Configuration Guide

Overview

The CDN Manager is the Helm release cdn-platform, configured by Helm values. The release is installed and updated only by deploy, which builds the values from three layers:

1. The preset on the installation ISO: values-production.yaml or values-lab.yaml, chosen with deploy init.
2. Your overrides in /etc/acd/deploy/values.override.yaml: only the settings you want to change.
3. Derived settings worked out from your site settings in /etc/acd/deploy/group_vars/all.yaml and the certs/ folder. These always win.

deploy merges them into /etc/acd/deploy/values.yaml, which is what the cluster receives. See Application Settings.

This guide is the reference for the Helm values.

Applying Configuration

To change a value:

1. Write the setting in /etc/acd/deploy/values.override.yaml, with the same nesting as below. For example:

   cdn-manager:
     manager:
       logLevel: debug
   

2. Run deploy:

   /mnt/esb3027/deploy
   

Do not run helm install, helm upgrade or helm rollback yourself: the next deploy replaces the release with what the configuration says. To undo a change, revert it in values.override.yaml and run deploy again.

helm list -A shows six more releases, which the cluster itself runs on. They come from the installation ISO and k3s, not from your values, so leave them alone too:

Set through site settings, not values: the manager hostnames (global.hosts.manager and Zitadel’s ExternalDomain), the CDN Directors (global.hosts.routers, when external_directors is not empty) and the TLS certificate secret are derived by deploy, and override anything in values.override.yaml. Set them with manager_hostnames, external_directors and the certs/ folder.

Reference Files

The installation ISO provides the presets and a complete reference at /mnt/esb3027/:

Hardware requirements: For per-node hardware specifications, refer to the System Requirements Guide. The System Requirements Guide is the authoritative source — the hardware comments in the header of values-production.yaml may not reflect the current requirements.

Configuration Reference

Global Settings

The global section contains cluster-wide settings. The most critical configuration is global.hosts.

global:
  hosts:
    manager:
      - host: manager.local
    routers:
      - name: default
        address: 127.0.0.1
    edns_proxy: []
    geoip: []

Important: deploy sets global.hosts.manager, Zitadel’s ExternalDomain and global.hosts.routers from manager_hostnames and external_directors in Site Settings. Do not set them in values.override.yaml.

Manager Configuration

Core Manager API server settings:

Manager Resources

The chart supports both resource presets and explicit resource specifications:

Note: For production workloads, explicitly set cdn-manager.manager.resources rather than using presets.

Manager Datastore

cdn-manager:
  manager:
    datastore:
      type: redis
      namespace: "cdn_manager_ds"
      default_ttl: ""
      compression: zstd

Manager Database

The manager keeps its own data, including the subnet map, in a manager database in the PostgreSQL cluster. The manager creates the database if it is absent.

cdn-manager:
  manager:
    database:
      name: manager
      host: acd-cluster-postgresql-rw
      port: 5432
      user: app
      provision:
        enabled: true

Manager Discovery

cdn-manager:
  manager:
    discovery: []
    # Example:
    # - namespace: "other"
    #   hosts:
    #     - other-host1
    #     - other-host2
    #   pattern: "other-.*"

Manager Tuning

cdn-manager:
  manager:
    tuning:
      enable_cache_control: true
      cache_control_max_age: "5m"
      cache_control_miss_max_age: ""
      subnet:
        mutation_lock:
          wait: ""
      postgres:
        retry_min: ""
        retry_max: ""
        acquire_timeout: ""
        pool_size: ""

Manager Container Arguments

cdn-manager:
  manager:
    args:
      - --config-file=/etc/manager/config.toml
      - http-server

Gateway Configuration

NGinx Gateway settings:

MIB Frontend Configuration

Web-based configuration GUI settings:

Confd Configuration

Confd settings for configuration management:

VictoriaMetrics Configuration

Time-series database for metrics:

Ingress Configuration

Traffic exposure settings:

Ingress Extra Paths

The chart includes default extra paths for Confd and GeoIP:

cdn-manager:
  ingress:
    extraPaths:
      - path: /confd
        pathType: Prefix
        backend:
          service:
            name: cdn-platform-cdn-manager-gateway
            port:
              name: http
      - path: /geoip
        pathType: Prefix
        backend:
          service:
            name: cdn-platform-cdn-manager-gateway
            port:
              name: http

TLS Certificate Secrets

Note: With deploy, put the certificate and key in /etc/acd/deploy/certs/ instead: deploy creates the secret and wires it to every ingress. See TLS Certificates. The settings below are for reference.

For production TLS certificates:

cdn-manager:
  ingress:
    secrets:
      - name: manager.local-tls
        key: |-
          -----BEGIN RSA PRIVATE KEY-----
          ...
          -----END RSA PRIVATE KEY-----
        certificate: |-
          -----BEGIN CERTIFICATE-----
          ...
          -----END CERTIFICATE-----
    tls: true

Resource Configuration

Resource Presets

Predefined resource configurations for common deployment sizes:

Note: Limits are calculated as requests plus 50% (except for xlarge/2xlarge and ephemeral-storage).

Custom Resources

Override preset with custom values:

cdn-manager:
  manager:
    resources:
      requests:
        cpu: "300m"
        memory: "512Mi"
      limits:
        cpu: "1"
        memory: "1Gi"

Note:

• CPU values use millicores (1000m = 1 core)
• Memory values use binary SI units (1024Mi = 1GiB)
• Requests represent minimum guaranteed resources
• Limits represent maximum consumable resources

Capacity Planning

When sizing resources:

• Requests determine scheduling (node must have available capacity)
• Limits prevent resource starvation
• Maintain 20-30% cluster headroom for scaling
• Total capacity = sum of all requests × replica count + headroom

Security Contexts

Pod Security Context

cdn-manager:
  manager:
    podSecurityContext:
      enabled: true
      fsGroup: 1001
      fsGroupChangePolicy: Always
      sysctls: []
      supplementalGroups: []

Container Security Context

cdn-manager:
  manager:
    containerSecurityContext:
      enabled: true
      runAsUser: 1001
      runAsGroup: 1001
      runAsNonRoot: true
      readOnlyRootFilesystem: true
      privileged: false
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]
      seccompProfile:
        type: "RuntimeDefault"

Health Probes

Probe Types

Default Probe Configuration

Liveness Probe

cdn-manager:
  manager:
    livenessProbe:
      enabled: true
      initialDelaySeconds: 5
      periodSeconds: 30
      timeoutSeconds: 10
      failureThreshold: 5
      successThreshold: 1
      httpGet:
        path: /api/v1/health/alive
        port: http

Readiness Probe

cdn-manager:
  manager:
    readinessProbe:
      enabled: true
      initialDelaySeconds: 5
      periodSeconds: 10
      timeoutSeconds: 7
      failureThreshold: 3
      successThreshold: 1
      httpGet:
        path: /api/v1/health/ready
        port: http

Startup Probe

cdn-manager:
  manager:
    startupProbe:
      enabled: true
      initialDelaySeconds: 0
      periodSeconds: 5
      timeoutSeconds: 3
      failureThreshold: 10
      successThreshold: 1
      httpGet:
        path: /api/v1/health/alive
        port: http

Autoscaling Configuration

Horizontal Pod Autoscaler (HPA)

cdn-manager:
  manager:
    autoscaling:
      hpa:
        enabled: true
        minReplicas: 3
        maxReplicas: 8
        targetCPU: 50
        targetMemory: 80

Network Policy

cdn-manager:
  networkPolicy:
    enabled: true
    allowExternal: true
    allowExternalEgress: true
    addExternalClientAccess: true

Pod Affinity and Anti-Affinity

cdn-manager:
  manager:
    podAffinityPreset: ""
    podAntiAffinityPreset: soft
    nodeAffinityPreset:
      type: ""
      key: ""
      values: []
    affinity: {}

Service Configuration

cdn-manager:
  service:
    type: ClusterIP
    ports:
      http: 80
    annotations:
      service.kubernetes.io/topology-mode: Auto
    externalTrafficPolicy: Cluster
    sessionAffinity: None

Persistence Configuration

Warning: Set volume sizes before the first deploy. Helm cannot change the size of a persistent volume claim that already exists, so changing a size or persistence setting in values.override.yaml on an installed cluster does not resize the volume, and can make the upgrade fail. This applies to every component with storage, such as Kafka, VictoriaMetrics, PostgreSQL and Redis. Raising a retention setting also uses more disk, so check the volume has room first.

cdn-manager:
  persistence:
    enabled: false
    mountPath: /agiletv/manager/data
    storageClass: ""
    accessModes:
      - ReadWriteOnce
    size: 8Gi

RBAC and Service Account

cdn-manager:
  rbac:
    create: false
    rules: []

  serviceAccount:
    create: true
    name: ""
    automountServiceAccountToken: true
    annotations: {}

Metrics

cdn-manager:
  metrics:
    enabled: false
    serviceMonitor:
      enabled: false
      namespace: ""
      annotations: {}
      labels: {}
      interval: ""
      scrapeTimeout: ""

Next Steps

After configuration:

1. Installation Guide - Deploy with your configuration
2. Operations Guide - Day-to-day management
3. Performance Tuning Guide - Optimize system performance
4. Architecture Guide - Understand component relationships