---
title: "Step 4: Write your values file"
description: "Generate openlm-values.yaml, the one file that describes your OpenLM Platform installation: web address, ingress, placement, and components."
product: OpenLM Platform
---

Generate the values file, which tells the chart about your installation, from your worksheet. You don't write it by hand: the command in 4.1 generates it. Then you check one section and you're done.

The commands on this page load their variables from `openlm-install.env`, the file you created from the [installation worksheet](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/before-you-start/worksheet).

```bash
source ./openlm-install.env
```

## 4.1 Generate the file

Copy and run the whole block. It creates `openlm-values.yaml` in the current folder.

```bash
STORAGE_PROVISIONER="$(kubectl get storageclass "$STORAGE_CLASS" -o jsonpath='{.provisioner}')"
cat > openlm-values.yaml <<EOF
# openlm-values.yaml for $DOMAIN (generated $(date +%F))
global:
  useOpenShift: false            # OpenShift: see the OpenShift page
  securityContext:
    omitIds: false               # true = let the cluster choose user IDs (OpenShift sets this for you)
  affinity:
    enabled: false               # true only if your nodes carry openlm.com/role labels (Node placement page)
  taints:
    enabled: false
  traefikRoutes:
    enabled: false
  masterIngress:
    enabled: true                # one Ingress for the whole platform
    hostname: $DOMAIN
    ingressClassName: $INGRESS_CLASS
    secretName: openlm-lb-cert
  ingressAnnotations:            # remove the per-component rewrite rules; the single Ingress doesn't use them
    nginx.ingress.kubernetes.io/rewrite-target: null
    nginx.ingress.kubernetes.io/use-regex: null

# ── Settings shared by every service ──────────────────────────────────────────
openlm_config_generic:
  configmap:
    vars_list:
      LB_FQDN: "$DOMAIN"
      INFRASTRUCTURE__LBFQDN: "$DOMAIN"
      AUTHORITY_URL: "https://$DOMAIN/identity"
      INFRASTRUCTURE__AUTHORITYURL: "https://$DOMAIN/identity"
      IssuerUri: "https://$DOMAIN/identity"
      UI_BASE_HREF_URL: "https://$DOMAIN/identity"
      UI_OAUTH_ISSUER_URL: "https://$DOMAIN/identity"
      LdapServiceHost: "https://$DOMAIN"
      PERSONAL_DASHBOARD_ADDRESS: "https://$DOMAIN/personal-dashboard"
      general__personalDashboardAddress: "https://$DOMAIN/personal-dashboard"
      OLM__K8s__ServiceNamespace: "$NS"
      INFRASTRUCTURE__ServerDbPrefix: "${DB_PREFIX}_operational"
      INFRASTRUCTURE__USESECURITY: "true"
      DbType: "SqlServer_SQLServerAuth"
      DB_TYPE: "SqlServer_SQLServerAuth"
      DbConnectionConfig__DbType: "SqlServer_SQLServerAuth"
      LICENSEMANAGER__BaseUrl: "http://openlm-licensemanager/"
      UGSINTEGRATION__UGSURL: "http://openlm-usersandgroupsservice/"
      KAFKA_WITH_PORT: "$KAFKA_BOOTSTRAP"
      KAFKA_BOOTSTRAPSERVERS_CONNECTION: "$KAFKA_BOOTSTRAP"
      Audit__Kafka__ProducerConfig__BootstrapServers: "$KAFKA_BOOTSTRAP"
      LicenseManager__FeaturesConsumerSettings__BootstrapServers: "$KAFKA_BOOTSTRAP"
openlm_telemetry_config_generic:
  configmap:
    vars_list:
      TELEMETRY__ENABLED: "false"   # turn on only with an OpenTelemetry collector

# ── Components that need settings in this release (each listed once) ─────────
identity:
  enabled: true
  configmap:
    vars_list:
      IssuerUri: "https://$DOMAIN/identity"
      UI_BASE_HREF_URL: "https://$DOMAIN/identity"
      UI_OAUTH_ISSUER_URL: "https://$DOMAIN/identity"
      DbType: "SqlServer_SQLServerAuth"
identitydiscovery:
  enabled: true
  secrets:
    - { name: openlm-generic-mongo-db-credentials, type: env }
    - { name: openlm-generic-kafka-bootstrap-credentials, type: env }
    - { name: openlm-generic-redis-connection-credentials, type: env }
    - { name: openlm-identitydiscovery-hangfire-credentials, type: env }
dss:
  enabled: true
  configmap: { vars_list: { LdapServiceHost: "https://$DOMAIN" } }
dssui:
  enabled: true
  configmap: { vars_list: { UI_BASE_HREF_URL: "https://$DOMAIN/dss" } }
usageservice:
  enabled: true
  configmap: { vars_list: { ProductServiceIntegration__HostName: "openlm-productservice.$NS.svc.cluster.local" } }
denialservice:
  enabled: true
  configmap: { vars_list: { ProductServiceIntegration__HostName: "openlm-productservice.$NS.svc.cluster.local" } }
licensefilecomparatormiddleware:
  enabled: true
  configmap: { vars_list: { AWS_SQS_QUEUE_URL: "", SERVICENOW_INSTANCE_URL: "" } }
licenseconcurency:
  enabled: true
  configmap: { vars_list: { HADOOP_USER_NAME: "openlm", SPARK_USER: "openlm" } }
  pvc: { storageClassName: $STORAGE_CLASS, annotations: { storageProvisioner: $STORAGE_PROVISIONER } }
officetimecalculation:
  enabled: true
  pvc: { storageClassName: $STORAGE_CLASS, annotations: { storageProvisioner: $STORAGE_PROVISIONER } }
sparkmongo:
  enabled: true
  configmap: { vars_list: { KAFKA_BOOTSTRAPSERVERS_CONNECTION: "$KAFKA_BOOTSTRAP", MONGODB_CONNECTION: "" } }
  pvc: { storageClassName: $STORAGE_CLASS, annotations: { storageProvisioner: $STORAGE_PROVISIONER } }
sparkmssql:
  enabled: true
  pvc: { storageClassName: $STORAGE_CLASS, annotations: { storageProvisioner: $STORAGE_PROVISIONER } }
catalogenrichment:
  enabled: true
  configmap:
    vars_list:
      GRAPHQL_URL: "https://$DOMAIN/api/samcatalog/graphql"
      SAM_INVENTORY_URL: "https://$DOMAIN/api/softwareassetmanagement/graphql"
EOF
echo "written: openlm-values.yaml"
```

:::note[Why `https://` everywhere]
Every address on your web address starts with `https://`, including the identity addresses. A single `http://` here breaks sign-in once the ingress redirects HTTP to HTTPS. Addresses of services *inside* the cluster, such as `http://openlm-licensemanager/`, stay `http://`: that traffic never leaves the cluster.
:::

:::warning[Each component appears once]
A component can appear only **once** in the values file. If you add a setting for a component later, add it under that component's existing entry. A second `identity:` later in the file silently replaces the first, including its settings.
:::

## 4.2 Add the components

Switch on the rest of the **standard set** with the following block. The standard set gives the full platform: sign-in, license management and reporting, and every product except the integrations under [Optional components](#optional-components). Every component is off until you switch it on, and the components in 4.1 are already switched on.

To leave out a component from 4.1, change its `enabled: true` to `enabled: false`.

```bash
cat >> openlm-values.yaml <<'EOF'

# ── Components ────────────────────────────────────────────────────────────────
EOF
for c in \
  agentactivitymanager agentshub agentshubui alertsservice alertsserviceui alldbupgradeapi \
  allocationservice auditservice auditserviceui brokerhub \
  brokerhubconnector brokerhubui cloudbroker cloudbrokerui complianceservice \
  complianceserviceui dbconfigurationtoolui denialsaggregation denialsui \
  disposabletokens donglemonitoring donglemonitoringui dsconnector emailnotification \
  enduserservices featureservice flexlmcompare homepage homepageui \
  identityapi identityui kafkainitpod \
  licenseaccesscontrol licenseaccesscontrolui licenseallocationsui licenseautomationtool \
  licensefilesmanagement licensefilesui \
  licenseharvester licensemanager licensemanagerui licenseserversui licensesui navigationservice \
  navigationui notificationgateway notificationui operationalapi \
  personaldashboard platformhealth processmanager processmanagerui \
  productservice productsserviceui projectsserviceapi projectsservicemigration projectsserviceui \
  pushnotification reportingdataapi \
  samcatalog samcatalogui server sessioncreator \
  softwareassetmanagement softwareassetmanagementui subscriptionoptimizer \
  uiconfigurationservice uiconfigurationserviceui \
  usageui useravailibility usersandgroupsmigrationservice usersandgroupsservice \
  usersandgroupsserviceui vlm vlmui
do
  printf '%s:\n  enabled: true\n' "$c" >> openlm-values.yaml
  case "$c" in   # these components need placement switched off on their own entry as well
    licensefilesmanagement|platformhealth)
      printf '  affinity: ""\n  taints: ""\n' >> openlm-values.yaml ;;
  esac
done
echo "done: $(grep -c '^  enabled: true' openlm-values.yaml) components switched on"
```

`kafkainitpod` isn't a service: it's the one-time job that creates the Kafka topics during installation and upgrades. Keep it on.

:::warning[Don't switch these on]
`kafka-rest-proxy` is a helper chart for OpenLM's own environments. It isn't meant for your installation: use your own data services (step 2). Leave `openlm-apigateway` off as well. The API gateway is its own release ([step 5](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/install/step-5-gateway)). The Router components (`routerapi`, `routerui`, `routerconsolidatorwriter`, `routeringestgateway`, `dashboardapi`, `dashboardui`) aren't part of this release: leave them off.
:::

## Which components do I need?

Switch on the full standard set from 4.1 and 4.2, even if you don't use every product. OpenLM recommends this setup and tests the guide with it.

After OpenLM Platform runs, you can switch off components you don't need: set their `enabled: true` to `enabled: false` in `openlm-values.yaml` and run the same `helm upgrade --install` command as in [step 6](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/install/step-6-install). This guide doesn't list yet which components each product needs, so ask OpenLM before you switch a component off.

### Optional components

Switch these on only if you use them. Add each entry to `openlm-values.yaml` once, after the 4.2 block:

| You use | Add |
|---|---|
| ServiceNow Connector or ServiceNow integration | `servicenowconnectoretl` (with the setting in the following block), `servicenowcreds`, `servicenowalertintegration`, `servicenowemintegration`, `integrationui` |
| Zendesk Alerts Integration | `ticketingnotification` |
| Data anonymization | `anonymization`, `anonymizationui` |

For ServiceNow, run this block:

```bash
cat >> openlm-values.yaml <<EOF
servicenowconnectoretl:
  enabled: true
  configmap: { vars_list: { INFRASTRUCTURE__KAFKABOOTSTRAPSERVERS: "$KAFKA_BOOTSTRAP" } }
servicenowcreds: { enabled: true }
servicenowalertintegration: { enabled: true }
servicenowemintegration: { enabled: true }
integrationui: { enabled: true }
EOF
```

For the other two rows, add `<component>: { enabled: true }` the same way. On OpenShift, the anonymization UI also needs the Route in [Routes](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/openshift#routes).

## 4.3 Add the settings for your cluster type

Certain cluster types need a few more lines in this file. Add them now:

| Cluster | Add |
|---|---|
| EKS | Nothing more, unless you use dedicated node groups: [EKS](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/eks#values) |
| AKS | Nothing more, unless you use dedicated node pools: [AKS](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/aks#values) |
| OpenShift | The OpenShift block: [OpenShift](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/openshift#values) |
| K3s | Nothing more: [K3s](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/k3s#values) |

:::tip[Check]
Render the chart with your file. Helm checks the file without installing anything:

```bash
helm repo add openlm https://openlm-helm.github.io/helmcharts && helm repo update openlm
helm template openlm-platform openlm/openlm-platform --version "$OPENLM_VERSION" \
  -n "$NS" -f openlm-values.yaml > /tmp/openlm-render.yaml && echo "render OK"
grep -c "^kind: Deployment" /tmp/openlm-render.yaml
```

It must print `render OK` and then a number around 85 (the Deployments it would create). An error names the line in your values file that is wrong.
:::

Keep `openlm-values.yaml`. You use the same file for every upgrade.