Configuration

Configuration model

Unkey services read configuration from a TOML file passed at startup. Environment variables can be referenced with ${VAR} and are expanded before parsing. Defaults and validation run after parsing. The config schema maps to svc/krane/config.go. Krane enables the secrets RPC only when vault.url is set. Other features run without Vault. Minimal config example:

instance_id = "${POD_NAME}"
rpc_port = 8080

[cluster]
cell_id = "${UNKEY_CELL_ID}"
platform = "aws"
region = "${UNKEY_REGION}"

[control]
url = "${UNKEY_CTRL_URL}"
token = "${UNKEY_CTRL_TOKEN}"

[vault]
url = "${UNKEY_VAULT_URL}"
token = "${UNKEY_VAULT_TOKEN}"

[registry]
url = "${UNKEY_REGISTRY_URL}"
username = "${UNKEY_REGISTRY_USERNAME}"
password = "${UNKEY_REGISTRY_PASSWORD}"

string

Instance identifier for logs and tracing.

object

required

Identity of the infrastructure cell managed by this Krane agent.

Show Fields

string

required

Cell identifier, such as cell001.

string

required

Infrastructure provider, such as aws.

string

required

Geographic region, such as us-east-1.

int

default:"8070"

RPC server port.

object

Registry credentials. The krane runtime does not read this config today.

Show Fields

string

Registry URL.

string

Registry username.

string

Registry password.

object

Vault connection for the secrets service.

Show Fields

string

Vault URL.

string

Vault token.

object

Control plane connection.

Show Fields

string

required

Control API URL.

string

required

Control API token.

object

Tracing, logging, and metrics configuration.

Show Fields

float

default:"0.25"

Trace sampling rate.

float

default:"1.0"

Log sampling rate.

duration

default:"1s"

Slow log threshold.

int

default:"0"

Prometheus port. Set to 0 to disable.

Example configuration

instance_id = "${POD_NAME}"
rpc_port = 8080

[cluster]
cell_id = "${UNKEY_CELL_ID}"
platform = "aws"
region = "${UNKEY_REGION}"

[control]
url = "${UNKEY_CTRL_URL}"
token = "${UNKEY_CTRL_TOKEN}"

[vault]
url = "${UNKEY_VAULT_URL}"
token = "${UNKEY_VAULT_TOKEN}"

[registry]
url = "${UNKEY_REGISTRY_URL}"
username = "${UNKEY_REGISTRY_USERNAME}"
password = "${UNKEY_REGISTRY_PASSWORD}"

[observability.tracing]
sample_rate = 0.1

[observability.logging]
sample_rate = 0.01
slow_threshold = "2s"

[observability.metrics]
prometheus_port = 9090

Overview

Services

RFCs

Configuration model

Example configuration

​Configuration model

​Example configuration

Configuration model

Example configuration