Environment variables

ADS is built on Spring Boot, which supports externalized configurationOpens in a new tab. Any property defined in deployment.yaml can be overridden using an environment variable, with no code changes required.

This is the recommended approach for managing environment-specific values (such as passwords, hostnames, and ports) without modifying deployment.yaml itself.

Conversion rule

Spring Boot converts environment variable names to property keys by:

1. Replacing underscores (_) with dots (.).
2. Converting to lowercase.

To go the other direction (converting a property key to an environment variable name):

1. Replace every dot (.) with an underscore (_).
2. Convert to uppercase.

Example:

deployment.yaml property	Environment variable
ads.server.port: 8443	ADS_SERVER_PORT=8443

note

This is the standard Spring Boot environment variable binding convention. For properties with hyphens in the key segment (e.g. ads.some-property), Spring Boot relaxed binding also accepts underscores in their place.

Inline environment variable syntax

You can also reference environment variables directly within deployment.yaml using Spring's placeholder syntax:

property: ${<ENVIRONMENT_VARIABLE_NAME>:<default_value>}

Example: use the PORT variable with a fallback of 8080:

server:
  port: ${PORT:8080}

If PORT is not defined in the environment, ADS uses 8080.

note

Unlike domain configuration, deployment configuration environment variable placeholders must not have a trailing hyphen (-) in the default value. This follows standard Spring framework conventions.

Commonly overridden properties

The following table lists properties that are typically set via environment variables in production deployments.

Environment variable	Equivalent property	Example value
SERVER_PORT	server.port	8443
MANAGEMENT_SERVER_PORT	management.server.port	9090
SPRING_SECURITY_USER_NAME	spring.security.user.name	ads-admin
SPRING_SECURITY_USER_PASSWORD	spring.security.user.password	{bcrypt}$2a$10$...
SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI	spring.security.oauth2.resourceserver.jwt.jwk-set-uri	https://auth.example.com/.well-known/jwks
DOMAIN_PATH	(referenced via ${DOMAIN_PATH} in domain.path)	/config/domain.yaml
DOMAIN_USER	(referenced via ${DOMAIN_USER} in domain.authentication.username)	ads-reader
DOMAIN_PASSWORD	(referenced via ${DOMAIN_PASSWORD} in domain.authentication.password)	<password>
KEYSTORE_PASSWORD	(referenced via ${KEYSTORE_PASSWORD} in server.ssl.key-store-password)	<keystore-password>
TRUSTSTORE_PASSWORD	(referenced via ${TRUSTSTORE_PASSWORD} in server.ssl.trust-store-password)	<truststore-password>
LICENSE	(referenced via ${LICENSE} in license)	file:/config/axiomatics_ADS.license
LOGGING_LEVEL_ROOT	logging.level.root	WARN
AUDIT_MODE	audit.mode	verbose_json
DOMAIN_REFRESH_INTERVAL	domain.refreshInterval	30 seconds
MANAGEMENT_INFLUX_METRICS_EXPORT_TOKEN	management.influx.metrics.export.token	<influxdb-token>

Security best practice

Always use environment variables (or a secrets manager) for sensitive values such as passwords, client secrets, and keystore credentials. Storing secrets as plain text in deployment.yaml risks exposing them in version control or container image layers.