Skip to content
Governance Platform

Chart Values

Overview

Section titled “Overview”

As you provision external resources (storage, key management, authentication), save the configuration in two files:

  • values.yaml - Non-sensitive configuration (domains, regions, feature flags)
  • secrets.yaml - Sensitive credentials (passwords, API keys, access keys)

These files are used together when deploying the Governance Platform Helm chart.

Important: Never commit secrets.yaml to version control. The Helm chart will automatically create Kubernetes secrets from the values in this file.

Configuration File (values.yaml)

Section titled “Configuration File (values.yaml)”

Create a values.yaml file with platform configuration. Replace REPLACE_* placeholders with values from the setup guides.

values.yaml
# Governance Platform Configuration
# Replace all REPLACE_* placeholders with actual values


global:
  domain: "REPLACE_DOMAIN"  # e.g., governance.example.com


# =============================================================================
# Auth Service
# =============================================================================
auth-service:
  image:
    tag: "latest"  # Use latest stable image


  ingress:
    enabled: true
    className: "nginx"
    annotations:
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/rewrite-target: "/$2"
    hosts:
      - host: REPLACE_DOMAIN
        paths:
          - path: "/authService(/|$)(.*)"
            pathType: ImplementationSpecific
    tls:
      - secretName: governance-tls
        hosts:
          - REPLACE_DOMAIN


  config:
    # Identity Provider - From Auth0 or Entra ID setup guide
    idp:
      provider: "REPLACE_IDP_PROVIDER"  # "auth0" or "entra"


      # For Auth0 - from Auth0 setup guide
      # issuer: "https://REPLACE_AUTH0_DOMAIN/"
      # auth0:
      #   domain: "REPLACE_AUTH0_DOMAIN"
      #   managementAudience: "https://REPLACE_AUTH0_DOMAIN/api/v2/"
      #   apiIdentifier: "https://REPLACE_DOMAIN"


      # For Entra ID - from Entra ID setup guide
      # issuer: "https://login.microsoftonline.com/REPLACE_TENANT_ID/v2.0"
      # entra:
      #   tenantId: "REPLACE_TENANT_ID"
      #   defaultRoles: "user"


    # Key Management - From AWS KMS or Azure Key Vault setup guide
    keyManagement:
      provider: "REPLACE_KMS_PROVIDER"  # "azure_key_vault" or "aws_kms"


      # For Azure Key Vault - from Azure Key Vault setup guide
      # azure_key_vault:
      #   vaultUrl: "https://REPLACE_KEYVAULT.vault.azure.net/"
      #   tenantId: "REPLACE_AZURE_TENANT_ID"


      # For AWS KMS - from AWS KMS setup guide
      # aws_kms:
      #   region: "REPLACE_AWS_REGION"
      #   aliasPrefix: "alias/eqtylab/did"
      #   deletionWindowDays: 7


# =============================================================================
# Governance Service
# =============================================================================
governance-service:
  image:
    tag: "latest"  # Use latest stable image


  ingress:
    enabled: true
    className: "nginx"
    annotations:
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/rewrite-target: "/$2"
    hosts:
      - host: REPLACE_DOMAIN
        paths:
          - path: "/governanceService(/|$)(.*)"
            pathType: ImplementationSpecific
    tls:
      - secretName: governance-tls
        hosts:
          - REPLACE_DOMAIN


  config:
    # Storage Provider - From object storage setup guide
    storageProvider: "REPLACE_STORAGE_PROVIDER"  # "azure_blob", "aws_s3", or "gcs"


    # For Azure Blob - from Azure Blob Storage setup guide
    # azureStorageAccountName: "REPLACE_STORAGE_ACCOUNT"
    # azureStorageContainerName: "REPLACE_GOVERNANCE_CONTAINER"


    # For AWS S3 - from AWS S3 setup guide
    # awsS3Region: "REPLACE_AWS_REGION"
    # awsS3BucketName: "REPLACE_GOVERNANCE_BUCKET"


    # For GCS - from GCS setup guide
    # gcsBucketName: "REPLACE_GOVERNANCE_BUCKET"


    # Auth Provider - From authentication setup guide
    # For Auth0
    # authProvider: "auth0"
    # auth0Domain: "REPLACE_AUTH0_DOMAIN"


    # For Entra ID
    # entraTenantId: "REPLACE_TENANT_ID"


# =============================================================================
# Governance Studio
# =============================================================================
governance-studio:
  image:
    tag: "latest"  # Use latest stable image


  ingress:
    enabled: true
    className: "nginx"
    annotations:
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
    hosts:
      - host: REPLACE_DOMAIN
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: governance-tls
        hosts:
          - REPLACE_DOMAIN


  config:
    # Auth Provider - From authentication setup guide
    # For Auth0
    # authProvider: "auth0"
    # auth0Domain: "REPLACE_AUTH0_DOMAIN"
    # auth0ClientId: "REPLACE_SPA_CLIENT_ID"
    # auth0Audience: "https://REPLACE_AUTH0_DOMAIN/api/v2/"


    # For Entra ID
    # entraTenantId: "REPLACE_TENANT_ID"
    # entraClientId: "REPLACE_SPA_CLIENT_ID"
    # entraScopes: "openid profile email offline_access api://REPLACE_BACKEND_CLIENT_ID/access_as_user"


# =============================================================================
# Integrity Service
# =============================================================================
integrity-service:
  image:
    tag: "latest"  # Use latest stable image


  ingress:
    enabled: true
    className: "nginx"
    annotations:
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/rewrite-target: "/$2"
    hosts:
      - host: REPLACE_DOMAIN
        paths:
          - path: "/integrityService(/|$)(.*)"
            pathType: ImplementationSpecific
    tls:
      - secretName: governance-tls
        hosts:
          - REPLACE_DOMAIN


  config:
    # Storage Provider - From object storage setup guide
    integrityAppBlobStoreType: "REPLACE_STORAGE_PROVIDER"  # "azure_blob", "aws_s3", or "gcs"


    # For Azure Blob - from Azure Blob Storage setup guide
    # integrityAppBlobStoreAccount: "REPLACE_STORAGE_ACCOUNT"
    # integrityAppBlobStoreContainer: "REPLACE_INTEGRITY_CONTAINER"


    # For AWS S3 - from AWS S3 setup guide
    # integrityAppBlobStoreAwsRegion: "REPLACE_AWS_REGION"
    # integrityAppBlobStoreAwsBucket: "REPLACE_INTEGRITY_BUCKET"
    # integrityAppBlobStoreAwsFolder: "rootstore"


    # For GCS - from GCS setup guide
    # integrityAppBlobStoreGcsBucket: "REPLACE_INTEGRITY_BUCKET"
    # integrityAppBlobStoreGcsFolder: "rootstore"


# =============================================================================
# PostgreSQL
# =============================================================================
postgresql:
  enabled: true
  primary:
    persistence:
      enabled: true
      size: 10Gi

Secrets File (secrets.yaml)

Section titled “Secrets File (secrets.yaml)”

Create a secrets.yaml file with sensitive credentials. The Helm chart will automatically create Kubernetes secrets from these values.

Before starting the setup guides: Generate the platform secrets listed first (imageRegistry, database, encryption, authService, governanceWorker). The remaining secrets will be obtained from the setup guides.

secrets.yaml
# WARNING: Never commit this file to version control
# WARNING: Replace all placeholders with actual credentials


global:
  secrets:
    # Enable automatic secret creation
    create: true


    # =========================================================================
    # IMAGE REGISTRY
    # =========================================================================
    imageRegistry:
      secretName: "platform-image-pull-secret"
      registry: "ghcr.io"
      values:
        username: "REPLACE_GITHUB_USERNAME"
        password: "REPLACE_GITHUB_PAT"  # GitHub PAT with read:packages scope
        email: "REPLACE_EMAIL"


    # =========================================================================
    # DATABASE CREDENTIALS
    # =========================================================================
    database:
      secretName: "platform-database"
      values:
        username: "postgres"
        password: "GENERATE_SECURE_PASSWORD"  # Generate with: openssl rand -hex 32


    # =========================================================================
    # ENCRYPTION KEY
    # =========================================================================
    encryption:
      secretName: "platform-encryption-key"
      values:
        key: "GENERATE_ENCRYPTION_KEY"  # Generate with: openssl rand -base64 32


    # =========================================================================
    # AUTH SERVICE
    # =========================================================================
    authService:
      secretName: "platform-auth-service"
      values:
        apiSecret: "GENERATE_API_SECRET"  # Generate with: openssl rand -base64 32
        jwtSecret: "GENERATE_JWT_SECRET"  # Generate with: openssl rand -base64 32


    # =========================================================================
    # GOVERNANCE WORKER
    # =========================================================================
    governanceWorker:
      secretName: "platform-governance-worker"
      values:
        encryptionKey: "GENERATE_WORKER_KEY"  # Generate with: openssl rand -base64 32
        clientId: "REPLACE_WORKER_M2M_CLIENT_ID"
        clientSecret: "REPLACE_WORKER_M2M_CLIENT_SECRET"


    # =========================================================================
    # AUTHENTICATION PROVIDER
    # =========================================================================
    # Configure ONE provider: auth0 or entra
    auth:
      provider: "REPLACE_AUTH_PROVIDER"  # "auth0" or "entra"


      # For Auth0 - From Auth0 setup guide
      # auth0:
      #   secretName: "platform-auth0"
      #   values:
      #     clientId: "REPLACE_PLATFORM_API_CLIENT_ID"
      #     clientSecret: "REPLACE_PLATFORM_API_CLIENT_SECRET"
      #     mgmtClientId: "REPLACE_AUTH_SERVICE_CLIENT_ID"
      #     mgmtClientSecret: "REPLACE_AUTH_SERVICE_CLIENT_SECRET"


      # For Entra ID - From Entra ID setup guide
      # entra:
      #   secretName: "platform-entra"
      #   values:
      #     clientId: "REPLACE_BACKEND_CLIENT_ID"
      #     clientSecret: "REPLACE_BACKEND_CLIENT_SECRET"
      #     tenantId: "REPLACE_TENANT_ID"
      #     graphClientId: "REPLACE_GRAPH_CLIENT_ID"
      #     graphClientSecret: "REPLACE_GRAPH_CLIENT_SECRET"


    # =========================================================================
    # STORAGE CREDENTIALS
    # =========================================================================
    storage:
      # For AWS S3 - From AWS S3 setup guide
      # aws_s3:
      #   secretName: "platform-aws-s3"
      #   values:
      #     accessKeyId: "REPLACE_AWS_ACCESS_KEY_ID"
      #     secretAccessKey: "REPLACE_AWS_SECRET_ACCESS_KEY"


      # For Azure Blob - From Azure Blob Storage setup guide
      # azure_blob:
      #   secretName: "platform-azure-blob"
      #   values:
      #     accountKey: "REPLACE_AZURE_STORAGE_KEY"
      #     connectionString: "DefaultEndpointsProtocol=https;AccountName=...;AccountKey=...;EndpointSuffix=core.windows.net"


      # For GCS - From GCS setup guide
      # gcs:
      #   secretName: "platform-gcs"
      #   values:
      #     serviceAccountJson: |
      #       {
      #         "type": "service_account",
      #         ...
      #       }


    # =========================================================================
    # KEY MANAGEMENT
    # =========================================================================
    # Configure ONE provider: azure_key_vault or aws_kms
    keyManagement:
      provider: "REPLACE_KMS_PROVIDER"  # "azure_key_vault" or "aws_kms"


      # For Azure Key Vault - From Azure Key Vault setup guide
      # azure_key_vault:
      #   secretName: "platform-azure-key-vault"
      #   values:
      #     clientId: "REPLACE_AZURE_CLIENT_ID"
      #     clientSecret: "REPLACE_AZURE_CLIENT_SECRET"
      #     tenantId: "REPLACE_AZURE_TENANT_ID"
      #     vaultUrl: "https://REPLACE_VAULT.vault.azure.net/"


      # For AWS KMS - From AWS KMS setup guide
      # aws_kms:
      #   secretName: "platform-aws-kms"
      #   values:
      #     accessKeyId: "REPLACE_KMS_ACCESS_KEY_ID"
      #     secretAccessKey: "REPLACE_KMS_SECRET_ACCESS_KEY"
      #     sessionToken: ""

Customer Guidance

Section titled “Customer Guidance”
  • Prefer global values for shared settings.
  • Use component overrides only when the customer deployment requires them.
  • Store sensitive values in a secrets file or approved secret-management system.
  • Use registry override values for mirrored or air-gapped installs.
  • Use the chart version recorded in the release manifest.

Next Steps

Section titled “Next Steps”

After creating both configuration files:

  1. Generate platform secrets (imageRegistry, database, encryption, authService, governanceWorker)
  2. Follow the setup guides to obtain provider-specific credentials
  3. Uncomment and fill in sections for chosen providers (Auth0/Entra, S3/Blob/GCS, KMS/Key Vault)
  4. Replace all REPLACE_* and GENERATE_* placeholders with actual values
  5. Proceed to the Helm Deployment guide