Configuration reference¶
This page collects the application and pipeline contract. HCL inputs, cloud credentials and HTTP backend variables are detailed in infrastructure variables.
Application CI variables¶
| Variable | Origin or observed value | Purpose and scope |
|---|---|---|
CD_DEPLOY_USER |
External variable | Identity reading/writing the manifest repository |
CD_DEPLOY_TOKEN |
External secret | Git authentication with push capability; its name does not imply a Deploy Token |
CD_PROJECT_PATH |
Each application's YAML | Authenticated HTTPS URL of the corresponding manifest repository |
ENABLE_QUALITY |
true in both applications |
Enables Code Quality and its summary on protected references |
ENABLE_SECURITY |
true in both applications |
Enables secrets, containers and their summaries; does not itself change inherited SAST rules |
DEPLOY_TARGET |
gke in applications; eks in template |
Selects one deployment context |
EKS_KUBE_CONTEXT |
<group>/terraform-modules:eks-agent |
AWS context shared by the agent |
GKE_KUBE_CONTEXT |
<group>/terraform-modules:gke-agent |
GCP context shared by the agent |
K8S_NAMESPACE |
app |
Application namespace |
CS_SEVERITY_THRESHOLD |
HIGH |
Minimum severity in the container report |
SECRET_DETECTION_HISTORIC_SCAN |
true |
Requests historical secret scanning |
Store credentials outside YAML, with appropriate scope and branch protection. Validate that protected variables are available in the intended execution context. Private variable, role and runner settings cannot be fully reconstructed from the public repository.
Variables supplied by GitLab¶
CI_REGISTRY, CI_REGISTRY_IMAGE, CI_REGISTRY_USER and CI_REGISTRY_PASSWORD connect to the registry. CI_COMMIT_SHA, CI_COMMIT_REF_SLUG, CI_COMMIT_BRANCH and CI_COMMIT_REF_PROTECTED drive tags and rules. GITLAB_USER_NAME and GITLAB_USER_EMAIL identify the author of the manifest commit; the credentials in the CD variables authenticate the push.
The agent provides KUBECONFIG to authorized projects. No production kubeconfig file was found in version control. Avoid replacing these predefined variables with static values when copying the project.
Runtime configuration¶
| Variable | Default / origin | Consumer |
|---|---|---|
REST_PORT |
8080 | Backend server |
REST_DB_HOST |
rest Secret, populated from infrastructure |
RDS or Cloud SQL address |
REST_DB_PORT |
rest Secret; infrastructure default 3306 |
MySQL port |
REST_DB_DATABASE |
rest Secret; configured database name |
Application schema |
REST_DB_USER |
rest Secret |
Database user |
REST_DB_PASSWORD |
rest Secret |
Database password |
REST_LOGGING_ROOT |
info |
Backend root log level |
REST_LOGGING_CANALS |
info |
Backend application package logs |
WEB_PORT |
8080 | Frontend server |
WEB_REST_URL |
Configuration: http://rest:8080; Deployment: empty |
Base for browser API endpoints |
WEB_LOGGING_ROOT |
INFO |
Frontend root logs |
WEB_LOGGING_CANALS |
INFO |
Frontend application package logs |
WEB_LOGGING_SPRING |
INFO |
Frontend Spring logs |
LANG, LC_ALL |
es_ES.UTF-8 in Deployment |
Requested frontend container locale |
Secrets injected as environment variables are read when a container starts. When changing the database Secret, check restart behavior and coordinate with the actual database password; do not assume a running process reloads the values.
Target matrix¶
| Layer | AWS | Google Cloud |
|---|---|---|
| Infrastructure | CLOUD_PROVIDER=aws |
CLOUD_PROVIDER=gcp |
| Application | DEPLOY_TARGET=eks |
DEPLOY_TARGET=gke |
| Agent | eks-agent |
gke-agent |
| Database | Private RDS | Private-IP Cloud SQL |
| Versioned Ingress | AWS ALB | No confirmed GKE variant |
No shared variable automatically synchronizes the first two rows. ENVIRONMENT belongs to the infrastructure pipeline; it does not configure application dev/pre/pro promotion.
This site's configuration¶
The build tool obtains its publication URL from CI_PAGES_URL and accepts an explicit base URL for local builds. Exact commands and options are in publishing. The documentation site needs none of the cloud credentials above.