| LISTEN_PORT=5000 |
| COUCHDB_SERVICE_PORT=5984 |
| COUCHDB_SERVICE_HOST=host.docker.internal |
| COUCHDB_ADMIN_USER=whisk_admin |
| COUCHDB_ADMIN_PASSWORD= |
| KUBERNETES_SERVICE_HOST=host.docker.internal |
| KUBERNETES_SERVICE_PORT=56490 |
| KUBERNETES_TOKEN_FILENAME=./tokens/token |
| KUBERNETES_CERT_FILENAME=./tokens/ca.crt |
| |
| # registry to use (ghcr or dockerhub or apache) |
| # if not set, the image is build with local tag and will not be pushed |
| REGISTRY= |
| # namespace is required if REGISTRY is set |
| NAMESPACE= |
| |
| REGISTRY_HOST=http://127.0.0.1:5000 |
| REGISTRY_USER=opsuser |
| REGISTRY_PASS=password |
| |
| ADMIN_API_URL=http://127.0.0.1:5002 |
| |
| # --- OIDC integration (see docs/OIDC.md) --- |
| |
| # Issuer URL of the OIDC realm (required). Also used to derive the device |
| # authorization and token endpoints unless overridden below. |
| OIDC_ISSUER_URL=https://keycloak.example.com/realms/openserverless |
| # JWKS endpoint used to verify the access token signature (required) |
| OIDC_JWKS_URL=https://keycloak.example.com/realms/openserverless/protocol/openid-connect/certs |
| # Expected audience ("aud" claim) of the access token (required) |
| OIDC_AUDIENCE=openserverless |
| # Client id used for the device and password grant flows (defaults to OIDC_AUDIENCE) |
| # OIDC_CLIENT_ID=openserverless |
| # Client secret, only needed if the OIDC client is confidential |
| OIDC_CLIENT_SECRET= |
| # Claim used as the external username (default: preferred_username) |
| OIDC_USERNAME_CLAIM=preferred_username |
| # Claim to use directly as the namespace, when present and valid |
| OIDC_NAMESPACE_CLAIM= |
| # Claim holding the user's group memberships (default: groups) |
| OIDC_GROUPS_CLAIM=groups |
| # If set, tokens without this group are rejected with 403 |
| OIDC_REQUIRED_GROUP= |
| # Clock skew tolerance in seconds applied to exp/nbf validation (default: 30) |
| OIDC_CLOCK_LEEWAY_SECONDS=30 |
| # Provider name recorded on auto-provisioned WhiskUsers (default: keycloak) |
| OIDC_PROVIDER=keycloak |
| # Device Authorization endpoint (default: ${OIDC_ISSUER_URL}/protocol/openid-connect/auth/device) |
| # OIDC_DEVICE_AUTHORIZATION_URL= |
| # Token endpoint used by the device and password flows (default: ${OIDC_ISSUER_URL}/protocol/openid-connect/token) |
| # OIDC_TOKEN_URL= |
| # Scope requested when starting a device flow (default: openid email profile) |
| OIDC_DEVICE_SCOPE=openid email profile |
| # Scope requested for the password grant (default: openid email profile) |
| OIDC_PASSWORD_SCOPE=openid email profile |
| |
| # Keep the external username as namespace when it is already a valid namespace (default: true) |
| SSO_NAMESPACE_PRESERVE_VALID=true |
| # Length of the collision-avoidance hash suffix appended to normalized namespaces (default: 8, clamped 6-16) |
| SSO_NAMESPACE_HASH_LENGTH=8 |
| # Maximum length of a generated namespace (default: 61, clamped 13-61) |
| SSO_NAMESPACE_MAX_LENGTH=61 |
| # Create a WhiskUser automatically on first successful OIDC login (default: false) |
| SSO_AUTOPROVISION_ON_LOGIN=false |
| # When set to "all", enables redis/mongodb/postgres/object-storage/milvus on the provisioned WhiskUser (default: all) |
| SSO_AUTOPROVISION_DEFAULT_SERVICES=all |
| # Object-storage quota assigned to auto-provisioned users (default: auto) |
| SSO_AUTOPROVISION_STORAGE_QUOTA=auto |
| # How long (seconds) admin-api waits for the provisioned namespace metadata to appear (default: 120) |
| SSO_AUTOPROVISION_TIMEOUT_SECONDS=120 |
| # Poll interval (seconds) while waiting for provisioning to complete (default: 2) |
| SSO_AUTOPROVISION_POLL_SECONDS=2 |
