Database workers: Removes the node selector from restricting observability components to Platform workers. This allows for scheduling of observability components on worker nodes with other labels; for example, database nodes. Enable this only for constrained environments or when all workers provide homogenous hardware.

Backend: Determines which storage engine to use for observability data. Use separate buckets for metrics versus logs storage; you cannot use the same bucket for both.

Region identifier for the AWS S3 bucket. This field is not used by S3-compatible storage backends.

Access Key ID: Key ID used during authentication to the storage backend.

Secret Access Key: Secret access key used during authentication to the storage backend.

Endpoint URL: The endpoint URL for the S3-compatible storage backend. This field is not used by AWS S3.

Observability Bucket Insecure Access: Allows for disabling Certificate Authority (CA) certificate validation when connecting to S3-compatible storage backends.

Topology: Change the replication factor and the number of replicas for each Mimir component.

Resources: Change the resources (CPU, memory) allocated to each Mimir component.

Advanced Settings

Number of Distributor instances: Default: 1. Distributors receive metrics samples from Vector and forward them to the ingesters.

Number of Ingester instances: Default: 1. Ingester instances receive metrics samples from the Distributor and write them to the object storage.

Number of Compactor instances: Default: 1. Compactors are responsible for compacting the data in object storage that are received from multiple ingesters and for removing duplicate samples.

Number of Query Frontend instances: Default: 1. Query Frontend is responsible for checking for query results in a cache. Queries which may not be answered from the cache are queued for the Queriers.

Number of Query Scheduler instances: Default: 1. Maintains the queue of queries to be performed.

Number of Querier instances: Default: 1. Queriers are responsible for querying the data in object storage and on ingesters to fetch all data required for a query.

Number of Store Gateway instances: Default: 1. Store Gateways are responsible for fetching data from object storage and serving it to the Queriers.

Number of ruler instances: Default: 1. Ruler is responsible for evaluating recording and alerting rules and sending alerts to the Alert Manager.

Number of Alert Manager instances: Default: 2. Alert Manager is responsible for handling alerts sent by the Ruler and sending notifications to the configured receivers. The Alert Manager deduplicates and groups alert notifications, and routes them to a notification channel, such as email, PagerDuty, or OpsGenie. A minimum of two (2) instances are required for the Alert Manager.

Ingester Replication Factor: Default: 1. Writes to the Mimir cluster are successful if a majority of ingesters received the data.

Mimir Alertmanager Replication Factor: Default: 2. The Alert Manager shards and replicates alerts by tenant. A minimum Replication Factor of two (2) is required.

CPU: Default: 100m. The amount of CPU requested for the Mimir components in milli-CPUs. 1000m is equivalent to 1 vCPU.

Memory: Default: 128Mi. The amount of memory requested for the Mimir components. The allowable units are: Gi, Mi, and Ki. Memory is measured in bytes.

Limits: Limit to apply to containers once they are running on a worker.

CPU: Default: 0. CPU usage limit for Mimir components in milli-CPUs. 1000m is equivalent to 1 vCPU. Setting this to 0 removes all limits.

Memory: Default: 2Gi. Memory usage limit for Mimir components. The allowable units are: Gi, Mi, and Ki. Memory is measured in bytes. Setting this to 0 (zero) removes all limits.

Storage Retention: Default: 7d. The allowable units are: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days), w (weeks), y (years). 0 (zero) means unlimited.

Tune Attached Storage: Allows for tuning the local attached storage.

Storage Class: Setting the storage class to "-" disables dynamic provisioning. Leaving it empty (null) uses the default storage class.

Access Modes: Default: ReadWriteOnce.

Alert Manager Volume Size: Default: 1Gi.

Use 10GB for Production environments. Warning: this size cannot be modified after the initialization of the cluster.

Compactor Volume Size: Default: 2Gi.

Use a minimum of 300GB for production environments. Warning: this size cannot be modified after the initialization of the cluster.

Ingester Volume Size: Default: 2Gi.

Use a minimum of 100GB for production environments. Warning: this size cannot be modified after the initialization of the cluster.

Store Gateway Volume Size: Default: 2Gi.

Use 50GB for production environments. Warning: this size cannot be modified after the initialization of the cluster.

Topology: Change the replication factor and the number of replicas for each Loki component.

Number of Reader instances: Default: 1. Loki readers are responsible for querying the data in object storage and on ingesters to fetch all data required for a query.

Number of Writer instances: Default: 1. Loki writers are responsible for writing logs to the object storage.

Loki replication factor: Default: 1. Determines the number of Writer instances that will receive a given write. This should be less than or equal to the number of Writer instances.

Storage Retention - Default: 7d. The allowable units are: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days), w (weeks), y (years). 0s means unlimited retention. Minimum period is 24h.

Force Path-Style Addressing: Forces requests to use AWS S3 path-style addressing. This is useful when using MinIO as the S3 storage backend.

Tune Attached Storage: Allows for tuning the local attached storage.

Volume Size: Default: 10Gi. Warning: this size cannot be modified after the initialization of the cluster.

Storage Class: Leave it empty (null) to use the default storage class.

LDAP: Allows for configuring the LDAP connector.

OpenID Connect (OIDC): Allows for configuring the OIDC connector.

Static Credentials: Enables specifying a static user account. This is recommended during initial configuration, but should be disabled after deploying one of the other connectors.

Host: Host and optional port of the LDAP server.

No SSL: Required if the LDAP host is not using TLS (port 389). This option inherently leaks passwords to anyone on the same network as Dex. Important: Do not use this outside of exploratory phases. Not recommended.

Skip TLS verify: Turn off TLS certificate verification. This is unsecure. Important: Do not use this outside of exploratory phases. Not recommended.

Start TLS: Connect to the server using the ldap:// protocol and then issue a StartTLS command. If unspecified, connections use the ldaps:// protocol.

Root CA: A trusted root certificate file (base64-encoded PEM file).

Bind DN: The Distinguished Name (DN) to bind with when performing the search. If not provided, the search is performed anonymously.

Bind password: The password to bind with when performing the search. If not provided, the search is performed anonymously.

Username prompt: The prompt to display to the user when asking for their username. If unspecified, the default is "Username".

User base DN: BaseDN from which to start the search. It translates to the query (&(objectClass=person)(uid=<username>)).

User filter: Optional filter to apply when searching for the user. It translates to the query (&(objectClass=person)(uid=<username>)).

Username attribute: Username attribute used for comparing user entries. This is translated and combined with the other filter as (<attr>=<username>).

Group base DN: BaseDN from which to start the search. It translates to the query (&(objectClass=group)(member=<user uid>)).

Group filter: Optional filter to apply when searching the directory.

Group/user matchers: A list of field pairs used to match a user to a group. It adds an additional requirement to the filter that an attribute in the group must match the user’s attribute value. Expected format: multi-line YAML list of objects with userAttr and groupAttr keys.

Mission Control URL: A canonical URL that clients browsers will use to connect to the Mission Control UI. This is required with external providers because they will redirect back to this URL. It must also be addressable from within the Kubernetes cluster.

Issuer URL: Canonical URL of the provider, also used for configuration discovery. This value MUST match the value returned in the provider config discovery.

Client ID: OAuth Client ID.

Client secret: OAuth Client Secret.

Basic auth unsupported: Some providers require passing client_secret through POST parameters instead of basic auth, despite the OAuth2 RFC discouraging it. Many of these cases are caught internally, but you may need to check this box.

Scopes: List of additional scopes to request in token response. Default is profile and email. See the Full list. Expected format: multi-line YAML list of strings.

Skip email_verified: Some providers return claims without email_verified, when they had no usage of emails verification in the enrollment process, or if they are acting as a proxy for another IDP. An example is AWS Cognito with an upstream SAML IDP. Checking this box forces email_verified to true in Dex’s response. Not recommended.

Enable groups: Groups claims (like the rest of OIDC claims through Dex) only refresh when the IDToken is refreshed, meaning the regular refresh flow doesn’t update the groups claim. Therefore, by default, the OIDC connector doesn’t allow groups claims. If it is acceptable to have potentially stale group claims then you can use this option to enable groups claims through the OIDC connector on a per-connector basis. Not recommended.

Get user info: When enabled, the OpenID Connector queries the UserInfo endpoint for additional claims. UserInfo claims take priority over claims returned by the IDToken. This option should be used when the IDToken doesn’t contain all the claims requested. See OpenID user information.

User ID key: The claim used as user ID. Defaults to sub. See full claims list.

Username key: The claim used as username. Defaults to name.

ACR values: The Authentication Context Class values within the Authentication Request that the Authorization Server is being requested to process from this Client. Expected format: multi-line YAML list of strings.

Prompt type: For offline_access, the prompt parameter is set by default to prompt=consent. However, this is not supported by all OIDC providers. Some of them support different values for prompt, like login or none.

Preferred username claim: The claim used as preferred username. Defaults to preferred_username.

Email claim: The claim used as email. Defaults to email.

Preferred groups claim: The claim used as groups. Defaults to groups.

Password Hash: The bcrypt hash of the password. On *nix systems, generate this with the following command:

Important: Skipping this step will result in installation failure.