Settings and Environment Variables

Most of the platform’s settings are environment variables. This page lists every setting that the documentation describes, which part of the platform reads it, and the page that explains it.

Where to set them

Part Where its settings go

Part	Where its settings go
Governor	On its API container: the `backend` service in Docker Compose, or `api.container.config` in Helm (`api.container.secretConfig` for secrets). Restart the container after a change.
Worker	On the worker container, for example with `docker run -e` or in the worker service of your Compose file.
CLI	In the environment of the shell or job that runs `tdk`, in an `application.properties` file, or with `docker run -e` for the CLI Docker image.

Governor

On its API container: the backend service in Docker Compose, or api.container.config in Helm (api.container.secretConfig for secrets). Restart the container after a change.

Worker

On the worker container, for example with docker run -e or in the worker service of your Compose file.

CLI

In the environment of the shell or job that runs tdk, in an application.properties file, or with docker run -e for the CLI Docker image.

Settings with names like TDK_WORKINGDIRECTORY_ENABLED can also be set as application properties.

Workflow behaviour, such as modes, transformers and flags, isn’t set here: it’s in the workflow configuration.

Governor

Variable What it’s for Explained in

Variable	What it’s for	Explained in
`SPRING_DATASOURCE_URL`, `SPRING_DATASOURCE_USERNAME`, `SPRING_DATASOURCE_PASSWORD`	Governor’s own database	Docker Compose, Helm
`JWT_SECRET`	Key that signs sign-in tokens	Docker Compose
`ADMIN_EMAIL`, `ADMIN_DEFAULT_PASSWORD`	First administrator account	Docker Compose
`CREDENTIALS_ENCRYPTION_KEY`	Key that encrypts stored data source passwords	Docker Compose
`SYNTHESIZED_KEY`	License key	Docker Compose
`UI_XML_GENERATOR`, `UI_CSRI`, `UI_SAP_UI`	Feature flags	Feature flags
`JWT_ACCESS_TOKEN_EXPIRATION`, `JWT_REFRESH_TOKEN_EXPIRATION`, `JWT_ISSUER`	Sign-in tokens	Security and sign-in
`GOVERNOR_SECURITY_*`	Roles, CORS, owner-only access, single sign-on redirect	Security and sign-in
`GOVERNOR_SECURITY_SAML_*`	SAML roles and logout	SAML, Single Sign-On
`WORKER_GRPC_PORT`, `WORKER_GRPC_MAXMESSAGESIZE`, `WORKER_GRPC_COMPRESSION_ENABLED`, `WORKER_ALIVEMINUTES`, `WORKER_CHECKTASKDELAY`	Connection to workers	Workers
`WORKFLOW_RUNNER_`, `WORKFLOW_DATASOURCE_`, `WORKFLOW_LOGFILE_*`	Run threads, data source connection pools, run log files	Workflow execution
`GOVERNOR_SCHEDULING_*`	Background housekeeping	Scheduled tasks
`SPRING_DATASOURCE_HIKARI_*`	Connection pool for Governor’s database	Governor database connection pool
`MANAGEMENT_`, `SENTRY_`, `APP_FEIGN_*`	Health checks, metrics, error reporting, HTTP timeouts	Monitoring
`DB_URL`, `DB_USER`, `DB_PASSWORD`, `SQL_DIALECT`, `SERVER_PORT`	Governor’s database and API port	Application Properties
`SPRING_LIQUIBASE_`, `SPRING_MAIN_`	Internal settings	Internal settings

SPRING_DATASOURCE_URL, SPRING_DATASOURCE_USERNAME, SPRING_DATASOURCE_PASSWORD

Governor’s own database

Docker Compose, Helm

JWT_SECRET

Key that signs sign-in tokens

Docker Compose

ADMIN_EMAIL, ADMIN_DEFAULT_PASSWORD

First administrator account

Docker Compose

CREDENTIALS_ENCRYPTION_KEY

Key that encrypts stored data source passwords

Docker Compose

SYNTHESIZED_KEY

License key

Docker Compose

UI_XML_GENERATOR, UI_CSRI, UI_SAP_UI

Feature flags

JWT_ACCESS_TOKEN_EXPIRATION, JWT_REFRESH_TOKEN_EXPIRATION, JWT_ISSUER

Sign-in tokens

Security and sign-in

GOVERNOR_SECURITY_*

Roles, CORS, owner-only access, single sign-on redirect

Security and sign-in

GOVERNOR_SECURITY_SAML_*

SAML roles and logout

SAML, Single Sign-On

WORKER_GRPC_PORT, WORKER_GRPC_MAXMESSAGESIZE, WORKER_GRPC_COMPRESSION_ENABLED, WORKER_ALIVEMINUTES, WORKER_CHECKTASKDELAY

Connection to workers

Workers

WORKFLOW_RUNNER_*, WORKFLOW_DATASOURCE_*, WORKFLOW_LOGFILE_*

Run threads, data source connection pools, run log files

Workflow execution

GOVERNOR_SCHEDULING_*

Background housekeeping

Scheduled tasks

SPRING_DATASOURCE_HIKARI_*

Connection pool for Governor’s database

Governor database connection pool

MANAGEMENT_*, SENTRY_*, APP_FEIGN_*

Health checks, metrics, error reporting, HTTP timeouts

Monitoring

DB_URL, DB_USER, DB_PASSWORD, SQL_DIALECT, SERVER_PORT

Governor’s database and API port

Application Properties

SPRING_LIQUIBASE_*, SPRING_MAIN_*

Internal settings

Worker

Variable What it’s for Explained in

Variable	What it’s for	Explained in
`WORKER_SERVERHOST`, `WORKER_SERVERPORT`	The Governor gRPC host and port to connect to	Synthesized Workers
`WORKER_TAGS`	Tags that identify the worker	Synthesized Workers
`WORKER_DATASOURCES`	The worker groups it serves, or `*` for all	Synthesized Workers, Multi-Worker Deployment
`WORKER_USEPLAINTEXT`	Plaintext instead of TLS	Synthesized Workers
`WORKER_GRPC_TLS_ENABLED`, `WORKER_GRPC_TLS_CERT_CHAIN`, `WORKER_GRPC_TLS_PRIVATE_KEY`, `WORKER_GRPC_TLS_TRUST_CERT`, `WORKER_GRPC_TLS_KEY_PASSWORD`	Mutual TLS, on the worker and on Governor	Worker–Governor mTLS
`WORKER_WORKING_DIRECTORY_PATH`	Working directory	Working directory
`AGENT_*`	Older names of the `WORKER_*` variables, still accepted	Workers

WORKER_SERVERHOST, WORKER_SERVERPORT

The Governor gRPC host and port to connect to

Synthesized Workers

WORKER_TAGS

Tags that identify the worker

Synthesized Workers

WORKER_DATASOURCES

The worker groups it serves, or * for all

Synthesized Workers, Multi-Worker Deployment

WORKER_USEPLAINTEXT

Plaintext instead of TLS

Synthesized Workers

WORKER_GRPC_TLS_ENABLED, WORKER_GRPC_TLS_CERT_CHAIN, WORKER_GRPC_TLS_PRIVATE_KEY, WORKER_GRPC_TLS_TRUST_CERT, WORKER_GRPC_TLS_KEY_PASSWORD

Mutual TLS, on the worker and on Governor

Worker–Governor mTLS

WORKER_WORKING_DIRECTORY_PATH

Working directory

AGENT_*

Older names of the WORKER_* variables, still accepted

Workers

CLI

Variable What it’s for Explained in

Variable	What it’s for	Explained in
`SYNTHESIZED_USERCONFIG_FILE`, `SYNTHESIZED_USERCONFIG`	The workflow configuration	CLI Docker Environment Variables
`SYNTHESIZED_INVENTORY_FILE`, `SYNTHESIZED_INVENTORY`	The inventory file	CLI Docker Environment Variables
`SYNTHESIZED_INPUT_`, `SYNTHESIZED_OUTPUT_`	Input and output connections	CLI Docker Environment Variables
`SYNTHESIZED_COMMAND`	The command to run	CLI Docker Environment Variables
`SYNTHESIZED_KEY`	License key	CLI installation

SYNTHESIZED_USERCONFIG_FILE, SYNTHESIZED_USERCONFIG

The workflow configuration

CLI Docker Environment Variables

SYNTHESIZED_INVENTORY_FILE, SYNTHESIZED_INVENTORY

The inventory file

CLI Docker Environment Variables

SYNTHESIZED_INPUT_*, SYNTHESIZED_OUTPUT_*

Input and output connections

CLI Docker Environment Variables

SYNTHESIZED_COMMAND

The command to run

CLI Docker Environment Variables

SYNTHESIZED_KEY

License key

CLI installation

CLI and Governor

Variable What it’s for Explained in

Variable	What it’s for	Explained in
`SECRETS_AWS_SECRET_MANAGER_ENABLED`, `SECRETS_GCP_SECRET_MANAGER_ENABLED`, `SECRETS_VAULT_SECRET_MANAGER_ENABLED`	Credentials from a secret manager	Secret managers
`TDK_WORKINGDIRECTORY_ENABLED`, `TDK_WORKINGDIRECTORY_PATH`	Working directory	Working directory
`TDK_DB_MAXIMUM-POOL-SIZE`	Database connection pool size	Connection pool
`TDK_AWS_ENABLED`, `TDK_GCP_ENABLED`	AWS and Google Cloud integration	Cloud integrations
`TDK_AWS_LICENSE_ENABLED`, `TDK_GCP_LICENSE_ENABLED`, `TDK_AZURE_LICENSE_ENABLED`	Marketplace licensing	Cloud integrations
`GOOGLE_APPLICATION_CREDENTIALS`	Google Cloud credentials file	Cloud integrations
`TDK_S3_PROTOCOL`, `TDK_S3_REGION`, `TDK_S3_FORCE_PATH_STYLE`	S3 client for CSV files in S3	CSV Support

SECRETS_AWS_SECRET_MANAGER_ENABLED, SECRETS_GCP_SECRET_MANAGER_ENABLED, SECRETS_VAULT_SECRET_MANAGER_ENABLED

Credentials from a secret manager

Secret managers

TDK_WORKINGDIRECTORY_ENABLED, TDK_WORKINGDIRECTORY_PATH

Working directory

TDK_DB_MAXIMUM-POOL-SIZE

Database connection pool size

Connection pool

TDK_AWS_ENABLED, TDK_GCP_ENABLED

AWS and Google Cloud integration

Cloud integrations

TDK_AWS_LICENSE_ENABLED, TDK_GCP_LICENSE_ENABLED, TDK_AZURE_LICENSE_ENABLED

Marketplace licensing

Cloud integrations

GOOGLE_APPLICATION_CREDENTIALS

Google Cloud credentials file

Cloud integrations

TDK_S3_PROTOCOL, TDK_S3_REGION, TDK_S3_FORCE_PATH_STYLE

S3 client for CSV files in S3

CSV Support

Java options

JAVA_TOOL_OPTIONS passes options to the Java runtime, for example the Kerberos settings in Kerberos for database connections. For the JVM heap, see Performance Troubleshooting.