Install configuration reference

string

required

YAML schema version.Values: 1.16

string

required

Unique deployment name. This must contain the name of the deployment owner.Values: [a-zA-Z0-9_-]+Note: On data plane installs, this is the subdomain of the data plane, that is, the data-plane of data-plane.domino.example.com.

string

required

Domino version to install. Each installer release supports one Domino version; find the pairing on the releases page.Values: A Domino version, for example 6.3.0

string

required

Hostname Domino application is accessed at.Values: Valid fully qualified domain name (FQDN)Note: On data plane installs, this is the hostname of the control plane.

boolean

required

Should Domino only be accessible with HTTPS.Values: true, false

boolean

required

Should Domino only be accessible with HTTPS.Values: true, false

boolean

required

Create Kubernetes resource requests and limits for services.Values: true, false

boolean

required

Use network policies for fine-grained service access.Values: true, falseNote: Requires a compatible CNI plugin, for example, Calico.

string

A URL to ECR (Amazon Elastic Container Registry), ACR (Azure Container Registry), GCR (Google Container Registry) or GAR (Google Artifact Registry). The node must have permissions to the registry.Values: Note: Either external_docker_registry or internal_docker_registry must be configured.

object

required

Custom Certificates

boolean

Use the minimum amount of nodes and resources to run Domino. This may not be a stable configuration and should be used with caution.Values: false

string

The Kubernetes cluster domain name.Values: cluster.local

string

AWS account ID in which Domino is deployed.

string

IAM role arn.

string

Kubernetes service account name.

Control and Data Planes

This section configures whether Domino is a “control plane” or “data plane” install.

boolean

If true, install the control plane. This currently always includes a local data plane.Values: true, false

string

Which type of data plane to install. When performing a data plane-only install, this should be remote.Values: local, remote

To perform a standard “control plane” install, you can omit both of these sections. The defaults are a “control plane” and a local data plane type.
To perform a “data plane” install, you should configure the following:

control_plane: false
data_plane:
  type: remote

Istio

This section configures how and if an Istio Service Mesh is deployed by or integrated to Domino. A Domino-deployed Istio is for Domino use only. These configurations must only be installed and/or enabled if intra-cluster encryption in transit is required.

boolean

required

Enable Istio in deployment (that is, sidecar injection).Values: true, false

boolean

required

Install Istio service with Domino.Values: true, false

boolean

required

Configures whether Istio installation is done with a CNI.If true, the installation is done with a CNI and requires fewer permissions; this is our preferred and recommended setting. If false, the installation adds required capabilities to every pod security policy: NET_ADMIN, and NET_RAW.Values: true, false

Ingress controller

This section configures the NGINX ingress controller deployed by the fleetcommand-agent.

boolean

required

Install the NGINX ingress controller.Values: true, false

string

On Google Cloud Platform (GCP), use a static IP address to expose nginx.Values: The name of the IP address

string

required

Name of the ingress class for Domino.Values: nginx

boolean

required

Include annotations related to Istio.Values: true,false

string[]

List of allowed ingress CIDR blocks.

Namespaces

Use Namespaces to virtually segment Kubernetes executions. Domino creates namespaces according to the specifications in this section. The installer requires that these namespaces do not exist at installation.

string

required

Namespace to place Domino services.Values: Kubernetes Names

string

required

Namespace for user executions.Values: Kubernetes NamesNote: Might be the same as the platform namespace.

string

required

Namespace for deployment metadata.Values: Kubernetes Names

string

required

Namespace for Istio.Values: Kubernetes Names

object

Optional annotations to apply to each namespace.Values: Kubernetes Annotation

object

Optional labels to apply to each namespace.Values: Kubernetes Labels and Selectors

Storage classes

Storage Classes are a way to abstract the dynamic provisioning of volumes in Kubernetes. Domino requires the following storage classes:

block storage for Domino services and user executions that need fast I/O.
shared storage that can be shared between multiple executions.

Domino supports pre-created storage classes, although the installer can create a shared storage class backed by NFS or a cloud NFS analog as long as the cluster can access the NFS system for read and write, and the installer can create several types of block storage classes backed cloud block storage systems like Amazon EBS.

Block

boolean

required

Whether to create the block storage class.Values: true, false

string

required

The block storage class name.Values: Kubernetes NameNote: Always required due to platform limitations. Cannot be "" which indicates the default storage class.

string

required

Type of the block storage class to use.Values: For example,

ebs
hostpath
gce
azure-disk
ceph-rdb

string

Base path to use on nodes with hostpath volumes.

boolean

required

Whether to set this storage class as the default.Values: true, false

Shared

boolean

required

Whether to create the shared storage class.Values: true, false

string

required

The shared storage class name.Values: Kubernetes Name

string

required

Type of the shared storage class to use.Values: For example,

efs
nfs
azure-file Azure File requires outbound port 445 to be open from your Azure cluster.
cephfs

string

EFS store AWS region.Values: For example, us-west-2

string

EFS filesystem ID.Values: For example, fs-7a535bd1

string

Access Point ID.Values: For example, fsap-01234567

string

NFS server IP or hostname.

string

Base path to use on the server when you create shared storage volumes.

string[]

YAML List of additional NFS mount options.Values: For example, - mfsymlinks

string

Azure storage account to create file stores.

Blob storage

Domino can store long-term, unstructured data in blob storage buckets. Only the shared storage class described previously (NFS and S3) are supported for logs. projects also support Azure storage, and backups also supports both Azure and Google Cloud Storage (GCS) storage.

S3

string

AWS region of the S3 bucket store.Values: For example, us-west-2

string

S3 bucket name.Values: For example, domino-bucket-1

string

KMS Key ARN.Values: For example, arn:aws:kms:us-west-2:890728157128:key/mrk-eb66487f9d674b46b3ca3c8b934ddd4b

Azure

string

Azure storage account name.Values: For example, mystorage

string

Access key for the storage account.Values: For example, domino-bucket-1

string

Name of the container in the storage account.Values: For example, backups

GCS (Google Cloud Storage)

string

The bucket name.Values: For example, domino-bucket-1

string

The service account name with write access to the bucket.Values: For example, bucket-sa

string

The service account’s project name.Values: For example, myproject

Autoscaler

For Kubernetes clusters without native cluster scaling in response to new user executions, Domino supports the use of the cluster autoscaler.

string

Cloud provider Domino is deployed with.Values: For example, aws

string

AWS region Domino is deployed into.Values: For example, us-west-2

string

Azure resource group Domino is deployed into.Values: Azure resource group

string

Azure subscription ID Domino is deployed with.Values: Azure subscription ID

AWS auto discovery

The cluster autoscaler supports Auto Discovery on AWS. Without any explicit configuration of specific autoscaling groups, it detects all ASGs that have the appropriate tags and refreshes them if their settings are updated directly. All ASGs must be listed with accurate min/max settings (or not listed at all) is not required as referenced below in the Groups section. ASG settings can be updated directly in AWS. The cluster-autoscaler configuration doesn’t need to be updated, and you don’t need to rerun the installer.

string

Kubernetes Cluster Name.Values: Must exactly match the name in AWS

string[]

Optional: If filled in, cluster_name is ignored.Values: For example, - my.tag or []

object

Values: Must be set to [] if using auto_discovery

By default, if no autoscaler.groups and autoscaler.auto_discovery.tags are specified, the cluster_name is used to look for the following AWS tags:

k8s.io/cluster-autoscaler/enabled
k8s.io/cluster-autoscaler/{{ cluster_name }}

The tags setting can be used to explicitly specify which resource tags the autoscaler service must look for. To disable auto-discovery and use specific groups, ensure that auto_discovery.cluster_name is an empty value.

Groups

Autoscaling groups are not dynamically discovered. Each autoscaling group must be individually specified, along with the minimum and maximum scaling size.

string

Autoscaling group name.Values: Must exactly match the name in the cloud provider

number

Minimum scaling size.Values: For example, 0

number

Maximum scaling size.Values: For example, 10

External DNS

Domino can automatically configure your cloud DNS provider. See external-dns for more information.

string

Cloud DNS provider.Values: For example, aws

string

Only allow access to domains that match this filter.Values: For example, my-domain.example.com

string

Only allow updates to specific hosted zones.

string

The owner ID in the TXT record.

Email notifications

Domino supports SMTP to send email notifications in response to user actions and run results.

boolean

required

Whether Domino must send email notifications.Values: true, false

string

SMTP server hostname or IP.

number

SMTP server port.

boolean

required

Whether the SMTP server uses SSL encryption.Values: true, false

string

Email address to send emails from Domino with.Values: For example, domino @example.com

string

If you use SMTP authentication, the username.

string

If you use SMTP authentication, the password.

Monitoring

Domino supports in-cluster monitoring with Prometheus as well as more detailed, external monitoring through New Relic APM and Infrastructure.

boolean

required

Install Prometheus monitoring.Values: true, false

boolean

Enable Node Exporter to generate and expose hardware and OS metrics.Values: true, false

boolean

Enable Kube-State-Metrics to generate and expose cluster-level metrics.Values: true, false

boolean

required

Enable New Relic APM.Values: true, false

boolean

required

Enable New Relic Infrastructure.Values: true, false

string

New Relic account license key.

boolean

Configure New Relic for Kubernetes clusters with managed control planes, that is, EKS, AKS, and GKE.

boolean

Enable GPU metrics.

Grafana alerts

Domino supports in-cluster alerting with Grafana. To enable in-cluster alerting, a Grafana contact point needs to be defined to receive alert notifications.

string

The display name of the Slack contact point in the Grafana UI.

string

The name of the Slack channel to send alerts to.

string

The Slack app token used to authenticate to your Slack workspace.

Helm

Configuration for the Helm repository that stores Domino’s charts.

string

required

Which version of Helm to use.Values: 2 or 3

string

required

Hostname of the chart repository.Values: For Helm 2 this must be quay.io or the address of your private app server. For Helm 3 it must be gcr.io.

string

Namespace to find charts in the repository.Values: Helm repo namespace. When you use official Domino repositories this must be domino. For Helm 3 with gcr.io or mirrors.domino.tech, use domino-eng-service-artifacts.

string

Username for chart repository if authentication is required. When you use Helm 3 with charts hosted in GCR this must be _json_key.Values: Username

string

Password for chart repository if authentication is required.Values: For Helm 3 this is the base64 encoded JSON key that was provided by Domino.

Image registries

List of Docker registries for Domino components.

string

required

Docker registry host.Values: For example,

quay.io
mirrors.domino.tech

Can be empty if no explicit auth credentials are needed (node already configured, etc.)

string

required

Docker registry username.

string

required

Docker registry password.

Internal Docker registry

The recommended configuration for the internal Docker registry deployed with Domino. Use override values to allow the registry to use S3, GCS, or Azure blob store as a backend store. GCS requires a service account already be bound into the Kubernetes cluster with configuration to ensure the docker-registry service account is properly mapped.

Either internal_docker_registry or external_docker_registry must be configured.

string

AWS region of the S3 bucket store.Values: For example, us-west-2

string

S3 bucket name.Values: For example, domino-bucket-1

string

KMS Key ARN.Values: For example, arn:aws:kms:us-west-2:890728157128:key/mrk-eb66487f9d674b46b3ca3c8b934ddd4b

string

GCS bucket name.Values: For example, domino-bucket-1

string

GCS service account with access to the bucket.

string

GCP project name that Domino is deployed into.

string

Azure blobstore account name.

string

Azure blobstore account key.

string

Azure blobstore container name.

Telemetry

Domino supports user telemetry data to help improve the product.

boolean

Enable Mixpanel. Defaults to true. Set to false to disable telemetry. See the note below.Values: true, false

boolean

required

When enabled, telemetry data is redacted to remove potentially sensitive information.Values: true, false

To set a customer_name or deployment_name so Domino Support can identify your deployment, see Deployment identification. That’s a separate setting from the mixpanel block on this page.

As of Domino 6.2.0, mixpanel.enabled defaults to true. In Domino 6.1.x, this setting had to be explicitly set to enable telemetry.
As of Domino 6.1.0, the mixpanel.token field was removed from deploy.yaml. Do not set this value yourself - a static default token is applied automatically. Setting it causes a validation error: Extra inputs are not permitted in telemetry.mixpanel.token.

Support

Domino supports customer service tools to improve customer experience.

boolean

required

Enable Zendesk.Values: true, false

string

required

Zendesk API token.

Domino Governance

Configuration for Domino Governance.

boolean

required

Enable Domino Governance.Values: true, false

Audit Trail

Domino’s Audit Trail feature captures user-generated events to be queried and viewed in the UI.

boolean

required

Enable Audit Trail.Values: true, false

GPU

If using NVIDIA-based GPU compute nodes, enable the following configuration setting to install the required components:

boolean

required

Enable GPU support.Values: true, false

Neuron

If using Neuron Trainium GPU compute nodes, enable the following configuration setting to install the required components:

boolean

required

Enable GPU support.Values: true, false

Fleetcommand

Domino supports minor patch upgrades through an internal tool named Fleetcommand. To learn more about the telemetry being sent back to Domino, see Deployments Telemetry.

boolean

required

Enable ability for Domino staff to apply minor patches.Values: true, false

string

The URL to fleetcommand, Domino staff provides this.

string

Deployment-specific API token (Domino staff provides this).

Node selectors

Domino by default deploys some DaemonSets on all available nodes in the host cluster. When you run Domino in a multi-tenant Kubernetes cluster, where some nodes must not be used by Domino, you can label nodes for Domino with a single, consistent label. Then, provide that label to fleetcommand-agent with the below configuration to apply a selector to all Domino resources for that label. Domino also supports a separate “platform jobs” node selector, configured with platform_jobs_node_selectors. Certain ephemeral jobs use these nodes, which can limit node churn to a specific group of nodes, separate from the stable platform nodes.

object

List of key/value pairs to use as the label for the selector.Values: Example:

global_node_selectors:
  domino-owned: "true"

This example applies a selector for domino-owned=true to all Domino deployment resources.

object

List of key/value pairs to use as the label for the selector.Values: Example:

platform_jobs_node_selectors:
  domino-platform-jobs: "true"

This example applies a selector for domino-platform-jobs=true to Domino deployment resources that can use the jobs selector.

Pod configurations

Global pod configuration that applies to all pods which Domino deploys.

object

List of key and value pairs to use as annotations that apply to all pods.Values: Example:

global_pod_annotation:
  my-annotation: "abc"

This example adds an annotation my-annotation to all Domino pod resources.

object

List of key and value pairs to use as labels that apply to all pods.Values: Example:

global_pod_labels:
  my-label: "abc"

This example adds a label my-label to all Domino pod resources.

object

List of name and value pairs to use as environment variables that apply to all pods.Values: Example:

global_pod_environment:
  - name: MY_ENV
    value: VALUE

This example adds an environment variable MY_ENV to all Domino pod resources.

Image caching

These settings control the Domino image caching service, which runs as a privileged pod and uses the host Docker socket to pre-pull popular Domino environment images onto compute workers. It can be disabled.

boolean

required

Whether or not to deploy the image caching service.Values: true, false

Certificate management

boolean

required

Whether to install cert-manager. Domino requires cert-manager, but only one instance of cert-manager can be installed in any given Kubernetes cluster. If your Kubernetes cluster already has cert-manager installed, this should be false.Values: true, false

Teleport Kubernetes agent

No teleport support is installed if teleport_kube_agent is not present.

string

required

The teleport address.

string

required

The authentication token for Teleport.

Elasticsearch

boolean

required

To disable the sysctlInitContainer (which runs as root), set the sysctl vm.max_map_count correctly through some other method.Values: true, false

Image building

A builder uses a storage cache as large as the amount specified by the cache_storage_size. When a build completes, the storage cache is reduced to the cache_storage_retention amount. The cache_storage_retention value must not be greater than the cache_storage_size. When the underlying OS does not support user namespace mapping, like EKS, you might have to disable rootless building for deployment targets. Running rootless in an environment that does not support it defaults to using the native filesystem snapshotter and causes image building performance to drop significantly.

boolean

required

Enable verbose logging.Values: true, false

boolean

required

Run as a non-root user.Values: true, false

number

Maximum number of concurrent image builds.

string

Size of each image builder’s cache.

string

Amount of storage to keep during garbage collection.

object

List of key/value pairs to use as the label for the selector.

string

Duration after which builder cluster is inspected for idle pods.Values: Examples: 1h, 5m, 30s

string

Duration after which idle build pods are terminated.Values: Examples: 1h, 5m, 30s

string

Duration the build waits to fetch and extract the remote Docker context.Values: Examples: 1h, 5m, 30s

number

Number of seconds the worker pool waits for a buildkit pod to become ready for traffic.

Registries

Configures buildkit/hephaestus to support HTTP-only and/or self-signed registries.

boolean

required

Registry only supports HTTP.Values: true, false

boolean

required

Registry uses a self-signed certificate and is considered insecure.Values: true, false

Cloud registry authentication

Set up cloud authentication so that the image builder can pull images from and push images to cloud container registries.

Azure

string

required

Azure AD Directory (tenant) ID.

string

required

Azure AD Application (client) ID.

string

Azure AD Application secret, required when using a Service Principal.

boolean

required

Azure AD Application (client) ID represents a Workload Identity.Values: true, false

Google Cloud Platform (GCP)

string

required

Service account with access to target GCR/GAR registry.

Service host prefixes

Certain services (currently only apps) can be configured with a separate subdomain.

string

Optional subdomain prefix for apps.

Admin Toolkit

The Domino Admin Toolkit compiles troubleshooting data for debugging and support.

boolean

Upload toolkit report to Domino.Values: true, false

FIPS

Control whether Domino is FIPS 140-2 compliant.

boolean

Enables a FIPS compliant configuration.Values: true, false

Enabling FIPS compliance requires the following:

The Kubernetes node image must have FIPS enabled.
To ensure compliance with the fips-140-2 policy, a FIPS enabled version of Istio must be installed and enabled. This can be achieved by setting fips=true and istio.install=true. Otherwise, if you’re providing your own version of Istio, it must be FIPS compliant.
For EKS, the following must be added to global_pod_environment.

global_pod_environment:
  - name: AWS_USE_FIPS_ENDPOINT
    value: "true"

Domino flows

Domino Flows enables efficient orchestration and monitoring of multi-step processes while ensuring full lineage and reliable reproducibility. Domino Flows is implemented on top of Flyte, which is an open source task orchestrator that facilitates building production-grade data and ML pipelines. The orchestrator stores task data (inputs and outputs) and task metadata in blob storage. Configure the following so that Domino Flows has appropriate access to blob storage.

AWS

string

AWS region of the Flyte metadata S3 bucket.Values: For example, us-west-2

string

Flyte metadata S3 bucket name.Values: For example, domino-flyte-metadata-bucket-1

string

KMS key ID associated with the Flyte metadata S3 bucket.Values: For example, 2f38143f-a42e-4f11-9ebb-162f11a6c350

string

AWS region of the Flyte data S3 bucket.Values: For example, us-west-2

string

Flyte data S3 bucket name.Values: For example, domino-flyte-data-bucket-1

string

KMS key ID associated with the Flyte data S3 bucket.Values: For example, 2f38143f-a42e-4f11-9ebb-162f11a6c350

string

AWS account ID associated with the Flyte S3 buckets.Values: For example, 012345678901

string

ARN for the AWS role that has access to the Flyte metadata S3 bucket.Values: For example, arn:aws:iam::012345678901:role/domino-flyte-controlplane

string

ARN for the AWS role that has access to the Flyte data S3 bucket.Values: For example, arn:aws:iam::012345678901:role/domino-flyte-dataplane

Azure

string

Azure storage account name for the Flyte metadata container.Values: For example, domino-flyte-account-name

string

Access key for the Flyte metadata storage account.Values: For example, [to come]

string

Name of the Flyte metadata container in the storage account.Values: For example, domino-flyte-metadata-container

string

Azure storage account name for the Flyte data container.Values: For example, [to come]

string

Access key for the Flyte data storage account.Values: For example, [to come]

string

Name of the Flyte data container in the storage account.Values: For example, domino-flyte-data-container

string

ID of the tenant associated with the storage containers.Values: For example, fc04e151-a39c-40a1-96d9-3913aa8a4a46

string

Azure subscription ID associated with the storage containers.Values: For example, f914720b-d639-4832-bc9c-4d6f2cdebce4

string

Azure client ID associated with the metadata storage.Values: For example, 3831e719-05b8-470f-a171-a3b34ca50af9

string

Azure client ID associated with the data storage.Values: For example, 01770221-a803-49fb-bda4-94033a87638e

Workspace file audit

Enable the Workspace File Audit service during installation or upgrade. You provision two AWS S3 buckets for audit data storage and enable the service flags in the installer.

boolean

Whether the workspace audit feature should be enabled.Values: For example, true

string

Cloud storage provider to be used for the workspace audit feature.Values: For example, aws

string

Name of the workspace audit archive S3 bucket.Values: For example, domino-workspace-audit-archive-bucket

string

AWS region of the workspace audit archive S3 bucket.Values: For example, us-west-2

string

KMS key ID associated with the workspace audit archive S3 bucket.Values: For example, 2f38143f-a42e-4f11-9ebb-162f11a6c350

string

Name of the workspace audit working S3 bucket.Values: For example, domino-workspace-audit-working-bucket

string

AWS region of the workspace audit working S3 bucket.Values: For example, us-west-2

string

KMS key ID associated with the workspace audit working S3 bucket.Values: For example, 2f38143f-a42e-4f11-9ebb-162f11a6c350

​Control and Data Planes

​Istio

​Ingress controller

​Namespaces

​Storage classes

​Block

​Shared

​Blob storage

​S3

​Azure

​GCS (Google Cloud Storage)

​Autoscaler

​AWS auto discovery

​Groups

​External DNS

​Email notifications

​Monitoring

​Grafana alerts

​Helm

​Image registries

​Internal Docker registry

​Telemetry

​Support

​Domino Governance

​Audit Trail

​GPU

​Neuron

​Fleetcommand

​Node selectors

​Pod configurations

​Image caching

​Certificate management

​Teleport Kubernetes agent

​Elasticsearch

​Image building

​Registries

​Cloud registry authentication

​Azure

​Google Cloud Platform (GCP)

​Service host prefixes

​Admin Toolkit

​FIPS

​Domino flows

​AWS

​Azure

​Workspace file audit

Control and Data Planes

Istio

Ingress controller

Namespaces

Storage classes

Block

Shared

Blob storage

S3

Azure

GCS (Google Cloud Storage)

Autoscaler

AWS auto discovery

Groups

External DNS

Email notifications

Monitoring

Grafana alerts

Helm

Image registries

Internal Docker registry

Telemetry

Support

Domino Governance

Audit Trail

GPU

Neuron

Fleetcommand

Node selectors

Pod configurations

Image caching

Certificate management

Teleport Kubernetes agent

Elasticsearch

Image building

Registries

Cloud registry authentication

Azure

Google Cloud Platform (GCP)

Service host prefixes

Admin Toolkit

FIPS

Domino flows

AWS

Azure

Workspace file audit