Appendix A: Configuring the Helm chart

Use the following topics to configure the Helm chart.

• Configure custom memory settings for OpenSearch
• Configure container image registry
• Configure ingress
• Configure persistent storage
• Configure database
• Configure license
• Optional configurati

BEST PRACTICE: To help you configure the Helm chart, use the examples for basic and HA values available in this GitHub repository.

If you have an existing KOTS stack and you want to copy some of its settings, see Appendix C: Mapping KOTS configuration to Helm values.

Configure custom memory settings for OpenSearch

Use the following information to configure custom memory settings for OpenSearch.

OS/NODE METHOD (PREFERRED)

Refer to Prepare custom memory settings for OpenSearch in Preparing your environment. 

INIT CONTAINERS METHOD (OPTIONAL)

Our chart optionally sets and checks the memory setting at pod startup. If your cluster forbids privileged pods, you must use the OS/node method.

Init containers available:

• Checker — Always runs. Verifies the node’s vm.max_map_count is at least the required value. If not, the pod fails to start.
• Setter — Privileged. Only runs when explicitly enabled. It attempts to raise the value on the node before OpenSearch starts.

To enable the Setter initContainer, add the following to your values.yaml file:

core:
  search:
    opensearch:
      application:
        virtualMemory:
          autoSet: true

AVAILABLE RELATED PARAMETERS

Configure container image registry

Configure ingress

CONFIGURE TLS FOR INGRESS

When you set global.url.secure to true, you can enable TLS termination at the ingress resource level. You can bring your own certificate, let the chart generate a self-signed one, or reuse an existing Kubernetes TLS secret.

To do so, use the following parameters. The Priority column indicates the order in which the parameters are considered.

On installation and upgrade:

• Custom certificate — If you set ingress.tls.cert and ingress.tls.key, the chart always creates or updates the TLS secret with these values, even if a secret already exists. To renew/rotate your certificate, simply update these values and run Helm upgrade.
• Self-signed certificate — If ingress.tls.generateSelfSigned: true, and there is no TLS secret yet; the chart generates a self-signed certificate for global.url.domain and stores it in the TLS secret. If the TLS secret already exists, the existing certificate is reused, and no new one is generated. To force a new self-signed certificate, delete the existing TLS secret (or change to a custom cert/key) and run Helm upgrade.
• Reuse an existing TLS secret — If you specify ingress.tls.secretName (or there is already a TLS secret with the chart’s configured name) and you do not set ingress.tls.cert/ingress.tls.key, the chart uses that secret name in our ingress. This is useful when the certificate is managed externally.
• No TLS secret — If no certificate is provided, generateSelfSigned is false, and no matching TLS secret exists, the chart does not create a TLS secret.

To see the TLS secret names, if any, used by the ingress resources in a namespace, run:

kubectl get ingress -n <namespace> -o jsonpath='{.items[*].spec.tls[*].
secretName}{"\\n"}'

If this command returns nothing, no ingress in that namespace is currently configured with TLS.

OPTIONAL INGRESS CONFIGURATION

If your ingress controller requires it, you can configure the service resources used by the ingress resource:

Additionally, we bundle a Traefik ingress controller inside our chart. To use it, see Traefik ingress controller.

Configure persistent storage

Configure database

Configure license

Optional configuration

Use the information in the following topics to configure your environment optionally.

• Trusted certificates
• Horizontal scaling of core pods
• Traefik ingress controller
• Memory and CPU settings
• Wiris
• OpenSearch cluster
• High Availability
• Restore from the .jama backup
• Enable JMX monitoring

Trusted certificates

You can use a PEM-formatted file containing any certificates that Jama Connect needs to trust. The file might contain a concatenation of multiple PEM-formatted certificates to trust. For example, you might need this functionality to make an encrypted connection from Jama Connect to your database if the database is protected with a self-signed certificate.

When a TLS certificate is available for ingress (see Configure TLS for ingress), the chart:

• Creates a dedicated secret for trusted certificates
• Stores the concatenation of:
  • Any PEM content provided in core.secrets.trustedCertificates.data
  • The ingress TLS certificate

This allows Jama Connect to trust both your own custom CAs or intermediate certificates and the same certificate that is used for HTTPS at ingress.

Horizontal scaling of core pods

Enable horizontal scaling of core pods to deploy specialized core pods instead of a single one.

Before enabling this feature, consider the following:

• If this is the first time you are installing Jama Connect in the cluster, DO NOT enable this feature. Once Jama Connect is installed and working properly, you can enable horizontal scaling safely. If you are restoring a backup, restore it without horizontal scaling enabled.
• You must provide a new database schema and user for Quartz to use.
• You can configure the number of replicas for each role. Once you have increased the number of replicas, DO NOT decrease it.

Traefik ingress controller

This table shows the main parameters that you can pass. For a full list, see the official Traefik documentation.

Memory and CPU settings

In memory values, you MUST use a literal size, such as 2 G or 1000 M or 2000000 k, although sensible defaults are given. It is unlikely that you need to override them.

In CPU values, 1000 m is equal to one core.

In case of any doubt, don’t make any changes and contact Support.

Wiris

Use these settings to configure a custom connection to your own Wiris instance. In case of any doubt, don’t make any changes and contact Jama Support.

OpenSearch cluster

The properties that control settings to enable multiple OpenSearch pods are:

High Availability

To enable HA mode for Jama Connect, you must create a Kubernetes cluster with nodes in different availability zones and set a storage class that supports RWX for the tenant assets. See Configure persistent storage.

Besides that, you must configure the HA properties for each Jama Connect component:

• HA settings for Traefik ingress controller
• HA settings for OpenSearch
• HA settings for activemq
• HA settings for diff
• HA settings for hazelcast
• HA settings for oauth
• HA settings for saml
• HA settings for search

HA SETTINGS FOR TRAEFIK INGRESS CONTROLLER

When using Traefik ingress controller (traefik.enabled set to true) in high availability mode, you must:

1. Set up a load balancer that forwards requests to the Kubernetes nodes using the ports defined for Traefik in Traefik ingress controller. If your load balancer handles TLS termination, you can disable TLS termination at ingress level by leaving ingress.tls.cert and ingress.tls.key empty.
2. Set the following properties:

HA SETTINGS FOR OPENSEARCH

The properties that control HA settings for OpenSearch pods are detailed in the OpenSearch cluster.

HA SETTINGS FOR ACTIVEMQ

ActiveMQ uses a shared-store HA model in this chart. That means it supports only:

• core.activemq.replicaCount: 1 for standalone mode.
• core.activemq.replicaCount: 2 for HA mode (1 live broker + 1 backup broker).

IMPORTANT: Only values 1 and 2 are supported for ActiveMQ HA in this chart.

The properties that control HA settings for activemq components are:

HA SETTINGS FOR DIFF

The properties that control HA settings for diff components are:

HA SETTINGS FOR HAZELCAST

The properties that control HA settings for Hazelcast components are:

HA SETTINGS FOR OAUTH

The properties that control HA settings for oauth components are:

HA SETTINGS FOR SAML

The properties that control HA settings for saml components are:

HA SETTINGS FOR SEARCH

The properties that control HA settings for search components are:

Restore from the .jama backup

To restore from an existing .jama backup, use the following parameters:

See Use a .jama backup file to configure a dataset under Preparing your environment for more details on this restore mechanism.

Enable JMX monitoring

JMX can be enabled for the JVM-based components core, search, OpenSearch, and diff to expose standard management data (heap usage, thread counts, class loading, OS metrics, system properties, and any registered MBeans). Each component is configured independently and listens on its own fixed JMX port inside the pod.

JMX SETTINGS

JMX RMI HOSTNAME

You can define a global RMI hostname to be used by core, search, OpenSearch, and diff pods.

By default, each pod uses its own IP, which might not be accessible externally. If needed, set this to a hostname that can be reached from outside the cluster.

In This Section

• Overview
• Planning your installation
• Preparing your environment
• Installing and upgrading
• FAQ
• Appendix A: Configuring the Helm chart
• Appendix B: Back up to .jama or XML file
• Appendix C: Mapping KOTS configuration to Helm values