systemlink-secrets.yaml

## Default secret values for the systemlink Helm chart.
## This is a YAML-formatted file.
## Declare override values for variables.

global:
  secrets:
    mongodb:
      ## <ATTENTION> - If `global.mongodb.install` is false, configure the external MongoDB connection string to be used by services in this deployment.
      #
      # If you are setting credentials per service (e.g. assetservice.secrets.mongodb.servicePassword) leave the placeholders
      # <username> and <password> in the connection string. These will be replaced dynamically when deploying.
      #
      # If you have provisioned MongoDB to use a single set of credentials replace <username>:<password> with the values desired.
      #
      # <database> is required and will be replaced dynamically.
      #
      # examples:
      # - MongoDB Atlas: mongodb+srv://<username>:<password>@my-atlas-cluster.mongodb.net/<database>
      # - MongoDB Community: mongodb://<username>:<password>@my-mongodb-cluster-0,my-mongodb-cluster-1,my-mongodb-cluster-2/<database>?replicaSet=rs0
      # - MongoDB Community (single set of credentials): mongodb://myusername:myPassw0rD@my-mongodb-cluster-0,my-mongodb-cluster-1,my-mongodb-cluster-2/<database>?replicaSet=rs0
      #
      # If `global.mongodb.install` is `true` leave the connection string as a blank string or comment it out.
      connection_string: ""

## The following values are typically shared across multiple configurations. The values
## here are not used directly as configuration but provide a convenient way to share
## common configuration throughout this file. Individual references to these values can
## be overridden with custom values if required.
##
## User name for S3 access
# <ATTENTION> Configure S3 credentials.
##
s3User: &s3User ""
## Password for s3 access
s3Password: &s3Password ""
##
s3DefaultRegion: &s3DefaultRegion "us-east-1"

## Secrets that apply to the entire application.
##
secrets:
  ## Container image repository credentials.
  ##
  imagePull:
    ## Toggle off to disable deployment of this specific secret. This should be done if this secret is being configured as a cluster setting
    ## rather than for this specific application.
    ##
    # <ATTENTION> - Disable if the container repository credentials are configured elsewhere.
    deploySecret: true
    ##  The registry to which this secret applies. Ignored if global.imageRegistry is set.
    ##
    registry: ""
    ## User for repository access. This information will have been provided with the application.
    ##
    user: &imageRegistryUser "" # <ATTENTION>
    ## Password for repository access. This information will have been provided with the application.
    ##
    password: &imageRegistryPassword ""  # <ATTENTION>
  ## RabbitMQ message bus credentials for service-to-service communication.
  ##
  rabbitmq:
    ## Password for RabbitMQ access. No requirements are enforced on the format of this password.
    ##
    password: ""  # <ATTENTION>
    ## This cookie is used to authenticate containers in the RabbitMQ stateful set. Use a strong random sequence of characters.
    ##
    erlangCookie: ""  # <ATTENTION>

## Secret configuration for the SystemLink web application.
##
webserver:
  secrets:
    ## Cryptographic key to be used for AES-128 encryption of session data. This key should have a length of 32 bytes.
    ##
    encryptionKey: ""  # <ATTENTION>
    ## Cryptographic key to be used for SHA-256 signing of session data. This key should have a length between 32 and 64 bytes.
    ##
    signatureKey: ""  # <ATTENTION>
    ## If webserver.proxy.authority is configured, optionally provide credentials for the proxy.
    ##
    proxy:
      # Optional - The username for the proxy credentials
      username: "" # <ATTENTION> - only required if the proxy is enabled.
      # Optional - The password for the proxy credentials
      password: "" # <ATTENTION> - only required if the proxy is enabled.
    ## Secrets used to configure the OpenID Connect provider.
    ##
    oidc:
      ## OpenID Connect client identifier for this application. This value will come from your authentication provider.
      ##
      clientId: ""  # <ATTENTION>
      ## Secret associated with the clientId. This value will come from your authentication provider.
      ##
      clientSecret: ""  # <ATTENTION>
      ## [Optional] A JSON web key set used to authenticate web tokens provided by the authentication provider.
      ##
      # jwks: ""
    # The password used to connect to Redis.
    redisPassword: "" # <ATTENTION>

## Secret configuration for user management.
##
userservices:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Password for the limited user allocated to allow the user service to access the database. This password cannot contain commas or any character which must be escaped in a URL.
      ##
      userServicePassword: ""  # <ATTENTION>
      ## Password for the limited user allocated to allow the key service to access the database. This password cannot contain commas or any character which must be escaped in a URL.
      ##
      keyServicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>
    ## Cryptographic key used for AEAD encryption of continuation tokens. Use a 32-byte cryptographically random value which is base64 encoded.
    ##
    continuationTokenEncryptionKey: "" # <ATTENTION>
    ## A list of API keys. SystemLink uses these keys to authorize service-to-service interactions within the application.
    ## Each entry must provide the key, the name of the assigned service, and a SHA-512 hash of the key.
    ## For more information visit https://github.com/ni/install-systemlink-enterprise/blob/main/getting-started/secrets.md
    ##
    whitelistedApiKeys: # <ATTENTION>
      - serviceName: "assetservice"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "comments"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "dashboardhost"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "jupyterhub"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "nbexec-argo-workflow"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "saltmaster-init"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "sessionmanagerservice"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "systemsmanagement-service"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "webserver"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "routineeventtrigger"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "routinescheduletrigger"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "routineexecutor"
        key: ""
        hash: "<SHA512 hash of key>"
      - serviceName: "testmonitor"
        key: ""
        hash: "<SHA512 hash of key>"

## Secret configuration for Asset Management
##
assetservice:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: "" # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: "" # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to mongodb documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: "" # <ATTENTION>

## Secret configuration for the Alarm Service
##
alarmservice:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: "" # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: "" # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to mongodb documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: "" # <ATTENTION>

## Secret configuration for Grafana dashboard hosting.
##
dashboardhost:
  secrets:
    ## PostgresSQL Database credentials.
    ##
    database:
      ## Database host
      ##
      host: ""  # <ATTENTION>
      ## User for database access. The default can be used.
      ##
      user: "systemlink"
      ## Password for database access.
      ##
      password: ""  # <ATTENTION>
    ## Admin credentials for the Grafana instance.
    ## Note: You cannot change the credentials after the first deployment.
    grafana:
      ## Admin user name. The default can be used.
      ##
      user: "admin"
      ## Admin password.
      ##
      password: ""  # <ATTENTION>

## Secret configuration for the data frame service.
##
dataframeservice:
  secrets:
    ## Access key information for S3 access.
    ##
    s3:
      ## Access key ID for the S3 instance.
      ##
      accessKeyId: *s3User
      ## Access key for the S3 instance.
      ##
      accessKey: *s3Password
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster. Ignored if database.useCustom is true.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster. Ignored if database.useCustom is true.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>
    ## Credentials for the Dremio instance.
    ##
    dremio:
      ## The username for the Dremio instance.
      ##
      username: "systemlink"
      ## The password for the Dremio instance.
      ##
      password: ""  # <ATTENTION>
  sldremio:
    # Dremio distributed storage configuration. This must be configured for the service to perform acceptably.
    # See https://github.com/dremio/dremio-cloud-tools/blob/master/charts/dremio_v2/docs/Values-Reference.md#distributed-storage-values
    # Configure this section as appropriate for your environment. The configuration below
    # assumes the service is being connected to Amazon S3 or an equivalent, like MinIO.
    # Note: this only partially configures distributed storage. See the rest of the configuration in
    # systemlink-values.yaml under dataframeservice.sldremio.distStorage.
    distStorage:
      aws: # <ATTENTION> - change if not using Amazon S3 or an equivalent
        credentials:
          accessKey: *s3User
          secret: *s3Password

## Secret configuration for feedservice
##
feedservice:
  secrets:
    ## Access key information for S3 access.
    ##
    s3:
      ## Access key ID for the S3 instance.
      ##
      accessKeyId: *s3User
      ## Access key for the S3 instance.
      ##
      accessKey: *s3Password
      ## Default region for the S3 instance.
      ##
      defaultRegion: *s3DefaultRegion
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for file uploads.
##
fileingestion:
  secrets:
    ## Cryptographic key used for AES-256 encryption of data at rest. Use a 32-byte cryptographically random value which is base64 encoded.
    ##
    encryptionKey: ""  # <ATTENTION>
    ## Cryptographic key to be used for encryption of download tokens. This key should have a length of at least 32 bytes.
    ##
    downloadTokenEncryptionKey: "" # <ATTENTION>
    ## Access key information for S3 access.
    ##
    s3:
      ## Access key ID for the S3 instance.
      ##
      accessKeyId: *s3User
      ## Access key for the S3 instance.
      ##
      accessKey: *s3Password
      ## Default region for the S3 instance.
      ##
      defaultRegion: *s3DefaultRegion
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for Jupyter notebook execution.
##
nbexecservice:
  secrets:
    ## Access key information for S3 access.
    ##
    s3:
      ## Access key ID for the S3 instance.
      ##
      accessKeyId: *s3User
      ## Access key for the S3 instance.
      ##
      accessKey: *s3Password
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: "" # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: "" # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to mongodb documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: "" # <ATTENTION>

## Secret configuration for notifications
##
notification:
  secrets:
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: "" # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: "" # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to mongodb documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: "" # <ATTENTION>

## Secret configuration for emails
##
smtp:
  secrets:
    smtpServer:
      ## Optional - Credentials used to access the SMTP server
      ##
      username: "" # <ATTENTION>
      password: "" # <ATTENTION>

## Secret configuration for the systems event manager.
##
sysmgmtevent:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for salt master.
##
saltmaster:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      # Root user password for the database cluster.
      rootPassword: ""  # <ATTENTION>
      # Limited user password to allow the service to access the minions database. This password cannot contain commas or any character that must be escaped in a URL.
      minionsPassword: ""  # <ATTENTION>
      # Limited user password to allow the service to access the pillars database. This password cannot contain commas or any character that must be escaped in a URL.
      pillarsPassword: ""  # <ATTENTION>
      # Key used to authenticate pods in the database cluster.
      # Refer to MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      replicaSetKey: ""  # <ATTENTION>
    ## RSA keys used by saltmaster in the communication with client systems.
    ##
    saltmaster:
      # RSA Private key using PKCS1 padding for salt-master.
      privateKey: ""  # <ATTENTION>
      # RSA Public key using PKCS1 padding for salt-master.
      publicKey: ""  # <ATTENTION>

## Secret configuration for systems management.
##
systems:
  secrets:
    ## Cryptographic key to be used for AES-128 encryption of data. This key should have a length of 32 bytes.
    ##
    encryptionKey: ""  # <ATTENTION>
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for test result storage.
##
testmonitorservice:
  secrets:
    ## Database configuration secrets. Only set one of connectionString or connectionPassword depending on whether
    ## the database is external or managed by this chart.
    ##
    database:
      ## Connection string for an existing PostgresSQL database.
      ## NOTE: Ignored unless `database.connectionString.secretName` parameter is set.
      ##
      connectionString: ""  # <ATTENTION>
      ## Password to use for a PostgresSQL database created by this chart.
      ## NOTE: Ignored if `database.secretName` parameter is set.
      ##
      connectionPassword: ""  # <ATTENTION>
      ## Connection string that is used to perform PostgreSQL schema migrations managed by this chart.
      ## NOTE: Ignored unless `database.connectionString.secretName` and `database.connectionString.migrationConnectionStringKey` parameters are set.
      ##
      migrationConnectionString: ""
      ## Password for the PostgresSQL user that will perform database migrations managed by this chart.
      ## Pairs with the username set with `database.connectionInfo.migrationUser`.
      ## NOTE: Ignored if `database.connectionString.secretName` parameter is set or `database.connectionInfo.migrationPasswordKey` is unset.
      ##
      migrationConnectionPassword: ""

## Secret configuration for user data
##
userdata:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for document hosting
##
webappservices:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>
    ## Cryptographic key used for AEAD encryption of continuation tokens. Use a 32-byte cryptographically random value which is base64 encoded.
    ##
    continuationTokenEncryptionKey: ""  # <ATTENTION>

## Secret configuration for routine management
##
routineservice:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for time-based routine triggering
##
routinescheduletrigger:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for tags
##
tags:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for taghistorian
##
taghistorian:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>
    ## Cryptographic key used for AEAD encryption of continuation tokens. Use a 32-byte cryptographically random value which is base64 encoded.
    ##
    continuationTokenEncryptionKey: ""  # <ATTENTION>

## Secret configuration for repository
##
repository:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for comments
##
comments:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for work order
##
workorder:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for specification management
##
specificationmanagement:
  secrets:
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for systems state
##
systemsstate:
  secrets:
    ## Cryptographic key to be used for AES-128 encryption of data. This key should have a length of 32 bytes.
    ##
    encryptionKey: ""  # <ATTENTION>
    ## Credentials for the MongoDB cluster.
    ##
    mongodb:
      ## Root user password for the database cluster.
      ##
      rootPassword: ""  # <ATTENTION>
      ## Limited user password to allow the service to access the database. This password cannot contain commas or any character that must be escaped in a URL.
      ##
      servicePassword: ""  # <ATTENTION>
      ## Key used to authenticate pods in the database cluster.
      ## Refer to the MongoDB documentation for key generation: https://www.mongodb.com/docs/manual/tutorial/enforce-keyfile-access-control-in-existing-replica-set/#create-a-keyfile
      ##
      replicaSetKey: ""  # <ATTENTION>

## Secret configuration for dynamic form fields.
##
dynamicformfields:
  secrets:
    ## Database configuration secrets. Only set one of connectionString or connectionPassword depending on whether
    ## the database is external or managed by this chart.
    ##
    database:
      ## Connection string for an existing PostgresSQL database.
      ## NOTE: Ignored unless `database.connectionString.secretName` parameter is set.
      ##
      connectionString: ""  # <ATTENTION>
      ## Password to use for a PostgresSQL database created by this chart.
      ## NOTE: Ignored if `database.secretName` parameter is set.
      ##
      connectionPassword: ""  # <ATTENTION>
      ## Connection string that is used to perform PostgreSQL schema migrations managed by this chart.
      ## NOTE: Ignored unless `database.connectionString.secretName` and `database.connectionString.migrationConnectionStringKey` parameters are set.
      ##
      migrationConnectionString: ""
      ## Password for the PostgresSQL user that will perform database migrations managed by this chart.
      ## Pairs with the username set with `database.connectionInfo.migrationUser`.
      ## NOTE: Ignored if `database.connectionString.secretName` parameter is set or `database.connectionInfo.migrationPasswordKey` is unset.
      ##
      migrationConnectionPassword: ""