Decide how many times in seconds the application is supposed to stop at maximum. After this time, the application will be forced to stop (killed)
An application requiring several tasks to be stopped properly should have a higher grace period. If the application finishes early, then it will not wait until the end of the grace period
Set pod placement on specific Kubernetes nodes labels.
Can be useful to send pods on desired architecture (GPU/ARM/AMD) or any other specific workload based on node labels (Eg. {"eks.amazonaws.com/nodegroup": "gpu"}, {"kubernetes.io/arch": "arm64"})
Define how you want pods affinity to behave. • Preferred: allows, but does not require, pods of a given service are not co-located (or co-hosted) on a single node • Required: ensures that the pods of a given service are not co-located (or co-hosted) on a single node (safer in term of availability but can be expensive depending on the number of replicas)
Set deployment strategy type (RollingUpdate or Recreate)
Rolling update strategy will gracefully rollout new versions, while Recreate will stop all current versions and create new ones once all old ones have been shutdown (more info)
Define the percentage of a maximum number of pods that can be unavailable during the update process (more info).
25
It's important to understand maxSurge and maxUnavailable govern availability, not strict real-time counting. Don't expect the exact numbers of pods to be unavailable at any given time during a rollout.
Allows you to run a command before the application is stopped. The command should be a shell command or script. Qovery requires the sh shell by default and sets a sleep of 15 seconds to let Nginx update its config. Avoiding error codes returned during a rolling update.
(For CORS users) Allows you to specify which set of headers can be present in the client request.
For security purposes, you can indicate which HTTP headers can be used during a CORS preflight request which includes the Access-Control-Request-Headers request header. For more information, see CORS HTTP Response Headers.
(For CORS users) Allows you to specify which set of methods can be used for the client request.
For security purposes, you can indicate which HTTP methods are permitted while accessing a resource in response to cross-origin requests. For more information, see CORS HTTP Response Headers.
(For CORS users) Allows you to specify which origin(s) (domain, scheme, port) can access a resource.
For security purposes, you can allow only one or a short list of origins to access your resources. For more information, see CORS HTTP Response Headers.
Allows you to enable Cross-Origin Resource Sharing (CORS).
The CORS mechanism supports secure cross-origin requests and data transfers between browsers and servers. For more information on CORS and when to enable it, see Cross-Origin Resources Sharing.
Enable the load balancer to bind a user's session to a specific target. This ensures that all requests from the user during the session are sent to the same target
Limits the maximum time (in seconds) during which requests can be processed through one keepalive connection. After this time is reached, the connection is closed following the subsequent request processing.
Allows you to set, in megabytes, a maximum size for resources that can be downloaded from your server.
By default, users can download resources (files, images, videos...) of up to 100 MB. You can use this advanced setting to lower or increase this limitation.
Defines a timeout (in seconds) for establishing a connection with a proxied server. It should be noted that this timeout cannot usually exceed 75 seconds.
E.g. You can use it to define the maximum time to wait for your application to establish the connexion.
Defines a timeout for reading a response from the proxied server. The timeout is set only between two successive read operations, not for the transmission of the whole response. If the proxied server does not transmit anything within this time, the connection is closed.
E.g. You can use it to fine-tune your WebSocket application.
Sets a timeout (in seconds) for transmitting a request to the proxied server. The timeout is set only between two successive write operations, not for the transmission of the whole request. If the proxied server does not receive anything within this time, the connection is closed.
E.g. You can use it to fine-tune your WebSocket application.
Sets a timeout (in seconds) for transmitting a response to the client. The timeout is set only between two successive write operations, not for the transmission of the whole response. If the client does not receive anything within this time, the connection is closed.
Useful to define the maximum timeout to wait for client connection.
Allows you to specify which IP ranges are allowed to access your application. The value is a comma-separated list of CIDRs, e.g. 10.0.0.0/24,172.10.0.1
By default, any IP can access your application if it's exposed publicly and the users know the URL. You can limit its access by specifying the IPs you want to reach the app (e.g. the IP of your office)
Allows you to specify which IP ranges are not allowed to access your application. The value is a comma-separated list of CIDRs, e.g. 10.0.0.0/24,172.10.0.1
Set the name of an environment variable to use as a basic authentication (login:crypted_password) from htpasswd command.
``
Here is an example where you can create a secret environment variable on Qovery and set a name like BASIC_AUTH_CREDENTIALS. The content should be the result of the htpasswd command:
$ htpasswd -n <username>
New password:
Re-type new password:
username:$apr1$jpwW4vG9$fwbzWBgRqARzNX93plDq20
The content of the BASIC_AUTH_CREDENTIALS environment variable should be: username:$apr1$jpwW4vG9$fwbzWBgRqARzNX93plDq20. To finish, set the network.ingress.basic_auth_env_var advanced settings to BASIC_AUTH_CREDENTIALS.
You can pass set credentials by separating them with a comma. For example: username1:$apr1$jpwW4vG9$fwbzWBgRqARzNX93plDq20,username2:$apr1$jpwW4vG9$fwbzWBgRqARzNX93plDq20. However, the total length of the environment variable should not exceed 1MB.
Allows you to specify additional headers to the outgoing response. The header values are separated by comma (e.g. {"X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff"}
Allows you to specify additional headers to the incoming requests. The header values are separated by comma (e.g. {"X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff"}).
Auto-scaling is triggered when a specific memory utilization metric is reached (for instance, 40%). This advanced setting allows you to set this metric.
By default terminated jobs in a completed or failure state are not deleted. if this parameter is set, Kubernetes will automatically cleanup completed jobs after the ttl
Using overcommit on pod resources can lead to instability on your cluster and we strongly discourage it. Be careful when using this feature.
Type
Description
Use Case
Default Value
integer
Define the CPU overcommit (pod cpu limit) of the service.
A service require more CPU at startup than during the running phase. You can reduce the configured CPU for the service and just increase the resources.override.limit.cpu_in_milli to reduce the resources used by the service at runtime
Using overcommit on pod resources can lead to instability on your cluster and we strongly discourage it. Be careful when using this feature.
Type
Description
Use Case
Default Value
integer
Define the memory overcommit (pod memory limit) of the service.
A service require more memory at startup than during the running phase. You can reduce the configured memory for the service and just increase the resources.override.limit.ram_in_mib to reduce the resources used by the service at runtime
Mounts the container's root filesystem as read-only, preventing any write operations to the container filesystem for enhanced security. Applications requiring write access should use volumes or temporary storage.
