EQTY LabDocs

Governance Service Configuration

Customer-facing configuration categories for Governance Service.

View as Markdown

Governance Service configuration is managed through the deployment chart and customer environment values. This page describes the configuration areas operators should understand before release, and the environment variables the service reads, including a few the chart does not set.

Required Configuration Areas

  • Auth Service connection for identity and authorization checks.
  • Platform database connection for durable governance records.
  • Object storage provider for attachments.
  • Integrity Service connection for signed governance records. Creating projects, creating or applying policies, submitting declarations, reviews, and attachments, exporting reports, and issuing credentials all fail without it.
  • PDFGen connection for downloadable reports, PDFGEN_SERVICE_URL. PDFGen’s own settings are in PDFGen Configuration.

Object Storage

Supported attachment storage providers are Azure Blob Storage, Google Cloud Storage, AWS S3, and a mock provider for local or non-production use.

Use production-grade object storage for customer environments. Confirm bucket or container access before enabling attachment-heavy workflows.

Identity Provider Alignment

Governance Service does not replace Auth Service. It must be configured to trust the Auth Service deployment that owns users, roles, API keys, and service accounts.

Environment Variables

The main variables Governance Service reads, by category:

CategoryVariableDefault
ServerPORT10001
ServerENVIRONMENTlocal
ServerSERVICE_VERSIONdev; the chart sets its version
ServerSERVER_READ_TIMEOUT_SECONDS30
ServerSERVER_WRITE_TIMEOUT_SECONDS30
ServerSERVER_IDLE_TIMEOUT_SECONDS120
ServerSWAGGER_ENABLEDtrue
DatabaseDB_HOST / DB_USER / DB_NAMEnone, required
DatabaseDB_PASSWORDnone
DatabaseDB_PORTnone
DatabaseDB_SSLMODEdisable
DatabaseMIGRATIONS_RUN_AT_STARTUPfalse; the chart sets true
DatabaseMIGRATIONS_PATHmigrations; the chart sets /app/migrations
Auth ServiceAUTH_SERVICE_URLhttp://localhost:8080
Auth ServiceAUTH_SERVICE_API_KEYnone
Auth ServiceAUTH_CACHE_TTL30s
Auth ServiceAUTH_CACHE_SIZE10000
Auth ServiceAUTH_CLIENT_TIMEOUT10s
IdentityAUTH0_DOMAIN / AUTH0_CLIENT_ID / AUTH0_CLIENT_SECRETnone
IdentityAUTH0_SYNC_AT_STARTUPfalse; the chart sets true
IdentityAUTH0_SYNC_PAGE_SIZE50
IdentityKEYCLOAK_URL / KEYCLOAK_REALM / KEYCLOAK_CLIENT_ID / KEYCLOAK_CLIENT_SECRETnone
IdentityENTRA_TENANT_ID / ENTRA_CLIENT_ID / ENTRA_CLIENT_SECRETnone
IntegrationsINTEGRITY_SERVICE_URLhttp://localhost/integrityService
IntegrationsPDFGEN_SERVICE_URLhttp://localhost:8000
IntegrationsCONTROL_PLANE_URLnone; the chart sets it from config.controlPlaneUrl, empty by default
Object storageSTORAGE_PROVIDERdetected, else mock
Object storageAZURE_STORAGE_ACCOUNT_NAME / AZURE_STORAGE_CONTAINER_NAMEnone
Object storageAZURE_STORAGE_ACCOUNT_KEY / AZURE_STORAGE_CONNECTION_STRINGnone
Object storageAZURE_USE_MANAGED_IDENTITYfalse
Object storageGCS_BUCKET_NAMEnone
Object storageGCS_CREDENTIALS_FILE / GCS_CREDENTIALS_JSONApplication Default Credentials
Object storageAWS_S3_BUCKET_NAME / AWS_REGIONnone
Object storageAWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEYthe default AWS credential chain
IdempotencyIDEMPOTENCY_TTL_HOURS24
IdempotencyIDEMPOTENCY_CLEANUP_INTERVAL_MINUTES60
LoggingLOG_LEVELinfo
LoggingLOG_FORMATtext when ENVIRONMENT is local, otherwise JSON; the chart sets json
LoggingLOGGER_SKIP_PATHS/health

STORAGE_PROVIDER accepts azure_blob, gcs, aws_s3, or mock. When it is unset, the service picks gcs if GCS_BUCKET_NAME is set, then azure_blob if AZURE_STORAGE_ACCOUNT_NAME is set, then aws_s3 if AWS_S3_BUCKET_NAME is set, and mock otherwise. Azure Blob Storage needs a connection string, an account key, or AZURE_USE_MANAGED_IDENTITY=true; startup fails without one.

Without AUTH_SERVICE_API_KEY, Governance Service cannot get the governance worker’s service-account token from Auth Service. Indicator-generated declarations fail, and so does most of an agent assessment: pinning configurations, registering declaration files, reviewing controls, issuing agent certifications, and a reviewer revoking a certification they authorized.

Without CONTROL_PLANE_URL, agent assessments cannot reach the agent registry, so starting an assessment fails, no agent certification can be issued, and certifications are never attached to or refreshed in the gateway. The chart sets it only when config.controlPlaneUrl is set, so with the Gateway Stack set that value to the Control Plane’s in-cluster URL; see Agent Certification.

The chart does not set AUTH_CACHE_TTL, AUTH_CACHE_SIZE, AUTH_CLIENT_TIMEOUT, IDEMPOTENCY_TTL_HOURS, IDEMPOTENCY_CLEANUP_INTERVAL_MINUTES, or GCS_CREDENTIALS_JSON, so a chart deployment uses their defaults.

Operational Settings

Operators should confirm health checks, readiness behavior, idempotency settings, database migration behavior, and upgrade notes before release. Keep customer-specific secrets out of product documentation and store them in the deployment’s secret management system.