The Central Configuration is where all global settings for a Domino installation are listed.
-
Go to Admin portal.
-
Click Advanced > Central Config.
-
On the Configuration Management page, you can:
-
Click an existing record to edit its attributes.
-
Click Add Record to create a new setting. If no record is created in the application, the system uses the default value.
You must restart the Domino services for changes to take effect.
-
These options relate to the Keycloak authentication service. They are available in namespace common and must be recorded with no name.
Key | Default | Description |
| ||
| Enables Domino organization membership to synchronize with SAML identity provider attributes so that membership can be managed by the identity provider. | |
| ||
| Enables Domino’s user roles to synchronize with SAML identity provider attributes so that user role management can be managed by the identity provider. See Admin roles assignments through users role SAML attributes. | |
| ||
| If | |
These options relate to the Domino builder.
The Domino builder is a container that runs as a Kubernetes job to build the Docker images for Domino environments and Domino Model APIs. This container is deployed to a node labeled with a configurable Kubernetes label (defaults to domino/build-node=TRUE) whenever a user triggers an environment or model build.
Key | Default | Description |
| ||
| Node label key that the selector in the pod specification for the builder job will target. | |
| ||
| Node label value that the selector in the pod specification for the builder job will target. | |
| ||
| The builder job mounts the host Docker socket to execute builds. This should point to a path on the builder nodes where a Docker socket file can be mounted as part of the builder job pod specification. | |
| ||
| The external Docker registry URI to pull Domino base images from. | |
| ||
| The K8s secret containing credentials for authentication to an external Docker registry. | |
| ||
<Domino Compute Namespace> | The namespace where the external Docker registry secret is located. | |
| ||
None | Sets a hard upper limit on the object size of created environment revisions in the internal Docker registry. Takes arguments in the form: | |
| ||
None | Sets a hard upper limit on the object size of created Model API revisions in the internal Docker registry. Takes arguments in the form: | |
| ||
| Sets a hard upper limit on the vCPU required for image builds. Takes kubernetes quantities as arguments. | |
| ||
| Sets a hard upper limit on the memory required for image builds. Takes kubernetes quantities as arguments | |
| Key | Default | Description |
|---|---|---|
| ||
| The length of time from which the feature flag information is requested to the next time they will be retrieved from the server. | |
These settings are related to the ability to enable auto-scaling of Spark, Ray, and Dask on-demand clusters. They are available in namespace common and must be recorded with no name.
Key | Default | Description |
| ||
None | Target CPU utilization percentage when scale up of clusters should trigger. If not set, the Kubernetes default of 80% is used. | |
| ||
None | Target memory utilization percentage when scale up of clusters should trigger. This setting requires Kubernetes 1.18 or above. | |
| ||
None | Scale down stabilization window. This setting requires Kubernetes 1.18 or above. On lower versions, 300 seconds will apply. | |
The following table describes the interaction of the auto-scaling settings.
| targetCpuUtilizationPercent | targetMemoryUtilizationPercent | behavior |
|---|---|---|
Not set | Not set | The default Kubernetes setting of 80% CPU utilization applies. |
| ||
Not set |
| |
Not set |
| CPU utilization is not considered. |
| ||
| Scaling will trigger based on reaching either | |
For more information on compute cluster auto-scaling, you can see the Kubernetes HPA documentation.
These options relate to the compute grid. They are available in namespace common and must be recorded with no name.
Key | Default | Description |
| ||
| Controls how often the garbage collector runs to delete old or excess persistent volumes. | |
| ||
None | Setting a value in minutes here will cause persistent volumes older than that to be automatically deleted by the garbage collector. | |
| ||
| Maximum number of idle persistent volumes to keep. Idle volumes in excess of this number will be deleted by the garbage collector. | |
| ||
| Kubernetes storage class that will be used to dynamically provision persistent volumes. This is set initially to the value of | |
| ||
| Size in GB of compute grid persistent volumes. This is the total amount of disk space available to users in runs and workspaces. | |
| ||
| This is the maximum number of executions each user will be allowed to run concurrently. If a user attempts to start additional executions in excess of this those executions will be queued until some of the user’s other executions finish. | |
Use the Custom certificates to configure Domino to connect to external services.
Key | Default | Description |
| ||
| Contents of the custom certificates bundle. Values are concatenated certificates in PEM format1 | |
(1) The bundle is formatted as a series of concatenated certificates in PEM format. You must have the line breaks around the lines:
-----BEGIN CERTIFICATE—--
-----END CERTIFICATE—--
The bundle must contain all the certificates that you would typically use to connect to the private services, including intermediate and root certificates.
These options customize MongoDB connections.
| Key | Default | Description |
|---|---|---|
| ||
| Domino recommends consulting your Domino representative before changing this key. Sets the time (in milliseconds) after which the user object is retrieved from the MongoDB rather than from the cache. | |
| ||
| Deprecated. Set to | |
| ||
| Do not change the value of this key. The name of the MongoDB collection that stores central configuration data set at initial deployment. | |
| ||
Empty | Deprecated. The URI for an external MongoDB used to store Domino metadata. | |
| ||
| Sets the initial backoff duration for any database operation retries that use an exponential backoff algorithm with the MongoDB. | |
| ||
| Sets the maximum attempts for MongoDB operation retries with exponential backoff. | |
| ||
| Indicates whether MongoDB operations will be retried with exponential backoff or not. Values are | |
| ||
| Specifies whether the enter organization’s Mongo collection is cached in memory to improve performance in the Domino application. | |
| ||
| Specifies the cache lifetime (in milliseconds) for | |
| ||
| The maximum number of threads allowed to wait for a MongoDB connection. The | |
These options relate to Domino datasources. They are available in namespace common and must be recorded with no name.
| Key | Default | Description |
|---|---|---|
| ||
| The authentication type supported for MySQL. | |
| ||
| The authentication type supported for PostgreSQL. | |
| ||
| The authentication type supported for Redshift. | |
| ||
| The authentication type supported for Snowflake. | |
| ||
`Basic, AWSIAMRole ` | The authentication type supported for S3. | |
These options relate to Domino API.
| Key | Default | Description |
|---|---|---|
| ||
| When | |
| ||
N/A | Do not use. | |
| ||
N/A | Typically set at deployment, the Superuser’s API key is used for interactions between Domino components. Contact your Domino representative if you need assistance. | |
| ||
N/A | Typically set at deployment, the Superuser’s username is used for interactions between Domino components. Contact your Domino representative if you need assistance. | |
These options relate to Domino CLI.
| Key | Default | Description |
|---|---|---|
| ||
N/A | Identifies what will handle requests to S3. If set to S3, then the Domino CLI will interact directly with S3. If set to API, then the CLI will interact with the Domino instance, and Domino will then interact with S3. | |
| ||
| Used to separately host the Domino Command Line Interface (CLI). An example of when this might be used is when a critical fix is needed before the next Domino upgrade. | |
These options relate to email notifications from Domino. They are available in namespace common and must be recorded with no name.
| Key | Default | Description |
|---|---|---|
| ||
N/A | Deprecated. Set this value in Domino’s administrator application. To configure the email address from which to get notifications, go to Admin > Advanced > Email Settings and complete the Notifications FROM Address field. | |
| ||
| When | |
| ||
| Deprecated. If you want to set SMTP to bypass password authentication, go to Admin > Advanced > Email Settings and select SMTP. Then, select the No Password check box. | |
| ||
| Deprecated. If you want to set SMTP to bypass user authentication, go to Admin > Advanced > Email Settings and select SMTP. Then, select the No Username check box. | |
| ||
N/A | Deprecated. Go to Admin > Advanced > Email Settings and select the transport type as SES, SMTP, or Logging. | |
| ||
None | Hostname of SMTP relay to use for sending emails from Domino. | |
| ||
None | Username to use for authenticating to the SMTP host. | |
| ||
| Port to use for connecting to SMTP host. | |
| ||
| Whether the SMTP host uses SSL. | |
These options relate to Domino Environments. They are available in namespace common and must be recorded with no name.
Key | Default | Description |
| ||
| If set to | |
| ||
| Docker image URI for the initial default environment. | |
| ||
Domino Analytics Distribution Py3.6 R3.6 | Name of the initial default environment. | |
These options relate to the file contents download API endpoint. They are available in namespace common and must be recorded with no name.
Key | Default | Description |
| ||
| Set to | |
| ||
None | Set to | |
These options relate to the Domino Image Builder v2 (code name Forge).
Forge is the next generation service powering creation of new Environment revision and Model API version Docker images. To satisfy requirements around heightened security and support for non-Docker container runtimes (such as cri-o for OpenShift), Forge uses an open source image building engine named Buildkit and wraps in a suitable fashion for Domino’s use. Forge acts as a controller, built around the Kubernetes operator pattern in which it acts on custom resources (ContainerImageBuild) using standard CRUD actions.
Key | Default | Description |
| ||
| The external Docker registry URI to pull Domino base images from. | |
| ||
| The K8s secret containing credentials for authentication to an external Docker registry. | |
| ||
<Domino Compute Namespace> | The namespace where the external Docker registry secret is located. | |
| ||
None | Sets a hard upper limit on the object size of created environment revisions in the internal Docker registry. Takes arguments in the form: | |
| ||
None | Sets a hard upper limit on the object size of created Model API revisions in the internal Docker registry. Takes arguments in the form: | |
| ||
| Sets a hard upper limit on the vCPU required for image builds. Takes kubernetes quantities as arguments. | |
| ||
| Sets a hard upper limit on the memory required for image builds. Takes kubernetes quantities as arguments | |
These options relate to long-running workspace sessions. They are available in namespace common and must be recorded with no name.
Key | Default | Description |
| ||
| Defines how long a workspace must run in seconds before the workspace is classified as 'long-running' and begins to generate notifications or becomes subject to automatic shutdown. | |
| ||
| Set to | |
| ||
| Set to | |
| ||
| Maximum time (in seconds) that a user can set as the period between receiving long-running notification emails. Note | |
| ||
| Set to | |
| ||
| Set to | |
| ||
| Longest time in seconds a long-running workspace will be allowed to continue before automatic shutdown. Users cannot set their automatic shutdown timer to be longer than this. | |
These options relate to Model APIs. They are available in namespace common and must be recorded with no name.
| Key | Default | Description |
|---|---|---|
| ||
| Default number of instances per Model used for Model API scaling. | |
| ||
| Maximum number of instances per Model used for Model API scaling. | |
| ||
| Key used in Kubernetes label node selector for Model API pods. | |
| ||
| Value used in Kubernetes label node selector for Model API pods. | |
These options customize how prediction data is captured for monitoring:
Data retention and deletion options
domino.parquet.cleanup_job.retention_days
30
Retention of the parquet files (in number of days) before they get deleted to free up space.
domino.parquet.conversion_job.autodelete_key
autodelete
Key of the \{key: value} pair used to select a file for auto-deletion
domino.parquet.conversion_job.autodelete_value
TRUE
Value of the \{key: value} pair used to select a file for auto-deletion
domino.parquet.conversion_job.raw_data_debug_grace_days
1
Grace period to keep the source raw log files post processing
Model API-specific options
Key
Default
Description
com.cerebro.domino.modelmanager.pvc.name
shared-$stage-compute (Same as domino filecache)
PVC name for storing prediction data.
com.cerebro.domino.modelmanager.pvc.mountPoint
/domino/shared
PVC mount point for storing prediction data.
Com.cerebro.domino.modelmanager.pvc.subdir
scratch
PVC sub mount point.
com.cerebro.domino.modelmanager.fluentBit.image
Supplied from Domino Charts
Fluent-bit image.
com.cerebro.domino.modelmanager.logrotate.image
Supplied from Domino Charts
Logrotate image.
Cohort Analysis options
Key
Default
Description
com.cerebro.domino.actionable.insights.project.name
DominoActionableInsights
The name of the project for Actionable Insights.
com.cerebro.domino.actionable.insights.dataset.name
DominoActionableInsightsDataset
The name of the dataset for Actionable Insights.
com.cerebro.domino.actionable.insights.environment.id
Environment ID for the Actionable Insights Job. If not defined
com.cerebro.domino.actionable.insights.compute.environment.id
Environment ID for the Actionable Insights Spark Cluster. If not defined
com.cerebro.domino.actionable.insights.hardware.tier.id
small-k8s
Hardware Tier ID for the Actionable Insights Job.
com.cerebro.domino.actionable.insights.master.hardware.tier.id
medium-k8s
Hardware Tier ID for the Actionable Insights Spark Master.
com.cerebro.domino.actionable.insights.worker.hardware.tier.id
medium-k8s
Hardware Tier ID for the Actionable Insights Spark Workers.
com.cerebro.domino.actionable.insights.worker.count
2
Number of workers for the Spark cluster.
The ShortLived.EnableUserNotifications feature flag enables the Notifications feature. This means that it shows the following:
-
Notifications page for Administrators where they can create and manage notifications.
-
Notifications icon and indicator to identify the criticality of the notifications in the navigation pane.
-
Notifications page where users can view their notifications.
If this flag is turned off, all these items are hidden.
See Notifications in the User Guide and Notifications in this Admin Guide.
Key | Default | Description |
| ||
| Frequency with which notifications will be checked for automatic expiry ( | |
| ||
| Enables the job that expires notifications. Notifications without a set end time are expired based on the setting in | |
| ||
| Sets an expiration time (in days) for notifications without an end date. | |
| ||
| Specifies the time (in days) after which expired notifications will be deleted. | |
| ||
| Specifies the maximum number of notifications allowed in the system. | |
| ||
| Enables backend telemetry (statistics about the number and type of generated notifications) for notifications. | |
| ||
| The delay before Notifications telemetry is executed the first time. This delays the impact on database processing during initial system startup. | |
| ||
| The time between when the notification statistics are updated. | |
| ||
| If true, the system shows metrics for each user about the number and types of notifications generated. If false, the system shows metrics about all notifications. | |
The options relate to Notification channels.
Key | Default | Description |
| ||
N/A | The email address from which Domino sends email notifications. | |
| ||
N/A | The host address of the SMTP server from which Domino sends emails. | |
| ||
N/A | The password for the SMTP server, which is typically the same password for your web server, from which Domino sends emails. | |
| ||
25 | The TCP port to use to communicate with your SMTP server. | |
| ||
| Indicates whether the SMTP server uses Secure Sockets Layer (SSL) for secure communications. | |
| ||
N/A | The username used by the client to authenticate to the SMTP server to send email. | |
The options relate to the on-demand MPI clusters. They are available in namespace common and must be recorded with no name.
| Key | Default | Description |
|---|---|---|
| ||
| Frequency in seconds to run status checks on on-demand MPI clusters. | |
| ||
| How long the frontend waits for a response, in seconds, after a file sync request before sending an error. | |
| ||
| The maximum duration a sync runs before being considered to have timed out. | |
| ||
| The interval, in seconds, the Job launcher script checks the compute cluster file sync status waiting for ready status. | |
| ||
| The name of the secret in the domino-compute namespace containing the SSH key material used when configuring SSH on MPI workers. | |
| ||
| Volume mount path location of additional storage for the compute cluster. | |
| ||
| None (inherits STRICT from cluster-wide policy) | |
These options relate to the on-demand Spark clusters. They are available in namespace common and must be recorded with no name.
Key | Default | Description |
| ||
| Frequency in seconds to run status checks on on-demand Spark clusters. | |
| ||
| File system path on which Spark worker storage is mounted. | |
| ||
None | Option to supply alternative default configuration directory for on-demand Spark clusters. | |
| ||
| Minimum amount of memory in MiB to use for Spark worker overhead. | |
| ||
| Spark worker overhead scaling factor. | |
| ||
None | Set to | |
The following configuration settings are used for caching.
| Key | Default | Description |
|---|---|---|
| ||
| Use this key to modify the period (in months) of historical data that the Control Center uses. You might have to change this value to less than Caution | |
| ||
| Specifies how often the cache is refreshed in minutes. This cache is used in the Control Center and improves performance. However, if the cache is refreshed every 30 minutes some recent data will not be included in the reports. | |
These options relate to project visibility settings. They are available in namespace common and must be recorded with no name.
Key | Default | Description |
| ||
| If set to | |
| ||
| Controls the default visibility setting for new projects. Options are | |
This option is related to
Who can see my App?.
This is available in namespace common and must be recorded with no name.
Key | Default | Description |
| ||
TRUE | Set to FALSE to disable the Anyone, including anonymous users and Anyone with an account access permissions. See Who can see my App? for more information about these permissions. | |
These options relate to read-write datasets. They are available in namespace common and must be recorded with no name. Scratch spaces have been deprecated starting with Domino 4.5.
Key | Default | Description |
| ||
| The time before the system deletes a dataset that was marked for deletion. If you deleted a dataset, you have this time to retrieve the dataset. After this time expires, the dataset cannot be recovered. See Manage datasets and snapshots. | |
| ||
| If | |
| ||
| The maximum number of snapshots a user can create for a dataset. If the user reaches the maximum number of snapshots, the next time they create a snapshot, Domino shows a warning that they have reached their snapshot limit and that if they proceed, their oldest snapshot will be marked for deletion. | |
| ||
| The maximum number of datasets you can create in a project. If the user reaches the maximum number of datasets, Domino shows a message about the limit. | |
| ||
| Set the path to mount datasets in Domino projects. Users see this path in the Path column on the Domino Datasets tab on the Data page. Note | |
| ||
| Path at which datasets resides in git based projects. | |
| ||
1 minute | The time allotted to gather all file sizes to calculate the size of the snapshot. If the time expires and the size hasn’t finished calculating, Domino shows the current calculation for the snapshot but doesn’t notify the user that the calculation is incomplete. | |
These options relate to the User Activity Reports.
| Key | Default | Description |
|---|---|---|
| ||
| Sets the default recipient for the User Activity Report. To access this report, go to Admin > Advanced > User Activity Report. | |
| ||
| When | |
| ||
| Specifies the number of days to report for recent activity in the User Activity Reports. For example, the default value includes activity within the past 30 days in the Recent Activity section. See License usage reporting. | |
| ||
| Defines the frequency for automatically scheduled User Activity Reports. The default cron string value is set to daily at 02:00. | |
| ||
Empty | Identifies a comma-separated list of email addresses that receive automatic scheduled User Activity Reports. This is not shown in the Central Configuration unless it is set explicitly. Example values are: email1@domain.com, email2@domain.com. See License usage reporting. | |
In Domino, secrets are stored in an instance of HashiCorp Vault. By default, Vault does not require any configuration for specific secrets to be stored in encrypted form at rest. Supported Secrets are:
-
User environment variables
-
User API keys
-
Data source access secrets
-
Project environment variables
The following configuration settings are used to connect to Vault.
Key | Default | Description |
| ||
| Do not use. | |
| ||
| Do not use. | |
| ||
| Do not use. | |
| ||
N/A | Do not use. | |
| ||
N/A | Beta feature: Contact your Domino representative for assistance. Used to configure Domino to work with your Vault installation outside the Domino cluster. This is the path where the Vault token is present. If the .token config key is present, this is ignored. | |
| ||
N/A | Beta feature: Contact your Domino representative for assistance. Used to configure Domino to work with your Vault installation outside the Domino cluster. This is the literal value of the Vault token that overrides the .tokenFile config key. | |
| ||
N/A | Beta feature: Contact your Domino representative for assistance. Used to configure Domino to work with your Vault installation outside the Domino cluster. Specifies how often to reread the token when configuring an external Vault integration. This setting is only useful when the token is configured with tokenFile. Example values are: 2s, 10m, 1h. See duration format for syntax information. | |
| ||
N/A | Beta feature: Contact your Domino representative for assistance. Used to configure Domino to work with your Vault installation outside the Domino cluster. The URL with port for the Vault’s API endpoint which is used to configure the external Vault integration. | |
| ||
| Beta feature: Contact your Domino representative for assistance. Used to configure Domino to work with your Vault installation outside the Domino cluster. The path in the Vault to the key-value store that Domino uses. | |
| ||
| Beta feature: Contact your Domino representative for assistance. Used to configure Domino to work with your Vault installation outside the Domino cluster. An optional path in the key-value store that serves as the root for all Domino-stored secrets. | |
IFrame Security
Web apps in Domino are served in HTML inline frames, also known as “iframes”. To improve iframe security, a “sandbox” attribute can be set for iframe elements. When this attribute is set, extra security restrictions are applied to the iframes serving web apps in Domino, like blocking cross-origin requests, form submissions, script executions, and much more.
In Domino, this “sandbox” attribute can be toggled with the ShortLived.iFrameSecurityEnabled feature flag. Setting this flag to “TRUE” will apply the sandbox attribute to the iframe and apply the extra security restrictions. If the flag is set to “FALSE”, no security restrictions will be applied to the iframe. By default, in Domino 4.4.1 the ShortLived.iFrameSecurityEnabled flag is set to FALSE.
Content Security Policies
A content security policy allows Domino web apps to access specific, whitelisted external resources. Any request made to non-whitelisted external resources, however, will be blocked.
In Domino, you can toggle this feature with the EnableContentSecurityPolicyforApps feature flag. Setting this flag to “TRUE” will block requests to all non-whitelisted resources and allow requests to whitelisted resources. Setting this flag to “FALSE” will allow all requests to resources (that is, no blocking of any kind). By default, in Domino 4.4.1 the EnableContentSecurityPolicyforApps is set to FALSE.
The keys and default values associated with this feature flag are listed in the table below.
Key | Default | Description |
| ||
| Allows images to be inserted directly into a webapp using a | |
| ||
| Whitelists the URLs of the scripts that the demo Apps in the | |
| ||
| Allows apps to define their own styles with | |
| ||
| Allows the app to use WebSockets, which use URLs that begin with | |
To whitelist a resource:
-
Go to Configuration Management (that is, Central Config) in your Domino admin settings.
-
Click Add Record.
-
Set the key to
com.cerebro.domino.apps.contentSecurityPolicy.whiteListedConnectSrcList. -
Set the value to
ws:followed by the URL of the resource you’d like to whitelist (that is,ws: https://foobar.buz.bax/). You must work with your team to figure out which URLs have to be whitelisted. For more details, see: Content Security Policies for Web Apps. -
Save the record and restart Domino services.
IFrame Security in combination with Content Security Policies
In Domino 4.4.1, the ShortLived.iFrameSecurityEnabled and EnableContentSecurityPolicyforApps feature flags coexist. The matrix below describes the blocking behavior for requests based on both feature flags.
| ShortLived.iFrameSecurityEnabled = FALSE | ShortLived.iFrameSecurityEnabled = TRUE | |
|---|---|---|
EnableContent SecurityPolicyForApps = FALSE | No blocking occurs. All requests to external resources are allowed. | All requests from web apps to external resources are blocked. |
EnableContent SecurityPolicyForApps = TRUE | Only requests to whitelisted external resources are allowed. All other requests to external resources are blocked. | All requests from web apps to external resources are blocked. |
These options relate to Domino workspaces.
Key | Default | Description |
| ||
| Controls default allocated persistent volume size for a new workspace. | |
| ||
| Controls min allocated persistent volume size for a new workspace. | |
| ||
| Controls max allocated persistent volume size for a new workspace. | |
| ||
| Sets a limit on the number of provisioned workspaces per user per project. | |
| ||
| Sets a limit on the number of provisioned workspaces per user across all projects. | |
| ||
| Sets a limit on the number of provisioned workspaces across the whole Domino. | |
| ||
| Sets a limit on the total volume size of all provisioned workspaces across the whole Domino combined. | |
| ||
| The number of seconds the frontend waits after the workspace stops before making the delete request to the backend. This allows for enough time after workspace stop for the workspace’s persistent volume to be released. If users frequently receive an error after trying a delete, then this value should be increased. | |
| ||
| Whether to capture snapshots of workspace persistent volumes. | |
| ||
| How often to delete all but the X most recent snapshots. Where X is a number defined by workbench.workspace.volume.numSnapshotsToRetain | |
| ||
| The number of snapshots to retain. All older snapshots beyond this limit will be deleted during a periodic cleanup. | |