://restate:8080` Type: string

`kafka`

Consumed only when valuechange.direct is enabled, which puts isa95 into direct Kafka consumption rather than receiving events through Restate.

Value	Description
`kafka.servername` [Required when `valuechange.direct` is `true`]	Broker hostname, joined with `kafka.serverport` to form the bootstrap address. Environment variable: `RHIZE_ISA95_KAFKA_SERVERNAME` Default: `localhost` Example: `redpanda` Type: string
`kafka.serverport` [Required when `valuechange.direct` is `true`]	Broker port. Environment variable: `RHIZE_ISA95_KAFKA_SERVERPORT` Default: `29092` Example: `9092` Type: string
`kafka.groupid`	Consumer group id. Change the group id only if you intend to run an independent set of consumers. Environment variable: `RHIZE_ISA95_KAFKA_GROUPID` Default: `rhize-isa95` Example: `rhize-isa95` Type: string
`kafka.consumer_count`	Number of consumers started per topic. Raise the count to read faster, up to the number of partitions on the topic. Environment variable: `RHIZE_ISA95_KAFKA_CONSUMER_COUNT` Default: `1` Example: `1` Type: integer
`valuechange.direct`	Enables direct Kafka consumption of value change events. When off, none of the Kafka settings are used. Environment variable: `RHIZE_ISA95_VALUECHANGE_DIRECT` Default: `false` Example: `false` Type: boolean
`valuechange.topic`	Space-separated list of topics to consume. Empty means the single topic `ValueChange`. Environment variable: `RHIZE_ISA95_VALUECHANGE_TOPIC` Example: `ValueChange import_materials import` Type: list
`ludicrous.mode`	Commits Kafka offsets in batches rather than one per message, which is faster but can replay or skip a few messages after an unclean restart. Environment variable: `RHIZE_ISA95_LUDICROUS_MODE` Default: `false` Example: `false` Type: boolean

`questdb`

The time series store for equipment property history. Reads and writes use two different QuestDB ports: queries go over the PostgreSQL protocol, and writes go over the InfluxDB line protocol on HTTP.

Value	Description
`questdb.host` [Required when `timeseries.enabled` is `true`]	QuestDB hostname, used for both queries and writes. Environment variable: `RHIZE_ISA95_QUESTDB_HOST` Default: `localhost` Example: `questdb` Type: string
`questdb.port` [Required when `timeseries.enabled` is `true`]	Port QuestDB serves the PostgreSQL protocol on, used for queries only; writes always go to port 9000 unless `questdb.ilpconf` says otherwise. QuestDB serves this on `8812` unless it has been configured otherwise, so set this to match the QuestDB being used. Environment variable: `RHIZE_ISA95_QUESTDB_PORT` Default: `38812` Example: `8812` Type: integer
`questdb.username` [Required when `timeseries.enabled` is `true`]	QuestDB username. Environment variable: `RHIZE_ISA95_QUESTDB_USERNAME` Example: `admin` Type: string
`questdb.password` [Required when `timeseries.enabled` is `true`]	QuestDB password. Supply from a Kubernetes Secret. Environment variable: `RHIZE_ISA95_QUESTDB_PASSWORD` Example: `ExamplePassword123` Type: string
`questdb.ilpconf`	Complete line protocol connection string, which when set replaces the string built from host, username, and password. Use this string to reach QuestDB on a non-default line protocol port or over TLS. Environment variable: `RHIZE_ISA95_QUESTDB_ILPCONF` Example: `http::addr=questdb:9000;` Type: string
`timeseries.enabled`	Enables time series recording of equipment property changes and binds the historical equipment property Restate service. Environment variable: `RHIZE_ISA95_TIMESERIES_ENABLED` Default: `true` Example: `true` Type: boolean

`equipment_property_change_buffer`

Batches equipment property changes before writing them to the time series store. Each value falls back to the built-in default if it is zero or negative, with a warning.

Value	Description
`equipment_property_change_buffer.flush_interval`	How often buffered changes are flushed. Environment variable: `RHIZE_ISA95_EQUIPMENT_PROPERTY_CHANGE_BUFFER_FLUSH_INTERVAL` Default: `1s` Example: `1s` Type: duration
`equipment_property_change_buffer.buffer_size_per_equipment`	Maximum buffered changes held per equipment before an early flush. Environment variable: `RHIZE_ISA95_EQUIPMENT_PROPERTY_CHANGE_BUFFER_BUFFER_SIZE_PER_EQUIPMENT` Default: `50` Example: `50` Type: integer
`equipment_property_change_buffer.receive_channel_size`	Capacity of the channel feeding the buffer. Raise the capacity if bursts of incoming data are being dropped. Environment variable: `RHIZE_ISA95_EQUIPMENT_PROPERTY_CHANGE_BUFFER_RECEIVE_CHANNEL_SIZE` Default: `1000` Example: `1000` Type: integer

Other services

Value	Description
`jsonata.grpc` [Required]	Host and port of `typescript-host-service`, as a single `host:port` string. Environment variable: `RHIZE_ISA95_JSONATA_GRPC` Default: `localhost:19082` Example: `typescript-host-service:9082` Type: string
`opentelemetry.serverurl`	OTLP endpoint for trace export. Environment variable: `RHIZE_ISA95_OPENTELEMETRY_SERVERURL` Default: `localhost:4317` Example: `tempo-distributor.monitoring.svc.cluster.local:4317` Type: string

Helm chart values

Values shared by every chart are documented in shared-helm-values.md. This chart deploys a Deployment, has no ConfigMap, and passes all configuration as environment variables.

Value	Description
`envVars` [Required]	Map of environment variable names to values, passed straight to the container. This is the primary configuration mechanism for isa95. Default: `RHIZE_ISA95_BAAS_URL` and `RHIZE_ISA95_PORT` Example: see the example block below Type: map
`additionalSecrets`	List of entries that each carry one value from a Kubernetes Secret into an environment variable: `name` is the variable the service reads, `secretName` is the Secret to take the value from, and `secretKey` is the name of the entry within that Secret. This is how every credential should reach isa95, using the environment variable names listed in the tables above: `RHIZE_ISA95_OIDC_CLIENTSECRET`, `RHIZE_ISA95_OIDC_PASSWORD`, `RHIZE_ISA95_SECRET_KEY`, and the QuestDB password. Example: see the example block below Type: list
`graphqlCA`	Contents of a PEM CA certificate for outbound HTTPS calls, given as a YAML block, `graphqlCA: \|`, with the certificate’s lines indented beneath. Trusting a certificate takes two values: give the certificate here, which mounts it at `/certs/graphql_ca.crt`, and set `RHIZE_ISA95_LIBREDATASTOREGRAPHQL_CAFILE` to that path through `envVars`. Example: `-----BEGIN CERTIFICATE-----…` Type: string

The Deployment also sets POD_IP from the downward API.

The Restate admin URL set directly, and two credentials taken from Secrets:

envVars:
  RHIZE_ISA95_RESTATE_ADMIN: "http://restate:9070"
additionalSecrets:
  - name: RHIZE_ISA95_OIDC_CLIENTSECRET
    secretName: libre-client-secrets
    secretKey: libreISA95
  - name: RHIZE_ISA95_SECRET_KEY
    secretName: libre-secrets
    secretKey: isa95SecretKey

BAAS configuration TypeScript host service configuration