DETalk to us →
ClusterPilot Docs
v0.0.1 RC · fcc5871
Start with:EvaluateInstallCreate a clusterOperateRecoverAutomate
Documentation/Administer
Administer · v0.0.1

Configuration

Configure durable dependencies, replicas, secret protection, clock health, and feature gates without unsafe fallbacks.

AudiencePlatform administrators, release engineersReading time15 minCommands in contextNo terminal requiredReviewed sourcefcc5871 · 30 July 2026
RC

Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.

Configuration sources

Use the release-owned example and chart values as the schema for the exact version you deploy. Separate non-secret settings from secret material and record the effective configuration revision in change evidence.

DataPreferred source
Non-secret application settingsVersion-controlled Helm values or managed environment configuration.
Database and object-store credentialsKubernetes Secret or protected host secret file/reference.
Secrets protection master keyExternal key escrow/secret manager delivered as a runtime secret.
Provider, registry, SSH, and cluster credentialsClusterPilot typed secret references, materialized only at the approved agent boundary.
Release identity and locksSigned release metadata and immutable digests.

Production-critical settings

SettingRequired posture
ConnectionStrings__ClusterPilotDurable PostgreSQL; no ephemeral local database.
Hosting__ApiReplicas / WorkerReplicasActual deployed counts.
ControlPlane__LeaderElection__Enabledtrue when either replica count exceeds one.
ArtifactStorage__ProviderExplicit filesystem or s3-compatible.
ArtifactStorage__FileSystem__Sharedtrue for multi-replica filesystem storage on a durable shared volume.
Secrets__Protection__MasterKeyBase64-encoded 32-byte key from a managed secret source.
Secrets__Protection__KeyIdManaged identifier; never local-dev.
Secrets__Protection__AllowInsecureDevelopmentFallbackfalse in Preprod and Production.

Clock health

Accurate UTC is required for signatures, sessions, leases, events, agent heartbeat, and evidence ordering. The default direct NTP mode can be replaced with a trusted local service for restricted networks.

Command
Clock__Health__ReferenceMode=trusted_local_service
Clock__Health__NtpServer=ntp.internal.example
Clock__Health__ServerWarningThresholdSeconds=5
Clock__Health__ServerDegradedThresholdSeconds=30
Clock__Health__AgentWarningThresholdSeconds=5
Clock__Health__AgentRejectionThresholdSeconds=30

Feature gates

Operational capabilities are disabled until their release and environment gates are satisfied. Keep a reviewed register that records owner, reason, target environment, evidence, expiry, rollback, and exact configuration revision for every enabled gate.

Capabilityv0.0.1 posture
Control plane operationsProduction-gated; disabled by default
Provider and cluster lifecyclePreview/production-gated by provider; disabled
Kubernetes read operationsPreview/gated; disabled
Sensitive Kubernetes mutationsContract-only; disabled
Built-in/custom add-on installationPreview/gated; disabled
ConformanceCandidate catalog; gated
Updates and self-hosted distributionProduction-gated

Configuration change procedure

  1. 01

    Diff effective configuration

    Compare intended values with the active non-secret configuration and release compatibility manifest.

  2. 02

    Validate secrets and dependencies

    Resolve references and reachability without printing values.

  3. 03

    Run preflight

    Block on startup, replica, storage, migration, trust, and release-integrity failures.

  4. 04

    Apply through the deployment surface

    Use Helm or the release-owned Compose entrypoint; avoid live container edits.

  5. 05

    Verify and retain evidence

    Check health, readiness, clock, build identity, workers, agents, and one bounded read path.