Service Advanced Settings
To further fine-tune your Qovery infrastructure, you can set advanced settings through the Advanced Settings section of your service.
To access the Advanced Settings section:
Select the service where you want to modify the advanced settings
Open the advanced settings section from the left menu
The screen shows you the list of available advanced settings and for each of them:
- The default value
- The value configured right now
You can show only the modified values by activating the "Show only overridden settings" feature toggle.
All services have access to advanced settings, you can find where they are available in the documentation below with those badges:
Application Deployment
build.timeout_max_sec
Type | Description | Default Value |
---|---|---|
integer | Allows you to specify an interval, in seconds, after which the application build times out. | 1800 |
build.cpu_max_in_milli
Type | Description | Default Value |
---|---|---|
integer | CPU allocated to your build process | 4000 |
build.ram_max_in_gib
Type | Description | Default Value |
---|---|---|
integer | GB RAM allocated to your build process | 8 |
deployment.custom_domain_check_enabled
Type | Description | Use Case | Default Value |
---|---|---|---|
boolean | Qovery allows you to set custom domains for your applications through the addition of a CNAME record to your domain's DNS settings. By default, when an application is deployed, Qovery checks that the CNAME record is set up correctly. This advanced setting allows you to disable this check. | If you are using a Content Delivery Network (CDN), checking the CNAME setup for any custom domains you may have set up is likely to stall the deployment of your application. Therefore, if you are using a CDN behind your application, we recommend disabling this feature to save time during your application deployments. | true |
deployment.termination_grace_period_seconds
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Decide how many times in seconds the application is supposed to stop at maximum. After this time, the application will be forced to stop (killed) | An application requiring several tasks to be stopped properly should have a higher grace period. If the application finishes early, then it will not wait until the end of the grace period | 60 |
deployment.affinity.node.required
Type | Description | Use Case | Default Value |
---|---|---|---|
Map<String, String> | Set pod placement on specific Kubernetes nodes labels. | Can be useful to send pods on GPU nodes or any other specific workload based on node lablels (Eg. {"eks.amazonaws.com/nodegroup": "gpu"} ) | `` |
deployment.antiaffinity.pod
Type | Description | Default Value |
---|---|---|
string | Define how you want pods affinity to behave. • Preferred : allows, but does not require, pods of a given service are not co-located (or co-hosted) on a single node• Required : ensures that the pods of a given service are not co-located (or co-hosted) on a single node (safer in term of availability but can be expensive depending on the number of replicas) | Preferred |
Deployment strategy
deployment.update_strategy.type
Type | Description | Use Case | Default Value |
---|---|---|---|
string | Set deployment strategy type (RollingUpdate or Recreate ) | Rolling update strategy will gracefully rollout new versions, while Recreate will stop all current versions and create new ones once all old ones have been shutdown (more info) | RollingUpdate |
deployment.update_strategy.rolling_update.max_unavailable_percent
Type | Description | Default Value |
---|---|---|
integer | Define the percentage of a maximum number of pods that can be unavailable during the update process (more info). | 25 |
deployment.update_strategy.rolling_update.max_surge_percent
Type | Description | Default Value |
---|---|---|
integer | Define the percentage of the maximum number of pods that can be created over the desired number of pods (more info) | 25 |
Network Settings
network.ingress.cors_allow_headers
Type | Description | Use Case | Default Value |
---|---|---|---|
string | (For CORS users) Allows you to specify which set of headers can be present in the client request. | For security purposes, you can indicate which HTTP headers can be used during a CORS preflight request which includes the Access-Control-Request-Headers request header. For more information, see CORS HTTP Response Headers. | "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" |
network.ingress.cors_allow_methods
Type | Description | Use Case | Default Value |
---|---|---|---|
string | (For CORS users) Allows you to specify which set of methods can be used for the client request. | For security purposes, you can indicate which HTTP methods are permitted while accessing a resource in response to cross-origin requests. For more information, see CORS HTTP Response Headers. | "GET, PUT, POST, DELETE, PATCH, OPTIONS" |
network.ingress.cors_allow_origin
Type | Description | Use Case | Default Value |
---|---|---|---|
string | (For CORS users) Allows you to specify which origin(s) (domain, scheme, port) can access a resource. | For security purposes, you can allow only one or a short list of origins to access your resources. For more information, see CORS HTTP Response Headers. | "*" |
network.ingress.enable_cors
Type | Description | Use Case | Default Value |
---|---|---|---|
boolean | Allows you to enable Cross-Origin Resource Sharing (CORS). | The CORS mechanism supports secure cross-origin requests and data transfers between browsers and servers. For more information on CORS and when to enable it, see Cross-Origin Resources Sharing. | false |
network.ingress.enable_sticky_session
Type | Description | Use Case | Default Value |
---|---|---|---|
boolean | Allows you to enable Sticky session. | Enable the load balancer to bind a user's session to a specific target. This ensures that all requests from the user during the session are sent to the same target | false |
network.ingress.keepalive_time_seconds
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Limits the maximum time (in seconds) during which requests can be processed through one keepalive connection. After this time is reached, the connection is closed following the subsequent request processing. | Useful to tune your gRPC application | 3600 |
network.ingress.keepalive_timeout_seconds
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Sets a timeout (in seconds) during which an idle keepalive connection to an upstream server will stay open. | Useful to tune your gRPC application | 60 |
network.ingress.proxy_body_size_mb
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Allows you to set, in megabytes, a maximum size for resources that can be downloaded from your server. | By default, users can download resources (files, images, videos...) of up to 100 MB. You can use this advanced setting to lower or increase this limitation. | 100 |
network.ingress.proxy_buffer_size_kb
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Allows you to set, in kilobytes, a header buffer size used while reading the response header from upstream. | E.g. You are using Auth0 with NextJS, you will need to set a bigger header size | 4 |
network.ingress.proxy_connect_timeout_seconds
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Defines a timeout (in seconds) for establishing a connection with a proxied server. It should be noted that this timeout cannot usually exceed 75 seconds. | E.g. You can use it to define the maximum time to wait for your application to establish the connexion. | 60 |
network.ingress.proxy_read_timeout_seconds
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Defines a timeout for reading a response from the proxied server. The timeout is set only between two successive read operations, not for the transmission of the whole response. If the proxied server does not transmit anything within this time, the connection is closed. | E.g. You can use it to fine-tune your WebSocket application. | 60 |
network.ingress.proxy_send_timeout_seconds
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Sets a timeout (in seconds) for transmitting a request to the proxied server. The timeout is set only between two successive write operations, not for the transmission of the whole request. If the proxied server does not receive anything within this time, the connection is closed. | E.g. You can use it to fine-tune your WebSocket application. | 60 |
network.ingress.proxy_buffering
Type | Description | Default Value |
---|---|---|
string | Allows you to enable or disable nginx proxy-buffering . Valid values are on or off | on |
network.ingress.proxy_request_buffering
Type | Description | Default Value |
---|---|---|
string | Allows you to enable or disable nginx proxy-request_buffering . Valid values are on or off | on |
network.ingress.send_timeout_seconds
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Sets a timeout (in seconds) for transmitting a response to the client. The timeout is set only between two successive write operations, not for the transmission of the whole response. If the client does not receive anything within this time, the connection is closed. | Useful to define the maximum timeout to wait for client connection. | 60 |
network.ingress.whitelist_source_range
Type | Description | Use Case | Default Value |
---|---|---|---|
string | Allows you to specify which IP ranges are allowed to access your application. The value is a comma-separated list of CIDRs, e.g. 10.0.0.0/24,172.10.0.1 | By default, any IP can access your application if it's exposed publicly and the users know the URL. You can limit its access by specifying the IPs you want to reach the app (e.g. the IP of your office) | 0.0.0.0/0 (any IP) |
network.ingress.denylist_source_range
Type | Description | Default Value |
---|---|---|
string | Allows you to specify which IP ranges are not allowed to access your application. The value is a comma-separated list of CIDRs, e.g. 10.0.0.0/24,172.10.0.1 | `` |
network.ingress.basic_auth_env_var
Type | Description | Default Value |
---|---|---|
string | Set the name of an environment variable to use as a basic authentication (login:crypted_password ) from htpasswd command. | `` |
Here is an example where you can create a secret environment variable on Qovery and set a name like BASIC_AUTH_CREDENTIALS
. The content should be the result of the htpasswd
command:
$ htpasswd -n <username>New password:Re-type new password:username:$apr1$jpwW4vG9$fwbzWBgRqARzNX93plDq20
The content of the BASIC_AUTH_CREDENTIALS
environment variable should be: username:$apr1$jpwW4vG9$fwbzWBgRqARzNX93plDq20
. To finish, set the network.ingress.basic_auth_env_var
advanced settings to BASIC_AUTH_CREDENTIALS
.
You can pass set credentials by separating them with a comma. For example: username1:$apr1$jpwW4vG9$fwbzWBgRqARzNX93plDq20,username2:$apr1$jpwW4vG9$fwbzWBgRqARzNX93plDq20
. However, the total length of the environment variable should not exceed 1MB.
network.ingress.extra_headers
Type | Description | Default Value |
---|---|---|
string | Allows you to specify response headers with values separated by comma (e.g. {"X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff"} | {} |
Auto-scaling
hpa.cpu.average_utilization_percent
Type | Description | Default Value |
---|---|---|
integer | Auto-scaling is triggered when a specific CPU utilization metric is reached (for instance, 40%). This advanced setting allows you to set this metric. | 60 |
Job Settings
job.delete_ttl_seconds_after_finished
Type | Description | Default Value |
---|---|---|
integer | By default terminated jobs in a completed or failure state are not deleted. if this parameter is set, Kubernetes will automatically cleanup completed jobs after the ttl | null |
cronjob.concurrency_policy
Type | Description | Default Value |
---|---|---|
string | It defines if it is allowed to start another instance of the same job if the previous execution didn't finish yet: Allow /Forbid /Replace ) | Forbidden |
cronjob.failed_job_history_limit
Type | Description | Default Value |
---|---|---|
string | Allows you to define the maximum number of failed job executions that should be returned in the job execution history | 1 |
cronjob.success_job_history_limit
Type | Description | Default Value |
---|---|---|
string | Allows you to define the maximum number of succeeded job executions that should be returned in the job execution history | 1 |
Resources
resources.override.limit.cpu_in_milli
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Define the CPU overcommit (pod cpu limit) of the service. | A service require more CPU at startup than during the running phase. You can reduce the configured CPU for the service and just increase the resources.override.limit.cpu_in_milli to reduce the resources used by the service at runtime | null (i.e. request = limit) |
resources.override.limit.ram_in_mib
Type | Description | Use Case | Default Value |
---|---|---|---|
integer | Define the memory overcommit (pod memory limit) of the service. | A service require more memory at startup than during the running phase. You can reduce the configured memory for the service and just increase the resources.override.limit.ram_in_mib to reduce the resources used by the service at runtime | null (i.e. request = limit) |
Security
security.service_account_name
Type | Description | Use Case | Default Value |
---|---|---|---|
string | Allows you to set an existing Kubernetes service account name | E.g. On AWS, you can assume a role on an application to give it specific AWS permissions without having to specify AWS credentials | `` |
security.automount_service_account_token
Type | Description | Default Value |
---|---|---|
boolean | Automount Kubernetes service account token to have access to Kubernetes API from pods | false |