a9s MongoDB SPI Configuration
This document describes a9s MongoDB SPI configuration.
Summary
Custom Parameter Configuration
The a9s MongoDB SPI handles custom parameters for all service instances. It does configuration and validation of custom parameters.
The a9s MongoDB SPI defines default values for certain custom parameters. Also, it defines whether a custom parameter can be set by the application developer.
The platform operator can overwrite those choices by changing the a9s MongoDB
SPI configuration. The platform operator has to configure the property
mongodb-spi.service_instance.custom_param_config
. The property
value must be a hash. Every key in that hash stands for a custom parameter and
the value for every key contains the configuration for that particular
parameter. The configuration for a particular param is a hash consisting of
the following optional keys: default_value
and modifiable
.
The key default_value
specifies the default value for that parameter and
modifiable
specifies whether the application developer is allowed to
set that custom parameter. For example:
mongodb-spi:
service_instance:
custom_param_config:
ssl_min_protocol_version:
default_value: TLSv1
modifiable: true
Default Custom Parameter Configuration
The following table contains custom parameters that are configurable by the platform operator. The meaning of those custom parameters can be read in the application developer documentation for a9s MongoDB SPI.
Name | Default value | Is modifiable |
---|---|---|
ssl_ciphers | HIGH:!EXPORT:!aNULL@STRENGTH | true |
ssl_min_protocol_version | TLSv1 | true |
ssl_ciphers
The parameter ssl_ciphers
corresponds to the MongoDB parameter
opensslCipherConfig
.
a9s MongoDB SPI does no validation for the ssl_ciphers
value except that
it must be of type string or null
(use default value).
ssl_min_protocol_version
The parameter ssl_min_protoctol_version
currently has no effect.
Example Configuration
Let's build an imaginary example.
The default value for the custom parameter ssl_min_protocol_version
should be TLSv1.3.
Additionally, the application developer should not be allowed to set
ssl_min_protocol_version
.
Then the configuration must look the following way:
mongodb-spi:
service_instance:
custom_param_config:
ssl_min_protocol_version:
default_value: TLSv1.3
modifiable: false
Per Plan Configuration
Take a look at Service Plans documentation if you want to configure the custom parameters per plan.
Notes
Additional custom parameters will be made available over time. We do not make all available custom parameters the SPIs knows about available to the platform operator from the beginning.
During the SPI startup, the configuration the platform operator made will be checked. When it's invalid, the SPI will not start up.
mongodb-spi.protocols
For more details on this property, please refer to the a9s Framework TLS configuration documentation.