Persistence and key-provider environment
Local and object persistence, backup workers, and root secret-provider settings.
Persistence environment variables configure the control plane's artifact stores, backup execution, and root secret-provider connection.
Read environment loading before setting
values. Edit deployment values in the release bundle's infra.env or the corresponding
Kubernetes ConfigMap and Secret, then restart the affected service.
Local and object-backed stores
INFRA_ARTIFACT_BACKEND
Type: enum. Default: filesystem.
Accepts filesystem or s3. Controls installation artifacts and exports, not the project's application object-bucket service.
INFRA_ARTIFACT_DIR
Type: absolute directory. Default: /var/lib/infra/artifacts.
Filesystem artifact store. Derived from the state directory when omitted. Must be persistent and writable when selected.
INFRA_METRICS_DIR
Type: absolute directory. Default: /var/lib/infra/metrics.
Local metrics path derived from the state directory when omitted. HA requires the selected observation topology to support its persistence mode.
INFRA_LOGS_DIR
Type: absolute directory. Default: /var/lib/infra/logs.
Local journal and log path, derived from the state directory when omitted. Loss removes retained observations, not guest disks.
INFRA_OBJECT_STORAGE_ENDPOINT
Type: HTTPS URL. Default: unset.
Required for an S3 artifact backend. Specifies the private control-plane artifact endpoint, not an application bucket's public data endpoint.
INFRA_OBJECT_STORAGE_BUCKET
Type: string. Default: unset.
Required existing artifact bucket when using S3. Infra does not silently create a public bucket.
INFRA_OBJECT_STORAGE_PREFIX
Type: string. Default: infra/.
Managed artifact prefix. Changing it does not move retained objects; migrate references before retiring the previous prefix.
INFRA_OBJECT_STORAGE_REGION
Type: string. Default: unset.
Required provider region for the selected S3 endpoint. It must agree with request signing and residency policy.
INFRA_OBJECT_STORAGE_ACCESS_KEY_ID
Type: string. Default: unset.
Service access-key identifier when using static S3 credentials. Omit only when the configured deployment uses supported workload identity.
INFRA_OBJECT_STORAGE_SECRET_ACCESS_KEY
Type: string secret. Default: unset.
Static S3 secret or its file alternative. Not read by guest processes or returned by resource APIs.
INFRA_OBJECT_STORAGE_SECRET_ACCESS_KEY_FILE
Type: absolute secret path. Default: unset.
Alternative to the inline S3 secret. Both sources are rejected; missing required credential access fails readiness for the selected store.
INFRA_OBJECT_STORAGE_FORCE_PATH_STYLE
Type: boolean. Default: false.
Uses bucket-in-path addressing when true. The default uses virtual-host addressing and therefore requires suitable DNS and TLS names.
INFRA_OBJECT_STORAGE_CA_FILE
Type: absolute input path. Default: system trust.
Optional CA bundle for a private artifact endpoint. Invalid trust is rejected rather than disabling certificate verification.
INFRA_OBJECT_STORAGE_TIMEOUT_SECONDS
Type: integer seconds. Default: 30.
Inclusive range 1–300. Limits an individual object API request, not an entire backup or export operation.
Backup worker resources
INFRA_BACKUP_STAGING_DIR
Type: absolute directory. Default: /var/lib/infra/backup-staging.
Temporary transfer staging. Derived from the state directory when omitted. It must have the free space required by admitted backup work.
INFRA_BACKUP_CONCURRENCY
Type: positive integer. Default: 4.
Inclusive range 1–64 per backup worker. Destination and source policies can impose lower limits.
INFRA_BACKUP_PART_SIZE_MIB
Type: integer MiB. Default: 64.
Inclusive range 8–512. Provider capability checks can reject an unsupported size; it is not silently rounded.
INFRA_BACKUP_BANDWIDTH_BYTES_PER_SECOND
Type: positive integer bytes per second. Default: unset.
Optional worker transfer ceiling. Omission leaves the deployment ceiling unset; resource policies and physical throughput still apply. Zero is rejected.
INFRA_BACKUP_VERIFY_AFTER_COPY
Type: boolean. Default: true.
When true, runs object and manifest verification after each copy. When false, a copied point remains unverified until an explicit verification succeeds. A policy requiring verification cannot complete successfully without that result. Application restore tests remain separate.
Root secret provider
INFRA_SECRET_PROVIDER
Type: enum. Default: local.
Accepts local or vault for the installation root integration. Project consumer references can use separately configured approved providers.
INFRA_SECRET_PROVIDER_URL
Type: HTTPS URL. Default: unset.
Required for the Vault integration. Must be reachable through the control-plane management path.
INFRA_SECRET_PROVIDER_TOKEN
Type: string secret. Default: unset.
Provider credential or its file alternative. Required unless the selected provider uses configured workload identity.
INFRA_SECRET_PROVIDER_TOKEN_FILE
Type: absolute secret path. Default: unset.
Alternative to the inline provider token. Both sources together are rejected.
INFRA_SECRET_PROVIDER_NAMESPACE
Type: string. Default: unset.
Optional provider namespace. Omission uses the provider's root/default namespace; it does not imply access outside credential scope.
INFRA_SECRET_PROVIDER_CA_FILE
Type: absolute input path. Default: system trust.
Optional trust bundle for the external provider. Missing issuer trust causes resolution failure.
INFRA_SECRET_PROVIDER_TIMEOUT_SECONDS
Type: integer seconds. Default: 10.
Inclusive range 1–120. Bounds one provider resolution attempt. Consumer caching follows its explicit policy.