From a36dc4b11e77a7d8cca83b31abf5ce3e0aa50a61 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Fri, 31 Jul 2026 10:34:10 +0100 Subject: [PATCH] fix: Fixes to running on kubernetes --- docs/getting-started/self-hosted-install.md | 1 - docs/reference/environment-variables.md | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/docs/getting-started/self-hosted-install.md b/docs/getting-started/self-hosted-install.md index 75179cf..625da0f 100644 --- a/docs/getting-started/self-hosted-install.md +++ b/docs/getting-started/self-hosted-install.md @@ -50,7 +50,6 @@ GRPC_HOST=vantage.example.com:9090 KEY_ENCRYPTION_KEY= # Optional: where workflow run logs are written inside the container. -VANTAGE_WORKFLOW_LOG_DIR=/data/workflow-logs ``` Generate the encryption key: diff --git a/docs/reference/environment-variables.md b/docs/reference/environment-variables.md index d9e9e60..be0e557 100644 --- a/docs/reference/environment-variables.md +++ b/docs/reference/environment-variables.md @@ -13,7 +13,7 @@ it is absent. | -------------------------- | --------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `GRPC_HOST` | **yes** | | The `host:port` agents dial. Boot fails without it. There is deliberately no fallback to the web host: that would hand every agent a port that does not speak gRPC | | `MONGO_URI` | no | `mongodb://localhost:27017` | The database name is taken from the URI path, falling back to `vantage`. There is no separate `MONGO_DB` | -| `REDIS_ADDR` | no | `localhost:6379` | Sessions only | +| `REDIS_ADDR` | no | `localhost:6379` | Sessions, and the bus that routes agent commands between server replicas. Every replica must point at the **same** Redis | | `REDIS_USERNAME` | no | | Redis 6+ ACL user. Leave empty against a legacy `requirepass` instance, which authenticates with the password alone | | `REDIS_PASSWORD` | no | | Leave empty for an unauthenticated Redis. Both of these exist so an install can use a managed Redis rather than the bundled one | | `KEY_ENCRYPTION_KEY` | yes in practice | | 64 hex characters (32 bytes) for AES-256-GCM. Required for private keys, vault secrets, OIDC client secrets and console credentials | @@ -21,8 +21,8 @@ it is absent. | `GUACD_ADDR` | no | `guacd:4822` | The [browser console](../vantage/browser-console.md) daemon | | `PROXY_ADVERTISE_HOST` | no | `server` | The hostname **guacd** uses to reach the control plane's console relay. Wrong here and every console session fails at connect with guacd unable to resolve the relay | | `PROXY_LISTEN_HOST` | no | `0.0.0.0` | Interface the ephemeral relay listeners bind. Narrow it only if guacd shares a known interface | +| `POD_IP` | no | | Kubernetes only, set by the Helm chart from the downward API. Overrides `PROXY_ADVERTISE_HOST`, because a console relay belongs to one replica and a Service address names all of them | | `APP_ROOT_LABEL` | no | `vantage` | The app root label for the host and session organisation guard | -| `VANTAGE_WORKFLOW_LOG_DIR` | no | | Where workflow run logs are written | :::danger `KEY_ENCRYPTION_KEY` has no recovery path It encrypts SSH private keys, vault secrets, OIDC client secrets and console