Step 4: Write your values file

Generate the values file, which tells the chart about your installation, from your worksheet. You don't write it by hand: the command in 4.1 generates it. Then you check one section and you're done.

The commands on this page load their variables from openlm-install.env, the file you created from the installation worksheet.

source ./openlm-install.env

4.1 Generate the file

Copy and run the whole block. It creates openlm-values.yaml in the current folder.

STORAGE_PROVISIONER="$(kubectl get storageclass "$STORAGE_CLASS" -o jsonpath='{.provisioner}')"
cat > openlm-values.yaml <<EOF
# openlm-values.yaml for $DOMAIN (generated $(date +%F))
global:
  useOpenShift: false            # OpenShift: see the OpenShift page
  securityContext:
    omitIds: false               # true = let the cluster choose user IDs (OpenShift sets this for you)
  affinity:
    enabled: false               # true only if your nodes carry openlm.com/role labels (Node placement page)
  taints:
    enabled: false
  traefikRoutes:
    enabled: false
  masterIngress:
    enabled: true                # one Ingress for the whole platform
    hostname: $DOMAIN
    ingressClassName: $INGRESS_CLASS
    secretName: openlm-lb-cert
  ingressAnnotations:            # remove the per-component rewrite rules; the single Ingress doesn't use them
    nginx.ingress.kubernetes.io/rewrite-target: null
    nginx.ingress.kubernetes.io/use-regex: null

# ── Settings shared by every service ──────────────────────────────────────────
openlm_config_generic:
  configmap:
    vars_list:
      LB_FQDN: "$DOMAIN"
      INFRASTRUCTURE__LBFQDN: "$DOMAIN"
      AUTHORITY_URL: "https://$DOMAIN/identity"
      INFRASTRUCTURE__AUTHORITYURL: "https://$DOMAIN/identity"
      IssuerUri: "https://$DOMAIN/identity"
      UI_BASE_HREF_URL: "https://$DOMAIN/identity"
      UI_OAUTH_ISSUER_URL: "https://$DOMAIN/identity"
      LdapServiceHost: "https://$DOMAIN"
      PERSONAL_DASHBOARD_ADDRESS: "https://$DOMAIN/personal-dashboard"
      general__personalDashboardAddress: "https://$DOMAIN/personal-dashboard"
      OLM__K8s__ServiceNamespace: "$NS"
      INFRASTRUCTURE__ServerDbPrefix: "${DB_PREFIX}_operational"
      INFRASTRUCTURE__USESECURITY: "true"
      DbType: "SqlServer_SQLServerAuth"
      DB_TYPE: "SqlServer_SQLServerAuth"
      DbConnectionConfig__DbType: "SqlServer_SQLServerAuth"
      LICENSEMANAGER__BaseUrl: "http://openlm-licensemanager/"
      UGSINTEGRATION__UGSURL: "http://openlm-usersandgroupsservice/"
      KAFKA_WITH_PORT: "$KAFKA_BOOTSTRAP"
      KAFKA_BOOTSTRAPSERVERS_CONNECTION: "$KAFKA_BOOTSTRAP"
      Audit__Kafka__ProducerConfig__BootstrapServers: "$KAFKA_BOOTSTRAP"
      LicenseManager__FeaturesConsumerSettings__BootstrapServers: "$KAFKA_BOOTSTRAP"
openlm_telemetry_config_generic:
  configmap:
    vars_list:
      TELEMETRY__ENABLED: "false"   # turn on only with an OpenTelemetry collector

# ── Components that need settings in this release (each listed once) ─────────
identity:
  enabled: true
  configmap:
    vars_list:
      IssuerUri: "https://$DOMAIN/identity"
      UI_BASE_HREF_URL: "https://$DOMAIN/identity"
      UI_OAUTH_ISSUER_URL: "https://$DOMAIN/identity"
      DbType: "SqlServer_SQLServerAuth"
identitydiscovery:
  enabled: true
  secrets:
    - { name: openlm-generic-mongo-db-credentials, type: env }
    - { name: openlm-generic-kafka-bootstrap-credentials, type: env }
    - { name: openlm-generic-redis-connection-credentials, type: env }
    - { name: openlm-identitydiscovery-hangfire-credentials, type: env }
dss:
  enabled: true
  configmap: { vars_list: { LdapServiceHost: "https://$DOMAIN" } }
dssui:
  enabled: true
  configmap: { vars_list: { UI_BASE_HREF_URL: "https://$DOMAIN/dss" } }
usageservice:
  enabled: true
  configmap: { vars_list: { ProductServiceIntegration__HostName: "openlm-productservice.$NS.svc.cluster.local" } }
denialservice:
  enabled: true
  configmap: { vars_list: { ProductServiceIntegration__HostName: "openlm-productservice.$NS.svc.cluster.local" } }
licensefilecomparatormiddleware:
  enabled: true
  configmap: { vars_list: { AWS_SQS_QUEUE_URL: "", SERVICENOW_INSTANCE_URL: "" } }
licenseconcurency:
  enabled: true
  configmap: { vars_list: { HADOOP_USER_NAME: "openlm", SPARK_USER: "openlm" } }
  pvc: { storageClassName: $STORAGE_CLASS, annotations: { storageProvisioner: $STORAGE_PROVISIONER } }
officetimecalculation:
  enabled: true
  pvc: { storageClassName: $STORAGE_CLASS, annotations: { storageProvisioner: $STORAGE_PROVISIONER } }
sparkmongo:
  enabled: true
  configmap: { vars_list: { KAFKA_BOOTSTRAPSERVERS_CONNECTION: "$KAFKA_BOOTSTRAP", MONGODB_CONNECTION: "" } }
  pvc: { storageClassName: $STORAGE_CLASS, annotations: { storageProvisioner: $STORAGE_PROVISIONER } }
sparkmssql:
  enabled: true
  pvc: { storageClassName: $STORAGE_CLASS, annotations: { storageProvisioner: $STORAGE_PROVISIONER } }
catalogenrichment:
  enabled: true
  configmap:
    vars_list:
      GRAPHQL_URL: "https://$DOMAIN/api/samcatalog/graphql"
      SAM_INVENTORY_URL: "https://$DOMAIN/api/softwareassetmanagement/graphql"
EOF
echo "written: openlm-values.yaml"

Why https:// everywhere

Every address on your web address starts with https://, including the identity addresses. A single http:// here breaks sign-in once the ingress redirects HTTP to HTTPS. Addresses of services inside the cluster, such as http://openlm-licensemanager/, stay http://: that traffic never leaves the cluster.

Each component appears once

A component can appear only once in the values file. If you add a setting for a component later, add it under that component's existing entry. A second identity: later in the file silently replaces the first, including its settings.

4.2 Add the components

Switch on the rest of the standard set with the following block. The standard set gives the full platform: sign-in, license management and reporting, and every product except the integrations under Optional components. Every component is off until you switch it on, and the components in 4.1 are already switched on.

To leave out a component from 4.1, change its enabled: true to enabled: false.

cat >> openlm-values.yaml <<'EOF'

# ── Components ────────────────────────────────────────────────────────────────
EOF
for c in \
  agentactivitymanager agentshub agentshubui alertsservice alertsserviceui alldbupgradeapi \
  allocationservice auditservice auditserviceui brokerhub \
  brokerhubconnector brokerhubui cloudbroker cloudbrokerui complianceservice \
  complianceserviceui dbconfigurationtoolui denialsaggregation denialsui \
  disposabletokens donglemonitoring donglemonitoringui dsconnector emailnotification \
  enduserservices featureservice flexlmcompare homepage homepageui \
  identityapi identityui kafkainitpod \
  licenseaccesscontrol licenseaccesscontrolui licenseallocationsui licenseautomationtool \
  licensefilesmanagement licensefilesui \
  licenseharvester licensemanager licensemanagerui licenseserversui licensesui navigationservice \
  navigationui notificationgateway notificationui operationalapi \
  personaldashboard platformhealth processmanager processmanagerui \
  productservice productsserviceui projectsserviceapi projectsservicemigration projectsserviceui \
  pushnotification reportingdataapi \
  samcatalog samcatalogui server sessioncreator \
  softwareassetmanagement softwareassetmanagementui subscriptionoptimizer \
  uiconfigurationservice uiconfigurationserviceui \
  usageui useravailibility usersandgroupsmigrationservice usersandgroupsservice \
  usersandgroupsserviceui vlm vlmui
do
  printf '%s:\n  enabled: true\n' "$c" >> openlm-values.yaml
  case "$c" in   # these components need placement switched off on their own entry as well
    licensefilesmanagement|platformhealth)
      printf '  affinity: ""\n  taints: ""\n' >> openlm-values.yaml ;;
  esac
done
echo "done: $(grep -c '^  enabled: true' openlm-values.yaml) components switched on"

kafkainitpod isn't a service: it's the one-time job that creates the Kafka topics during installation and upgrades. Keep it on.

Don't switch these on

kafka-rest-proxy is a helper chart for OpenLM's own environments. It isn't meant for your installation: use your own data services (step 2). Leave openlm-apigateway off as well. The API gateway is its own release (step 5). The Router components (routerapi, routerui, routerconsolidatorwriter, routeringestgateway, dashboardapi, dashboardui) aren't part of this release: leave them off.

Which components do I need?

Switch on the full standard set from 4.1 and 4.2, even if you don't use every product. OpenLM recommends this setup and tests the guide with it.

After OpenLM Platform runs, you can switch off components you don't need: set their enabled: true to enabled: false in openlm-values.yaml and run the same helm upgrade --install command as in step 6. This guide doesn't list yet which components each product needs, so ask OpenLM before you switch a component off.

Optional components

Switch these on only if you use them. Add each entry to openlm-values.yaml once, after the 4.2 block:

You use	Add
ServiceNow Connector or ServiceNow integration	servicenowconnectoretl (with the setting in the following block), servicenowcreds, servicenowalertintegration, servicenowemintegration, integrationui
Zendesk Alerts Integration	ticketingnotification
Data anonymization	anonymization, anonymizationui

For ServiceNow, run this block:

cat >> openlm-values.yaml <<EOF
servicenowconnectoretl:
  enabled: true
  configmap: { vars_list: { INFRASTRUCTURE__KAFKABOOTSTRAPSERVERS: "$KAFKA_BOOTSTRAP" } }
servicenowcreds: { enabled: true }
servicenowalertintegration: { enabled: true }
servicenowemintegration: { enabled: true }
integrationui: { enabled: true }
EOF

For the other two rows, add <component>: { enabled: true } the same way. On OpenShift, the anonymization UI also needs the Route in Routes.

4.3 Add the settings for your cluster type

Certain cluster types need a few more lines in this file. Add them now:

Cluster	Add
EKS	Nothing more, unless you use dedicated node groups: EKS
AKS	Nothing more, unless you use dedicated node pools: AKS
OpenShift	The OpenShift block: OpenShift
K3s	Nothing more: K3s

Check

Render the chart with your file. Helm checks the file without installing anything:

helm repo add openlm https://openlm-helm.github.io/helmcharts && helm repo update openlm
helm template openlm-platform openlm/openlm-platform --version "$OPENLM_VERSION" \
  -n "$NS" -f openlm-values.yaml > /tmp/openlm-render.yaml && echo "render OK"
grep -c "^kind: Deployment" /tmp/openlm-render.yaml

It must print render OK and then a number around 85 (the Deployments it would create). An error names the line in your values file that is wrong.

Keep openlm-values.yaml. You use the same file for every upgrade.