Configuration property fixed at build time - All other configuration properties are overridable at runtime

AWS Lambda

Type

Default

The handler name. Handler names are specified on handler classes using the @javax.inject.Named annotation. If this name is unspecified and there is exactly one unnamed implementation of com.amazonaws.services.lambda.runtime.RequestHandler then this unnamed handler will be used. If there is only a single named handler and the name is unspecified then the named handler will be used.

string

AWS Lambda Common

Type

Default

Port to access mock event server in dev mode

int

8080

Port to access mock event server in dev mode

int

8081

AWS Lambda Gateway REST API

Type

Default

Enable security mechanisms to process lambda and AWS based security (i.e. Cognito, IAM) from the http event sent from API Gateway

boolean

false

Agroal - Database connection pool

Type

Default

If we create a JDBC datasource for this datasource.

boolean

true

The datasource driver class name

string

Whether we want to use regular JDBC transactions, XA, or disable all transactional capabilities. When enabling XA you will need a driver implementing javax.sql.XADataSource.

enabled, xa, disabled

enabled

Enable datasource metrics collection. If unspecified, collecting metrics will be enabled by default if a metrics extension is active.

boolean

The datasource URL

string

The initial size of the pool. Usually you will want to set the initial size to match at least the minimal size, but this is not enforced so to allow for architectures which prefer a lazy initialization of the connections on boot, while being able to sustain a minimal pool size after boot.

int

The datasource pool minimum size

int

0

The datasource pool maximum size

int

20

The interval at which we validate idle connections in the background. Set to 0 to disable background validation.

Duration

2M

Perform foreground validation on connections that have been idle for longer than the specified interval.

Duration

The timeout before cancelling the acquisition of a new connection

Duration

5

The interval at which we check for connection leaks.

Duration

The interval at which we try to remove idle connections.

Duration

5M

The max lifetime of a connection.

Duration

The transaction isolation level.

undefined, none, read-uncommitted, read-committed, repeatable-read, serializable

Collect and display extra troubleshooting info on leaked connections.

boolean

false

When enabled Agroal will be able to produce a warning when a connection is returned to the pool without the application having closed all open statements. This is unrelated with tracking of open connections. Disable for peak performance, but only when there’s high confidence that no leaks are happening.

boolean

true

Query executed when first using a connection.

string

Query executed to validate a connection.

string

Disable pooling to prevent reuse of Connections. Use this with when an external pool manages the life-cycle of Connections.

boolean

true

Require an active transaction when acquiring a connection. Recommended for production. WARNING: Some extensions acquire connections without holding a transaction for things like schema updates and schema validation. Setting this setting to STRICT may lead to failures in those cases.

off, warn, strict

Other unspecified properties to be passed to the JDBC driver when creating new connections.

Map<String,String>

Additional named datasources

Type

Default

If we create a JDBC datasource for this datasource.

boolean

true

The datasource driver class name

string

Whether we want to use regular JDBC transactions, XA, or disable all transactional capabilities. When enabling XA you will need a driver implementing javax.sql.XADataSource.

enabled, xa, disabled

enabled

Enable datasource metrics collection. If unspecified, collecting metrics will be enabled by default if a metrics extension is active.

boolean

string

The initial size of the pool. Usually you will want to set the initial size to match at least the minimal size, but this is not enforced so to allow for architectures which prefer a lazy initialization of the connections on boot, while being able to sustain a minimal pool size after boot.

int

The datasource pool minimum size

int

0

The datasource pool maximum size

int

20

The interval at which we validate idle connections in the background. Set to 0 to disable background validation.

Duration

2M

Perform foreground validation on connections that have been idle for longer than the specified interval.

Duration

The timeout before cancelling the acquisition of a new connection

Duration

5

The interval at which we check for connection leaks.

Duration

The interval at which we try to remove idle connections.

Duration

5M

The max lifetime of a connection.

Duration

undefined, none, read-uncommitted, read-committed, repeatable-read, serializable

Collect and display extra troubleshooting info on leaked connections.

boolean

false

When enabled Agroal will be able to produce a warning when a connection is returned to the pool without the application having closed all open statements. This is unrelated with tracking of open connections. Disable for peak performance, but only when there’s high confidence that no leaks are happening.

boolean

true

Query executed when first using a connection.

string

Query executed to validate a connection.

string

Disable pooling to prevent reuse of Connections. Use this with when an external pool manages the life-cycle of Connections.

boolean

true

Require an active transaction when acquiring a connection. Recommended for production. WARNING: Some extensions acquire connections without holding a transaction for things like schema updates and schema validation. Setting this setting to STRICT may lead to failures in those cases.

off, warn, strict

Other unspecified properties to be passed to the JDBC driver when creating new connections.

Map<String,String>

Amazon DynamoDB

Type

Default

List of execution interceptors that will have access to read and modify the request and response objects as they are processed by the AWS SDK. The list should consists of class names which implements software.amazon.awssdk.core.interceptor.ExecutionInterceptor interface.

list of string

Type of the sync HTTP client implementation

url, apache

url

Enable DynamoDB service endpoint discovery.

boolean

false

AWS SDK client configurations

Type

Default

The endpoint URI with which the SDK should communicate. If not specified, an appropriate endpoint to be used for the given service and region.

URI

The amount of time to allow the client to complete the execution of an API call. This timeout covers the entire client execution except for marshalling. This includes request handler execution, all HTTP requests including retries, unmarshalling, etc. This value should always be positive, if present.

Duration

The amount of time to wait for the HTTP request to complete before giving up and timing out. This value should always be positive, if present.

Duration

AWS services configurations

Type

Default

An Amazon Web Services region that hosts the given service.

It overrides region provider chain with static value of region with which the service client should communicate.

If not set, region is retrieved via the default providers chain in the following order:

  • aws.region system property

  • region property from the profile file

  • Instance profile file

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Default credentials provider configuration

Type

Default

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Static credentials provider configuration

Type

Default

string

string

AWS Profile credentials provider configuration

Type

Default

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

Process credentials provider configuration

Type

Default

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

The command that should be executed to retrieve credentials.

string

Sync HTTP transport configurations

Type

Default

The maximum amount of time to establish a connection before timing out.

Duration

2S

The amount of time to wait for data to be transferred over an established, open connection before the connection is timed out.

Duration

30S

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Apache HTTP client specific configurations

Type

Default

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

10S

The maximum amount of time that a connection should be allowed to remain open while idle.

Duration

60S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum number of connections allowed in the connection pool. Each built HTTP client has its own private connection pool.

int

50

Whether the client should send an HTTP expect-continue handshake before each request.

boolean

true

Whether the idle connections in the connection pool should be closed asynchronously. When enabled, connections left idling for longer than quarkus..sync-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The username to use when connecting through a proxy.

string

The password to use when connecting through a proxy.

string

For NTLM proxies - the Windows domain name to use when authenticating with the proxy.

string

For NTLM proxies - the Windows workstation name to use when authenticating with the proxy.

string

Whether to attempt to authenticate preemptively against the proxy server using basic authentication.

boolean

The hosts that the client is allowed to access without going through the proxy.

list of string

Netty HTTP transport configurations

Type

Default

The maximum number of allowed concurrent requests. For HTTP/1.1 this is the same as max connections. For HTTP/2 the number of connections that will be used depends on the max streams allowed per connection.

int

50

The maximum number of pending acquires allowed. Once this exceeds, acquire tries will be failed.

int

10000

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait for a write on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait when initially establishing a connection before giving up and timing out.

Duration

10S

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

2S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum amount of time that a connection should be allowed to remain open while idle. Currently has no effect if quarkus..async-client.use-idle-connection-reaper is false.

Duration

5S

Whether the idle connections in the connection pool should be closed. When enabled, connections left idling for longer than quarkus..async-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

The HTTP protocol to use.

http1-1, http2

http1-1

The SSL Provider to be used in the Netty client. Default is OPENSSL if available, JDK otherwise.

jdk, openssl, openssl-refcnt

The maximum number of concurrent streams for an HTTP/2 connection. This setting is only respected when the HTTP/2 protocol is used.

long

4294967295

The initial window size for an HTTP/2 stream. This setting is only respected when the HTTP/2 protocol is used.

int

1048576

Sets the period that the Netty client will send PING frames to the remote endpoint to check the health of the connection. To disable this feature, set a duration of 0. This setting is only respected when the HTTP/2 protocol is used.

Duration

5

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The hosts that the client is allowed to access without going through the proxy.

list of string

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Enable the custom configuration of the Netty event loop group.

boolean

false

Number of threads to use for the event loop group. If not set, the default Netty thread count is used (which is double the number of available processors unless the io.netty.eventLoopThreads system property is set.

int

The thread name prefix for threads created by this thread factory used by event loop group. The prefix will be appended with a number unique to the thread factory and a number unique to the thread. If not specified it defaults to aws-java-sdk-NettyEventLoop

string

Amazon IAM

Type

Default

List of execution interceptors that will have access to read and modify the request and response objects as they are processed by the AWS SDK. The list should consists of class names which implements software.amazon.awssdk.core.interceptor.ExecutionInterceptor interface.

list of string

Type of the sync HTTP client implementation

url, apache

url

AWS SDK client configurations

Type

Default

The endpoint URI with which the SDK should communicate. If not specified, an appropriate endpoint to be used for the given service and region.

URI

The amount of time to allow the client to complete the execution of an API call. This timeout covers the entire client execution except for marshalling. This includes request handler execution, all HTTP requests including retries, unmarshalling, etc. This value should always be positive, if present.

Duration

The amount of time to wait for the HTTP request to complete before giving up and timing out. This value should always be positive, if present.

Duration

AWS services configurations

Type

Default

An Amazon Web Services region that hosts the given service.

It overrides region provider chain with static value of region with which the service client should communicate.

If not set, region is retrieved via the default providers chain in the following order:

  • aws.region system property

  • region property from the profile file

  • Instance profile file

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Default credentials provider configuration

Type

Default

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Static credentials provider configuration

Type

Default

string

string

AWS Profile credentials provider configuration

Type

Default

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

Process credentials provider configuration

Type

Default

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

The command that should be executed to retrieve credentials.

string

Sync HTTP transport configurations

Type

Default

The maximum amount of time to establish a connection before timing out.

Duration

2S

The amount of time to wait for data to be transferred over an established, open connection before the connection is timed out.

Duration

30S

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Apache HTTP client specific configurations

Type

Default

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

10S

The maximum amount of time that a connection should be allowed to remain open while idle.

Duration

60S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum number of connections allowed in the connection pool. Each built HTTP client has its own private connection pool.

int

50

Whether the client should send an HTTP expect-continue handshake before each request.

boolean

true

Whether the idle connections in the connection pool should be closed asynchronously. When enabled, connections left idling for longer than quarkus..sync-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The username to use when connecting through a proxy.

string

The password to use when connecting through a proxy.

string

For NTLM proxies - the Windows domain name to use when authenticating with the proxy.

string

For NTLM proxies - the Windows workstation name to use when authenticating with the proxy.

string

Whether to attempt to authenticate preemptively against the proxy server using basic authentication.

boolean

The hosts that the client is allowed to access without going through the proxy.

list of string

Netty HTTP transport configurations

Type

Default

The maximum number of allowed concurrent requests. For HTTP/1.1 this is the same as max connections. For HTTP/2 the number of connections that will be used depends on the max streams allowed per connection.

int

50

The maximum number of pending acquires allowed. Once this exceeds, acquire tries will be failed.

int

10000

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait for a write on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait when initially establishing a connection before giving up and timing out.

Duration

10S

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

2S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum amount of time that a connection should be allowed to remain open while idle. Currently has no effect if quarkus..async-client.use-idle-connection-reaper is false.

Duration

5S

Whether the idle connections in the connection pool should be closed. When enabled, connections left idling for longer than quarkus..async-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

The HTTP protocol to use.

http1-1, http2

http1-1

The SSL Provider to be used in the Netty client. Default is OPENSSL if available, JDK otherwise.

jdk, openssl, openssl-refcnt

The maximum number of concurrent streams for an HTTP/2 connection. This setting is only respected when the HTTP/2 protocol is used.

long

4294967295

The initial window size for an HTTP/2 stream. This setting is only respected when the HTTP/2 protocol is used.

int

1048576

Sets the period that the Netty client will send PING frames to the remote endpoint to check the health of the connection. To disable this feature, set a duration of 0. This setting is only respected when the HTTP/2 protocol is used.

Duration

5

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The hosts that the client is allowed to access without going through the proxy.

list of string

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Enable the custom configuration of the Netty event loop group.

boolean

false

Number of threads to use for the event loop group. If not set, the default Netty thread count is used (which is double the number of available processors unless the io.netty.eventLoopThreads system property is set.

int

The thread name prefix for threads created by this thread factory used by event loop group. The prefix will be appended with a number unique to the thread factory and a number unique to the thread. If not specified it defaults to aws-java-sdk-NettyEventLoop

string

Amazon KMS

Type

Default

List of execution interceptors that will have access to read and modify the request and response objects as they are processed by the AWS SDK. The list should consists of class names which implements software.amazon.awssdk.core.interceptor.ExecutionInterceptor interface.

list of string

Type of the sync HTTP client implementation

url, apache

url

AWS SDK client configurations

Type

Default

The endpoint URI with which the SDK should communicate. If not specified, an appropriate endpoint to be used for the given service and region.

URI

The amount of time to allow the client to complete the execution of an API call. This timeout covers the entire client execution except for marshalling. This includes request handler execution, all HTTP requests including retries, unmarshalling, etc. This value should always be positive, if present.

Duration

The amount of time to wait for the HTTP request to complete before giving up and timing out. This value should always be positive, if present.

Duration

AWS services configurations

Type

Default

An Amazon Web Services region that hosts the given service.

It overrides region provider chain with static value of region with which the service client should communicate.

If not set, region is retrieved via the default providers chain in the following order:

  • aws.region system property

  • region property from the profile file

  • Instance profile file

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Default credentials provider configuration

Type

Default

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Static credentials provider configuration

Type

Default

string

string

AWS Profile credentials provider configuration

Type

Default

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

Process credentials provider configuration

Type

Default

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

The command that should be executed to retrieve credentials.

string

Sync HTTP transport configurations

Type

Default

The maximum amount of time to establish a connection before timing out.

Duration

2S

The amount of time to wait for data to be transferred over an established, open connection before the connection is timed out.

Duration

30S

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Apache HTTP client specific configurations

Type

Default

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

10S

The maximum amount of time that a connection should be allowed to remain open while idle.

Duration

60S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum number of connections allowed in the connection pool. Each built HTTP client has its own private connection pool.

int

50

Whether the client should send an HTTP expect-continue handshake before each request.

boolean

true

Whether the idle connections in the connection pool should be closed asynchronously. When enabled, connections left idling for longer than quarkus..sync-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The username to use when connecting through a proxy.

string

The password to use when connecting through a proxy.

string

For NTLM proxies - the Windows domain name to use when authenticating with the proxy.

string

For NTLM proxies - the Windows workstation name to use when authenticating with the proxy.

string

Whether to attempt to authenticate preemptively against the proxy server using basic authentication.

boolean

The hosts that the client is allowed to access without going through the proxy.

list of string

Netty HTTP transport configurations

Type

Default

The maximum number of allowed concurrent requests. For HTTP/1.1 this is the same as max connections. For HTTP/2 the number of connections that will be used depends on the max streams allowed per connection.

int

50

The maximum number of pending acquires allowed. Once this exceeds, acquire tries will be failed.

int

10000

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait for a write on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait when initially establishing a connection before giving up and timing out.

Duration

10S

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

2S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum amount of time that a connection should be allowed to remain open while idle. Currently has no effect if quarkus..async-client.use-idle-connection-reaper is false.

Duration

5S

Whether the idle connections in the connection pool should be closed. When enabled, connections left idling for longer than quarkus..async-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

The HTTP protocol to use.

http1-1, http2

http1-1

The SSL Provider to be used in the Netty client. Default is OPENSSL if available, JDK otherwise.

jdk, openssl, openssl-refcnt

The maximum number of concurrent streams for an HTTP/2 connection. This setting is only respected when the HTTP/2 protocol is used.

long

4294967295

The initial window size for an HTTP/2 stream. This setting is only respected when the HTTP/2 protocol is used.

int

1048576

Sets the period that the Netty client will send PING frames to the remote endpoint to check the health of the connection. To disable this feature, set a duration of 0. This setting is only respected when the HTTP/2 protocol is used.

Duration

5

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The hosts that the client is allowed to access without going through the proxy.

list of string

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Enable the custom configuration of the Netty event loop group.

boolean

false

Number of threads to use for the event loop group. If not set, the default Netty thread count is used (which is double the number of available processors unless the io.netty.eventLoopThreads system property is set.

int

The thread name prefix for threads created by this thread factory used by event loop group. The prefix will be appended with a number unique to the thread factory and a number unique to the thread. If not specified it defaults to aws-java-sdk-NettyEventLoop

string

Amazon S3

Type

Default

List of execution interceptors that will have access to read and modify the request and response objects as they are processed by the AWS SDK. The list should consists of class names which implements software.amazon.awssdk.core.interceptor.ExecutionInterceptor interface.

list of string

Type of the sync HTTP client implementation

url, apache

url

Enable using the accelerate endpoint when accessing S3. Accelerate endpoints allow faster transfer of objects by using Amazon CloudFront’s globally distributed edge locations.

boolean

false

Enable doing a validation of the checksum of an object stored in S3.

boolean

true

Enable using chunked encoding when signing the request payload for software.amazon.awssdk.services.s3.model.PutObjectRequest and software.amazon.awssdk.services.s3.model.UploadPartRequest.

boolean

true

Enable dualstack mode for accessing S3. If you want to use IPv6 when accessing S3, dualstack must be enabled.

boolean

false

Enable using path style access for accessing S3 objects instead of DNS style access. DNS style access is preferred as it will result in better load balancing when accessing S3.

boolean

false

Enable cross-region call to the region specified in the S3 resource ARN different than the region the client was configured with. If this flag is not set to 'true', the cross-region call will throw an exception.

boolean

false

Define the profile name that should be consulted to determine the default value of use-arn-region-enabled. This is not used, if the use-arn-region-enabled is configured to 'true'. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

AWS SDK client configurations

Type

Default

The endpoint URI with which the SDK should communicate. If not specified, an appropriate endpoint to be used for the given service and region.

URI

The amount of time to allow the client to complete the execution of an API call. This timeout covers the entire client execution except for marshalling. This includes request handler execution, all HTTP requests including retries, unmarshalling, etc. This value should always be positive, if present.

Duration

The amount of time to wait for the HTTP request to complete before giving up and timing out. This value should always be positive, if present.

Duration

AWS services configurations

Type

Default

An Amazon Web Services region that hosts the given service.

It overrides region provider chain with static value of region with which the service client should communicate.

If not set, region is retrieved via the default providers chain in the following order:

  • aws.region system property

  • region property from the profile file

  • Instance profile file

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Default credentials provider configuration

Type

Default

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Static credentials provider configuration

Type

Default

string

string

AWS Profile credentials provider configuration

Type

Default

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

Process credentials provider configuration

Type

Default

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

The command that should be executed to retrieve credentials.

string

Sync HTTP transport configurations

Type

Default

The maximum amount of time to establish a connection before timing out.

Duration

2S

The amount of time to wait for data to be transferred over an established, open connection before the connection is timed out.

Duration

30S

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Apache HTTP client specific configurations

Type

Default

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

10S

The maximum amount of time that a connection should be allowed to remain open while idle.

Duration

60S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum number of connections allowed in the connection pool. Each built HTTP client has its own private connection pool.

int

50

Whether the client should send an HTTP expect-continue handshake before each request.

boolean

true

Whether the idle connections in the connection pool should be closed asynchronously. When enabled, connections left idling for longer than quarkus..sync-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The username to use when connecting through a proxy.

string

The password to use when connecting through a proxy.

string

For NTLM proxies - the Windows domain name to use when authenticating with the proxy.

string

For NTLM proxies - the Windows workstation name to use when authenticating with the proxy.

string

Whether to attempt to authenticate preemptively against the proxy server using basic authentication.

boolean

The hosts that the client is allowed to access without going through the proxy.

list of string

Netty HTTP transport configurations

Type

Default

The maximum number of allowed concurrent requests. For HTTP/1.1 this is the same as max connections. For HTTP/2 the number of connections that will be used depends on the max streams allowed per connection.

int

50

The maximum number of pending acquires allowed. Once this exceeds, acquire tries will be failed.

int

10000

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait for a write on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait when initially establishing a connection before giving up and timing out.

Duration

10S

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

2S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum amount of time that a connection should be allowed to remain open while idle. Currently has no effect if quarkus..async-client.use-idle-connection-reaper is false.

Duration

5S

Whether the idle connections in the connection pool should be closed. When enabled, connections left idling for longer than quarkus..async-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

The HTTP protocol to use.

http1-1, http2

http1-1

The SSL Provider to be used in the Netty client. Default is OPENSSL if available, JDK otherwise.

jdk, openssl, openssl-refcnt

The maximum number of concurrent streams for an HTTP/2 connection. This setting is only respected when the HTTP/2 protocol is used.

long

4294967295

The initial window size for an HTTP/2 stream. This setting is only respected when the HTTP/2 protocol is used.

int

1048576

Sets the period that the Netty client will send PING frames to the remote endpoint to check the health of the connection. To disable this feature, set a duration of 0. This setting is only respected when the HTTP/2 protocol is used.

Duration

5

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The hosts that the client is allowed to access without going through the proxy.

list of string

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Enable the custom configuration of the Netty event loop group.

boolean

false

Number of threads to use for the event loop group. If not set, the default Netty thread count is used (which is double the number of available processors unless the io.netty.eventLoopThreads system property is set.

int

The thread name prefix for threads created by this thread factory used by event loop group. The prefix will be appended with a number unique to the thread factory and a number unique to the thread. If not specified it defaults to aws-java-sdk-NettyEventLoop

string

Amazon SES

Type

Default

List of execution interceptors that will have access to read and modify the request and response objects as they are processed by the AWS SDK. The list should consists of class names which implements software.amazon.awssdk.core.interceptor.ExecutionInterceptor interface.

list of string

Type of the sync HTTP client implementation

url, apache

url

AWS SDK client configurations

Type

Default

The endpoint URI with which the SDK should communicate. If not specified, an appropriate endpoint to be used for the given service and region.

URI

The amount of time to allow the client to complete the execution of an API call. This timeout covers the entire client execution except for marshalling. This includes request handler execution, all HTTP requests including retries, unmarshalling, etc. This value should always be positive, if present.

Duration

The amount of time to wait for the HTTP request to complete before giving up and timing out. This value should always be positive, if present.

Duration

AWS services configurations

Type

Default

An Amazon Web Services region that hosts the given service.

It overrides region provider chain with static value of region with which the service client should communicate.

If not set, region is retrieved via the default providers chain in the following order:

  • aws.region system property

  • region property from the profile file

  • Instance profile file

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Default credentials provider configuration

Type

Default

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Static credentials provider configuration

Type

Default

string

string

AWS Profile credentials provider configuration

Type

Default

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

Process credentials provider configuration

Type

Default

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

The command that should be executed to retrieve credentials.

string

Sync HTTP transport configurations

Type

Default

The maximum amount of time to establish a connection before timing out.

Duration

2S

The amount of time to wait for data to be transferred over an established, open connection before the connection is timed out.

Duration

30S

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Apache HTTP client specific configurations

Type

Default

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

10S

The maximum amount of time that a connection should be allowed to remain open while idle.

Duration

60S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum number of connections allowed in the connection pool. Each built HTTP client has its own private connection pool.

int

50

Whether the client should send an HTTP expect-continue handshake before each request.

boolean

true

Whether the idle connections in the connection pool should be closed asynchronously. When enabled, connections left idling for longer than quarkus..sync-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The username to use when connecting through a proxy.

string

The password to use when connecting through a proxy.

string

For NTLM proxies - the Windows domain name to use when authenticating with the proxy.

string

For NTLM proxies - the Windows workstation name to use when authenticating with the proxy.

string

Whether to attempt to authenticate preemptively against the proxy server using basic authentication.

boolean

The hosts that the client is allowed to access without going through the proxy.

list of string

Netty HTTP transport configurations

Type

Default

The maximum number of allowed concurrent requests. For HTTP/1.1 this is the same as max connections. For HTTP/2 the number of connections that will be used depends on the max streams allowed per connection.

int

50

The maximum number of pending acquires allowed. Once this exceeds, acquire tries will be failed.

int

10000

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait for a write on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait when initially establishing a connection before giving up and timing out.

Duration

10S

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

2S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum amount of time that a connection should be allowed to remain open while idle. Currently has no effect if quarkus..async-client.use-idle-connection-reaper is false.

Duration

5S

Whether the idle connections in the connection pool should be closed. When enabled, connections left idling for longer than quarkus..async-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

The HTTP protocol to use.

http1-1, http2

http1-1

The SSL Provider to be used in the Netty client. Default is OPENSSL if available, JDK otherwise.

jdk, openssl, openssl-refcnt

The maximum number of concurrent streams for an HTTP/2 connection. This setting is only respected when the HTTP/2 protocol is used.

long

4294967295

The initial window size for an HTTP/2 stream. This setting is only respected when the HTTP/2 protocol is used.

int

1048576

Sets the period that the Netty client will send PING frames to the remote endpoint to check the health of the connection. To disable this feature, set a duration of 0. This setting is only respected when the HTTP/2 protocol is used.

Duration

5

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The hosts that the client is allowed to access without going through the proxy.

list of string

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Enable the custom configuration of the Netty event loop group.

boolean

false

Number of threads to use for the event loop group. If not set, the default Netty thread count is used (which is double the number of available processors unless the io.netty.eventLoopThreads system property is set.

int

The thread name prefix for threads created by this thread factory used by event loop group. The prefix will be appended with a number unique to the thread factory and a number unique to the thread. If not specified it defaults to aws-java-sdk-NettyEventLoop

string

Amazon SNS

Type

Default

List of execution interceptors that will have access to read and modify the request and response objects as they are processed by the AWS SDK. The list should consists of class names which implements software.amazon.awssdk.core.interceptor.ExecutionInterceptor interface.

list of string

Type of the sync HTTP client implementation

url, apache

url

AWS SDK client configurations

Type

Default

The endpoint URI with which the SDK should communicate. If not specified, an appropriate endpoint to be used for the given service and region.

URI

The amount of time to allow the client to complete the execution of an API call. This timeout covers the entire client execution except for marshalling. This includes request handler execution, all HTTP requests including retries, unmarshalling, etc. This value should always be positive, if present.

Duration

The amount of time to wait for the HTTP request to complete before giving up and timing out. This value should always be positive, if present.

Duration

AWS services configurations

Type

Default

An Amazon Web Services region that hosts the given service.

It overrides region provider chain with static value of region with which the service client should communicate.

If not set, region is retrieved via the default providers chain in the following order:

  • aws.region system property

  • region property from the profile file

  • Instance profile file

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Default credentials provider configuration

Type

Default

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Static credentials provider configuration

Type

Default

string

string

AWS Profile credentials provider configuration

Type

Default

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

Process credentials provider configuration

Type

Default

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

The command that should be executed to retrieve credentials.

string

Sync HTTP transport configurations

Type

Default

The maximum amount of time to establish a connection before timing out.

Duration

2S

The amount of time to wait for data to be transferred over an established, open connection before the connection is timed out.

Duration

30S

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Apache HTTP client specific configurations

Type

Default

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

10S

The maximum amount of time that a connection should be allowed to remain open while idle.

Duration

60S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum number of connections allowed in the connection pool. Each built HTTP client has its own private connection pool.

int

50

Whether the client should send an HTTP expect-continue handshake before each request.

boolean

true

Whether the idle connections in the connection pool should be closed asynchronously. When enabled, connections left idling for longer than quarkus..sync-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The username to use when connecting through a proxy.

string

The password to use when connecting through a proxy.

string

For NTLM proxies - the Windows domain name to use when authenticating with the proxy.

string

For NTLM proxies - the Windows workstation name to use when authenticating with the proxy.

string

Whether to attempt to authenticate preemptively against the proxy server using basic authentication.

boolean

The hosts that the client is allowed to access without going through the proxy.

list of string

Netty HTTP transport configurations

Type

Default

The maximum number of allowed concurrent requests. For HTTP/1.1 this is the same as max connections. For HTTP/2 the number of connections that will be used depends on the max streams allowed per connection.

int

50

The maximum number of pending acquires allowed. Once this exceeds, acquire tries will be failed.

int

10000

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait for a write on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait when initially establishing a connection before giving up and timing out.

Duration

10S

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

2S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum amount of time that a connection should be allowed to remain open while idle. Currently has no effect if quarkus..async-client.use-idle-connection-reaper is false.

Duration

5S

Whether the idle connections in the connection pool should be closed. When enabled, connections left idling for longer than quarkus..async-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

The HTTP protocol to use.

http1-1, http2

http1-1

The SSL Provider to be used in the Netty client. Default is OPENSSL if available, JDK otherwise.

jdk, openssl, openssl-refcnt

The maximum number of concurrent streams for an HTTP/2 connection. This setting is only respected when the HTTP/2 protocol is used.

long

4294967295

The initial window size for an HTTP/2 stream. This setting is only respected when the HTTP/2 protocol is used.

int

1048576

Sets the period that the Netty client will send PING frames to the remote endpoint to check the health of the connection. To disable this feature, set a duration of 0. This setting is only respected when the HTTP/2 protocol is used.

Duration

5

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The hosts that the client is allowed to access without going through the proxy.

list of string

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Enable the custom configuration of the Netty event loop group.

boolean

false

Number of threads to use for the event loop group. If not set, the default Netty thread count is used (which is double the number of available processors unless the io.netty.eventLoopThreads system property is set.

int

The thread name prefix for threads created by this thread factory used by event loop group. The prefix will be appended with a number unique to the thread factory and a number unique to the thread. If not specified it defaults to aws-java-sdk-NettyEventLoop

string

Amazon SQS

Type

Default

List of execution interceptors that will have access to read and modify the request and response objects as they are processed by the AWS SDK. The list should consists of class names which implements software.amazon.awssdk.core.interceptor.ExecutionInterceptor interface.

list of string

Type of the sync HTTP client implementation

url, apache

url

AWS SDK client configurations

Type

Default

The endpoint URI with which the SDK should communicate. If not specified, an appropriate endpoint to be used for the given service and region.

URI

The amount of time to allow the client to complete the execution of an API call. This timeout covers the entire client execution except for marshalling. This includes request handler execution, all HTTP requests including retries, unmarshalling, etc. This value should always be positive, if present.

Duration

The amount of time to wait for the HTTP request to complete before giving up and timing out. This value should always be positive, if present.

Duration

AWS services configurations

Type

Default

An Amazon Web Services region that hosts the given service.

It overrides region provider chain with static value of region with which the service client should communicate.

If not set, region is retrieved via the default providers chain in the following order:

  • aws.region system property

  • region property from the profile file

  • Instance profile file

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Default credentials provider configuration

Type

Default

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Static credentials provider configuration

Type

Default

string

string

AWS Profile credentials provider configuration

Type

Default

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

Process credentials provider configuration

Type

Default

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

The command that should be executed to retrieve credentials.

string

Sync HTTP transport configurations

Type

Default

The maximum amount of time to establish a connection before timing out.

Duration

2S

The amount of time to wait for data to be transferred over an established, open connection before the connection is timed out.

Duration

30S

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Apache HTTP client specific configurations

Type

Default

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

10S

The maximum amount of time that a connection should be allowed to remain open while idle.

Duration

60S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum number of connections allowed in the connection pool. Each built HTTP client has its own private connection pool.

int

50

Whether the client should send an HTTP expect-continue handshake before each request.

boolean

true

Whether the idle connections in the connection pool should be closed asynchronously. When enabled, connections left idling for longer than quarkus..sync-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The username to use when connecting through a proxy.

string

The password to use when connecting through a proxy.

string

For NTLM proxies - the Windows domain name to use when authenticating with the proxy.

string

For NTLM proxies - the Windows workstation name to use when authenticating with the proxy.

string

Whether to attempt to authenticate preemptively against the proxy server using basic authentication.

boolean

The hosts that the client is allowed to access without going through the proxy.

list of string

Netty HTTP transport configurations

Type

Default

The maximum number of allowed concurrent requests. For HTTP/1.1 this is the same as max connections. For HTTP/2 the number of connections that will be used depends on the max streams allowed per connection.

int

50

The maximum number of pending acquires allowed. Once this exceeds, acquire tries will be failed.

int

10000

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait for a write on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait when initially establishing a connection before giving up and timing out.

Duration

10S

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

2S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum amount of time that a connection should be allowed to remain open while idle. Currently has no effect if quarkus..async-client.use-idle-connection-reaper is false.

Duration

5S

Whether the idle connections in the connection pool should be closed. When enabled, connections left idling for longer than quarkus..async-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

The HTTP protocol to use.

http1-1, http2

http1-1

The SSL Provider to be used in the Netty client. Default is OPENSSL if available, JDK otherwise.

jdk, openssl, openssl-refcnt

The maximum number of concurrent streams for an HTTP/2 connection. This setting is only respected when the HTTP/2 protocol is used.

long

4294967295

The initial window size for an HTTP/2 stream. This setting is only respected when the HTTP/2 protocol is used.

int

1048576

Sets the period that the Netty client will send PING frames to the remote endpoint to check the health of the connection. To disable this feature, set a duration of 0. This setting is only respected when the HTTP/2 protocol is used.

Duration

5

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The hosts that the client is allowed to access without going through the proxy.

list of string

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Enable the custom configuration of the Netty event loop group.

boolean

false

Number of threads to use for the event loop group. If not set, the default Netty thread count is used (which is double the number of available processors unless the io.netty.eventLoopThreads system property is set.

int

The thread name prefix for threads created by this thread factory used by event loop group. The prefix will be appended with a number unique to the thread factory and a number unique to the thread. If not specified it defaults to aws-java-sdk-NettyEventLoop

string

Amazon SSM

Type

Default

List of execution interceptors that will have access to read and modify the request and response objects as they are processed by the AWS SDK. The list should consists of class names which implements software.amazon.awssdk.core.interceptor.ExecutionInterceptor interface.

list of string

Type of the sync HTTP client implementation

url, apache

url

AWS SDK client configurations

Type

Default

The endpoint URI with which the SDK should communicate. If not specified, an appropriate endpoint to be used for the given service and region.

URI

The amount of time to allow the client to complete the execution of an API call. This timeout covers the entire client execution except for marshalling. This includes request handler execution, all HTTP requests including retries, unmarshalling, etc. This value should always be positive, if present.

Duration

The amount of time to wait for the HTTP request to complete before giving up and timing out. This value should always be positive, if present.

Duration

AWS services configurations

Type

Default

An Amazon Web Services region that hosts the given service.

It overrides region provider chain with static value of region with which the service client should communicate.

If not set, region is retrieved via the default providers chain in the following order:

  • aws.region system property

  • region property from the profile file

  • Instance profile file

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Default credentials provider configuration

Type

Default

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Static credentials provider configuration

Type

Default

string

string

AWS Profile credentials provider configuration

Type

Default

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

Process credentials provider configuration

Type

Default

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

The command that should be executed to retrieve credentials.

string

Sync HTTP transport configurations

Type

Default

The maximum amount of time to establish a connection before timing out.

Duration

2S

The amount of time to wait for data to be transferred over an established, open connection before the connection is timed out.

Duration

30S

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Apache HTTP client specific configurations

Type

Default

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

10S

The maximum amount of time that a connection should be allowed to remain open while idle.

Duration

60S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum number of connections allowed in the connection pool. Each built HTTP client has its own private connection pool.

int

50

Whether the client should send an HTTP expect-continue handshake before each request.

boolean

true

Whether the idle connections in the connection pool should be closed asynchronously. When enabled, connections left idling for longer than quarkus..sync-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The username to use when connecting through a proxy.

string

The password to use when connecting through a proxy.

string

For NTLM proxies - the Windows domain name to use when authenticating with the proxy.

string

For NTLM proxies - the Windows workstation name to use when authenticating with the proxy.

string

Whether to attempt to authenticate preemptively against the proxy server using basic authentication.

boolean

The hosts that the client is allowed to access without going through the proxy.

list of string

Netty HTTP transport configurations

Type

Default

The maximum number of allowed concurrent requests. For HTTP/1.1 this is the same as max connections. For HTTP/2 the number of connections that will be used depends on the max streams allowed per connection.

int

50

The maximum number of pending acquires allowed. Once this exceeds, acquire tries will be failed.

int

10000

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait for a write on a socket before an exception is thrown. Specify 0 to disable.

Duration

30S

The amount of time to wait when initially establishing a connection before giving up and timing out.

Duration

10S

The amount of time to wait when acquiring a connection from the pool before giving up and timing out.

Duration

2S

The maximum amount of time that a connection should be allowed to remain open, regardless of usage frequency.

Duration

The maximum amount of time that a connection should be allowed to remain open while idle. Currently has no effect if quarkus..async-client.use-idle-connection-reaper is false.

Duration

5S

Whether the idle connections in the connection pool should be closed. When enabled, connections left idling for longer than quarkus..async-client.connection-max-idle-time will be closed. This will not close connections currently in use.

boolean

true

The HTTP protocol to use.

http1-1, http2

http1-1

The SSL Provider to be used in the Netty client. Default is OPENSSL if available, JDK otherwise.

jdk, openssl, openssl-refcnt

The maximum number of concurrent streams for an HTTP/2 connection. This setting is only respected when the HTTP/2 protocol is used.

long

4294967295

The initial window size for an HTTP/2 stream. This setting is only respected when the HTTP/2 protocol is used.

int

1048576

Sets the period that the Netty client will send PING frames to the remote endpoint to check the health of the connection. To disable this feature, set a duration of 0. This setting is only respected when the HTTP/2 protocol is used.

Duration

5

boolean

false

The endpoint of the proxy server that the SDK should connect through. Currently, the endpoint is limited to a host and port. Any other URI components will result in an exception being raised.

URI

The hosts that the client is allowed to access without going through the proxy.

list of string

TLS key managers provider type.

Available providers:

  • none - Use this provider if you don’t want the client to present any certificates to the remote TLS host.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

none, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

TLS trust managers provider type.

Available providers:

  • trust-all - Use this provider to disable the validation of servers certificates and therefor turst all server certificates.

  • system-property - Provider checks the standard javax.net.ssl.keyStore, javax.net.ssl.keyStorePassword, and javax.net.ssl.keyStoreType properties defined by the JSSE.

  • file-store - Provider that loads a the key store from a file.

trust-all, system-property, file-store

system-property

path

Key store type. See the KeyStore section in the https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyStore[Java Cryptography Architecture Standard Algorithm Name Documentation] for information about standard keystore types.

string

string

Enable the custom configuration of the Netty event loop group.

boolean

false

Number of threads to use for the event loop group. If not set, the default Netty thread count is used (which is double the number of available processors unless the io.netty.eventLoopThreads system property is set.

int

The thread name prefix for threads created by this thread factory used by event loop group. The prefix will be appended with a number unique to the thread factory and a number unique to the thread. If not specified it defaults to aws-java-sdk-NettyEventLoop

string

Apache Kafka Client

Type

Default

Whether or not an health check is published in case the smallrye-health extension is present. If you enable the health check, you must specify the kafka.bootstrap.servers property.

boolean

false

Whether or not to enable Snappy in native mode. Note that Snappy requires GraalVM 21+ and embeds a native library in the native executable. This library is unpacked and loaded when the application starts.

boolean

false

If Dev Services for Kafka has been explicitly enabled or disabled. Dev Services are generally enabled by default, unless there is an existing configuration present. For Kafka, Dev Services starts a broker unless kafka.bootstrap.servers is set or if all the Reactive Messaging Kafka channel are configured with a bootstrap.servers.

boolean

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

string

vectorized/redpanda:v21.5.5

Indicates if the Kafka broker managed by Quarkus Dev Services is shared. When shared, Quarkus looks for running containers using label-based service discovery. If a matching container is found, it is used, and so a second one is not started. Otherwise, Dev Services for Kafka starts a new container. The discovery uses the quarkus-dev-service-kafka label. The value is configured using the service-name property. Container sharing is only used in dev mode.

boolean

true

The value of the quarkus-dev-service-kafka label attached to the started container. This property is used when shared is set to true. In this case, before starting a container, Dev Services for Kafka looks for a container with the quarkus-dev-service-kafka label set to the configured value. If found, it will use this container instead of starting a new one. Otherwise it starts a new container with the quarkus-dev-service-kafka label set to the specified value. This property is used when you need multiple shared Kafka brokers.

string

kafka

Timeout for admin client calls used in topic creation. Defaults to 2 seconds.

Duration

2S

The topic-partition pairs to create in the Dev Services Kafka broker. After the broker is started, given topics with partitions are created, skipping already existing topics. For example, quarkus.kafka.devservices.topic-partitions.test=2 will create a topic named test with 2 partitions. The topic creation will not try to re-partition existing topics with different number of partitions.

Map<String,Integer>

Apache Kafka Streams

Type

Default

Whether or not a health check is published in case the smallrye-health extension is present (defaults to true).

boolean

true

A unique identifier for this Kafka Streams application. If not set, defaults to quarkus.application.name.

string

${quarkus.application.name}

A comma-separated list of host:port pairs identifying the Kafka bootstrap server(s). If not set, fallback to kafka.bootstrap.servers, and if not set either use localhost:9012.

list of host:port

localhost:9012

A unique identifier of this application instance, typically in the form host:port.

string

A comma-separated list of topic names. The pipeline will only be started once all these topics are present in the Kafka cluster.

list of string

required

The schema registry key. Different schema registry libraries expect a registry URL in different configuration properties. For Apicurio Registry, use apicurio.registry.url. For Confluent schema registry, use schema.registry.url.

string

schema.registry.url

string

string

SASL mechanism used for client connections

string

JAAS login context parameters for SASL connections in the format used by JAAS configuration files

string

The fully qualified name of a SASL client callback handler class

string

The fully qualified name of a SASL login callback handler class

string

The fully qualified name of a class that implements the Login interface

string

The Kerberos principal name that Kafka runs as

string

Kerberos kinit command path

string

Login thread will sleep until the specified window factor of time from last refresh

double

Percentage of random jitter added to the renewal time

double

Percentage of random jitter added to the renewal time

long

Login refresh thread will sleep until the specified window factor relative to the credential’s lifetime has been reached-

double

The maximum amount of random jitter relative to the credential’s lifetime

double

The desired minimum duration for the login refresh thread to wait before refreshing a credential

Duration

The amount of buffer duration before credential expiration to maintain when refreshing a credential

Duration

The SSL protocol used to generate the SSLContext

string

The name of the security provider used for SSL connections

string

A list of cipher suites

string

The list of protocols enabled for SSL connections

string

string

string

string

string

string

string

string

string

string

Password of the private key in the key store

string

The algorithm used by key manager factory for SSL connections

string

The algorithm used by trust manager factory for SSL connections

string

The endpoint identification algorithm to validate server hostname using server certificate

string

https

The SecureRandom PRNG implementation to use for SSL cryptography operations

string

Apache Tika

Type

Default

The resource path within the application artifact to the tika-config.xml file.

string

Comma separated list of the parsers which must be supported. Most of the document formats recognized by Apache Tika are supported by default but it affects the application memory and native executable sizes. One can list only the required parsers in tika-config.xml to minimize a number of parsers loaded into the memory, but using this property is recommended to achieve both optimizations. Either the abbreviated or full parser class names can be used. Only PDF and OpenDocument format parsers can be listed using the reserved 'pdf' and 'odf' abbreviations. Custom class name abbreviations have to be used for all other parsers. For example: // Only PDF parser is required: quarkus.tika.parsers = pdf // Only PDF and OpenDocument parsers are required: quarkus.tika.parsers = pdf,odf This property will have no effect if the `tikaConfigPath' property has been set.

string

Controls how the content of the embedded documents is parsed. By default it is appended to the main document content. Setting this property to false makes the content of each of the embedded documents available separately.

boolean

true

Configuration of the individual parsers. For example: quarkus.tika.parsers = pdf,odf quarkus.tika.parser-options.pdf.sort-by-position = true

Map<String,Map<String,String>>

Full parser class name for a given parser abbreviation. For example: quarkus.tika.parsers = classparser quarkus.tika.parser.classparser = org.apache.tika.parser.asm.ClassParser

Map<String,String>

Apicurio Registry - Avro

Type

Default

If Dev Services for Apicurio Registry has been explicitly enabled or disabled. Dev Services are generally enabled by default, unless there is an existing configuration present. For Apicurio Registry, Dev Services starts a registry unless mp.messaging.connector.smallrye-kafka.apicurio.registry.url is set.

boolean

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

The Apicurio Registry image to use. Note that only Apicurio Registry 2.x images are supported.

string

apicurio/apicurio-registry-mem:2.0.1.Final

Indicates if the Apicurio Registry instance managed by Quarkus Dev Services is shared. When shared, Quarkus looks for running containers using label-based service discovery. If a matching container is found, it is used, and so a second one is not started. Otherwise, Dev Services for Apicurio Registry starts a new container. The discovery uses the quarkus-dev-service-apicurio-registry label. The value is configured using the service-name property. Container sharing is only used in dev mode.

boolean

true

The value of the quarkus-dev-service-apicurio-registry label attached to the started container. This property is used when shared is set to true. In this case, before starting a container, Dev Services for Apicurio Registry looks for a container with the quarkus-dev-service-apicurio-registry label set to the configured value. If found, it will use this container instead of starting a new one. Otherwise it starts a new container with the quarkus-dev-service-apicurio-registry label set to the specified value. This property is used when you need multiple shared Apicurio Registry instances.

string

apicurio-registry

ArC

Type

Default

  • If set to all (or true) the container will attempt to remove all unused beans.

  • If set to none (or false) no beans will ever be removed even if they are unused (according to the criteria set out below)

  • If set to fwk, then all unused beans will be removed, except the unused beans whose classes are declared in the application code An unused bean:

  • is not a built-in bean or interceptor,

  • is not eligible for injection to any injection point,

  • is not excluded by any extension,

  • does not have a name,

  • does not declare an observer,

  • does not declare any producer which is eligible for injection to any injection point,

  • is not directly eligible for injection into any javax.enterprise.inject.Instance injection point

string

all

If set to true @Inject is automatically added to all non-static fields that are annotated with one of the annotations defined by AutoInjectAnnotationBuildItem.

boolean

true

If set to true, the bytecode of unproxyable beans will be transformed. This ensures that a proxy/subclass can be created properly. If the value is set to false, then an exception is thrown at build time indicating that a subclass/proxy could not be created. Quarkus performs the following transformations when this setting is enabled: - Remove 'final' modifier from classes and methods when a proxy is required. - Create a no-args constructor if needed. - Makes private no-args constructors package-private if necessary.

boolean

true

The default naming strategy for ConfigProperties.NamingStrategy. The allowed values are determined by that enum

from-config, verbatim, kebab-case

kebab-case

The list of selected alternatives for an application. An element value can be: - a fully qualified class name, i.e. org.acme.Foo - a simple class name as defined by Class#getSimpleName(), i.e. Foo - a package name with suffix .*, i.e. org.acme.*, matches a package - a package name with suffix .**, i.e. org.acme.**, matches a package that starts with the value Each element value is used to match an alternative bean class, an alternative stereotype annotation type or a bean class that declares an alternative producer. If any value matches then the priority of Integer#MAX_VALUE is used for the relevant bean. The priority declared via javax.annotation.Priority or io.quarkus.arc.AlternativePriority is overriden.

list of string

If set to true then javax.enterprise.inject.Produces is automatically added to all non-void methods that are annotated with a scope annotation, a stereotype or a qualifier, and are not annotated with Inject or Produces, and no parameter is annotated with Disposes, Observes or ObservesAsync.

boolean

true

The list of types that should be excluded from discovery. An element value can be: - a fully qualified class name, i.e. org.acme.Foo - a simple class name as defined by Class#getSimpleName(), i.e. Foo - a package name with suffix .*, i.e. org.acme.*, matches a package - a package name with suffix .**, i.e. org.acme.**, matches a package that starts with the value If any element value matches a discovered type then the type is excluded from discovery, i.e. no beans and observer methods are created from this type.

list of string

List of types that should be considered unremovable regardless of whether they are directly used or not. This is a configuration option equivalent to using io.quarkus.arc.Unremovable annotation. An element value can be: - a fully qualified class name, i.e. org.acme.Foo - a simple class name as defined by Class#getSimpleName(), i.e. Foo - a package name with suffix .*, i.e. org.acme.*, matches a package - a package name with suffix .**, i.e. org.acme.**, matches a package that starts with the value If any element value matches a discovered bean, then such a bean is considered unremovable.

list of string

If set to true then the container attempts to detect "unused removed beans" false positives during programmatic lookup at runtime. You can disable this feature to conserve some memory when running your application in production.

boolean

true

If set to true then the container attempts to detect wrong usages of annotations and eventually fails the build to prevent unexpected behavior of a Quarkus application. A typical example is @javax.ejb.Singleton which is often confused with @javax.inject.Singleton. As a result a component annotated with @javax.ejb.Singleton would be completely ignored. Another example is an inner class annotated with a scope annotation - this component would be again completely ignored.

boolean

true

If set to true then the container monitors business method invocations and fired events during the development mode.

boolean

true

If set to true then disable StartupEvent and ShutdownEvent observers declared on application bean classes during the tests.

boolean

false

The list of packages that will not be checked for split package issues. A package string representation can be: - a full name of the package, i.e. org.acme.foo - a package name with suffix .*, i.e. org.acme.*, which matches a package that starts with provided value

list of string

Artifacts that should be excluded from discovery

Type

Default

string

required

The maven artifactId of the artifact.

string

required

The maven classifier of the artifact.

string

Artemis Core

Type

Default

Whether or not an health check is published in case the smallrye-health extension is present

boolean

true

Artemis connection url

string

required

Username for authentication, only used with JMS

string

Password for authentication, only used with JMS

string

Cache

Type

Default

Whether or not the cache extension is enabled.

boolean

true

Cache type.

string

caffeine

Minimum total size for the internal data structures. Providing a large enough estimate at construction time avoids the need for expensive resizing operations later, but setting this value unnecessarily high wastes memory.

int

Maximum number of entries the cache may contain. Note that the cache may evict an entry before this limit is exceeded or temporarily exceed the threshold while evicting. As the cache size grows close to the maximum, the cache evicts entries that are less likely to be used again. For example, the cache may evict an entry because it hasn’t been used recently or very often.

long

Specifies that each entry should be automatically removed from the cache once a fixed duration has elapsed after the entry’s creation, or the most recent replacement of its value.

Duration

Specifies that each entry should be automatically removed from the cache once a fixed duration has elapsed after the entry’s creation, the most recent replacement of its value, or its last read.

Duration

Consul Config

Type

Default

If set to true, the application will attempt to look up the configuration from Consul

boolean

false

host:port

localhost:8500

Whether or not to use HTTPS when communicating with the agent

boolean

false

Consul token to be provided when authentication is enabled

string

TrustStore to be used containing the SSL certificate used by Consul agent Can be either a classpath resource or a file system path

path

Password of TrustStore to be used containing the SSL certificate used by Consul agent

string

KeyStore to be used containing the SSL certificate for authentication with Consul agent Can be either a classpath resource or a file system path

path

Password of KeyStore to be used containing the SSL certificate for authentication with Consul agent

string

Password to recover key from KeyStore for SSL client authentication with Consul agent If no value is provided, the key-store-password will be used

string

When using HTTPS and no keyStore has been specified, whether or not to trust all certificates

boolean

false

The amount of time to wait when initially establishing a connection before giving up and timing out. Specify 0 to wait indefinitely.

Duration

10S

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to wait indefinitely.

Duration

60S

Common prefix that all keys share when looking up the keys from Consul. The prefix is not included in the keys of the user configuration

string

Keys whose value is a raw string. When this is used, the keys that end up in the user configuration are the keys specified her with '/' replaced by '.'

list of string

Keys whose value represents a properties file. When this is used, the keys that end up in the user configuration are the keys of the properties file, not these keys

list of string

If set to true, the application will not start if any of the configured config sources cannot be located

boolean

true

Container Image

Type

Default

The group the container image will be part of

string

${user.name}

The name of the container image. If not set defaults to the application name

string

${quarkus.application.name:unset}

The tag of the container image. If not set defaults to the application version

string

${quarkus.application.version:latest}

Additional tags of the container image.

list of string

The container registry to use

string

Represents the entire image string. If set, then group, name, registry, tags, additionalTags are ignored

string

The username to use to authenticate with the registry where the built image will be pushed

string

The password to use to authenticate with the registry where the built image will be pushed

string

Whether or not insecure registries are allowed

boolean

false

Whether or not a image build will be performed.

boolean

false

Whether or not an image push will be performed.

boolean

false

The name of the container image extension to use (e.g. docker, jib, s2i). The option will be used in case multiple extensions are present.

string

Custom labels to add to the generated image.

Map<String,String>

Container Image Docker

Type

Default

Path to the the JVM Dockerfile. If not set ${project.root}/src/main/docker/Dockerfile.jvm will be used If set to an absolute path then the absolute path will be used, otherwise the path will be considered relative to the project root

string

Path to the the JVM Dockerfile. If not set ${project.root}/src/main/docker/Dockerfile.native will be used If set to an absolute path then the absolute path will be used, otherwise the path will be considered relative to the project root

string

Images to consider as cache sources. Values are passed to docker build via the cache-from option

list of string

Name of binary used to execute the docker commands.

string

docker

Build args passed to docker via --build-arg

Map<String,String>

Container Image Jib

Type

Default

The base image to be used when a container image is being produced for the jar build

string

fabric8/java-alpine-openjdk11-jre

The base image to be used when a container image is being produced for the native binary build

string

registry.access.redhat.com/ubi8/ubi-minimal

Additional JVM arguments to pass to the JVM when starting the application

list of string

-Djava.util.logging.manager=org.jboss.logmanager.LogManager

Additional arguments to pass when starting the native application

list of string

If this is set, then it will be used as the entry point of the container image. There are a few things to be aware of when creating an entry point - A valid entrypoint is jar package specific (see quarkus.package.type) - A valid entrypoint depends on the location of both the launching scripts and the application jar file. To that end it’s helpful to remember that when fast-jar packaging is used (the default), all necessary application jars are added to the /work directory and that the same directory is also used as the working directory. When legacy-jar or uber-jar are used, the application jars are unpacked under the /app directory and that directory is used as the working directory. - Even if the jvmArguments field is set, it is ignored completely When this is not set, a proper default entrypoint will be constructed. As a final note, a very useful tool for inspecting container image layers that can greatly aid when debugging problems with endpoints is dive

list of string

If this is set, then it will be used as the entry point of the container image. There are a few things to be aware of when creating an entry point - A valid entrypoint depends on the location of both the launching scripts and the native binary file. To that end it’s helpful to remember that the native application is added to the /work directory and that and the same directory is also used as the working directory - Even if the nativeArguments field is set, it is ignored completely When this is not set, a proper default entrypoint will be constructed. As a final note, a very useful tool for inspecting container image layers that can greatly aid when debugging problems with endpoints is dive

list of string

The username to use to authenticate with the registry used to pull the base JVM image

string

The password to use to authenticate with the registry used to pull the base JVM image

string

The ports to expose

list of int

${quarkus.http.port:8080}

The user to use in generated image

string

Controls the optimization which skips downloading base image layers that exist in a target registry. If the user does not set this property, then read as false. If true, base image layers are always pulled and cached. If false, base image layers will not be pulled/cached if they already exist on the target registry.

boolean

false

List of target platforms. Each platform is defined using the pattern: \|\[/variant]|\/\[/variant] ex: linux/amd64,linux/arm64/v8. If not specified, OS default is linux and architecture default is amd64 If more than one platform is configured, it is important to note that the base image has to be a Docker manifest or an OCI image index containing a version of each chosen platform It doesn’t work with native images, as cross-compilation is not supported Target Platform is a incubating feature of Jib. See Jib FAQ for more information

list of string

The path of a file that will be written containing the digest of the generated image. If the path is relative, is writen to the output directory of the build tool

string

jib-image.digest

The path of a file that will be written containing the id of the generated image. If the path is relative, is writen to the output directory of the build tool

string

jib-image.id

Whether or not to operate offline.

boolean

false

Environment variables to add to the container image

Map<String,String>

Container Image OpenShift

Type

Default

The build config strategy to use.

binary, docker

binary

The base image to be used when a container image is being produced for the jar build

string

registry.access.redhat.com/ubi8/openjdk-11

The base image to be used when a container image is being produced for the native binary build

string

quay.io/quarkus/ubi-quarkus-native-binary-s2i:1.0

The default Dockerfile to use for jvm builds

string

src/main/docker/Dockerfile.jvm

The default Dockerfile to use for native builds

string

src/main/docker/Dockerfile.native

Additional JVM arguments to pass to the JVM when starting the application

list of string

-Dquarkus.http.host=0.0.0.0,-Djava.util.logging.manager=org.jboss.logmanager.LogManager

Additional arguments to pass when starting the native application

list of string

-Dquarkus.http.host=0.0.0.0

The directory where the jar is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non default image is used.

string

The resulting filename of the jar in the S2I image. This option may be used if the selected S2I image uses a fixed name for the jar.

string

The directory where the native binary is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non-default image is used.

string

The resulting filename of the native binary in the S2I image. This option may be used if the selected S2I image uses a fixed name for the native binary.

string

The build timeout.

Duration

PT5M

The base image to be used when a container image is being produced for the jar build

string

registry.access.redhat.com/ubi8/openjdk-11

The base image to be used when a container image is being produced for the native binary build

string

quay.io/quarkus/ubi-quarkus-native-binary-s2i:1.0

Additional JVM arguments to pass to the JVM when starting the application

list of string

-Dquarkus.http.host=0.0.0.0,-Djava.util.logging.manager=org.jboss.logmanager.LogManager

Additional arguments to pass when starting the native application

list of string

-Dquarkus.http.host=0.0.0.0

The directory where the jar is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non default image is used.

string

/deployments/target/

The resulting filename of the jar in the S2I image. This option may be used if the selected S2I image uses a fixed name for the jar.

string

The directory where the native binary is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non-default image is used.

string

/home/quarkus/

The resulting filename of the native binary in the S2I image. This option may be used if the selected S2I image uses a fixed name for the native binary.

string

The build timeout.

Duration

PT5M

Container Image S2I

Type

Default

The base image to be used when a container image is being produced for the jar build

string

registry.access.redhat.com/ubi8/openjdk-11

The base image to be used when a container image is being produced for the native binary build

string

quay.io/quarkus/ubi-quarkus-native-binary-s2i:1.0

Additional JVM arguments to pass to the JVM when starting the application

list of string

-Djava.util.logging.manager=org.jboss.logmanager.LogManager

Additional arguments to pass when starting the native application

list of string

The directory where the jar is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non default image is used.

string

/deployments/

The resulting filename of the jar in the S2I image. This option may be used if the selected S2I image uses a fixed name for the jar.

string

The directory where the native binary is added during the assemble phase. This is dependent on the S2I image and should be supplied if a non-default image is used.

string

/home/quarkus/

The resulting filename of the native binary in the S2I image. This option may be used if the selected S2I image uses a fixed name for the native binary.

string

The build timeout.

Duration

PT5M

Datasources

Type

Default

The kind of database we will connect to (e.g. h2, postgresql…​).

string

If DevServices has been explicitly enabled or disabled. DevServices is generally enabled by default, unless there is an existing configuration present. When DevServices is enabled Quarkus will attempt to automatically configure and start a database when running in Dev or Test mode.

boolean

The container image name to use, for container based DevServices providers. If the provider is not container based (e.g. a H2 Database) then this has no effect.

string

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

Whether this particular data source should be excluded from the health check if the general health check for data sources is enabled. By default, the health check includes all configured data sources (if it is enabled).

boolean

false

Whether or not an health check is published in case the smallrye-health extension is present. This is a global setting and is not specific to a datasource.

boolean

true

Whether or not datasource metrics are published in case a metrics extension is present. This is a global setting and is not specific to a datasource. NOTE: This is different from the "jdbc.enable-metrics" property that needs to be set on the JDBC datasource level to enable collection of metrics for that datasource.

boolean

false

The datasource username

string

The datasource password

string

The credentials provider name

string

The credentials provider bean name. It is the &#64;Named value of the credentials provider bean. It is used to discriminate if multiple CredentialsProvider beans are available. For Vault it is: vault-credentials-provider. Not necessary if there is only one credentials provider available.

string

Generic properties that are added to the database connection URL.

Map<String,String>

Additional named datasources

Type

Default

The kind of database we will connect to (e.g. h2, postgresql…​).

string

If DevServices has been explicitly enabled or disabled. DevServices is generally enabled by default, unless there is an existing configuration present. When DevServices is enabled Quarkus will attempt to automatically configure and start a database when running in Dev or Test mode.

boolean

The container image name to use, for container based DevServices providers. If the provider is not container based (e.g. a H2 Database) then this has no effect.

string

Generic properties that are added to the database connection URL.

Map<String,String>

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

Whether this particular data source should be excluded from the health check if the general health check for data sources is enabled. By default, the health check includes all configured data sources (if it is enabled).

boolean

false

string

string

string

The credentials provider bean name. It is the &#64;Named value of the credentials provider bean. It is used to discriminate if multiple CredentialsProvider beans are available. For Vault it is: vault-credentials-provider. Not necessary if there is only one credentials provider available.

string

Eclipse Vert.x

Type

Default

Enables or disables the Vert.x cache.

boolean

true

Enables or disabled the Vert.x classpath resource resolver.

boolean

true

The number of event loops. 2 x the number of core by default.

int

The maximum amount of time the event loop can be blocked.

Duration

2S

The amount of time before a warning is displayed if the event loop is blocked.

Duration

2S

The size of the worker thread pool.

int

20

The maximum amount of time the worker thread can be blocked.

Duration

60S

The size of the internal thread pool (used for the file system).

int

20

The queue size. For most applications this should be unbounded

int

The executor growth resistance. A resistance factor applied after the core pool is full; values applied here will cause that fraction of submissions to create new threads when no idle thread is available. A value of 0.0f implies that threads beyond the core size should be created as aggressively as threads within it; a value of 1.0f implies that threads beyond the core size should never be created.

float

0f

The amount of time a thread will stay alive with no work.

Duration

30S

Prefill thread pool when creating a new Executor. When io.vertx.core.spi.ExecutorServiceFactory.createExecutor is called, initialise with the number of defined threads at startup

boolean

false

Enables the async DNS resolver.

boolean

false

PEM Key/cert config is disabled by default.

boolean

false

Comma-separated list of the path to the key files (Pem format).

list of string

Comma-separated list of the path to the certificate files (Pem format).

list of string

JKS config is disabled by default.

boolean

false

Path of the key file (JKS format).

string

string

PFX config is disabled by default.

boolean

false

Path to the key file (PFX format).

string

string

PEM Trust config is disabled by default.

boolean

false

Comma-separated list of the trust certificate files (Pem format).

list of string

JKS config is disabled by default.

boolean

false

Path of the key file (JKS format).

string

string

PFX config is disabled by default.

boolean

false

Path to the key file (PFX format).

string

string

int

The client authentication.

string

NONE

Duration

60S

The idle timeout in milliseconds.

Duration

int

The number of reconnection attempts.

int

0

The reconnection interval in milliseconds.

Duration

1S

Whether or not to reuse the address.

boolean

true

Whether or not to reuse the port.

boolean

false

int

int

Enables or Disabled SSL.

boolean

false

Whether or not to keep the TCP connection opened (keep-alive).

boolean

false

Configure the TCP no delay.

boolean

true

Configure the traffic class.

int

Enables or disables the trust all parameter.

boolean

false

string

localhost

int

The public host name.

string

int

Enables or disables the clustering.

boolean

false

Duration

20S

Duration

20S

The maximum amount of time in seconds that a successfully resolved address will be cached. If not set explicitly, resolved addresses may be cached forever.

int

2147483647

The minimum amount of time in seconds that a successfully resolved address will be cached.

int

0

The amount of time in seconds that an unsuccessful attempt to resolve an address will be cached.

int

0

Enable or disable native transport

boolean

false

Eclipse Vert.x - HTTP

Type

Default

The number of history log entries to remember.

int

50

The HTTP root path. All web content will be served relative to this root path.

string

/

If basic auth should be enabled. If both basic and form auth is enabled then basic auth will be enabled in silent mode. If no authentication mechanisms are configured basic auth is the default.

boolean

If form authentication is enabled

boolean

false

string

/login.html

string

/j_security_check

string

j_username

string

j_password

string

/error.html

The landing page to redirect to if there is no saved page to redirect back to

string

/index.html

Option to disable redirect to landingPage if there is no saved page to redirect back to. Form Auth POST is followed by redirect to landingPage by default.

boolean

true

Option to control the name of the cookie used to redirect the user back to where he want to get access to.

string

quarkus-redirect-location

The inactivity (idle) timeout When inactivity timeout is reached, cookie is not renewed and a new login is enforced.

Duration

PT30M

How old a cookie can get before it will be replaced with a new cookie with an updated timeout, also referred to as "renewal-timeout". Note that smaller values will result in slightly more server load (as new encrypted cookies will be generated more often), however larger values affect the inactivity timeout as the timeout is set when a cookie is generated. For example if this is set to 10 minutes, and the inactivity timeout is 30m, if a users last request is when the cookie is 9m old then the actual timeout will happen 21m after the last request, as the timeout is only refreshed when a new cookie is generated. In other words no timeout is tracked on the server side; the timestamp is encoded and encrypted in the cookie itself and it is decrypted and parsed with each request.

Duration

PT1M

The cookie that is used to store the persistent session

string

quarkus-credential

The authentication realm

string

Quarkus

If this is true and credentials are present then a user will always be authenticated before the request progresses. If this is false then an attempt will only be made to authenticate the user if a permission check is performed or the current user is required for some other reason.

boolean

true

Configures the engine to require/request client authentication. NONE, REQUEST, REQUIRED

none, request, required

none

If this is true then only a virtual channel will be set up for vertx web. We have this switch for testing purposes.

boolean

false

A common root path for non-application endpoints. Various extension-provided endpoints such as metrics, health, and openapi are deployed under this path by default.

  • Relative path (Default, q) → Non-application endpoints will be served from ${quarkus.http.root-path}/${quarkus.http.non-application-root-path}.

  • Absolute path (/q) → Non-application endpoints will be served from the specified path.

  • ${quarkus.http.root-path} → Setting this path to the same value as HTTP root path disables this root path. All extension-provided endpoints will be served from ${quarkus.http.root-path}.

string

q

The REST Assured client timeout for testing.

Duration

30S

Enable the CORS filter.

boolean

false

The HTTP port

int

8080

The HTTP port used to run tests

int

8081

The HTTP host In dev/test mode this defaults to localhost, in prod mode this defaults to 0.0.0.0 Defaulting to 0.0.0.0 makes it easier to deploy Quarkus to container, however it is not suitable for dev/test mode as other people on the network can connect to your development machine.

string

required

Enable listening to host:port

boolean

true

The HTTPS port

int

8443

The HTTPS port used to run tests

int

8444

If insecure (i.e. http rather than https) requests are allowed. If this is enabled then http works as normal. redirect will still open the http port, but all requests will be redirected to the HTTPS port. disabled will prevent the HTTP port from opening at all.

enabled, redirect, disabled

enabled

If this is true (the default) then HTTP/2 will be enabled. Note that for browsers to be able to use it HTTPS must be enabled, and you must be running on JDK11 or above, as JDK8 does not support ALPN.

boolean

true

Origins allowed for CORS Comma separated list of valid URLs. ex: http://www.quarkus.io,http://localhost:3000 The filter allows any origin if this is not set. default: returns any requested origin as valid

list of string

HTTP methods allowed for CORS Comma separated list of valid methods. ex: GET,PUT,POST The filter allows any method if this is not set. default: returns any requested method as valid

list of string

HTTP headers allowed for CORS Comma separated list of valid headers. ex: X-Custom,Content-Disposition The filter allows any header if this is not set. default: returns any requested header as valid

list of string

HTTP headers exposed in CORS Comma separated list of valid headers. ex: X-Custom,Content-Disposition default: empty

list of string

The Access-Control-Max-Age response header value indicating how long the results of a pre-flight request can be cached.

Duration

The Access-Control-Allow-Credentials header is used to tell the browsers to expose the response to front-end JavaScript code when the request’s credentials mode Request.credentials is “include”. The value of this header will default to true if quarkus.http.cors.origins property is set and there is a match with the precise Origin header and that header is not '*'.

boolean

The list of path to server certificates using the PEM format. Specifying multiple files require SNI to be enabled.

list of path

The list of path to server certificates private key file using the PEM format. Specifying multiple files require SNI to be enabled. The order of the key files must match the order of the certificates.

list of path

An optional key store which holds the certificate information instead of specifying separate files.

path

An optional parameter to specify type of the key store file. If not given, the type is automatically detected based on the file name.

string

An optional parameter to specify a provider of the key store file. If not given, the provider is automatically detected based on the key store file type.

string

A parameter to specify the password of the key store file. If not given, the default ("password") is used.

string

password

An optional parameter to select a specific key in the key store. When SNI is disabled, if the key store contains multiple keys and no alias is specified, the behavior is undefined.

string

An optional parameter to define the password for the key, in case it’s different from key-store-password.

string

An optional trust store which holds the certificate information of the certificates to trust.

path

An optional parameter to specify type of the trust store file. If not given, the type is automatically detected based on the file name.

string

An optional parameter to specify a provider of the trust store file. If not given, the provider is automatically detected based on the trust store file type.

string

A parameter to specify the password of the trust store file.

string

An optional parameter to trust only one specific certificate in the trust store (instead of trusting all certificates in the store).

string

The cipher suites to use. If none is given, a reasonable default is selected.

list of string

The list of protocols to explicitly enable.

list of string

TLSv1.3,TLSv1.2

Enables Server Name Indication (SNI), an TLS extension allowing the server to use multiple certificates. The client indicate the server name during the TLS handshake, allowing the server to select the right certificate.

boolean

false

The number if IO threads used to perform IO. This will be automatically set to a reasonable value based on the number of CPU cores if it is not provided. If this is set to a higher value than the number of Vert.x event loops then it will be capped at the number of event loops. In general this should be controlled by setting quarkus.vertx.event-loops-pool-size, this setting should only be used if you want to limit the number of HTTP io threads to a smaller number than the total number of IO threads.

int

The maximum length of all headers.

MemorySize

20K

The maximum size of a request body.

MemorySize

10240K

The max HTTP chunk size

MemorySize

8192

The maximum length of the initial line (e.g. "GET / HTTP/1.0").

int

4096

The maximum length of a form attribute.

MemorySize

2048

The maximum number of connections that are allowed at any one time. If this is set it is recommended to set a short idle timeout.

int

Http connection idle timeout

Duration

30M

Http connection read timeout for blocking IO. This is the maximum amount of time a thread will wait for data, before an IOException will be thrown and the connection closed.

Duration

60S

Whether the files sent using multipart/form-data will be stored locally. If true, they will be stored in quarkus.http.body-handler.uploads-directory and will be made available via io.vertx.ext.web.RoutingContext.fileUploads(). Otherwise, the the files sent using multipart/form-data will not be stored locally, and io.vertx.ext.web.RoutingContext.fileUploads() will always return an empty collection. Note that even with this option being set to false, the multipart/form-data requests will be accepted.

boolean

true

The directory where the files sent using multipart/form-data should be stored. Either an absolute path or a path relative to the current directory of the application process.

string

${java.io.tmpdir}/uploads

Whether the form attributes should be added to the request parameters. If true, the form attributes will be added to the request parameters; otherwise the form parameters will not be added to the request parameters

boolean

true

Whether the uploaded files should be removed after serving the request. If true the uploaded files stored in quarkus.http.body-handler.uploads-directory will be removed after handling the request. Otherwise the files will be left there forever.

boolean

true

Whether the body buffer should pre-allocated based on the Content-Length header value. If true the body buffer is pre-allocated according to the size read from the Content-Length header. Otherwise the body buffer is pre-allocated to 1KB, and is resized dynamically

boolean

false

The encryption key that is used to store persistent logins (e.g. for form auth). Logins are stored in a persistent cookie that is encrypted with AES-256 using a key derived from a SHA-256 hash of the key that is provided here. If no key is provided then an in-memory one will be generated, this will change on every restart though so it is not suitable for production environments. This must be more than 16 characters long for security reasons

string

Enable socket reuse port (linux/macOs native transport only)

boolean

false

Enable tcp quick ack (linux native transport only)

boolean

false

Enable tcp cork (linux native transport only)

boolean

false

Enable tcp fast open (linux native transport only)

boolean

false

Path to a unix domain socket

string

/var/run/io.quarkus.app.socket

Enable listening to host:port

boolean

false

If this is true then the request start time will be recorded to enable logging of total request time. This has a small performance penalty, so is disabled by default.

boolean

false

If access logging is enabled. By default this will log via the standard logging facility

boolean

false

A regular expression that can be used to exclude some paths from logging.

string

The access log pattern.

If this is the string common, combined or long then this will use one of the specified named formats:

  • common: %h %l %u %t "%r" %s %b

  • combined: %h %l %u %t "%r" %s %b "%{i,Referer}" "%{i,User-Agent}"

  • long: %r\n%{ALL_REQUEST_HEADERS}

Otherwise consult the Quarkus documentation for the full list of variables that can be used.

string

common

If logging should be done to a separate file.

boolean

false

The access log file base name, defaults to 'quarkus' which will give a log file name of 'quarkus.log'.

string

quarkus

The log directory to use when logging access to a file If this is not set then the current working directory is used.

string

string

.log

The log category to use if logging is being done via the standard log mechanism (i.e. if base-file-name is empty).

string

io.quarkus.http.access-log

If the log should be rotated daily

boolean

true

If responses should be compressed. Note that this will attempt to compress all responses, to avoid compressing already compressed content (such as images) you need to set the following header: Content-Encoding: identity Which will tell vert.x not to compress the response.

boolean

false

When enabled, vert.x will decompress the request’s body if it’s compressed. Note that the compression format (e.g., gzip) must be specified in the Content-Encoding header in the request.

boolean

false

Provides a hint (optional) for the default content type of responses generated for the errors not handled by the application. If the client requested a supported content-type in request headers (e.g. "Accept: application/json", "Accept: text/html"), Quarkus will use that content type. Otherwise, it will default to the content type configured here.

json, html

If this is true then the address, scheme etc will be set from headers forwarded by the proxy server, such as X-Forwarded-For. This should only be set if you are behind a proxy that sets these headers.

boolean

false

If this is true and proxy address forwarding is enabled then the standard Forwarded header will be used, rather than the more common but not standard X-Forwarded-For.

boolean

false

Enable override the received request’s host through a forwarded host header.

boolean

false

Configure the forwarded host header to be used if override enabled.

string

X-Forwarded-Host

Enable prefix the received request’s path with a forwarded prefix header.

boolean

false

Configure the forwarded prefix header to be used if prefixing enabled.

string

X-Forwarded-Prefix

Determines whether the entire permission set is enabled, or not. By default, if the permission set is defined, it is enabled.

boolean

The HTTP policy that this permission set is linked to. There are 3 built in policies: permit, deny and authenticated. Role based policies can be defined, and extensions can add their own policies.

string

required

The methods that this permission set applies to. If this is not set then they apply to all methods. Note that if a request matches any path from any permission set, but does not match the constraint due to the method not being listed then the request will be denied. Method specific permissions take precedence over matches that do not have any methods set. This means that for example if Quarkus is configured to allow GET and POST requests to /admin to and no other permissions are configured PUT requests to /admin will be denied.

list of string

The paths that this permission check applies to. If the path ends in /* then this is treated as a path prefix, otherwise it is treated as an exact match. Matches are done on a length basis, so the most specific path match takes precedence. If multiple permission sets match the same path then explicit methods matches take precedence over over matches without methods set, otherwise the most restrictive permissions are applied.

list of string

Path specific authentication mechanism which must be used to authenticate a user. It needs to match HttpCredentialTransport authentication scheme such as 'basic', 'bearer', 'form', etc.

string

The roles that are allowed to access resources protected by this policy

list of string

required

If the cookie pattern is case sensitive

boolean

false

The value to set in the samesite attribute

none, strict, lax

required

Some User Agents break when sent SameSite=None, this will detect them and avoid sending the value

boolean

true

If this is true then the 'secure' attribute will automatically be sent on cookies with a SameSite attribute of None.

boolean

true

Eclipse Vert.x GraphQL

Type

Default

If GraphQL UI should be included every time. By default this is only included when the application is running in dev mode.

boolean

false

The path where GraphQL UI is available. The value / is not allowed as it blocks the application from serving anything else.

string

graphql-ui

Elasticsearch REST client

Type

Default

Whether or not an health check is published in case the smallrye-health extension is present.

boolean

true

The list of hosts of the Elasticsearch servers.

list of host:port

localhost:9200

The protocol to use when contacting Elasticsearch servers. Set to "https" to enable SSL/TLS.

string

http

The username for basic HTTP authentication.

string

The password for basic HTTP authentication.

string

Duration

1S

Duration

30S

The maximum number of connections to all the Elasticsearch servers.

int

20

The maximum number of connections per Elasticsearch server.

int

10

The number of IO thread. By default, this is the number of locally detected processors. Thread counts higher than the number of processors should not be necessary because the I/O threads rely on non-blocking operations, but you may want to use a thread count lower than the number of processors.

int

Defines if automatic discovery is enabled.

boolean

false

Refresh interval of the node list.

Duration

5M

Elytron Security JDBC

Type

Default

string

Quarkus

If the properties store is enabled.

boolean

false

The sql query to find the password

string

string

boolean

false

The index (1 based numbering) of the column containing the clear password

int

1

boolean

false

The index (1 based numbering) of the column containing the password hash

int

0

A string referencing the password hash encoding ("BASE64" or "HEX")

base64, hex

base64

The index (1 based numbering) of the column containing the Bcrypt salt

int

0

A string referencing the salt encoding ("BASE64" or "HEX")

base64, hex

base64

The index (1 based numbering) of the column containing the Bcrypt iteration count

int

0

int

0

string

required

string

string

int

0

string

required

boolean

false

The index (1 based numbering) of the column containing the clear password

int

1

boolean

false

The index (1 based numbering) of the column containing the password hash

int

0

A string referencing the password hash encoding ("BASE64" or "HEX")

base64, hex

base64

The index (1 based numbering) of the column containing the Bcrypt salt

int

0

base64, hex

base64

The index (1 based numbering) of the column containing the Bcrypt iteration count

int

0

Elytron Security LDAP Realm

Type

Default

The option to enable the ldap elytron module

boolean

false

The elytron realm name

string

Quarkus

Provided credentials are verified against ldap?

boolean

true

The url of the ldap server

string

required

The principal: user which is used to connect to ldap server (also named "bindDn")

string

The password which belongs to the principal (also named "bindCredential")

string

how ldap redirects are handled

ignore, follow, throw

ignore

The identifier which correlates to the provided user (also named "baseFilter")

string

uid

string

required

If the child nodes are also searched for identities

boolean

false

string

required

The identifier whom the attribute is mapped to (in Quarkus: "groups", in WildFly this is "Roles")

string

groups

string

required

string

required

Elytron Security OAuth 2.0

Type

Default

Determine if the OAuth2 extension is enabled. Enabled by default if you include the elytron-security-oauth2 dependency, so this would be used to disable it.

boolean

true

The claim that is used in the introspection endpoint response to load the roles.

string

scope

The OAuth2 client id used to validate the token. Mandatory if the extension is enabled.

string

The OAuth2 client secret used to validate the token. Mandatory if the extension is enabled.

string

The OAuth2 introspection endpoint URL used to validate the token and gather the authentication claims. Mandatory if the extension is enabled.

string

The OAuth2 server certificate file. Warning: this is not supported in native mode where the certificate must be included in the truststore used during the native image generation, see Using SSL With Native Executables.

string

Elytron Security Properties File

Type

Default

If the properties are stored in plain text. If this is false (the default) then it is expected that the passwords are of the form HEX( MD5( username ":" realm ":" password ) )

boolean

false

Determine which algorithm to use. This property is ignored if plainText is true.

digest-md5, digest-sha, digest-sha-256, digest-sha-384, digest-sha-512, digest-sha-512-256

digest-md5

The realm users user1=password\nuser2=password2…​ mapping. See Embedded Users.

Map<String,String>

none

The realm roles user1=role1,role2,…​\nuser2=role1,role2,…​ mapping See Embedded Roles.

Map<String,String>

none

Property Files Realm Configuration

Type

Default

The realm name. This is used when generating a hashed password

string

Quarkus

Determine whether security via the file realm is enabled.

boolean

false

If the properties are stored in plain text. If this is false (the default) then it is expected that the passwords are of the form HEX( MD5( username ":" realm ":" password ) )

boolean

false

Classpath resource name of properties file containing user to password mappings. See Users.properties.

string

users.properties

Classpath resource name of properties file containing user to role mappings. See Roles.properties.

string

roles.properties

Embedded Realm Configuration

Type

Default

The realm name. This is used when generating a hashed password

string

Quarkus

Determine whether security via the embedded realm is enabled.

boolean

false

Flyway

Type

Default

Comma-separated list of locations to scan recursively for migrations. The location type is determined by its prefix. Unprefixed locations or locations starting with classpath: point to a package on the classpath and may contain both SQL and Java-based migrations. Locations starting with filesystem: point to a directory on the filesystem, may only contain SQL migrations and are only scanned recursively down non-hidden directories.

list of string

db/migration

Comma-separated list of fully qualified class names of Callback implementations to use to hook into the Flyway lifecycle. The org.flywaydb.core.api.callback.Callback sub-class must have a no-args constructor and must not be abstract. These classes must also not have any fields that hold state (unless that state is initialized in the constructor).

list of string

The maximum number of retries when attempting to connect to the database. After each failed attempt, Flyway will wait 1 second before attempting to connect again, up to the maximum number of times specified by connectRetries.

int

Comma-separated case-sensitive list of schemas managed by Flyway. The first schema in the list will be automatically set as the default one during the migration. It will also be the one containing the schema history table.

list of string

The name of Flyway’s schema history table. By default (single-schema mode) the schema history table is placed in the default schema for the connection provided by the datasource. When the flyway.schemas property is set (multi-schema mode), the schema history table is placed in the first schema of the list.

string

The file name prefix for versioned SQL migrations. Versioned SQL migrations have the following file name structure: prefixVERSIONseparatorDESCRIPTIONsuffix , which using the defaults translates to V1.1__My_description.sql

string

The file name prefix for repeatable SQL migrations. Repeatable SQL migrations have the following file name structure: prefixSeparatorDESCRIPTIONsuffix , which using the defaults translates to R__My_description.sql

string

true to execute Flyway clean command automatically when the application starts, false otherwise.

boolean

false

true to prevent Flyway clean operations, false otherwise.

boolean

false

true to execute Flyway automatically when the application starts, false otherwise.

boolean

false

Enable the creation of the history table if it does not exist already.

boolean

false

The initial baseline version.

string

The description to tag an existing schema with when executing baseline.

string

Whether to automatically call validate when performing a migration.

boolean

false

Allows migrations to be run "out of order".

boolean

false

Ignore missing migrations when reading the history table. When set to true migrations from older versions present in the history table but absent in the configured locations will be ignored (and logged as a warning), when false (the default) the validation step will fail.

boolean

false

Ignore future migrations when reading the history table. When set to true migrations from newer versions present in the history table but absent in the configured locations will be ignored (and logged as a warning), when false (the default) the validation step will fail.

boolean

false

Whether Flyway should attempt to create the schemas specified in the schemas property

boolean

true

Prefix of every placeholder (default: ${ )

string

Suffix of every placeholder (default: } )

string

The SQL statements to run to initialize a new database connection immediately after opening it.

string

Comma-separated list of locations to scan recursively for migrations. The location type is determined by its prefix. Unprefixed locations or locations starting with classpath: point to a package on the classpath and may contain both SQL and Java-based migrations. Locations starting with filesystem: point to a directory on the filesystem, may only contain SQL migrations and are only scanned recursively down non-hidden directories.

list of string

db/migration

Comma-separated list of fully qualified class names of Callback implementations to use to hook into the Flyway lifecycle. The org.flywaydb.core.api.callback.Callback sub-class must have a no-args constructor and must not be abstract. These classes must also not have any fields that hold state (unless that state is initialized in the constructor).

list of string

Sets the placeholders to replace in SQL migration scripts.

Map<String,String>

The maximum number of retries when attempting to connect to the database. After each failed attempt, Flyway will wait 1 second before attempting to connect again, up to the maximum number of times specified by connectRetries.

int

Comma-separated case-sensitive list of schemas managed by Flyway. The first schema in the list will be automatically set as the default one during the migration. It will also be the one containing the schema history table.

list of string

The name of Flyway’s schema history table. By default (single-schema mode) the schema history table is placed in the default schema for the connection provided by the datasource. When the flyway.schemas property is set (multi-schema mode), the schema history table is placed in the first schema of the list.

string

The file name prefix for versioned SQL migrations. Versioned SQL migrations have the following file name structure: prefixVERSIONseparatorDESCRIPTIONsuffix , which using the defaults translates to V1.1__My_description.sql

string

The file name prefix for repeatable SQL migrations. Repeatable SQL migrations have the following file name structure: prefixSeparatorDESCRIPTIONsuffix , which using the defaults translates to R__My_description.sql

string

true to execute Flyway clean command automatically when the application starts, false otherwise.

boolean

false

true to prevent Flyway clean operations, false otherwise.

boolean

false

true to execute Flyway automatically when the application starts, false otherwise.

boolean

false

Enable the creation of the history table if it does not exist already.

boolean

false

string

The description to tag an existing schema with when executing baseline.

string

Whether to automatically call validate when performing a migration.

boolean

false

Allows migrations to be run "out of order".

boolean

false

Ignore missing migrations when reading the history table. When set to true migrations from older versions present in the history table but absent in the configured locations will be ignored (and logged as a warning), when false (the default) the validation step will fail.

boolean

false

Ignore future migrations when reading the history table. When set to true migrations from newer versions present in the history table but absent in the configured locations will be ignored (and logged as a warning), when false (the default) the validation step will fail.

boolean

false

Sets the placeholders to replace in SQL migration scripts.

Map<String,String>

Whether Flyway should attempt to create the schemas specified in the schemas property

boolean

true

Prefix of every placeholder (default: ${ )

string

Suffix of every placeholder (default: } )

string

The SQL statements to run to initialize a new database connection immediately after opening it.

string

Funqy Knative Events Binding

Type

Default

Cloud Event type (ce-type) that triggers this function. Default value is function name. This config item is only required when there is more than one function defined within the deployment. The ce-type is not looked at if there is only one function in the deployment. The message will just be dispatched to that function. This allows you to change the knative trigger binding without having to change the configuration of the quarkus deployment.

string

If function has response output, then what is the Cloud Event type (ce-type)? This will default to {function}.output

string

If function has response output, then what is the Cloud Event source (ce-source)? This will default to the function name

string

Funqy Server Common

Type

Default

The function to export. If there is more than one function defined for this deployment, then you must set this variable. If there is only a single function, you do not have to set this config item.

string

Google Cloud Functions

Type

Default

The function name. Function names are specified on function classes using the @javax.inject.Named annotation. If this name is unspecified and there is exactly one unnamed function then this unnamed function will be used. If there is only a single named function and the name is unspecified then the named function will be used. These rules apply for each function implementation (HttpFunction, BackgroundFunction, RawBackgroundFunction).

string

Hibernate Envers

Type

Default

Enable store_data_at_delete feature.

boolean

false

Defines a suffix for historical data table.

string

_AUD

Hibernate ORM

Type

Default

string

list of string

Name of the file containing the SQL statements to execute when Hibernate ORM starts. Its default value differs depending on the Quarkus launch mode:

  • In dev and test modes, it defaults to import.sql. Simply add an import.sql file in the root of your resources directory and it will be picked up without having to set this property. Pass no-file to force Hibernate ORM to ignore the SQL import file.

  • In production mode, it defaults to no-file. It means Hibernate ORM won’t try to execute any SQL import file by default. Pass an explicit value to force Hibernate ORM to execute the SQL import file.

If you need different SQL statements between dev mode, test (@QuarkusTest) and in production, use Quarkus configuration profiles facility.

application.properties
%dev.quarkus.hibernate-orm.sql-load-script = import-dev.sql
%test.quarkus.hibernate-orm.sql-load-script = import-test.sql
%prod.quarkus.hibernate-orm.sql-load-script = no-file

Quarkus supports .sql file with SQL statements or comments spread over multiple lines. Each SQL statement must be terminated by a semicolon.

list of string

import.sql in DEV, TEST ; no-file otherwise

Pluggable strategy contract for applying physical naming rules for database object names. Class name of the Hibernate PhysicalNamingStrategy implementation

string

Pluggable strategy for applying implicit naming rules when an explicit name is not given. Class name of the Hibernate ImplicitNamingStrategy implementation

string

Class name of a custom org.hibernate.boot.spi.MetadataBuilderContributor implementation.

Not all customization options exposed by org.hibernate.boot.MetadataBuilder will work correctly. Stay clear of options related to classpath scanning in particular.

This setting is exposed mainly to allow registration of types, converters and SQL functions.

string

XML files to configure the entity mapping, e.g. META-INF/my-orm.xml. Defaults to META-INF/orm.xml if it exists. Pass no-file to force Hibernate ORM to ignore META-INF/orm.xml.

list of string

META-INF/orm.xml if it exists; no-file otherwise

The default in Quarkus is for 2nd level caching to be enabled, and a good implementation is already integrated for you. Just cherry-pick which entities should be using the cache. Set this to false to disable all 2nd level caches.

boolean

true

Defines the method for multi-tenancy (DATABASE, NONE, SCHEMA). The complete list of allowed values is available in the Hibernate ORM JavaDoc. The type DISCRIMINATOR is currently not supported. The default value is NONE (no multi-tenancy).

string

Defines the name of the datasource to use in case of SCHEMA approach. The datasource of the persistence unit will be used if not set.

string

Whether statistics collection is enabled. If 'metrics.enabled' is true, then the default here is considered true, otherwise the default is false.

boolean

Whether or not metrics are published if a metrics extension is enabled.

boolean

false

Dialect related configuration

Type

Default

Class name of the Hibernate ORM dialect. The complete list of bundled dialects is available in the Hibernate ORM JavaDoc.

Not all the dialects are supported in GraalVM native executables: we currently provide driver extensions for PostgreSQL, MariaDB, Microsoft SQL Server and H2.

string

The storage engine to use when the dialect supports multiple storage engines.

E.g. MyISAM or InnoDB for MySQL.

string

Query related configuration

Type

Default

The maximum size of the query plan cache. see #QueryPlanCache#DEFAULT_QUERY_PLAN_MAX_COUNT

int

2048

Default precedence of null values in ORDER BY clauses.

Valid values are: none, first, last.

none, first, last

none

Database related configuration

Type

Default

The default catalog to use for the database objects.

string

The default schema to use for the database objects.

string

The charset of the database. Used for DDL generation and also for the SQL import scripts.

Charset

UTF-8

Whether Hibernate should quote all identifiers.

boolean

false

Select whether the database schema is generated or not. drop-and-create is awesome in development mode. This defaults to 'none', however if Dev Services is in use and no other extensions that manage the schema are present this will default to 'drop-and-create'. Accepted values: none, create, drop-and-create, drop, update, validate.

string

none

If Hibernate ORM should create the schemas automatically (for databases supporting them).

boolean

false

Whether we should stop on the first error when applying the schema.

boolean

false

JDBC related configuration

Type

Default

The time zone pushed to the JDBC driver.

string

How many rows are fetched at a time by the JDBC driver.

int

The number of updates (inserts, updates and deletes) that are sent by the JDBC driver at one time for execution.

int

Fetching logic configuration

Type

Default

The size of the batches used when loading entities and collections.

-1 means batch loading is disabled.

int

16

The maximum depth of outer join fetch tree for single-ended associations (one-to-one, many-to-one).

A 0 disables default outer join fetching.

int

Caching configuration

Type

Default

The maximum time before an object of the cache is considered expired.

Duration

The maximum number of objects kept in memory in the cache.

long

Discriminator related configuration

Type

Default

Existing applications rely (implicitly or explicitly) on Hibernate ignoring any DiscriminatorColumn declarations on joined inheritance hierarchies. This setting allows these applications to maintain the legacy behavior of DiscriminatorColumn annotations being ignored when paired with joined inheritance.

boolean

false

Additional named persistence units

Type

Default

string

list of string

Name of the file containing the SQL statements to execute when Hibernate ORM starts. Its default value differs depending on the Quarkus launch mode:

  • In dev and test modes, it defaults to import.sql. Simply add an import.sql file in the root of your resources directory and it will be picked up without having to set this property. Pass no-file to force Hibernate ORM to ignore the SQL import file.

  • In production mode, it defaults to no-file. It means Hibernate ORM won’t try to execute any SQL import file by default. Pass an explicit value to force Hibernate ORM to execute the SQL import file.

If you need different SQL statements between dev mode, test (@QuarkusTest) and in production, use Quarkus configuration profiles facility.

application.properties
%dev.quarkus.hibernate-orm.sql-load-script = import-dev.sql
%test.quarkus.hibernate-orm.sql-load-script = import-test.sql
%prod.quarkus.hibernate-orm.sql-load-script = no-file

Quarkus supports .sql file with SQL statements or comments spread over multiple lines. Each SQL statement must be terminated by a semicolon.

list of string

import.sql in DEV, TEST ; no-file otherwise

Pluggable strategy contract for applying physical naming rules for database object names. Class name of the Hibernate PhysicalNamingStrategy implementation

string

Pluggable strategy for applying implicit naming rules when an explicit name is not given. Class name of the Hibernate ImplicitNamingStrategy implementation

string

Class name of a custom org.hibernate.boot.spi.MetadataBuilderContributor implementation.

Not all customization options exposed by org.hibernate.boot.MetadataBuilder will work correctly. Stay clear of options related to classpath scanning in particular.

This setting is exposed mainly to allow registration of types, converters and SQL functions.

string

XML files to configure the entity mapping, e.g. META-INF/my-orm.xml. Defaults to META-INF/orm.xml if it exists. Pass no-file to force Hibernate ORM to ignore META-INF/orm.xml.

list of string

META-INF/orm.xml if it exists; no-file otherwise

The default in Quarkus is for 2nd level caching to be enabled, and a good implementation is already integrated for you. Just cherry-pick which entities should be using the cache. Set this to false to disable all 2nd level caches.

boolean

true

Defines the method for multi-tenancy (DATABASE, NONE, SCHEMA). The complete list of allowed values is available in the Hibernate ORM JavaDoc. The type DISCRIMINATOR is currently not supported. The default value is NONE (no multi-tenancy).

string

Defines the name of the datasource to use in case of SCHEMA approach. The datasource of the persistence unit will be used if not set.

string

Dialect related configuration

Type

Default

Class name of the Hibernate ORM dialect. The complete list of bundled dialects is available in the Hibernate ORM JavaDoc.

Not all the dialects are supported in GraalVM native executables: we currently provide driver extensions for PostgreSQL, MariaDB, Microsoft SQL Server and H2.

string

The storage engine to use when the dialect supports multiple storage engines.

E.g. MyISAM or InnoDB for MySQL.

string

Query related configuration

Type

Default

The maximum size of the query plan cache. see #QueryPlanCache#DEFAULT_QUERY_PLAN_MAX_COUNT

int

2048

Default precedence of null values in ORDER BY clauses.

Valid values are: none, first, last.

none, first, last

none

Database related configuration

Type

Default

The default catalog to use for the database objects.

string

The default schema to use for the database objects.

string

The charset of the database. Used for DDL generation and also for the SQL import scripts.

Charset

UTF-8

boolean

false

Select whether the database schema is generated or not. drop-and-create is awesome in development mode. This defaults to 'none', however if Dev Services is in use and no other extensions that manage the schema are present this will default to 'drop-and-create'. Accepted values: none, create, drop-and-create, drop, update, validate.

string

none

If Hibernate ORM should create the schemas automatically (for databases supporting them).

boolean

false

Whether we should stop on the first error when applying the schema.

boolean

false

JDBC related configuration

Type

Default

The time zone pushed to the JDBC driver.

string

How many rows are fetched at a time by the JDBC driver.

int

The number of updates (inserts, updates and deletes) that are sent by the JDBC driver at one time for execution.

int

Fetching logic configuration

Type

Default

The size of the batches used when loading entities and collections.

-1 means batch loading is disabled.

int

16

The maximum depth of outer join fetch tree for single-ended associations (one-to-one, many-to-one).

A 0 disables default outer join fetching.

int

Caching configuration

Type

Default

The maximum time before an object of the cache is considered expired.

Duration

The maximum number of objects kept in memory in the cache.

long

Discriminator related configuration

Type

Default

Existing applications rely (implicitly or explicitly) on Hibernate ignoring any DiscriminatorColumn declarations on joined inheritance hierarchies. This setting allows these applications to maintain the legacy behavior of DiscriminatorColumn annotations being ignored when paired with joined inheritance.

boolean

false

Database scripts related configuration

Type

Default

Select whether the database schema DDL files are generated or not. Accepted values: none, create, drop-and-create, drop, update, validate.

string

none

Filename or URL where the database create DDL file should be generated.

string

Filename or URL where the database drop DDL file should be generated.

string

Logging configuration

Type

Default

Show SQL logs and format them nicely. Setting it to true is obviously not recommended in production.

boolean

false

Format the SQL logs if SQL log is enabled

boolean

true

Whether JDBC warnings should be collected and logged.

boolean

depends on dialect

If set, Hibernate will log queries that took more than specified number of milliseconds to execute.

long

Logging configuration

Type

Default

Logs SQL bind parameters. Setting it to true is obviously not recommended in production.

boolean

false

Show SQL logs and format them nicely. Setting it to true is obviously not recommended in production.

boolean

false

Format the SQL logs if SQL log is enabled

boolean

true

Whether JDBC warnings should be collected and logged.

boolean

depends on dialect

If set, Hibernate will log queries that took more than specified number of milliseconds to execute.

long

Database scripts related configuration

Type

Default

Select whether the database schema DDL files are generated or not. Accepted values: none, create, drop-and-create, drop, update, validate.

string

none

Filename or URL where the database create DDL file should be generated.

string

Filename or URL where the database drop DDL file should be generated.

string

Hibernate Search + Elasticsearch

Type

Default

A bean reference to a component that should be notified of any failure occurring in a background process (mainly index operations).

The referenced bean must implement FailureHandler.

string

The schema management strategy, controlling how indexes and their schema are created, updated, validated or dropped on startup and shutdown.

Available values:

Strategy

Definition

none

Do nothing: assume that indexes already exist and that their schema matches Hibernate Search’s expectations.

validate

Validate that indexes exist and that their schema matches Hibernate Search’s expectations.

If it does not, throw an exception, but make no attempt to fix the problem.

create

For indexes that do not exist, create them along with their schema.

For indexes that already exist, do nothing: assume that their schema matches Hibernate Search’s expectations.

create-or-validate (default)

For indexes that do not exist, create them along with their schema.

For indexes that already exist, validate that their schema matches Hibernate Search’s expectations.

If it does not, throw an exception, but make no attempt to fix the problem.

create-or-update

For indexes that do not exist, create them along with their schema.

For indexes that already exist, validate that their schema matches Hibernate Search’s expectations; if it does not match expectations, try to update it.

This strategy is unfit for production environments, due to several important limitations, but can be useful when developing.

drop-and-create

For indexes that do not exist, create them along with their schema.

For indexes that already exist, drop them, then create them along with their schema.

drop-and-create-and-drop

For indexes that do not exist, create them along with their schema.

For indexes that already exist, drop them, then create them along with their schema.

Also, drop indexes and their schema on shutdown.

none, validate, create, create-or-validate, create-or-update, drop-and-create, drop-and-create-and-drop

create-or-validate

The strategy to use when loading entities during the execution of a search query.

skip, persistence-context, persistence-context-then-second-level-cache

skip

The fetch size to use when loading entities during the execution of a search query.

int

100

The synchronization strategy to use when indexing automatically.

Defines how complete indexing should be before resuming the application thread after a database transaction is committed.

Available values:

Strategy

Throughput

Guarantees when the application thread resumes

Changes applied

Changes safe from crash/power loss

Changes visible on search

async

Best

write-sync (default)

Medium

read-sync

Medium to worst

sync

Worst

This property also accepts a bean reference to a custom implementations of AutomaticIndexingSynchronizationStrategy.

string

write-sync

Whether to check if dirty properties are relevant to indexing before actually reindexing an entity. When enabled, re-indexing of an entity is skipped if the only changes are on properties that are not used when indexing.

boolean

true

Default backend

Type

Default

The version of Elasticsearch used in the cluster. As the schema is generated without a connection to the server, this item is mandatory. It doesn’t have to be the exact version (it can be 7 or 7.1 for instance) but it has to be sufficiently precise to choose a model dialect (the one used to generate the schema) compatible with the protocol dialect (the one used to communicate with Elasticsearch). There’s no rule of thumb here as it depends on the schema incompatibilities introduced by Elasticsearch versions. In any case, if there is a problem, you will have an error when Hibernate Search tries to connect to the cluster.

ElasticsearchVersion

A bean reference to the component used to configure layout (e.g. index names, index aliases).

The referenced bean must implement IndexLayoutStrategy.

Available built-in implementations:

simple

The default, future-proof strategy: if the index name in Hibernate Search is myIndex, this strategy will create an index named myindex-000001, an alias for write operations named myindex-write, and an alias for read operations named myindex-read.

no-alias

A strategy without index aliases, mostly useful on legacy clusters: if the index name in Hibernate Search is myIndex, this strategy will create an index named myindex, and will not use any alias.

string

A bean reference to the component used to configure full text analysis (e.g. analyzers, normalizers).

The referenced bean must implement ElasticsearchAnalysisConfigurer.

See [analysis-configurer] for more information.

string

The list of hosts of the Elasticsearch servers.

list of string

localhost:9200

The protocol to use when contacting Elasticsearch servers. Set to "https" to enable SSL/TLS.

http, https

http

The username used for authentication.

string

The password used for authentication.

string

The timeout when establishing a connection to an Elasticsearch server.

Duration

1S

The timeout when reading responses from an Elasticsearch server.

Duration

30S

The timeout when executing a request to an Elasticsearch server. This includes the time needed to wait for a connection to be available, send the request and read the response.

Duration

The maximum number of connections to all the Elasticsearch servers.

int

20

The maximum number of connections per Elasticsearch server.

int

10

Defines if automatic discovery is enabled.

boolean

false

Duration

10S

The size of the thread pool assigned to the backend. Note that number is per backend, not per index. Adding more indexes will not add more threads. As all operations happening in this thread-pool are non-blocking, raising its size above the number of processor cores available to the JVM will not bring noticeable performance benefit. The only reason to alter this setting would be to reduce the number of threads; for example, in an application with a single index with a single indexing queue, running on a machine with 64 processor cores, you might want to bring down the number of threads. Defaults to the number of processor cores available to the JVM on startup.

int

Whether Hibernate Search should check the version of the Elasticsearch cluster on startup. Set to false if the Elasticsearch cluster may not be available on startup.

boolean

true

green, yellow, red

yellow

How long we should wait for the status before failing the bootstrap.

Duration

10S

The number of indexing queues assigned to each index. Higher values will lead to more connections being used in parallel, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures.

int

10

The size of indexing queues. Lower values may lead to lower memory usage, especially if there are many queues, but values that are too low will reduce the likeliness of reaching the max bulk size and increase the likeliness of application threads blocking because the queue is full, which may lead to lower indexing throughput.

int

1000

The maximum size of bulk requests created when processing indexing queues. Higher values will lead to more documents being sent in each HTTP request sent to Elasticsearch, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures. Note that raising this number above the queue size has no effect, as bulks cannot include more requests than are contained in the queue.

int

100

A bean reference to the component used to configure full text analysis (e.g. analyzers, normalizers).

The referenced bean must implement ElasticsearchAnalysisConfigurer.

See [analysis-configurer] for more information.

string

green, yellow, red

yellow

Duration

10S

The number of indexing queues assigned to each index. Higher values will lead to more connections being used in parallel, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures.

int

10

The size of indexing queues. Lower values may lead to lower memory usage, especially if there are many queues, but values that are too low will reduce the likeliness of reaching the max bulk size and increase the likeliness of application threads blocking because the queue is full, which may lead to lower indexing throughput.

int

1000

The maximum size of bulk requests created when processing indexing queues. Higher values will lead to more documents being sent in each HTTP request sent to Elasticsearch, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures. Note that raising this number above the queue size has no effect, as bulks cannot include more requests than are contained in the queue.

int

100

Named backends

Type

Default

The version of Elasticsearch used in the cluster. As the schema is generated without a connection to the server, this item is mandatory. It doesn’t have to be the exact version (it can be 7 or 7.1 for instance) but it has to be sufficiently precise to choose a model dialect (the one used to generate the schema) compatible with the protocol dialect (the one used to communicate with Elasticsearch). There’s no rule of thumb here as it depends on the schema incompatibilities introduced by Elasticsearch versions. In any case, if there is a problem, you will have an error when Hibernate Search tries to connect to the cluster.

ElasticsearchVersion

A bean reference to the component used to configure layout (e.g. index names, index aliases).

The referenced bean must implement IndexLayoutStrategy.

Available built-in implementations:

simple

The default, future-proof strategy: if the index name in Hibernate Search is myIndex, this strategy will create an index named myindex-000001, an alias for write operations named myindex-write, and an alias for read operations named myindex-read.

no-alias

A strategy without index aliases, mostly useful on legacy clusters: if the index name in Hibernate Search is myIndex, this strategy will create an index named myindex, and will not use any alias.

string

A bean reference to the component used to configure full text analysis (e.g. analyzers, normalizers).

The referenced bean must implement ElasticsearchAnalysisConfigurer.

See [analysis-configurer] for more information.

string

A bean reference to the component used to configure full text analysis (e.g. analyzers, normalizers).

The referenced bean must implement ElasticsearchAnalysisConfigurer.

See [analysis-configurer] for more information.

string

The list of hosts of the Elasticsearch servers.

list of string

localhost:9200

The protocol to use when contacting Elasticsearch servers. Set to "https" to enable SSL/TLS.

http, https

http

string

string

The timeout when establishing a connection to an Elasticsearch server.

Duration

1S

The timeout when reading responses from an Elasticsearch server.

Duration

30S

The timeout when executing a request to an Elasticsearch server. This includes the time needed to wait for a connection to be available, send the request and read the response.

Duration

The maximum number of connections to all the Elasticsearch servers.

int

20

The maximum number of connections per Elasticsearch server.

int

10

boolean

false

Duration

10S

The size of the thread pool assigned to the backend. Note that number is per backend, not per index. Adding more indexes will not add more threads. As all operations happening in this thread-pool are non-blocking, raising its size above the number of processor cores available to the JVM will not bring noticeable performance benefit. The only reason to alter this setting would be to reduce the number of threads; for example, in an application with a single index with a single indexing queue, running on a machine with 64 processor cores, you might want to bring down the number of threads. Defaults to the number of processor cores available to the JVM on startup.

int

Whether Hibernate Search should check the version of the Elasticsearch cluster on startup. Set to false if the Elasticsearch cluster may not be available on startup.

boolean

true

green, yellow, red

yellow

Duration

10S

The number of indexing queues assigned to each index. Higher values will lead to more connections being used in parallel, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures.

int

10

The size of indexing queues. Lower values may lead to lower memory usage, especially if there are many queues, but values that are too low will reduce the likeliness of reaching the max bulk size and increase the likeliness of application threads blocking because the queue is full, which may lead to lower indexing throughput.

int

1000

The maximum size of bulk requests created when processing indexing queues. Higher values will lead to more documents being sent in each HTTP request sent to Elasticsearch, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures. Note that raising this number above the queue size has no effect, as bulks cannot include more requests than are contained in the queue.

int

100

green, yellow, red

yellow

Duration

10S

The number of indexing queues assigned to each index. Higher values will lead to more connections being used in parallel, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures.

int

10

The size of indexing queues. Lower values may lead to lower memory usage, especially if there are many queues, but values that are too low will reduce the likeliness of reaching the max bulk size and increase the likeliness of application threads blocking because the queue is full, which may lead to lower indexing throughput.

int

1000

The maximum size of bulk requests created when processing indexing queues. Higher values will lead to more documents being sent in each HTTP request sent to Elasticsearch, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures. Note that raising this number above the queue size has no effect, as bulks cannot include more requests than are contained in the queue.

int

100

Configuration for additional named persistence units

Type

Default

A bean reference to a component that should be notified of any failure occurring in a background process (mainly index operations).

The referenced bean must implement FailureHandler.

string

The schema management strategy, controlling how indexes and their schema are created, updated, validated or dropped on startup and shutdown.

Available values:

Strategy

Definition

none

Do nothing: assume that indexes already exist and that their schema matches Hibernate Search’s expectations.

validate

Validate that indexes exist and that their schema matches Hibernate Search’s expectations.

If it does not, throw an exception, but make no attempt to fix the problem.

create

For indexes that do not exist, create them along with their schema.

For indexes that already exist, do nothing: assume that their schema matches Hibernate Search’s expectations.

create-or-validate (default)

For indexes that do not exist, create them along with their schema.

For indexes that already exist, validate that their schema matches Hibernate Search’s expectations.

If it does not, throw an exception, but make no attempt to fix the problem.

create-or-update

For indexes that do not exist, create them along with their schema.

For indexes that already exist, validate that their schema matches Hibernate Search’s expectations; if it does not match expectations, try to update it.

This strategy is unfit for production environments, due to several important limitations, but can be useful when developing.

drop-and-create

For indexes that do not exist, create them along with their schema.

For indexes that already exist, drop them, then create them along with their schema.

drop-and-create-and-drop

For indexes that do not exist, create them along with their schema.

For indexes that already exist, drop them, then create them along with their schema.

Also, drop indexes and their schema on shutdown.

none, validate, create, create-or-validate, create-or-update, drop-and-create, drop-and-create-and-drop

create-or-validate

The strategy to use when loading entities during the execution of a search query.

skip, persistence-context, persistence-context-then-second-level-cache

skip

The fetch size to use when loading entities during the execution of a search query.

int

100

The synchronization strategy to use when indexing automatically.

Defines how complete indexing should be before resuming the application thread after a database transaction is committed.

Available values:

Strategy

Throughput

Guarantees when the application thread resumes

Changes applied

Changes safe from crash/power loss

Changes visible on search

async

Best

write-sync (default)

Medium

read-sync

Medium to worst

sync

Worst

This property also accepts a bean reference to a custom implementations of AutomaticIndexingSynchronizationStrategy.

string

write-sync

Whether to check if dirty properties are relevant to indexing before actually reindexing an entity. When enabled, re-indexing of an entity is skipped if the only changes are on properties that are not used when indexing.

boolean

true

Default backend

Type

Default

The version of Elasticsearch used in the cluster. As the schema is generated without a connection to the server, this item is mandatory. It doesn’t have to be the exact version (it can be 7 or 7.1 for instance) but it has to be sufficiently precise to choose a model dialect (the one used to generate the schema) compatible with the protocol dialect (the one used to communicate with Elasticsearch). There’s no rule of thumb here as it depends on the schema incompatibilities introduced by Elasticsearch versions. In any case, if there is a problem, you will have an error when Hibernate Search tries to connect to the cluster.

ElasticsearchVersion

A bean reference to the component used to configure layout (e.g. index names, index aliases).

The referenced bean must implement IndexLayoutStrategy.

Available built-in implementations:

simple

The default, future-proof strategy: if the index name in Hibernate Search is myIndex, this strategy will create an index named myindex-000001, an alias for write operations named myindex-write, and an alias for read operations named myindex-read.

no-alias

A strategy without index aliases, mostly useful on legacy clusters: if the index name in Hibernate Search is myIndex, this strategy will create an index named myindex, and will not use any alias.

string

A bean reference to the component used to configure full text analysis (e.g. analyzers, normalizers).

The referenced bean must implement ElasticsearchAnalysisConfigurer.

See [analysis-configurer] for more information.

string

A bean reference to the component used to configure full text analysis (e.g. analyzers, normalizers).

The referenced bean must implement ElasticsearchAnalysisConfigurer.

See [analysis-configurer] for more information.

string

The list of hosts of the Elasticsearch servers.

list of string

localhost:9200

The protocol to use when contacting Elasticsearch servers. Set to "https" to enable SSL/TLS.

http, https

http

string

string

The timeout when establishing a connection to an Elasticsearch server.

Duration

1S

The timeout when reading responses from an Elasticsearch server.

Duration

30S

The timeout when executing a request to an Elasticsearch server. This includes the time needed to wait for a connection to be available, send the request and read the response.

Duration

The maximum number of connections to all the Elasticsearch servers.

int

20

The maximum number of connections per Elasticsearch server.

int

10

boolean

false

Duration

10S

The size of the thread pool assigned to the backend. Note that number is per backend, not per index. Adding more indexes will not add more threads. As all operations happening in this thread-pool are non-blocking, raising its size above the number of processor cores available to the JVM will not bring noticeable performance benefit. The only reason to alter this setting would be to reduce the number of threads; for example, in an application with a single index with a single indexing queue, running on a machine with 64 processor cores, you might want to bring down the number of threads. Defaults to the number of processor cores available to the JVM on startup.

int

Whether Hibernate Search should check the version of the Elasticsearch cluster on startup. Set to false if the Elasticsearch cluster may not be available on startup.

boolean

true

green, yellow, red

yellow

Duration

10S

The number of indexing queues assigned to each index. Higher values will lead to more connections being used in parallel, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures.

int

10

The size of indexing queues. Lower values may lead to lower memory usage, especially if there are many queues, but values that are too low will reduce the likeliness of reaching the max bulk size and increase the likeliness of application threads blocking because the queue is full, which may lead to lower indexing throughput.

int

1000

The maximum size of bulk requests created when processing indexing queues. Higher values will lead to more documents being sent in each HTTP request sent to Elasticsearch, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures. Note that raising this number above the queue size has no effect, as bulks cannot include more requests than are contained in the queue.

int

100

green, yellow, red

yellow

Duration

10S

The number of indexing queues assigned to each index. Higher values will lead to more connections being used in parallel, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures.

int

10

The size of indexing queues. Lower values may lead to lower memory usage, especially if there are many queues, but values that are too low will reduce the likeliness of reaching the max bulk size and increase the likeliness of application threads blocking because the queue is full, which may lead to lower indexing throughput.

int

1000

The maximum size of bulk requests created when processing indexing queues. Higher values will lead to more documents being sent in each HTTP request sent to Elasticsearch, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures. Note that raising this number above the queue size has no effect, as bulks cannot include more requests than are contained in the queue.

int

100

Named backends

Type

Default

The version of Elasticsearch used in the cluster. As the schema is generated without a connection to the server, this item is mandatory. It doesn’t have to be the exact version (it can be 7 or 7.1 for instance) but it has to be sufficiently precise to choose a model dialect (the one used to generate the schema) compatible with the protocol dialect (the one used to communicate with Elasticsearch). There’s no rule of thumb here as it depends on the schema incompatibilities introduced by Elasticsearch versions. In any case, if there is a problem, you will have an error when Hibernate Search tries to connect to the cluster.

ElasticsearchVersion

A bean reference to the component used to configure layout (e.g. index names, index aliases).

The referenced bean must implement IndexLayoutStrategy.

Available built-in implementations:

simple

The default, future-proof strategy: if the index name in Hibernate Search is myIndex, this strategy will create an index named myindex-000001, an alias for write operations named myindex-write, and an alias for read operations named myindex-read.

no-alias

A strategy without index aliases, mostly useful on legacy clusters: if the index name in Hibernate Search is myIndex, this strategy will create an index named myindex, and will not use any alias.

string

A bean reference to the component used to configure full text analysis (e.g. analyzers, normalizers).

The referenced bean must implement ElasticsearchAnalysisConfigurer.

See [analysis-configurer] for more information.

string

A bean reference to the component used to configure full text analysis (e.g. analyzers, normalizers).

The referenced bean must implement ElasticsearchAnalysisConfigurer.

See [analysis-configurer] for more information.

string

list of string

localhost:9200

The protocol to use when contacting Elasticsearch servers. Set to "https" to enable SSL/TLS.

http, https

http

string

string

The timeout when establishing a connection to an Elasticsearch server.

Duration

1S

Duration

30S

The timeout when executing a request to an Elasticsearch server. This includes the time needed to wait for a connection to be available, send the request and read the response.

Duration

int

20

int

10

boolean

false

Duration

10S

The size of the thread pool assigned to the backend. Note that number is per backend, not per index. Adding more indexes will not add more threads. As all operations happening in this thread-pool are non-blocking, raising its size above the number of processor cores available to the JVM will not bring noticeable performance benefit. The only reason to alter this setting would be to reduce the number of threads; for example, in an application with a single index with a single indexing queue, running on a machine with 64 processor cores, you might want to bring down the number of threads. Defaults to the number of processor cores available to the JVM on startup.

int

Whether Hibernate Search should check the version of the Elasticsearch cluster on startup. Set to false if the Elasticsearch cluster may not be available on startup.

boolean

true

green, yellow, red

yellow

Duration

10S

The number of indexing queues assigned to each index. Higher values will lead to more connections being used in parallel, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures.

int

10

The size of indexing queues. Lower values may lead to lower memory usage, especially if there are many queues, but values that are too low will reduce the likeliness of reaching the max bulk size and increase the likeliness of application threads blocking because the queue is full, which may lead to lower indexing throughput.

int

1000

The maximum size of bulk requests created when processing indexing queues. Higher values will lead to more documents being sent in each HTTP request sent to Elasticsearch, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures. Note that raising this number above the queue size has no effect, as bulks cannot include more requests than are contained in the queue.

int

100

green, yellow, red

yellow

Duration

10S

The number of indexing queues assigned to each index. Higher values will lead to more connections being used in parallel, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures.

int

10

The size of indexing queues. Lower values may lead to lower memory usage, especially if there are many queues, but values that are too low will reduce the likeliness of reaching the max bulk size and increase the likeliness of application threads blocking because the queue is full, which may lead to lower indexing throughput.

int

1000

The maximum size of bulk requests created when processing indexing queues. Higher values will lead to more documents being sent in each HTTP request sent to Elasticsearch, which may lead to higher indexing throughput, but incurs a risk of overloading Elasticsearch, i.e. of overflowing its HTTP request buffers and tripping circuit breakers, leading to Elasticsearch giving up on some request and resulting in indexing failures. Note that raising this number above the queue size has no effect, as bulks cannot include more requests than are contained in the queue.

int

100

Hibernate Search + Elasticsearch - AWS authentication and request signing

Type

Default

Whether requests should be signed using the AWS credentials.

boolean

false

An Amazon Web Services region that hosts the Elasticsearch service.

Must be provided if signing is enabled; the region won’t be automatically detected.

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Whether requests should be signed using the AWS credentials.

boolean

false

An Amazon Web Services region that hosts the Elasticsearch service.

Must be provided if signing is enabled; the region won’t be automatically detected.

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Whether requests should be signed using the AWS credentials.

boolean

false

An Amazon Web Services region that hosts the Elasticsearch service.

Must be provided if signing is enabled; the region won’t be automatically detected.

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

boolean

false

An Amazon Web Services region that hosts the Elasticsearch service.

Must be provided if signing is enabled; the region won’t be automatically detected.

See software.amazon.awssdk.regions.Region for available regions.

Region

Configure the credentials provider that should be used to authenticate with AWS.

Available values:

  • default - the provider will attempt to identify the credentials automatically using the following checks:

    • Java System Properties - aws.accessKeyId and aws.secretAccessKey

    • Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

    • Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI

    • Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable is set and security manager has permission to access the variable.

    • Instance profile credentials delivered through the Amazon EC2 metadata service

  • static - the provider that uses the access key and secret access key specified in the static-provider section of the config.

  • system-property - it loads credentials from the aws.accessKeyId, aws.secretAccessKey and aws.sessionToken system properties.

  • env-variable - it loads credentials from the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

  • profile - credentials are based on AWS configuration profiles. This loads credentials from a profile file, allowing you to share multiple sets of AWS security credentials between different tools like the AWS SDK for Java and the AWS CLI.

  • container - It loads credentials from a local metadata service. Containers currently supported by the AWS SDK are Amazon Elastic Container Service (ECS) and AWS Greengrass

  • instance-profile - It loads credentials from the Amazon EC2 Instance Metadata Service.

  • process - Credentials are loaded from an external process. This is used to support the credential_process setting in the profile credentials file. See Sourcing Credentials From External Processes for more information.

  • anonymous - It always returns anonymous AWS credentials. Anonymous AWS credentials result in un-authenticated requests and will fail unless the resource or API’s policy has been configured to specifically allow anonymous access.

default, static, system-property, env-variable, profile, container, instance-profile, process, anonymous

default

Default credentials provider configuration

Type

Default

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Whether this provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block, but additional resources are used to maintain the provider.

boolean

false

Whether the provider should reuse the last successful credentials provider in the chain. Reusing the last successful credentials provider will typically return credentials faster than searching through the chain.

boolean

true

Static credentials provider configuration

Type

Default

string

string

string

string

string

string

string

string

AWS Profile credentials provider configuration

Type

Default

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

The name of the profile that should be used by this credentials provider. If not specified, the value in AWS_PROFILE environment variable or aws.profile system property is used and defaults to default name.

string

Process credentials provider configuration

Type

Default

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

The command that should be executed to retrieve credentials.

string

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

string

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

string

Whether the provider should fetch credentials asynchronously in the background. If this is true, threads are less likely to block when credentials are loaded, but additional resources are used to maintain the provider.

boolean

false

The amount of time between when the credentials expire and when the credentials should start to be refreshed. This allows the credentials to be refreshed *before* they are reported to expire.

Duration

15S

The maximum size of the output that can be returned by the external process before an exception is raised.

MemorySize

1024

string

Hibernate Validator

Type

Default

Enable the fail fast mode. When fail fast is enabled the validation will stop on the first constraint violation detected.

boolean

false

Method validation

Type

Default

Define whether overriding methods that override constraints should throw a ConstraintDefinitionException. The default value is false, i.e. do not allow. See Section 4.5.5 of the JSR 380 specification, specifically "In sub types (be it sub classes/interfaces or interface implementations), no parameter constraints may be declared on overridden or implemented methods, nor may parameters be marked for cascaded validation. This would pose a strengthening of preconditions to be fulfilled by the caller."

boolean

false

Define whether parallel methods that define constraints should throw a ConstraintDefinitionException. The default value is false, i.e. do not allow. See Section 4.5.5 of the JSR 380 specification, specifically "If a sub type overrides/implements a method originally defined in several parallel types of the hierarchy (e.g. two interfaces not extending each other, or a class and an interface not implemented by said class), no parameter constraints may be declared for that method at all nor parameters be marked for cascaded validation. This again is to avoid an unexpected strengthening of preconditions to be fulfilled by the caller."

boolean

false

Define whether more than one constraint on a return value may be marked for cascading validation are allowed. The default value is false, i.e. do not allow. See Section 4.5.5 of the JSR 380 specification, specifically "One must not mark a method return value for cascaded validation more than once in a line of a class hierarchy. In other words, overriding methods on sub types (be it sub classes/interfaces or interface implementations) cannot mark the return value for cascaded validation if the return value has already been marked on the overridden method of the super type or interface."

boolean

false

Infinispan Client

Type

Default

Sets the bounded entry count for near cache. If this value is 0 or less near cache is disabled.

int

0

Sets the host name/port to connect to. Each one is separated by a semicolon (eg. host1:11222;host2:11222).

string

Enables or disables Protobuf generated schemas upload to the server. Set it to 'false' when you need to handle the lifecycle of the Protobuf Schemas on Server side yourself. Default is 'true'.

boolean

true

Sets client intelligence used by authentication Available values: * BASIC - Means that the client doesn’t handle server topology changes and therefore will only used the list of servers supplied at configuration time. * TOPOLOGY_AWARE - Use this provider if you don’t want the client to present any certificates to the remote TLS host. * HASH_DISTRIBUTION_AWARE - Like TOPOLOGY_AWARE but with the additional advantage that each request involving keys will be routed to the server who is the primary owner which improves performance greatly. This is the default.

string

HASH_DISTRIBUTION_AWARE

Enables or disables authentication. Set it to false when connecting to a Infinispan Server without authentication. deployments. Default is 'true'.

boolean

true

Sets user name used by authentication.

string

Sets password used by authentication

string

Sets realm used by authentication

string

default

Sets server name used by authentication

string

infinispan

Sets client subject, necessary for those SASL mechanisms which require it to access client credentials.

string

Specifies a CallbackHandler to be used during the authentication handshake. The `Callback`s that need to be handled are specific to the chosen SASL mechanism.

string

Sets SASL mechanism used by authentication. Available values: * DIGEST-MD5 - Uses the MD5 hashing algorithm in addition to nonces to encrypt credentials. This is the default. * EXTERNAL - Uses client certificates to provide valid identities to Infinispan Server and enable encryption. * PLAIN - Sends credentials in plain text (unencrypted) over the wire in a way that is similar to HTTP BASIC authentication. You should use PLAIN authentication only in combination with TLS encryption.

string

DIGEST-MD5

Specifies the filename of a truststore to use to create the SSLContext. You also need to specify a trustStorePassword. Setting this property implicitly enables SSL/TLS.

string

Specifies the password needed to open the truststore You also need to specify a trustStore. Setting this property implicitly enables SSL/TLS.

string

Specifies the type of the truststore, such as JKS or JCEKS. Defaults to JKS if trustStore is enabled.

string

Jackson

Type

Default

If enabled, Jackson will fail when encountering unknown properties. You can still override it locally with @JsonIgnoreProperties(ignoreUnknown = false).

boolean

false

If enabled, Jackson will fail when no accessors are found for a type. This is enabled by default to match the default Jackson behavior.

boolean

true

If enabled, Jackson will serialize dates as numeric value(s).

boolean

false

If enabled, Jackson will ignore case during Enum deserialization.

boolean

false

If set, Jackson will default to using the specified timezone when formatting dates. Some examples values are "Asia/Jakarta" and "GMT+3". If not set, Jackson will use its own default.

ZoneId

UTC

Define which properties of Java Beans are to be included in serialization.

always, non-null, non-absent, non-empty, non-default, custom, use-defaults

Jacoco - Code Coverage

Type

Default

The jacoco data file

string

jacoco-quarkus.exec

Whether to reuse (true) or delete (false) the jacoco data file on each run.

boolean

false

If Quarkus should generate the Jacoco report

boolean

true

Encoding of the generated reports.

string

UTF-8

Name of the root node HTML report pages.

string

Footer text used in HTML report pages.

string

Encoding of the source files.

string

UTF-8

A list of class files to include in the report. May use wildcard characters (* and ?). When not specified everything will be included.

list of string

**

A list of class files to exclude from the report. May use wildcard characters (* and ?). When not specified nothing will be excluded.

list of string

The location of the report files.

string

jacoco-report

Jaeger

Type

Default

Defines if the Jaeger extension is enabled.

boolean

true

Whether or not metrics are published in case a metrics extension is present.

boolean

false

The traces endpoint, in case the client should connect directly to the Collector, like http://jaeger-collector:14268/api/traces

URI

Authentication Token to send as "Bearer" to the endpoint

string

Username to send as part of "Basic" authentication to the endpoint

string

Password to send as part of "Basic" authentication to the endpoint

string

The hostname and port for communicating with agent via UDP

host:port

Whether the reporter should also log the spans

boolean

The reporter’s maximum queue size

int

The reporter’s flush interval

Duration

The sampler type (const, probabilistic, ratelimiting or remote)

string

The sampler parameter (number)

BigDecimal

The host name and port when using the remote controlled sampler

host:port

The service name

string

A comma separated list of name = value tracer level tags, which get added to all reported spans. The value can also refer to an environment variable using the format ${envVarName:default}, where the :default is optional, and identifies a value to be used if the environment variable cannot be found

string

Comma separated list of formats to use for propagating the trace context. Defaults to the standard Jaeger format. Valid values are jaeger and b3

string

The sender factory class name

string

Whether the trace context should be logged.

boolean

true

Whether jaeger should run in zipkin compatibility mode

boolean

false

Keycloak Authorization

Type

Default

Enables policy enforcement.

boolean

false

Adapters will make separate HTTP invocations to the Keycloak server to turn an access code into an access token. This config option defines how many connections to the Keycloak server should be pooled

int

20

Specifies how policies are enforced.

permissive, enforcing, disabled

enforcing

Defines the limit of entries that should be kept in the cache

int

1000

Defines the time in milliseconds when the entry should be expired

long

30000

Specifies how the adapter should fetch the server for resources associated with paths in your application. If true, the policy enforcer is going to fetch resources on-demand accordingly with the path being requested

boolean

true

Specifies how scopes should be mapped to HTTP methods. If set to true, the policy enforcer will use the HTTP method from the current request to check whether or not access should be granted

boolean

false

The name of a resource on the server that is to be associated with a given path

string

A URI relative to the application’s context path that should be protected by the policy enforcer

string

string

required

An array of strings with the scopes associated with the method

list of string

required

A string referencing the enforcement mode for the scopes associated with a method

all, any, disabled

all

permissive, enforcing, disabled

enforcing

Map<String,Map<String,Map<String,String>>>

Map<String,Map<String,String>>

Map<String,Map<String,Map<String,String>>>

Map<String,Map<String,String>>

Additional named tenants

Type

Default

Adapters will make separate HTTP invocations to the Keycloak server to turn an access code into an access token. This config option defines how many connections to the Keycloak server should be pooled

int

20

Specifies how policies are enforced.

permissive, enforcing, disabled

enforcing

The name of a resource on the server that is to be associated with a given path

string

A URI relative to the application’s context path that should be protected by the policy enforcer

string

string

required

An array of strings with the scopes associated with the method

list of string

required

A string referencing the enforcement mode for the scopes associated with a method

all, any, disabled

all

permissive, enforcing, disabled

enforcing

Map<String,Map<String,Map<String,String>>>

Map<String,Map<String,String>>

Defines the limit of entries that should be kept in the cache

int

1000

Defines the time in milliseconds when the entry should be expired

long

30000

Specifies how the adapter should fetch the server for resources associated with paths in your application. If true, the policy enforcer is going to fetch resources on-demand accordingly with the path being requested

boolean

true

Map<String,Map<String,Map<String,String>>>

Map<String,Map<String,String>>

Specifies how scopes should be mapped to HTTP methods. If set to true, the policy enforcer will use the HTTP method from the current request to check whether or not access should be granted

boolean

false

Kubernetes

Type

Default

The name of the group this component belongs too

string

The name of the application. This value will be used for naming Kubernetes resources like: - Deployment - Service and so on …​

string

${quarkus.container-image.name}

The version of the application.

string

${quarkus.container-image.tag}

The namespace the generated resources should belong to. If not value is set, then the 'namespace' field will not be added to the 'metadata' section of the generated manifests. This in turn means that when the manifests are applied to a cluster, the namespace will be resolved from the current Kubernetes context (see https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#context for more details).

string

Whether or not to add the build timestamp to the Kubernetes annotations This is a very useful way to have manifests of successive builds of the same application differ - thus ensuring that Kubernetes will apply the updated resources

boolean

true

Working directory

string

list of string

list of string

The service account

string

The host under which the application is going to be exposed

string

The type of service that will be generated for the application

cluster-ip, node-port, load-balancer, external-name

cluster-ip

always, if-not-present, never

always

The image pull secret

list of string

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

The command to use for the probe.

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

The success threshold to use.

int

1

The failure threshold to use.

int

3

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

The command to use for the probe.

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

When true (the default), emit a set of annotations to identify services that should be scraped by prometheus for metrics. In configurations that use the Prometheus operator with ServiceMonitor, annotations may not be necessary.

boolean

true

Define the annotation prefix used for scrape values, this value will be used as the base for other annotation name defaults. Altering the base for generated annotations can make it easier to define re-labeling rules and avoid unexpected knock-on effects. The default value is prometheus.io See Prometheus example: https://github.com/prometheus/prometheus/blob/main/documentation/examples/prometheus-kubernetes.yml

string

prometheus.io

Define the annotation used to indicate services that should be scraped. By default, /scrape will be appended to the defined prefix.

string

Define the annotation used to indicate the path to scrape. By default, /path will be appended to the defined prefix.

string

Define the annotation used to indicate the port to scrape. By default, /port will be appended to the defined prefix.

string

Define the annotation used to indicate the scheme to use for scraping By default, /scheme will be appended to the defined prefix.

string

string

string

string

string

The optional list of Secret names to load environment variables from.

list of string

The optional list of ConfigMap names to load environment variables from.

list of string

Whether or not this service is cluster-local. Cluster local services are not exposed to the outside world.

boolean

false

This value controls the minimum number of replicas each revision should have. Knative will attempt to never have less than this number of replicas at any one point in time.

int

This value controls the maximum number of replicas each revision should have. Knative will attempt to never have more than this number of replicas running, or in the process of being created, at any one point in time.

int

The scale-to-zero values control whether Knative allows revisions to scale down to zero, or stops at “1”.

boolean

true

kpa, hpa

concurrency, rps, cpu

int

int

int

kpa, hpa

int

int

int

string

If set, the secret will mounted to the application container and its contents will be used for application configuration.

string

If set, the config amp will mounted to the application container and its contents will be used for application configuration.

string

Custom labels to add to all resources

Map<String,String>

Custom annotations to add to all resources

Map<String,String>

The port number. Refers to the container port.

int

int

The application path (refers to web application path).

string

/

tcp, udp

tcp

int

The name of the volumeName to mount.

string

string

Path within the volumeName from which the container’s volumeName should be mounted.

string

boolean

false

string

required

Default mode. When specifying an octal number, leading zero must be present.

string

0600

boolean

false

string

required

Default mode. When specifying an octal number, leading zero must be present.

string

0600

boolean

false

string

required

The directory of the repository to mount.

string

string

string

required

Default mode. When specifying an octal number, leading zero must be present.

string

0600

boolean

false

string

required

int

string

ext4

boolean

false

string

required

string

required

Wether the volumeName is read only or not.

boolean

false

string

required

The URI of the vhd blob object OR the resourceID of an Azure managed data disk if Kind is Managed

string

required

managed, shared

managed

read-write, read-only, none

read-write

string

ext4

Wether the volumeName is read only or not.

boolean

false

string

string

list of string

list of string

string

The host under which the application is going to be exposed.

string

int

int

The application path (refers to web application path).

string

/

tcp, udp

tcp

int

always, if-not-present, never

always

list of string

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

Duration

10S

int

1

int

3

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

Duration

10S

int

1

int

3

string

string

Path within the volumeName from which the container’s volumeName should be mounted.

string

boolean

false

The optional list of Secret names to load environment variables from.

list of string

The optional list of ConfigMap names to load environment variables from.

list of string

The map associating environment variable names to their associated field references they take their value from.

Map<String,String>

The map associating environment name to its associated value.

Map<String,String>

The optional name of the Secret from which a value is to be extracted. Mutually exclusive with from-configmap.

string

The optional name of the ConfigMap from which a value is to be extracted. Mutually exclusive with from-secret.

string

The key identifying the field from which the value is extracted.

string

required

string

string

list of string

list of string

string

The host under which the application is going to be exposed.

string

The port number. Refers to the container port.

int

int

The application path (refers to web application path).

string

/

tcp, udp

tcp

int

always, if-not-present, never

always

list of string

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

string

string

Path within the volumeName from which the container’s volumeName should be mounted.

string

boolean

false

The optional list of Secret names to load environment variables from.

list of string

The optional list of ConfigMap names to load environment variables from.

list of string

The map associating environment variable names to their associated field references they take their value from.

Map<String,String>

The map associating environment name to its associated value.

Map<String,String>

The optional name of the Secret from which a value is to be extracted. Mutually exclusive with from-configmap.

string

The optional name of the ConfigMap from which a value is to be extracted. Mutually exclusive with from-secret.

string

The key identifying the field from which the value is extracted.

string

required

string

The hostnames to resolve to the ip

list of string

The map associating environment variable names to their associated field references they take their value from.

Map<String,String>

The map associating environment name to its associated value.

Map<String,String>

The optional name of the Secret from which a value is to be extracted. Mutually exclusive with from-configmap.

string

The optional name of the ConfigMap from which a value is to be extracted. Mutually exclusive with from-secret.

string

The key identifying the field from which the value is extracted.

string

required

Tag is optionally used to expose a dedicated url for referencing this target exclusively.

string

RevisionName of a specific revision to which to send this portion of traffic.

string

LatestRevision may be optionally provided to indicate that the latest ready Revision of the Configuration should be used for this traffic target. When provided LatestRevision must be true if RevisionName is empty.

boolean

false

Percent indicates that percentage based routing should be used and the value indicates the percent of traffic that is be routed to this Revision or Configuration. 0 (zero) mean no traffic, 100 means all traffic.

long

100

The name of the group this component belongs too

string

The name of the application. This value will be used for naming Kubernetes resources like: - Deployment - Service and so on …​

string

${quarkus.container-image.name}

The version of the application.

string

${quarkus.container-image.tag}

The namespace the generated resources should belong to. If not value is set, then the 'namespace' field will not be added to the 'metadata' section of the generated manifests. This in turn means that when the manifests are applied to a cluster, the namespace will be resolved from the current Kubernetes context (see https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#context for more details).

string

Whether or not to add the build timestamp to the Kubernetes annotations This is a very useful way to have manifests of successive builds of the same application differ - thus ensuring that Kubernetes will apply the updated resources

boolean

true

Working directory

string

list of string

list of string

string

The host under which the application is going to be exposed

string

The number of desired pods

int

1

The type of service that will be generated for the application

cluster-ip, node-port, load-balancer, external-name

cluster-ip

The nodePort to set when serviceType is set to node-port.

int

always, if-not-present, never

always

list of string

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

The command to use for the probe.

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

The command to use for the probe.

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

When true (the default), emit a set of annotations to identify services that should be scraped by prometheus for metrics. In configurations that use the Prometheus operator with ServiceMonitor, annotations may not be necessary.

boolean

true

Define the annotation prefix used for scrape values, this value will be used as the base for other annotation name defaults. Altering the base for generated annotations can make it easier to define re-labeling rules and avoid unexpected knock-on effects. The default value is prometheus.io See Prometheus example: https://github.com/prometheus/prometheus/blob/main/documentation/examples/prometheus-kubernetes.yml

string

prometheus.io

Define the annotation used to indicate services that should be scraped. By default, /scrape will be appended to the defined prefix.

string

Define the annotation used to indicate the path to scrape. By default, /path will be appended to the defined prefix.

string

Define the annotation used to indicate the port to scrape. By default, /port will be appended to the defined prefix.

string

Define the annotation used to indicate the scheme to use for scraping By default, /scheme will be appended to the defined prefix.

string

The target deployment platform. Defaults to kubernetes. Can be kubernetes, openshift, knative, minikube etc, or any combination of the above as comma separated list.

list of string

string

string

string

string

If true, a Kubernetes Ingress will be created

boolean

false

If true, the service will be exposed

boolean

false

The host under which the application is going to be exposed

string

If true, the 'app.kubernetes.io/version' label will be part of the selectors of Service and Deployment

boolean

true

If set to true, Quarkus will attempt to deploy the application to the target Kubernetes cluster

boolean

false

If set, the secret will mounted to the application container and its contents will be used for application configuration.

string

If set, the config amp will mounted to the application container and its contents will be used for application configuration.

string

The optional list of Secret names to load environment variables from.

list of string

The optional list of ConfigMap names to load environment variables from.

list of string

Custom labels to add to all resources

Map<String,String>

Custom annotations to add to all resources

Map<String,String>

The port number. Refers to the container port.

int

int

The application path (refers to web application path).

string

/

tcp, udp

tcp

int

The name of the volumeName to mount.

string

string

Path within the volumeName from which the container’s volumeName should be mounted.

string

boolean

false

string

required

Default mode. When specifying an octal number, leading zero must be present.

string

0600

boolean

false

string

required

Default mode. When specifying an octal number, leading zero must be present.

string

0600

boolean

false

string

required

The directory of the repository to mount.

string

string

string

required

Default mode. When specifying an octal number, leading zero must be present.

string

0600

boolean

false

string

required

int

string

ext4

boolean

false

string

required

string

required

boolean

false

string

required

The URI of the vhd blob object OR the resourceID of an Azure managed data disk if Kind is Managed

string

required

managed, shared

managed

read-write, read-only, none

read-write

string

ext4

boolean

false

string

string

list of string

list of string

string

The host under which the application is going to be exposed.

string

int

int

The application path (refers to web application path).

string

/

tcp, udp

tcp

int

always, if-not-present, never

always

list of string

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

Duration

10S

int

1

int

3

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

Duration

10S

int

1

int

3

string

string

Path within the volumeName from which the container’s volumeName should be mounted.

string

boolean

false

The optional list of Secret names to load environment variables from.

list of string

The optional list of ConfigMap names to load environment variables from.

list of string

The map associating environment variable names to their associated field references they take their value from.

Map<String,String>

The map associating environment name to its associated value.

Map<String,String>

The optional name of the Secret from which a value is to be extracted. Mutually exclusive with from-configmap.

string

The optional name of the ConfigMap from which a value is to be extracted. Mutually exclusive with from-secret.

string

The key identifying the field from which the value is extracted.

string

required

string

string

list of string

list of string

string

The host under which the application is going to be exposed.

string

The port number. Refers to the container port.

int

int

The application path (refers to web application path).

string

/

tcp, udp

tcp

int

always, if-not-present, never

always

list of string

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

string

string

Path within the volumeName from which the container’s volumeName should be mounted.

string

boolean

false

The optional list of Secret names to load environment variables from.

list of string

The optional list of ConfigMap names to load environment variables from.

list of string

The map associating environment variable names to their associated field references they take their value from.

Map<String,String>

The map associating environment name to its associated value.

Map<String,String>

The optional name of the Secret from which a value is to be extracted. Mutually exclusive with from-configmap.

string

The optional name of the ConfigMap from which a value is to be extracted. Mutually exclusive with from-secret.

string

The key identifying the field from which the value is extracted.

string

required

string

The hostnames to resolve to the ip

list of string

Custom annotations to add to exposition (route or ingress) resources

Map<String,String>

The map associating environment variable names to their associated field references they take their value from.

Map<String,String>

The map associating environment name to its associated value.

Map<String,String>

The optional name of the Secret from which a value is to be extracted. Mutually exclusive with from-configmap.

string

The optional name of the ConfigMap from which a value is to be extracted. Mutually exclusive with from-secret.

string

The key identifying the field from which the value is extracted.

string

required

The OpenShift flavor / version to use. Older versions of OpenShift have minor differrences in the labels and fields they support. This option allows users to have their manifests automatically aligned to the OpenShift 'flavor' they use.

v3, v4

v4

The name of the group this component belongs too

string

The name of the application. This value will be used for naming Kubernetes resources like: - Deployment - Service and so on …​

string

${quarkus.container-image.name}

The version of the application.

string

${quarkus.container-image.tag}

The namespace the generated resources should belong to. If not value is set, then the 'namespace' field will not be added to the 'metadata' section of the generated manifests. This in turn means that when the manifests are applied to a cluster, the namespace will be resolved from the current Kubernetes context (see https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#context for more details).

string

Whether or not to add the build timestamp to the Kubernetes annotations This is a very useful way to have manifests of successive builds of the same application differ - thus ensuring that Kubernetes will apply the updated resources

boolean

true

Working directory

string

list of string

list of string

The service account

string

The host under which the application is going to be exposed

string

The number of desired pods

int

1

The type of service that will be generated for the application

cluster-ip, node-port, load-balancer, external-name

cluster-ip

The nodePort to set when serviceType is set to nodePort

int

always, if-not-present, never

always

The image pull secret

list of string

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

The command to use for the probe.

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

The command to use for the probe.

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

When true (the default), emit a set of annotations to identify services that should be scraped by prometheus for metrics. In configurations that use the Prometheus operator with ServiceMonitor, annotations may not be necessary.

boolean

true

Define the annotation prefix used for scrape values, this value will be used as the base for other annotation name defaults. Altering the base for generated annotations can make it easier to define re-labeling rules and avoid unexpected knock-on effects. The default value is prometheus.io See Prometheus example: https://github.com/prometheus/prometheus/blob/main/documentation/examples/prometheus-kubernetes.yml

string

prometheus.io

Define the annotation used to indicate services that should be scraped. By default, /scrape will be appended to the defined prefix.

string

Define the annotation used to indicate the path to scrape. By default, /path will be appended to the defined prefix.

string

Define the annotation used to indicate the port to scrape. By default, /port will be appended to the defined prefix.

string

Define the annotation used to indicate the scheme to use for scraping By default, /scheme will be appended to the defined prefix.

string

string

string

string

string

If true, an Openshift Route will be created

boolean

false

If true, the service will be exposed

boolean

false

The host under which the application is going to be exposed

string

If true, the 'app.kubernetes.io/version' label will be part of the selectors of Service and DeploymentConfig

boolean

true

The optional list of Secret names to load environment variables from.

list of string

The optional list of ConfigMap names to load environment variables from.

list of string

If set, the secret will mounted to the application container and its contents will be used for application configuration.

string

If set, the config amp will mounted to the application container and its contents will be used for application configuration.

string

Custom labels to add to all resources

Map<String,String>

Custom annotations to add to all resources

Map<String,String>

The port number. Refers to the container port.

int

int

The application path (refers to web application path).

string

/

tcp, udp

tcp

int

The name of the volumeName to mount.

string

string

Path within the volumeName from which the container’s volumeName should be mounted.

string

boolean

false

string

required

Default mode. When specifying an octal number, leading zero must be present.

string

0600

boolean

false

string

required

Default mode. When specifying an octal number, leading zero must be present.

string

0600

boolean

false

string

required

The directory of the repository to mount.

string

string

string

required

Default mode. When specifying an octal number, leading zero must be present.

string

0600

boolean

false

string

required

int

string

ext4

boolean

false

string

required

string

required

Wether the volumeName is read only or not.

boolean

false

string

required

The URI of the vhd blob object OR the resourceID of an Azure managed data disk if Kind is Managed

string

required

managed, shared

managed

read-write, read-only, none

read-write

string

ext4

Wether the volumeName is read only or not.

boolean

false

string

string

list of string

list of string

string

The host under which the application is going to be exposed.

string

int

int

The application path (refers to web application path).

string

/

tcp, udp

tcp

int

always, if-not-present, never

always

list of string

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

Duration

10S

int

1

int

3

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

Duration

10S

int

1

int

3

string

string

Path within the volumeName from which the container’s volumeName should be mounted.

string

boolean

false

The optional list of Secret names to load environment variables from.

list of string

The optional list of ConfigMap names to load environment variables from.

list of string

The map associating environment variable names to their associated field references they take their value from.

Map<String,String>

The map associating environment name to its associated value.

Map<String,String>

The optional name of the Secret from which a value is to be extracted. Mutually exclusive with from-configmap.

string

The optional name of the ConfigMap from which a value is to be extracted. Mutually exclusive with from-secret.

string

The key identifying the field from which the value is extracted.

string

required

string

string

list of string

list of string

string

The host under which the application is going to be exposed.

string

The port number. Refers to the container port.

int

int

The application path (refers to web application path).

string

/

tcp, udp

tcp

int

always, if-not-present, never

always

list of string

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

The http path to use for the probe For this to work, the container port also needs to be set Assuming the container port has been set (as per above comment), if execAction or tcpSocketAction are not set, an http probe will be used automatically even if no path is set (which will result in the root path being used)

string

string

The tcp socket to use for the probe (the format is host:port).

string

The amount of time to wait before starting to probe.

Duration

0S

The period in which the action should be called.

Duration

30S

The amount of time to wait for each action.

Duration

10S

int

1

int

3

The name of the volumeName to mount.

string

string

Path within the volumeName from which the container’s volumeName should be mounted.

string

boolean

false

The optional list of Secret names to load environment variables from.

list of string

The optional list of ConfigMap names to load environment variables from.

list of string

The map associating environment variable names to their associated field references they take their value from.

Map<String,String>

The map associating environment name to its associated value.

Map<String,String>

The optional name of the Secret from which a value is to be extracted. Mutually exclusive with from-configmap.

string

The optional name of the ConfigMap from which a value is to be extracted. Mutually exclusive with from-secret.

string

The key identifying the field from which the value is extracted.

string

required

string

The hostnames to resolve to the ip

list of string

Custom annotations to add to exposition (route or ingress) resources

Map<String,String>

The map associating environment variable names to their associated field references they take their value from.

Map<String,String>

The map associating environment name to its associated value.

Map<String,String>

The optional name of the Secret from which a value is to be extracted. Mutually exclusive with from-configmap.

string

The optional name of the ConfigMap from which a value is to be extracted. Mutually exclusive with from-secret.

string

The key identifying the field from which the value is extracted.

string

required

Kubernetes Client Internal

Type

Default

Whether or not the client should trust a self signed certificate if so presented by the API server

boolean

URL of the Kubernetes API server

string

Default namespace to use

string

string

string

string

string

string

string

string

string

Kubernetes auth username

string

Kubernetes auth password

string

Kubernetes oauth token

string

Duration

PT1S

Maximum reconnect attempts in case of watch failure By default there is no limit to the number of reconnect attempts

int

-1

Maximum amount of time to wait for a connection with the API server to be established

Duration

PT10S

Maximum amount of time to wait for a request to the API server to be completed

Duration

PT10S

Maximum amount of time in milliseconds to wait for a rollout to be completed

Duration

PT15M

HTTP proxy used to access the Kubernetes API server

string

HTTPS proxy used to access the Kubernetes API server

string

string

string

IP addresses or hosts to exclude from proxying

list of string

Kubernetes Config

Type

Default

Whether or not configuration can be read from secrets. If set to true, Kubernetes resources allowing access to secrets (role and role binding) will be generated.

boolean

false

If set to true, the application will attempt to look up the configuration from the API server

boolean

false

If set to true, the application will not start if any of the configured config sources cannot be located

boolean

true

ConfigMaps to look for in the namespace that the Kubernetes Client has been configured for. ConfigMaps defined later in this list have a higher priority that ConfigMaps defined earlier in this list. Furthermore any Secrets defined in secrets, will have higher priorities than all ConfigMaps.

list of string

Secrets to look for in the namespace that the Kubernetes Client has been configured for. If you use this, you probably want to enable quarkus.kubernetes-config.secrets.enabled. Secrets defined later in this list have a higher priority that ConfigMaps defined earlier in this list. Furthermore these Secrets have a higher priorities than all ConfigMaps defined in configMaps.

list of string

Namespace to look for config maps and secrets. If this is not specified, then the namespace configured in the kubectl config context is used. If the value is specified and the namespace doesn’t exist, the application will fail to start.

string

Kubernetes Service Binding

Type

Default

If enabled, Service Bindings will be looked in the file system

boolean

true

The bindings file system root. Specified by the Kubernetes Service ServiceBinding Specification.

string

${SERVICE_BINDING_ROOT:}

Liquibase

Type

Default

The liquibase change log file. All included change log files in this file are scanned and add to the projects.

string

db/changeLog.xml

true to execute Liquibase automatically when the application starts, false otherwise.

boolean

false

true to validate the applied changes against the available ones, false otherwise. It is only used if migration-at-start is true

boolean

true

true to execute Liquibase clean command automatically when the application starts, false otherwise.

boolean

false

Comma-separated case-sensitive list of ChangeSet contexts to execute for liquibase.

list of string

Comma-separated case-sensitive list of expressions defining labeled ChangeSet to execute for liquibase.

list of string

The liquibase change log lock table name. Name of table to use for tracking concurrent Liquibase usage.

string

DATABASECHANGELOGLOCK

The liquibase change log table name. Name of table to use for tracking change history.

string

DATABASECHANGELOG

The name of Liquibase’s default catalog.

string

The name of Liquibase’s default schema. Overwrites the default schema name (returned by the RDBMS) with a different database schema.

string

The name of the catalog with the liquibase tables.

string

The name of the schema with the liquibase tables.

string

The name of the tablespace where the -LOG and -LOCK tables will be created (if they do not exist yet).

string

The liquibase change log file. All included change log files in this file are scanned and add to the projects.

string

db/changeLog.xml

Map of parameters that can be used inside Liquibase changeLog files.

Map<String,String>

true to execute Liquibase automatically when the application starts, false otherwise.

boolean

false

true to validate the applied changes against the available ones, false otherwise. It is only used if migration-at-start is true

boolean

true

true to execute Liquibase clean command automatically when the application starts, false otherwise.

boolean

false

Comma-separated case-sensitive list of ChangeSet contexts to execute for liquibase.

list of string

Comma-separated case-sensitive list of expressions defining labeled ChangeSet to execute for liquibase.

list of string

Map of parameters that can be used inside Liquibase changeLog files.

Map<String,String>

The liquibase change log lock table name. Name of table to use for tracking concurrent Liquibase usage.

string

DATABASECHANGELOGLOCK

The liquibase change log table name. Name of table to use for tracking change history.

string

DATABASECHANGELOG

The name of Liquibase’s default catalog.

string

The name of Liquibase’s default schema. Overwrites the default schema name (returned by the RDBMS) with a different database schema.

string

The name of the catalog with the liquibase tables.

string

The name of the schema with the liquibase tables.

string

The name of the tablespace where the -LOG and -LOCK tables will be created (if they do not exist yet).

string

Liquibase MongoDB

Type

Default

string

db/changeLog.xml

The migrate at start flag

boolean

false

The validate on update flag

boolean

true

boolean

false

The list of contexts

list of string

list of string

string

string

The liquibase tables catalog name

string

The liquibase tables schema name

string

The liquibase tables tablespace name

string

The parameters to be passed to the changelog. Defined as key value pairs.

Map<String,String>

Logging GELF

Type

Default

Determine whether to enable the GELF logging handler

boolean

false

Hostname/IP-Address of the Logstash/Graylog Host By default it uses UDP, prepend tcp: to the hostname to switch to TCP, example: "tcp:localhost"

string

localhost

int

12201

GELF version: 1.0 or 1.1

string

1.1

Whether to post Stack-Trace to StackTrace field.

boolean

true

Only used when extractStackTrace is true. A value of 0 will extract the whole stack trace. Any positive value will walk the cause chain: 1 corresponds with exception.getCause(), 2 with exception.getCause().getCause(), …​ Negative throwable reference walk the exception chain from the root cause side: -1 will extract the root cause, -2 the exception wrapping the root cause, …​

int

0

Whether to perform Stack-Trace filtering

boolean

false

Java date pattern, see java.text.SimpleDateFormat

string

yyyy-MM-dd HH:mm:ss,SSS

The logging-gelf log level.

Level

ALL

Name of the facility.

string

jboss-logmanager

Whether to include all fields from the MDC.

boolean

false

Maximum message size (in bytes). If the message size is exceeded, the appender will submit the message in multiple chunks.

int

8192

Include message parameters from the log event

boolean

true

Include source code location

boolean

true

Post additional fields

Type

Default

string

required

Additional field type specification. Supported types: String, long, Long, double, Double and discover. Discover is the default if not specified, it discovers field type based on parseability.

string

discover

Logging JSON

Type

Default

Determine whether to enable the JSON console formatting extension, which disables "normal" console formatting.

boolean

true

Enable "pretty printing" of the JSON record. Note that some JSON parsers will fail to read pretty printed output.

boolean

false

The date format to use. The special string "default" indicates that the default format should be used.

string

default

The special end-of-record delimiter to be used. By default, newline is used as delimiter.

string

The zone ID to use. The special string "default" indicates that the default zone should be used.

string

default

The exception output type to specify.

detailed, formatted, detailed-and-formatted

detailed

Enable printing of more details in the log. Printing the details can be expensive as the values are retrieved from the caller. The details include the source class name, source file name, source method name and source line number.

boolean

false

Logging Sentry

Type

Default

Determine whether to enable the Sentry logging extension.

boolean

false

Sentry DSN The DSN is the first and most important thing to configure because it tells the SDK where to send events. You can find your project’s DSN in the “Client Keys” section of your “Project Settings” in Sentry.

string

The sentry log level.

Level

WARN

The minimum event level. Every log statement that is greater than minimum event level is turned into Sentry event.

Level

WARN

The minimum breadcrumb level. Every log statement that is greater than minimum breadcrumb level is added to Sentry scope as a breadcrumb, which can be later attached to SentryEvent if one is triggered.

Level

INFO

Sentry differentiates stack frames that are directly related to your application (“in application”) from stack frames that come from other packages such as the standard library, frameworks, or other dependencies. The difference is visible in the Sentry web interface where only the “in application” frames are displayed by default. You can configure which package prefixes your application uses with this option. This option is highly recommended as it affects stacktrace grouping and display on Sentry. See documentation: https://quarkus.io/guides/logging-sentry#in-app-packages

list of string

Environment With Sentry you can easily filter issues, releases, and user feedback by environment. The environment filter on sentry affects all issue-related metrics like count of users affected, times series graphs, and event count. By setting the environment option, an environment tag will be added to each new issue sent to Sentry. There are a few restrictions: → the environment name cannot contain newlines or spaces, cannot be the string “None” or exceed 64 characters.

string

Release A release is a version of your code that is deployed to an environment. When you give Sentry information about your releases, you unlock a number of new features: - Determine the issues and regressions introduced in a new release - Predict which commit caused an issue and who is likely responsible - Resolve issues by including the issue number in your commit message - Receive email notifications when your code gets deployed

string

Server name Sets the server name that will be sent with each event.

string

Debug Enables Sentry debug mode.

boolean

false

Mailer

Type

Default

Sets the default from attribute when not specified in the io.quarkus.mailer.Mail instance. It’s the sender email address.

string

Enables the mock mode. When enabled, mails are not sent, but stored in an in-memory mailbox. The content of the emails is also printed on the console. Disabled by default on PROD, enabled by default on DEV and TEST modes.

boolean

Sets the default bounce email address. A bounced email, or bounce, is an email message that gets rejected by a mail server.

string

Sets the SMTP host name.

string

localhost

The SMTP port. The default value depends on the configuration. The port 25 is used as default when ssl is disabled. This port continues to be used primarily for SMTP relaying. SMTP relaying is the transmission of email from email server to email server. The port 587 is the default port when ssl is enabled. It ensures that email is submitted securely. Note that the port 465 may be used by SMTP servers, however, IANA has reassigned a new service to this port, and it should no longer be used for SMTP communications.

int

Sets the username to connect to the SMTP server.

string

Sets the password to connect to the SMTP server.

string

Enables or disables the TLS/SSL.

boolean

false

Set whether all server certificates should be trusted. This option is only used when ssl is enabled.

boolean

Sets the max number of open connections to the mail server.

int

10

Sets the hostname to be used for HELO/EHLO and the Message-ID.

string

Sets if connection pool is enabled. If the connection pooling is disabled, the max number of sockets is enforced nevertheless.

boolean

true

Disable ESMTP. The RFC-1869 states that clients should always attempt EHLO as first command to determine if ESMTP is supported, if this returns an error code, HELO is tried to use the regular SMTP command.

boolean

false

Sets the TLS security mode for the connection. Either DISABLED, OPTIONAL or REQUIRED.

string

OPTIONAL

Sets the login mode for the connection. Either NONE, @{code DISABLED}, OPTIONAL, REQUIRED or XOAUTH2. - DISABLED means no login will be attempted - NONE means a login will be attempted if the server supports in and login credentials are set - REQUIRED means that a login will be attempted if the server supports it and the send operation will fail otherwise - XOAUTH2 means that a login will be attempted using Google Gmail Oauth2 tokens

string

NONE

Sets the allowed authentication methods. These methods will be used only if the server supports them. If not set, all supported methods may be used. The list is given as a space separated list, such as DIGEST-MD5 CRAM-SHA256 CRAM-SHA1 CRAM-MD5 PLAIN LOGIN.

string

Sets the trust store password if any. Note that the password is only used for JKS and PCK#12 trust stores.

string

Sets the location of the trust store files. If you use JKS or PCK#12, only one path is allowed. If you use PEM files, you can specify multiple paths. The relative paths are relative to the application working directly.

list of string

Sets the trust store type. By default, it guesses the type from the file name extension. For instance, truststore.pem will be seen as a PEM file, while truststore.jks will be seen as a JKS file. truststore.p12 and truststore.pfx will both be seen as PCK#12 files. Accepted values are: JKS, PEM, PCKS.

string

Whether or not the mail should always been sent as multipart even if they don’t have attachments. When sets to true, the mail message will be encoded as multipart even for simple mails without attachments.

boolean

false

Sets if sending allows recipients errors. If set to true, the mail will be sent to the recipients that the server accepted, if any.

boolean

false

Enables or disables the pipelining capability if the SMTP server supports it.

boolean

true

Sets the connection pool cleaner period. Zero disables expiration checks and connections will remain in the pool until they are closed.

Duration

PT1S

Set the keep alive timeout for the SMTP connection. This value determines how long a connection remains unused in the pool before being evicted and closed. A timeout of 0 means there is no timeout.

Duration

PT300S

Sets the workstation used on NTLM authentication.

string

Sets the domain used on NTLM authentication.

string

Micrometer metrics

Type

Default

Micrometer metrics support. Micrometer metrics support is enabled by default.

boolean

true

Micrometer MeterRegistry discovery. Micrometer MeterRegistry implementations discovered on the classpath will be enabled automatically by default.

boolean

true

Micrometer MeterBinder discovery. Micrometer MeterBinder implementations discovered on the classpath will be enabled automatically by default.

boolean

true

Outbound HTTP request metrics support. Support for HTTP client metrics will be enabled if Micrometer support is enabled, the REST client feature is enabled, and either this value is true, or this value is unset and quarkus.micrometer.binder-enabled-default is true.

boolean

Inbound HTTP metrics support. Support for HTTP server metrics will be enabled if Micrometer support is enabled, an extension serving HTTP traffic is enabled, and either this value is true, or this value is unset and quarkus.micrometer.binder-enabled-default is true.

boolean

Micrometer JVM metrics support. Support for JVM metrics will be enabled if Micrometer support is enabled, and either this value is true, or this value is unset and quarkus.micrometer.binder-enabled-default is true.

boolean

Kafka metrics support. Support for Kafka metrics will be enabled if Micrometer support is enabled, the Kafka Consumer or Producer interface is on the classpath and either this value is true, or this value is unset and quarkus.micrometer.binder-enabled-default is true.

boolean

Eclipse MicroProfile Metrics support.

Support for MicroProfile Metrics will be enabled if Micrometer support is enabled and the MicroProfile Metrics dependency is present:

<dependency>
  <groupId>org.eclipse.microprofile.metrics</groupId>
  <artifactId>microprofile-metrics-api</artifactId>
</dependency>

The Micrometer extension currently provides a compatibility layer that supports the MP Metrics API, but metric names and recorded values will be different. Note that the MP Metrics compatibility layer will move to a different extension in the future.

boolean

Micrometer System metrics support. Support for System metrics will be enabled if Micrometer support is enabled, and either this value is true, or this value is unset and quarkus.micrometer.binder-enabled-default is true.

boolean

Vert.x metrics support. Support for Vert.x metrics will be enabled if Micrometer support is enabled, Vert.x MetricsOptions is on the classpath and either this value is true, or this value is unset and quarkus.micrometer.binder-enabled-default is true.

boolean

Support for export to JSON format. Off by default.

boolean

false

The path for the JSON metrics endpoint. The default value is metrics.

string

metrics

Statistics like max, percentiles, and histogram counts decay over time to give greater weight to recent samples. Samples are accumulated to such statistics in ring buffers which rotate after the expiry, with this buffer length.

int

3

Statistics like max, percentiles, and histogram counts decay over time to give greater weight to recent samples. Samples are accumulated to such statistics in ring buffers which rotate after this expiry, with a particular buffer length.

Duration

P3D

Support for export to Prometheus. Support for Prometheus will be enabled if Micrometer support is enabled, the PrometheusMeterRegistry is on the classpath and either this value is true, or this value is unset and quarkus.micrometer.registry-enabled-default is true.

boolean

The path for the prometheus metrics endpoint (produces text/plain). The default value is metrics.

string

metrics

By default, this extension will create a Prometheus MeterRegistry instance. Use this attribute to veto the creation of the default Prometheus MeterRegistry.

boolean

true

Comma-separated list of regular expressions used to specify uri labels in http metrics.

Outbount HTTP client instrumentation will attempt to transform parameterized resource paths, /item/123, into a generic form, /item/{id}, to reduce the cardinality of uri label values.

Patterns specified here will take precedence over those computed values.

For example, if /item/\\\\d+=/item/custom or /item/[0-9]+=/item/custom is specified in this list, a request to a matching path (/item/123) will use the specified replacement value (/item/custom) as the value for the uri label. Note that backslashes must be double escaped as \\\\.

list of string

Comma-separated list of regular expressions defining uri paths that should be ignored (not measured).

list of string

Maximum number of unique URI tag values allowed. After the max number of tag values is reached, metrics with additional tag values are denied by filter.

int

100

Comma-separated list of regular expressions used to specify uri labels in http metrics.

Vertx instrumentation will attempt to transform parameterized resource paths, /item/123, into a generic form, /item/{id}, to reduce the cardinality of uri label values.

Patterns specified here will take precedence over those computed values.

For example, if /item/\\\\d+=/item/custom or /item/[0-9]+=/item/custom is specified in this list, a request to a matching path (/item/123) will use the specified replacement value (/item/custom) as the value for the uri label. Note that backslashes must be double escaped as \\\\.

list of string

Comma-separated list of regular expressions defining uri paths that should be ignored (not measured).

list of string

Maximum number of unique URI tag values allowed. After the max number of tag values is reached, metrics with additional tag values are denied by filter.

int

100

Prometheus registry configuration properties.

A property source for configuration of the Prometheus MeterRegistry, see https://micrometer.io/docs/registry/prometheus.

Map<String,String>

MongoDB client

Type

Default

Whether or not an health check is published in case the smallrye-health extension is present.

boolean

true

Whether or not metrics are published in case a metrics extension is present.

boolean

false

Whether or not tracing spans of driver commands are sent in case the smallrye-opentracing extension is present.

boolean

false

If set to true, the default clients will always be created even if there are no injection points that use them

boolean

false

If DevServices has been explicitly enabled or disabled. DevServices is generally enabled by default, unless there is an existing configuration present. When DevServices is enabled Quarkus will attempt to automatically configure and start a database when running in Dev or Test mode.

boolean

The container image name to use, for container based DevServices providers.

string

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

Configures the connection string. The format is: mongodb://[username:password@]host1[:port1][,host2[:port2],…​[,hostN[:portN]]][/[database.collection][?options]] mongodb:// is a required prefix to identify that this is a string in the standard connection format. username:password@ are optional. If given, the driver will attempt to login to a database after connecting to a database server. For some authentication mechanisms, only the username is specified and the password is not, in which case the ":" after the username is left off as well. host1 is the only required part of the connection string. It identifies a server address to connect to. :portX is optional and defaults to :27017 if not provided. /database is the name of the database to login to and thus is only relevant if the username:password@ syntax is used. If not specified the admin database will be used by default. ?options are connection options. Note that if database is absent there is still a / required between the last host and the ? introducing the options. Options are name=value pairs and the pairs are separated by "&". An alternative format, using the mongodb+srv protocol, is: mongodb+srv://[username:password@]host[/[database][?options]] - mongodb+srv:// is a required prefix for this format. - username:password@ are optional. If given, the driver will attempt to login to a database after connecting to a database server. For some authentication mechanisms, only the username is specified and the password is not, in which case the ":" after the username is left off as well - host is the only required part of the URI. It identifies a single host name for which SRV records are looked up from a Domain Name Server after prefixing the host name with "_mongodb._tcp". The host/port for each SRV record becomes the seed list used to connect, as if each one were provided as host/port pair in a URI using the normal mongodb protocol. - /database is the name of the database to login to and thus is only relevant if the username:password@ syntax is used. If not specified the "admin" database will be used by default. - ?options are connection options. Note that if database is absent there is still a / required between the last host and the ? introducing the options. Options are name=value pairs and the pairs are separated by "&". Additionally with the mongodb+srv protocol, TXT records are looked up from a Domain Name Server for the given host, and the text value of each one is prepended to any options on the URI itself. Because the last specified value for any option wins, that means that options provided on the URI will override any that are provided via TXT records.

string

Configures the MongoDB server addressed (one if single mode). The addresses are passed as host:port.

list of string

127.0.0.1:27017

Configure the database name.

string

Configures the application name.

string

Configures the maximum number of connections in the connection pool.

int

Configures the minimum number of connections in the connection pool.

int

Maximum idle time of a pooled connection. A connection that exceeds this limit will be closed.

Duration

Maximum life time of a pooled connection. A connection that exceeds this limit will be closed.

Duration

Configures the time period between runs of the maintenance job.

Duration

Configures period of time to wait before running the first maintenance job on the connection pool.

Duration

How long a connection can take to be opened before timing out.

Duration

How long a socket read can take before timing out.

Duration

If connecting with TLS, this option enables insecure TLS connections.

boolean

false

Whether to connect using TLS.

boolean

false

Implies that the hosts given are a seed list, and the driver will attempt to find all members of the set.

string

How long the driver will wait for server selection to succeed before throwing an exception.

Duration

When choosing among multiple MongoDB servers to send a request, the driver will only send that request to a server whose ping time is less than or equal to the server with the fastest ping time plus the local threshold.

Duration

The frequency that the driver will attempt to determine the current state of each server in the cluster.

Duration

Configures the read concern. Supported values are: local|majority|linearizable|snapshot|available

string

Configures the read preferences. Supported values are: primary|primaryPreferred|secondary|secondaryPreferred|nearest

string

The database used during the readiness health checks

string

admin

Generic properties that are added to the connection URL.

Map<String,String>

Configures the connection string. The format is: mongodb://[username:password@]host1[:port1][,host2[:port2],…​[,hostN[:portN]]][/[database.collection][?options]] mongodb:// is a required prefix to identify that this is a string in the standard connection format. username:password@ are optional. If given, the driver will attempt to login to a database after connecting to a database server. For some authentication mechanisms, only the username is specified and the password is not, in which case the ":" after the username is left off as well. host1 is the only required part of the connection string. It identifies a server address to connect to. :portX is optional and defaults to :27017 if not provided. /database is the name of the database to login to and thus is only relevant if the username:password@ syntax is used. If not specified the admin database will be used by default. ?options are connection options. Note that if database is absent there is still a / required between the last host and the ? introducing the options. Options are name=value pairs and the pairs are separated by "&". An alternative format, using the mongodb+srv protocol, is: mongodb+srv://[username:password@]host[/[database][?options]] - mongodb+srv:// is a required prefix for this format. - username:password@ are optional. If given, the driver will attempt to login to a database after connecting to a database server. For some authentication mechanisms, only the username is specified and the password is not, in which case the ":" after the username is left off as well - host is the only required part of the URI. It identifies a single host name for which SRV records are looked up from a Domain Name Server after prefixing the host name with "_mongodb._tcp". The host/port for each SRV record becomes the seed list used to connect, as if each one were provided as host/port pair in a URI using the normal mongodb protocol. - /database is the name of the database to login to and thus is only relevant if the username:password@ syntax is used. If not specified the "admin" database will be used by default. - ?options are connection options. Note that if database is absent there is still a / required between the last host and the ? introducing the options. Options are name=value pairs and the pairs are separated by "&". Additionally with the mongodb+srv protocol, TXT records are looked up from a Domain Name Server for the given host, and the text value of each one is prepended to any options on the URI itself. Because the last specified value for any option wins, that means that options provided on the URI will override any that are provided via TXT records.

string

Configures the MongoDB server addressed (one if single mode). The addresses are passed as host:port.

list of string

127.0.0.1:27017

string

string

Configures the maximum number of connections in the connection pool.

int

Configures the minimum number of connections in the connection pool.

int

Maximum idle time of a pooled connection. A connection that exceeds this limit will be closed.

Duration

Maximum life time of a pooled connection. A connection that exceeds this limit will be closed.

Duration

Configures the time period between runs of the maintenance job.

Duration

Configures period of time to wait before running the first maintenance job on the connection pool.

Duration

How long a connection can take to be opened before timing out.

Duration

How long a socket read can take before timing out.

Duration

If connecting with TLS, this option enables insecure TLS connections.

boolean

false

Whether to connect using TLS.

boolean

false

Implies that the hosts given are a seed list, and the driver will attempt to find all members of the set.

string

How long the driver will wait for server selection to succeed before throwing an exception.

Duration

When choosing among multiple MongoDB servers to send a request, the driver will only send that request to a server whose ping time is less than or equal to the server with the fastest ping time plus the local threshold.

Duration

The frequency that the driver will attempt to determine the current state of each server in the cluster.

Duration

Configures the read concern. Supported values are: local|majority|linearizable|snapshot|available

string

Configures the read preferences. Supported values are: primary|primaryPreferred|secondary|secondaryPreferred|nearest

string

The database used during the readiness health checks

string

admin

Write concern

Type

Default

Configures the safety. If set to true: the driver ensures that all writes are acknowledged by the MongoDB server, or else throws an exception. (see also w and wtimeoutMS). If set fo - false: the driver does not ensure that all writes are acknowledged by the MongoDB server.

boolean

true

Configures the journal writing aspect. If set to true: the driver waits for the server to group commit to the journal file on disk. If set to false: the driver does not wait for the server to group commit to the journal file on disk.

boolean

true

When set, the driver adds w: wValue to all write commands. It requires safe to be true. The value is typically a number, but can also be the majority string.

string

If set to true, the driver will retry supported write operations if they fail due to a network error.

boolean

false

When set, the driver adds wtimeout : ms to all write commands. It requires safe to be true.

Duration

Configures the safety. If set to true: the driver ensures that all writes are acknowledged by the MongoDB server, or else throws an exception. (see also w and wtimeoutMS). If set fo - false: the driver does not ensure that all writes are acknowledged by the MongoDB server.

boolean

true

Configures the journal writing aspect. If set to true: the driver waits for the server to group commit to the journal file on disk. If set to false: the driver does not wait for the server to group commit to the journal file on disk.

boolean

true

When set, the driver adds w: wValue to all write commands. It requires safe to be true. The value is typically a number, but can also be the majority string.

string

If set to true, the driver will retry supported write operations if they fail due to a network error.

boolean

false

When set, the driver adds wtimeout : ms to all write commands. It requires safe to be true.

Duration

Credentials and authentication mechanism

Type

Default

Configures the username.

string

Configures the password.

string

Configures the authentication mechanism to use if a credential was supplied. The default is unspecified, in which case the client will pick the most secure mechanism available based on the sever version. For the GSSAPI and MONGODB-X509 mechanisms, no password is accepted, only the username. Supported values: null or GSSAPI|PLAIN|MONGODB-X509|SCRAM_SHA_1|SCRAM_SHA_256|MONGODB_AWS

string

Configures the source of the authentication credentials. This is typically the database that the credentials have been created. The value defaults to the database specified in the path portion of the connection string or in the 'database' configuration property.. If the database is specified in neither place, the default value is admin. This option is only respected when using the MONGO-CR mechanism (the default).

string

Allows passing authentication mechanism properties.

Map<String,String>

string

string

Configures the authentication mechanism to use if a credential was supplied. The default is unspecified, in which case the client will pick the most secure mechanism available based on the sever version. For the GSSAPI and MONGODB-X509 mechanisms, no password is accepted, only the username. Supported values: null or GSSAPI|PLAIN|MONGODB-X509|SCRAM_SHA_1|SCRAM_SHA_256|MONGODB_AWS

string

Configures the source of the authentication credentials. This is typically the database that the credentials have been created. The value defaults to the database specified in the path portion of the connection string or in the 'database' configuration property.. If the database is specified in neither place, the default value is admin. This option is only respected when using the MONGO-CR mechanism (the default).

string

Allows passing authentication mechanism properties.

Map<String,String>

Narayana JTA - Transaction manager

Type

Default

The node name used by the transaction manager

string

quarkus

Duration

60

The directory name of location of the transaction logs. If the value is not absolute then the directory is relative to the user.dir system property.

string

ObjectStore

Narayana LRA - LRA Participant Support

Type

Default

The REST endpoint on which a coordinator is running. In order for an LRA to begin and end successfully and in order to join with an existing LRA, this coordinator must be available whenever a service method annotated with @LRA is invoked. In this version of the extension, a failed coordinator with LRAs that have not yet finished must be restarted.

string

http://localhost:50000/lra-coordinator

Neo4j client

Type

Default

Whether a health check is published in case the smallrye-health extension is present.

boolean

true

If DevServices has been explicitly enabled or disabled. DevServices is generally enabled by default, unless there is an existing configuration present. When DevServices is enabled Quarkus will attempt to automatically configure and start a database when running in Dev or Test mode.

boolean

The container image name to use, for container based DevServices providers.

string

neo4j:4.3

The uri this driver should connect to. The driver supports bolt, bolt+routing or neo4j as schemes.

string

bolt://localhost:7687

If the driver should use encrypted traffic.

boolean

false

Additional environment entries that can be added to the container before its start.

Map<String,String>

Authentication

Type

Default

The login of the user connecting to the database.

string

neo4j

The password of the user connecting to the database.

string

neo4j

Set this to true to disable authentication.

boolean

false

Configure trust settings for encrypted traffic

Type

Default

Configures which trust strategy to apply when using encrypted traffic.

trust-all-certificates, trust-custom-ca-signed-certificates, trust-system-ca-signed-certificates

trust-system-ca-signed-certificates

The file of the certificate to use.

path

boolean

false

Connection pool

Type

Default

Flag, if metrics are enabled.

boolean

false

Flag, if leaked sessions logging is enabled.

boolean

false

The maximum amount of connections in the connection pool towards a single database.

int

100

Pooled connections that have been idle in the pool for longer than this timeout will be tested before they are used again. The value 0 means connections will always be tested for validity and negative values mean connections will never be tested.

Duration

-0.001S

Pooled connections older than this threshold will be closed and removed from the pool.

Duration

1H

Acquisition of new connections will be attempted for at most configured timeout.

Duration

1M

Netty

Type

Default

The value configuring the io.netty.allocator.maxOrder system property of Netty. The default value is 3. Configuring this property overrides the minimum maxOrder requested by the extensions. This property affects the memory consumption of the application. It must be used carefully. More details on https://programmer.group/pool-area-of-netty-memory-pool.html.

int

OpenID Connect

Type

Default

If DevServices has been explicitly enabled or disabled. When DevServices is enabled Quarkus will attempt to automatically configure and start Keycloak when running in Dev or Test mode and when Docker is running.

boolean

true

The container image name to use, for container based DevServices providers.

string

quay.io/keycloak/keycloak:15.0.2

Indicates if the Keycloak container managed by Quarkus Dev Services is shared. When shared, Quarkus looks for running containers using label-based service discovery. If a matching container is found, it is used, and so a second one is not started. Otherwise, Dev Services for Keycloak starts a new container. The discovery uses the quarkus-dev-service-label label. The value is configured using the service-name property. Container sharing is only used in dev mode.

boolean

true

The value of the quarkus-dev-service-keycloak label attached to the started container. This property is used when shared is set to true. In this case, before starting a container, Dev Services for Keycloak looks for a container with the quarkus-dev-service-keycloak label set to the configured value. If found, it will use this container instead of starting a new one. Otherwise it starts a new container with the quarkus-dev-service-keycloak label set to the specified value. Container sharing is only used in dev mode.

string

quarkus

The class or file system path to a Keycloak realm file which will be used to initialize Keycloak.

string

The JAVA_OPTS passed to the keycloak JVM

string

The Keycloak realm name. This property will be used to create the realm if the realm file pointed to by the 'realm-path' property does not exist, default value is 'quarkus' in this case. If the realm file pointed to by the 'realm-path' property exists then it is still recommended to set this property for Dev Services for Keycloak to avoid parsing the realm file in order to determine the realm name.

string

Indicates if the Keycloak realm has to be created when the realm file pointed to by the 'realm-path' property does not exist. Disable it if you’d like to create a realm using Keycloak Administration Console or Keycloak Admin API from io.quarkus.test.common.QuarkusTestResourceLifecycleManager.

boolean

true

Grant type which will be used to acquire a token to test the OIDC 'service' applications

client, password, code, implicit

code

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

The WebClient timeout. Use this property to configure how long an HTTP client will wait for a response when requesting tokens from Keycloak and sending them to the service endpoint.

Duration

4S

The Keycloak users map containing the user name and password pairs. If this map is empty then two users, 'alice' and 'bob' with the passwords matching their names will be created. This property will be used to create the Keycloak users if the realm file pointed to by the 'realm-path' property does not exist.

Map<String,String>

The Keycloak user roles. If this map is empty then a user named 'alice' will get 'admin' and 'user' roles and all other users will get a 'user' role. This property will be used to create the Keycloak roles if the realm file pointed to by the 'realm-path' property does not exist.

Map<String,String>

If the OIDC extension is enabled.

boolean

true

Enable the registration of the Default TokenIntrospection and UserInfo Cache implementation bean. Note it only allows to use the default implementation, one needs to configure it in order to activate it, please see OidcConfig#tokenCache.

boolean

true

The base URL of the OpenID Connect (OIDC) server, for example, https://host:port/auth. OIDC discovery endpoint will be called by default by appending a '.well-known/openid-configuration' path to this URL. Note if you work with Keycloak OIDC server, make sure the base URL is in the following format: https://host:port/auth/realms/{realm} where {realm} has to be replaced by the name of the Keycloak realm.

string

Enables OIDC discovery. If the discovery is disabled then the 'token-path' property must be configured.

boolean

true

Relative path of the OIDC token endpoint which issues access and refresh tokens using either 'client_credentials' or 'password' grants

string

The client-id of the application. Each application has a client-id that is used to identify the application

string

The maximum amount of time connecting to the currently unavailable OIDC server will be attempted for. The number of times the connection request will be repeated is calculated by dividing the value of this property by 2. For example, setting it to 20S will allow for requesting the connection up to 10 times with a 2 seconds delay between the retries. Note this property is only effective when the initial OIDC connection is created, for example, when requesting a well-known OIDC configuration. Use the 'connection-retry-count' property to support trying to re-establish an already available connection which may have been dropped.

Duration

The number of times an attempt to re-establish an already available connection will be repeated for. Note this property is different to the connection-delay property which is only effective during the initial OIDC connection creation. This property is used to try to recover the existing connection which may have been temporarily lost. For example, if a request to the OIDC token endpoint fails due to a connection exception then the request will be retried for a number of times configured by this property.

int

3

The amount of time after which the current OIDC connection request will time out.

Duration

10S

The maximum size of the connection pool used by the WebClient

int

Client secret which is used for a client_secret_basic authentication method. Note that a 'client-secret.value' can be used instead but both properties are mutually exclusive.

string

The client secret value - it will be ignored if 'secret.key' is set

string

The CredentialsProvider name which should only be set if more than one CredentialsProvider is registered

string

The CredentialsProvider client secret key

string

basic, post

If provided, indicates that JWT is signed using a secret key

string

The CredentialsProvider name which should only be set if more than one CredentialsProvider is registered

string

The CredentialsProvider client secret key

string

If provided, indicates that JWT is signed using a private key in PEM or JWK format

string

If provided, indicates that JWT is signed using a private key from a key store

string

A parameter to specify the password of the key store file. If not given, the default ("password") is used.

string

password

The private key id/alias

string

string

password

Key identifier of the signing key added as a JWT 'kid' header

string

JWT life-span in seconds. It will be added to the time it was issued at to calculate the expiration time.

int

10

The host (name or IP address) of the Proxy. Note: If OIDC adapter needs to use a Proxy to talk with OIDC server (Provider), then at least the "host" config item must be configured to enable the usage of a Proxy.

string

The port number of the Proxy. Default value is 80.

int

80

The username, if Proxy needs authentication.

string

The password, if Proxy needs authentication.

string

Certificate validation and hostname verification, which can be one of the following values from enum Verification. Default is required.

required, certificate-validation, none

An optional trust store which holds the certificate information of the certificates to trust

path

A parameter to specify the password of the trust store file.

string

A parameter to specify the alias of the trust store certificate.

string

A unique tenant identifier. It must be set by TenantConfigResolver providers which resolve the tenant configuration dynamically and is optional in all other cases.

string

If this tenant configuration is enabled.

boolean

true

The application type, which can be one of the following values from enum ApplicationType.

web-app, service, hybrid

service

Relative path of the OIDC authorization endpoint which authenticates the users. This property must be set for the 'web-app' applications if OIDC discovery is disabled. This property will be ignored if the discovery is enabled.

string

Relative path of the OIDC userinfo endpoint. This property must only be set for the 'web-app' applications if OIDC discovery is disabled and 'authentication.user-info-required' property is enabled. This property will be ignored if the discovery is enabled.

string

Relative path of the OIDC RFC7662 introspection endpoint which can introspect both opaque and JWT tokens. This property must be set if OIDC discovery is disabled and 1) the opaque bearer access tokens have to be verified or 2) JWT tokens have to be verified while the cached JWK verification set with no matching JWK is being refreshed. This property will be ignored if the discovery is enabled.

string

Relative path of the OIDC JWKS endpoint which returns a JSON Web Key Verification Set. This property should be set if OIDC discovery is disabled and the local JWT verification is required. This property will be ignored if the discovery is enabled.

string

Relative path of the OIDC end_session_endpoint. This property must be set if OIDC discovery is disabled and RP Initiated Logout support for the 'web-app' applications is required. This property will be ignored if the discovery is enabled.

string

Public key for the local JWT token verification. OIDC server connection will not be created when this property is set.

string

Path to the claim containing an array of groups. It starts from the top level JWT JSON object and can contain multiple segments where each segment represents a JSON object name only, example: "realm/groups". Use double quotes with the namespace qualified claim names. This property can be used if a token has no 'groups' claim but has the groups set in a different claim.

string

Separator for splitting a string which may contain multiple group values. It will only be used if the "role-claim-path" property points to a custom claim whose value is a string. A single space will be used by default because the standard 'scope' claim may contain a space separated sequence.

string

Source of the principal roles.

idtoken, accesstoken, userinfo

Expected issuer 'iss' claim value. Note this property overrides the issuer property which may be set in OpenId Connect provider’s well-known configuration. If the iss claim value varies depending on the host/IP address or tenant id of the provider then you may skip the issuer verification by setting this property to 'any' but it should be done only when other options (such as configuring the provider to use the fixed iss claim value) are not possible.

string

Expected audience 'aud' claim value which may be a string or an array of strings.

list of string

Expected token type

string

Life span grace period in seconds. When checking token expiry, current time is allowed to be later than token expiration time by at most the configured number of seconds. When checking token issuance, current time is allowed to be sooner than token issue time by at most the configured number of seconds.

int

Name of the claim which contains a principal name. By default, the 'upn', 'preferred_username' and sub claims are checked.

string

Refresh expired ID tokens. If this property is enabled then a refresh token request will be performed if the ID token has expired and, if successful, the local session will be updated with the new set of tokens. Otherwise, the local session will be invalidated and the user redirected to the OpenID Provider to re-authenticate. In this case the user may not be challenged again if the OIDC provider session is still active. For this option be effective the authentication.session-age-extension property should also be set to a non-zero value since the refresh token is currently kept in the user session. This option is valid only when the application is of type ApplicationType#WEB_APP}.

boolean

false

Refresh token time skew in seconds. If this property is enabled then the configured number of seconds is added to the current time when checking whether the access token should be refreshed. If the sum is greater than this access token’s expiration time then a refresh is going to happen. This property will be ignored if the 'refresh-expired' property is not enabled.

Duration

Forced JWK set refresh interval in minutes.

Duration

10M

Custom HTTP header that contains a bearer token. This option is valid only when the application is of type ApplicationType#SERVICE}.

string

Allow the remote introspection of JWT tokens when no matching JWK key is available. Note this property is set to 'true' by default for backward-compatibility reasons and will be set to false instead in one of the next releases. Also note this property will be ignored if JWK endpoint URI is not available and introspecting the tokens is the only verification option.

boolean

true

Allow the remote introspection of the opaque tokens. Set this property to 'false' if only JWT tokens are expected.

boolean

true

The relative path of the logout endpoint at the application. If provided, the application is able to initiate the logout through this endpoint in conformance with the OpenID Connect RP-Initiated Logout specification.

string

Relative path of the application endpoint where the user should be redirected to after logging out from the OpenID Connect Provider. This endpoint URI must be properly registered at the OpenID Connect Provider as a valid redirect URI.

string

Relative path for calculating a "redirect_uri" query parameter. It has to start from a forward slash and will be appended to the request URI’s host and port. For example, if the current request URI is 'https://localhost:8080/service' then a 'redirect_uri' parameter will be set to 'https://localhost:8080/' if this property is set to '/' and be the same as the request URI if this property has not been configured. Note the original request URI will be restored after the user has authenticated if 'restorePathAfterRedirect' is set to 'true'.

string

If this property is set to 'true' then the original request URI which was used before the authentication will be restored after the user has been redirected back to the application. Note if redirectPath property is not set the the original request URI will be restored even if this property is disabled.

boolean

false

Remove the query parameters such as 'code' and 'state' set by the OIDC server on the redirect URI after the user has authenticated by redirecting a user to the same URI but without the query parameters.

boolean

true

Both ID and access tokens are fetched from the OIDC provider as part of the authorization code flow. ID token is always verified on every user request as the primary token which is used to represent the principal and extract the roles. Access token is not verified by default since it is meant to be propagated to the downstream services. The verification of the access token should be enabled if it is injected as a JWT token. Access tokens obtained as part of the code flow will always be verified if quarkus.oidc.roles.source property is set to accesstoken which means the authorization decision will be based on the roles extracted from the access token. Bearer access tokens are always verified.

boolean

false

Force 'https' as the 'redirect_uri' parameter scheme when running behind an SSL terminating reverse proxy. This property, if enabled, will also affect the logout post_logout_redirect_uri and the local redirect requests.

boolean

false

list of string

If enabled the state, session and post logout cookies will have their 'secure' parameter set to 'true' when HTTP is used. It may be necessary when running behind an SSL terminating reverse proxy. The cookies will always be secure if HTTPS is used even if this property is set to false.

boolean

false

Cookie path parameter value which, if set, will be used to set a path parameter for the session, state and post logout cookies. The cookie-path-header property, if set, will be checked first.

string

/

Cookie path header parameter value which, if set, identifies the incoming HTTP header whose value will be used to set a path parameter for the session, state and post logout cookies. If the header is missing then the cookie-path property will be checked.

string

Cookie domain parameter value which, if set, will be used for the session, state and post logout cookies.

string

If this property is set to 'true' then an OIDC UserInfo endpoint will be called

boolean

false

Session age extension in minutes. The user session age property is set to the value of the ID token life-span by default and the user will be redirected to the OIDC provider to re-authenticate once the session has expired. If this property is set to a non-zero value then the expired ID token can be refreshed before the session has expired. This property will be ignored if the token.refresh-expired property has not been enabled.

Duration

5M

If this property is set to 'true' then a normal 302 redirect response will be returned if the request was initiated via JavaScript API such as XMLHttpRequest or Fetch and the current user needs to be (re)authenticated which may not be desirable for Single Page Applications since it automatically following the redirect may not work given that OIDC authorization endpoints typically do not support CORS. If this property is set to false then a status code of '499' will be returned to allow the client to handle the redirect manually

boolean

true

Default TokenStateManager strategy.

keep-all-tokens, id-token, id-refresh-tokens

keep-all-tokens

Default TokenStateManager keeps all tokens (ID, access and refresh) returned in the authorization code grant response in a single session cookie by default. Enable this property to minimize a session cookie size

boolean

false

Allow caching the token introspection data. Note enabling this property does not enable the cache itself but only permits to cache the token introspection for a given tenant. If the default token cache can be used then please see OidcConfig.TokenCache how to enable it.

boolean

true

Allow caching the user info data. Note enabling this property does not enable the cache itself but only permits to cache the user info data for a given tenant. If the default token cache can be used then please see OidcConfig.TokenCache how to enable it.

boolean

true

Maximum number of cache entries. Set it to a positive value if the cache has to be enabled.

int

0

Maximum amount of time a given cache entry is valid for.

Duration

3M

Clean up timer interval. If this property is set then a timer will check and remove the stale entries periodically.

Duration

Additional properties which will be added as the query parameters to the authentication redirect URI.

Map<String,String>

Additional named tenants

Type

Default

The base URL of the OpenID Connect (OIDC) server, for example, https://host:port/auth. OIDC discovery endpoint will be called by default by appending a '.well-known/openid-configuration' path to this URL. Note if you work with Keycloak OIDC server, make sure the base URL is in the following format: https://host:port/auth/realms/{realm} where {realm} has to be replaced by the name of the Keycloak realm.

string

Enables OIDC discovery. If the discovery is disabled then the 'token-path' property must be configured.

boolean

true

Relative path of the OIDC token endpoint which issues access and refresh tokens using either 'client_credentials' or 'password' grants

string

The client-id of the application. Each application has a client-id that is used to identify the application

string

The maximum amount of time connecting to the currently unavailable OIDC server will be attempted for. The number of times the connection request will be repeated is calculated by dividing the value of this property by 2. For example, setting it to 20S will allow for requesting the connection up to 10 times with a 2 seconds delay between the retries. Note this property is only effective when the initial OIDC connection is created, for example, when requesting a well-known OIDC configuration. Use the 'connection-retry-count' property to support trying to re-establish an already available connection which may have been dropped.

Duration

The number of times an attempt to re-establish an already available connection will be repeated for. Note this property is different to the connection-delay property which is only effective during the initial OIDC connection creation. This property is used to try to recover the existing connection which may have been temporarily lost. For example, if a request to the OIDC token endpoint fails due to a connection exception then the request will be retried for a number of times configured by this property.

int

3

The amount of time after which the current OIDC connection request will time out.

Duration

10S

The maximum size of the connection pool used by the WebClient

int

Client secret which is used for a client_secret_basic authentication method. Note that a 'client-secret.value' can be used instead but both properties are mutually exclusive.

string

The client secret value - it will be ignored if 'secret.key' is set

string

The CredentialsProvider name which should only be set if more than one CredentialsProvider is registered

string

The CredentialsProvider client secret key

string

basic, post

If provided, indicates that JWT is signed using a secret key

string

The CredentialsProvider name which should only be set if more than one CredentialsProvider is registered

string

The CredentialsProvider client secret key

string

If provided, indicates that JWT is signed using a private key in PEM or JWK format

string

If provided, indicates that JWT is signed using a private key from a key store

string

A parameter to specify the password of the key store file. If not given, the default ("password") is used.

string

password

string

string

password

Key identifier of the signing key added as a JWT 'kid' header

string

JWT life-span in seconds. It will be added to the time it was issued at to calculate the expiration time.

int

10

The host (name or IP address) of the Proxy. Note: If OIDC adapter needs to use a Proxy to talk with OIDC server (Provider), then at least the "host" config item must be configured to enable the usage of a Proxy.

string

The port number of the Proxy. Default value is 80.

int

80

The username, if Proxy needs authentication.

string

The password, if Proxy needs authentication.

string

Certificate validation and hostname verification, which can be one of the following values from enum Verification. Default is required.

required, certificate-validation, none

An optional trust store which holds the certificate information of the certificates to trust

path

A parameter to specify the password of the trust store file.

string

A parameter to specify the alias of the trust store certificate.

string

A unique tenant identifier. It must be set by TenantConfigResolver providers which resolve the tenant configuration dynamically and is optional in all other cases.

string

If this tenant configuration is enabled.

boolean

true

The application type, which can be one of the following values from enum ApplicationType.

web-app, service, hybrid

service

Relative path of the OIDC authorization endpoint which authenticates the users. This property must be set for the 'web-app' applications if OIDC discovery is disabled. This property will be ignored if the discovery is enabled.

string

Relative path of the OIDC userinfo endpoint. This property must only be set for the 'web-app' applications if OIDC discovery is disabled and 'authentication.user-info-required' property is enabled. This property will be ignored if the discovery is enabled.

string

Relative path of the OIDC RFC7662 introspection endpoint which can introspect both opaque and JWT tokens. This property must be set if OIDC discovery is disabled and 1) the opaque bearer access tokens have to be verified or 2) JWT tokens have to be verified while the cached JWK verification set with no matching JWK is being refreshed. This property will be ignored if the discovery is enabled.

string

Relative path of the OIDC JWKS endpoint which returns a JSON Web Key Verification Set. This property should be set if OIDC discovery is disabled and the local JWT verification is required. This property will be ignored if the discovery is enabled.

string

Relative path of the OIDC end_session_endpoint. This property must be set if OIDC discovery is disabled and RP Initiated Logout support for the 'web-app' applications is required. This property will be ignored if the discovery is enabled.

string

Public key for the local JWT token verification. OIDC server connection will not be created when this property is set.

string

Path to the claim containing an array of groups. It starts from the top level JWT JSON object and can contain multiple segments where each segment represents a JSON object name only, example: "realm/groups". Use double quotes with the namespace qualified claim names. This property can be used if a token has no 'groups' claim but has the groups set in a different claim.

string

Separator for splitting a string which may contain multiple group values. It will only be used if the "role-claim-path" property points to a custom claim whose value is a string. A single space will be used by default because the standard 'scope' claim may contain a space separated sequence.

string

Source of the principal roles.

idtoken, accesstoken, userinfo

Expected issuer 'iss' claim value. Note this property overrides the issuer property which may be set in OpenId Connect provider’s well-known configuration. If the iss claim value varies depending on the host/IP address or tenant id of the provider then you may skip the issuer verification by setting this property to 'any' but it should be done only when other options (such as configuring the provider to use the fixed iss claim value) are not possible.

string

Expected audience 'aud' claim value which may be a string or an array of strings.

list of string

string

Life span grace period in seconds. When checking token expiry, current time is allowed to be later than token expiration time by at most the configured number of seconds. When checking token issuance, current time is allowed to be sooner than token issue time by at most the configured number of seconds.

int

Name of the claim which contains a principal name. By default, the 'upn', 'preferred_username' and sub claims are checked.

string

Refresh expired ID tokens. If this property is enabled then a refresh token request will be performed if the ID token has expired and, if successful, the local session will be updated with the new set of tokens. Otherwise, the local session will be invalidated and the user redirected to the OpenID Provider to re-authenticate. In this case the user may not be challenged again if the OIDC provider session is still active. For this option be effective the authentication.session-age-extension property should also be set to a non-zero value since the refresh token is currently kept in the user session. This option is valid only when the application is of type ApplicationType#WEB_APP}.

boolean

false

Refresh token time skew in seconds. If this property is enabled then the configured number of seconds is added to the current time when checking whether the access token should be refreshed. If the sum is greater than this access token’s expiration time then a refresh is going to happen. This property will be ignored if the 'refresh-expired' property is not enabled.

Duration

Forced JWK set refresh interval in minutes.

Duration

10M

Custom HTTP header that contains a bearer token. This option is valid only when the application is of type ApplicationType#SERVICE}.

string

Allow the remote introspection of JWT tokens when no matching JWK key is available. Note this property is set to 'true' by default for backward-compatibility reasons and will be set to false instead in one of the next releases. Also note this property will be ignored if JWK endpoint URI is not available and introspecting the tokens is the only verification option.

boolean

true

Allow the remote introspection of the opaque tokens. Set this property to 'false' if only JWT tokens are expected.

boolean

true

The relative path of the logout endpoint at the application. If provided, the application is able to initiate the logout through this endpoint in conformance with the OpenID Connect RP-Initiated Logout specification.

string

Relative path of the application endpoint where the user should be redirected to after logging out from the OpenID Connect Provider. This endpoint URI must be properly registered at the OpenID Connect Provider as a valid redirect URI.

string

Relative path for calculating a "redirect_uri" query parameter. It has to start from a forward slash and will be appended to the request URI’s host and port. For example, if the current request URI is 'https://localhost:8080/service' then a 'redirect_uri' parameter will be set to 'https://localhost:8080/' if this property is set to '/' and be the same as the request URI if this property has not been configured. Note the original request URI will be restored after the user has authenticated if 'restorePathAfterRedirect' is set to 'true'.

string

If this property is set to 'true' then the original request URI which was used before the authentication will be restored after the user has been redirected back to the application. Note if redirectPath property is not set the the original request URI will be restored even if this property is disabled.

boolean

false

Remove the query parameters such as 'code' and 'state' set by the OIDC server on the redirect URI after the user has authenticated by redirecting a user to the same URI but without the query parameters.

boolean

true

Both ID and access tokens are fetched from the OIDC provider as part of the authorization code flow. ID token is always verified on every user request as the primary token which is used to represent the principal and extract the roles. Access token is not verified by default since it is meant to be propagated to the downstream services. The verification of the access token should be enabled if it is injected as a JWT token. Access tokens obtained as part of the code flow will always be verified if quarkus.oidc.roles.source property is set to accesstoken which means the authorization decision will be based on the roles extracted from the access token. Bearer access tokens are always verified.

boolean

false

Force 'https' as the 'redirect_uri' parameter scheme when running behind an SSL terminating reverse proxy. This property, if enabled, will also affect the logout post_logout_redirect_uri and the local redirect requests.

boolean

false

list of string

Additional properties which will be added as the query parameters to the authentication redirect URI.

Map<String,String>

If enabled the state, session and post logout cookies will have their 'secure' parameter set to 'true' when HTTP is used. It may be necessary when running behind an SSL terminating reverse proxy. The cookies will always be secure if HTTPS is used even if this property is set to false.

boolean

false

Cookie path parameter value which, if set, will be used to set a path parameter for the session, state and post logout cookies. The cookie-path-header property, if set, will be checked first.

string

/

Cookie path header parameter value which, if set, identifies the incoming HTTP header whose value will be used to set a path parameter for the session, state and post logout cookies. If the header is missing then the cookie-path property will be checked.

string

Cookie domain parameter value which, if set, will be used for the session, state and post logout cookies.

string

If this property is set to 'true' then an OIDC UserInfo endpoint will be called

boolean

false

Session age extension in minutes. The user session age property is set to the value of the ID token life-span by default and the user will be redirected to the OIDC provider to re-authenticate once the session has expired. If this property is set to a non-zero value then the expired ID token can be refreshed before the session has expired. This property will be ignored if the token.refresh-expired property has not been enabled.

Duration

5M

If this property is set to 'true' then a normal 302 redirect response will be returned if the request was initiated via JavaScript API such as XMLHttpRequest or Fetch and the current user needs to be (re)authenticated which may not be desirable for Single Page Applications since it automatically following the redirect may not work given that OIDC authorization endpoints typically do not support CORS. If this property is set to false then a status code of '499' will be returned to allow the client to handle the redirect manually

boolean

true

Default TokenStateManager strategy.

keep-all-tokens, id-token, id-refresh-tokens

keep-all-tokens

Default TokenStateManager keeps all tokens (ID, access and refresh) returned in the authorization code grant response in a single session cookie by default. Enable this property to minimize a session cookie size

boolean

false

Allow caching the token introspection data. Note enabling this property does not enable the cache itself but only permits to cache the token introspection for a given tenant. If the default token cache can be used then please see OidcConfig.TokenCache how to enable it.

boolean

true

Allow caching the user info data. Note enabling this property does not enable the cache itself but only permits to cache the user info data for a given tenant. If the default token cache can be used then please see OidcConfig.TokenCache how to enable it.

boolean

true

OpenID Connect Client

Type

Default

If the OIDC client extension is enabled.

boolean

true

The base URL of the OpenID Connect (OIDC) server, for example, https://host:port/auth. OIDC discovery endpoint will be called by default by appending a '.well-known/openid-configuration' path to this URL. Note if you work with Keycloak OIDC server, make sure the base URL is in the following format: https://host:port/auth/realms/{realm} where {realm} has to be replaced by the name of the Keycloak realm.

string

Enables OIDC discovery. If the discovery is disabled then the 'token-path' property must be configured.

boolean

true

Relative path of the OIDC token endpoint which issues access and refresh tokens using either 'client_credentials' or 'password' grants

string

The client-id of the application. Each application has a client-id that is used to identify the application

string

The maximum amount of time connecting to the currently unavailable OIDC server will be attempted for. The number of times the connection request will be repeated is calculated by dividing the value of this property by 2. For example, setting it to 20S will allow for requesting the connection up to 10 times with a 2 seconds delay between the retries. Note this property is only effective when the initial OIDC connection is created, for example, when requesting a well-known OIDC configuration. Use the 'connection-retry-count' property to support trying to re-establish an already available connection which may have been dropped.

Duration

The number of times an attempt to re-establish an already available connection will be repeated for. Note this property is different to the connection-delay property which is only effective during the initial OIDC connection creation. This property is used to try to recover the existing connection which may have been temporarily lost. For example, if a request to the OIDC token endpoint fails due to a connection exception then the request will be retried for a number of times configured by this property.

int

3

The amount of time after which the current OIDC connection request will time out.

Duration

10S

The maximum size of the connection pool used by the WebClient

int

Client secret which is used for a client_secret_basic authentication method. Note that a 'client-secret.value' can be used instead but both properties are mutually exclusive.

string

The client secret value - it will be ignored if 'secret.key' is set

string

The CredentialsProvider name which should only be set if more than one CredentialsProvider is registered

string

The CredentialsProvider client secret key

string

basic, post

If provided, indicates that JWT is signed using a secret key

string

The CredentialsProvider name which should only be set if more than one CredentialsProvider is registered

string

The CredentialsProvider client secret key

string

If provided, indicates that JWT is signed using a private key in PEM or JWK format

string

If provided, indicates that JWT is signed using a private key from a key store

string

A parameter to specify the password of the key store file. If not given, the default ("password") is used.

string

password

string

string

password

Key identifier of the signing key added as a JWT 'kid' header

string

JWT life-span in seconds. It will be added to the time it was issued at to calculate the expiration time.

int

10

The host (name or IP address) of the Proxy. Note: If OIDC adapter needs to use a Proxy to talk with OIDC server (Provider), then at least the "host" config item must be configured to enable the usage of a Proxy.

string

The port number of the Proxy. Default value is 80.

int

80

The username, if Proxy needs authentication.

string

The password, if Proxy needs authentication.

string

Certificate validation and hostname verification, which can be one of the following values from enum Verification. Default is required.

required, certificate-validation, none

An optional trust store which holds the certificate information of the certificates to trust

path

A parameter to specify the password of the trust store file.

string

A parameter to specify the alias of the trust store certificate.

string

A unique OIDC client identifier. It must be set when OIDC clients are created dynamically and is optional in all other cases.

string

If this client configuration is enabled.

boolean

true

List of access token scopes

list of string

Refresh token time skew in seconds. If this property is enabled then the configured number of seconds is added to the current time when checking whether the access token should be refreshed. If the sum is greater than this access token’s expiration time then a refresh is going to happen.

Duration

client, password, code, exchange, refresh

client

Access token property name in a token grant response

string

access_token

Refresh token property name in a token grant response

string

refresh_token

Refresh token property name in a token grant response

string

expires_in

Requires that all filters which use 'OidcClient' acquire the tokens at the post-construct initialization time, possibly long before these tokens are used. This property should be disabled if the access token may expire before it is used for the first time and no refresh token is available.

boolean

true

Map<String,Map<String,String>>

Custom HTTP headers which have to be sent to the token endpoint

Map<String,String>

Additional named clients

Type

Default

The base URL of the OpenID Connect (OIDC) server, for example, https://host:port/auth. OIDC discovery endpoint will be called by default by appending a '.well-known/openid-configuration' path to this URL. Note if you work with Keycloak OIDC server, make sure the base URL is in the following format: https://host:port/auth/realms/{realm} where {realm} has to be replaced by the name of the Keycloak realm.

string

Enables OIDC discovery. If the discovery is disabled then the 'token-path' property must be configured.

boolean

true

Relative path of the OIDC token endpoint which issues access and refresh tokens using either 'client_credentials' or 'password' grants

string

The client-id of the application. Each application has a client-id that is used to identify the application

string

The maximum amount of time connecting to the currently unavailable OIDC server will be attempted for. The number of times the connection request will be repeated is calculated by dividing the value of this property by 2. For example, setting it to 20S will allow for requesting the connection up to 10 times with a 2 seconds delay between the retries. Note this property is only effective when the initial OIDC connection is created, for example, when requesting a well-known OIDC configuration. Use the 'connection-retry-count' property to support trying to re-establish an already available connection which may have been dropped.

Duration

The number of times an attempt to re-establish an already available connection will be repeated for. Note this property is different to the connection-delay property which is only effective during the initial OIDC connection creation. This property is used to try to recover the existing connection which may have been temporarily lost. For example, if a request to the OIDC token endpoint fails due to a connection exception then the request will be retried for a number of times configured by this property.

int

3

The amount of time after which the current OIDC connection request will time out.

Duration

10S

The maximum size of the connection pool used by the WebClient

int

Client secret which is used for a client_secret_basic authentication method. Note that a 'client-secret.value' can be used instead but both properties are mutually exclusive.

string

The client secret value - it will be ignored if 'secret.key' is set

string

The CredentialsProvider name which should only be set if more than one CredentialsProvider is registered

string

The CredentialsProvider client secret key

string

basic, post

If provided, indicates that JWT is signed using a secret key

string

The CredentialsProvider name which should only be set if more than one CredentialsProvider is registered

string

The CredentialsProvider client secret key

string

If provided, indicates that JWT is signed using a private key in PEM or JWK format

string

If provided, indicates that JWT is signed using a private key from a key store

string

A parameter to specify the password of the key store file. If not given, the default ("password") is used.

string

password

string

string

password

Key identifier of the signing key added as a JWT 'kid' header

string

JWT life-span in seconds. It will be added to the time it was issued at to calculate the expiration time.

int

10

The host (name or IP address) of the Proxy. Note: If OIDC adapter needs to use a Proxy to talk with OIDC server (Provider), then at least the "host" config item must be configured to enable the usage of a Proxy.

string

The port number of the Proxy. Default value is 80.

int

80

The username, if Proxy needs authentication.

string

The password, if Proxy needs authentication.

string

Certificate validation and hostname verification, which can be one of the following values from enum Verification. Default is required.

required, certificate-validation, none

An optional trust store which holds the certificate information of the certificates to trust

path

A parameter to specify the password of the trust store file.

string

A parameter to specify the alias of the trust store certificate.

string

A unique OIDC client identifier. It must be set when OIDC clients are created dynamically and is optional in all other cases.

string

If this client configuration is enabled.

boolean

true

List of access token scopes

list of string

Refresh token time skew in seconds. If this property is enabled then the configured number of seconds is added to the current time when checking whether the access token should be refreshed. If the sum is greater than this access token’s expiration time then a refresh is going to happen.

Duration

client, password, code, exchange, refresh

client

Access token property name in a token grant response

string

access_token

Refresh token property name in a token grant response

string

refresh_token

Refresh token property name in a token grant response

string

expires_in

Map<String,Map<String,String>>

Requires that all filters which use 'OidcClient' acquire the tokens at the post-construct initialization time, possibly long before these tokens are used. This property should be disabled if the access token may expire before it is used for the first time and no refresh token is available.

boolean

true

Custom HTTP headers which have to be sent to the token endpoint

Map<String,String>

OpenID Connect Client Filter

Type

Default

Enable OidcClientRequestFilter for all the injected MP RestClient implementations. If this property is disabled then OidcClientRequestFilter has to be registered as an MP RestClient provider.

boolean

false

Name of the configured OidcClient.

string

OpenID Connect Client Filter Reactive

Type

Default

Name of the configured OidcClient.

string

OpenID Connect Token Propagation

Type

Default

If the OIDC Token Propagation is enabled.

boolean

true

Enable either AccessTokenRequestFilter or JsonWebTokenRequestFilter for all the injected MP RestClient implementations. AccessTokenRequestFilter can propagate both opaque (binary) and JsonWebToken tokens but it can not modify and secure the updated JsonWebToken tokens. JsonWebTokenRequestFilter can only propagate JsonWebToken tokens but it can also modify and secure them again. Enable the 'jsonWebToken' property to have JsonWebTokenRequestFilter registered. Alternatively, instead of using this property for registering these filters with all the injected MP RestClient implementations, both filters can be registered as MP RestClient providers with the specific MP RestClient implementations.

boolean

false

Enable JsonWebTokenRequestFilter instead of AccessTokenRequestFilter for all the injected MP RestClient implementations. This filter can propagate as well as modify and secure the updated JsonWebToken tokens. Note this property is ignored unless the 'registerFilter' property is enabled.

boolean

false

Secure the injected and possibly modified JsonWebToken. For example, a JsonWebToken produced and signed by OpenId Connect provider can be re-signed using a new private key. Note this property is injected into JsonWebTokenRequestFilter.

boolean

false

Exchange the current token with OpenId Connect Provider for a new token before propagating it. Note this property is injected into AccessTokenRequestFilter.

boolean

false

Name of the configured OidcClient. Note this property is injected into AccessTokenRequestFilter and is only used if the exchangeToken property is enabled.

string

OpenTelemetry

Type

Default

OpenTelemetry support. OpenTelemetry support is enabled by default.

boolean

true

Comma separated list of OpenTelemetry propagators which must be supported. Valid values are b3, b3multi, baggage, jaeger, ottrace, tracecontext, xray. Default value is traceContext,baggage.

list of string

tracecontext,baggage

Support for tracing with OpenTelemetry. Support for tracing will be enabled if OpenTelemetry support is enabled and either this value is true, or this value is unset.

boolean

A comma separated list of name=value resource attributes that represents the entity producing telemetry (eg. service.name=authservice).

list of string

The sampler to use for tracing. Valid values are off, on, ratio. Defaults to on.

string

on

double

If the sampler to use for tracing is parent based. Valid values are true, false. Defaults to true.

boolean

true

Suppress non-application uris from trace collection. This will suppress tracing of /q endpoints. Providing a custom io.opentelemetry.sdk.trace.samplers.Sampler CDI Bean will ignore this setting. Suppressing non-application uris is enabled by default.

boolean

true

OpenTelemetry exporter: Jaeger

Type

Default

Jaeger SpanExporter support. Jaeger SpanExporter support is enabled by default.

boolean

true

The Jaeger endpoint to connect to. The endpoint must start with either http:// or https://.

string

The maximum amount of time to wait for the collector to process exported spans before an exception is thrown. A value of 0 will disable the timeout: the exporter will continue waiting until either exported spans are processed, or the connection fails, or is closed for some other reason.

Duration

10S

OpenTelemetry exporter: OTLP

Type

Default

OTLP SpanExporter support. OTLP SpanExporter support is enabled by default.

boolean

true

The OTLP endpoint to connect to. The endpoint must start with either http:// or https://.

string

Key-value pairs to be used as headers associated with gRPC requests. The format is similar to the OTEL_EXPORTER_OTLP_HEADERS environment variable, a list of key-value pairs separated by the "=" character. See Specifying headers for more details.

list of string

The maximum amount of time to wait for the collector to process exported spans before an exception is thrown. A value of 0 will disable the timeout: the exporter will continue waiting until either exported spans are processed, or the connection fails, or is closed for some other reason.

Duration

10S

Compression method to be used by exporter to compress the payload. See Configuration Options for the supported compression methods.

string

Picocli

Type

Default

Set this to false to use the picocli-codegen annotation processor instead of build steps. CAUTION: this will have serious build-time performance impact since this is run on every restart in devmode, use with care! This property is intended to be used only in cases where an incompatible change in the picocli library causes problems in the build steps used to support GraalVM Native images. In such cases this property allows users to make the trade-off between fast build cycles with the older version of picocli, and temporarily accept slower build cycles with the latest version of picocli until the updated extension is available.

boolean

true

Name of bean annotated with io.quarkus.picocli.runtime.annotations.TopCommand or FQCN of class which will be used as entry point for Picocli CommandLine instance. This class needs to be annotated with picocli.CommandLine.Command.

string

Quarkus - Core

Type

Default

The set of supported locales that can be consumed by the extensions. The locales must be specified in the IETF BCP 47 format e.g. en-US or fr-FR. For instance, the Hibernate Validator extension makes use of it.

list of Locale

${user.language:en}-${user.country:}

Default locale that can be consumed by the extensions. The locales must be specified in the IETF BCP 47 format e.g. en-US or fr-FR. For instance, the Hibernate Validator extension makes use of it.

Locale

${user.language:en}-${user.country:}

Additional config locations to be loaded with the Config. The configuration support multiple locations separated by a comma and each must represent a valid java.net.URI.

list of string

Accepts a single configuration profile name. If a configuration property cannot be found in the current active profile, the config performs the same lookup in the profile set by this configuration.

string

A property that allows accessing a generated UUID. It generates that UUID at startup time. So it changes between two starts including in dev mode. Access this generated UUID using expressions: ${quarkus.uuid}.

string

Profile that will be active when Quarkus launches Default value is 'prod'

string

The arguments passed to the command line. We don’t make it a list as the args are separated by a space, not a comma.

string

The name of the application. If not set, defaults to the name of the project (except for tests where it is not set at all).

string

The version of the application. If not set, defaults to the version of the project (except for tests where it is not set at all).

string

The path of the banner (path relative to root of classpath) which could be provided by user

string

default_banner.txt

Whether or not the banner will be displayed

boolean

true

If set to true, the workspace initialization will be based on the effective POMs (i.e. properly interpolated, including support for profiles, etc) instead of the raw ones.

boolean

false

Whether to throw an error, warn or silently ignore misaligned platform BOM imports

error, warn, ignore

error

Artifacts that are loaded in a parent first manner. This can be used to work around issues where a given class needs to be loaded by the system ClassLoader. Note that if you make a library parent first all its dependencies should generally also be parent first. Artifacts should be configured as a comma separated list of artifact ids, with the group, artifact-id and optional classifier separated by a colon. WARNING: This config property can only be set in application.properties

list of string

Artifacts that are loaded in the runtime ClassLoader in dev mode, so they will be dropped and recreated on change. This is an advanced option, it should only be used if you have a problem with libraries holding stale state between reloads. Note that if you use this any library that depends on the listed libraries will also need to be reloadable. This setting has no impact on production builds. Artifacts should be configured as a comma separated list of artifact ids, with the group, artifact-id and optional classifier separated by a colon. WARNING: This config property can only be set in application.properties

string

Artifacts that will never be loaded by the class loader, and will not be packed into the final application. This allows you to explicitly remove artifacts from your application even though they may be present on the class path.

list of string

Resources that should be removed/hidden from dependencies. This allows for classes and other resources to be removed from dependencies, so they are not accessible to the application. This is a map of artifact id (in the form group:artifact) to a list of resources to be removed. When running in dev and test mode these resources are hidden from the ClassLoader, when running in production mode these files are removed from the jars that contain them. Note that if you want to remove a class you need to specify the class file name. e.g. to remove com.acme.Foo you would specify com/acme/Foo.class. Note that for technical reasons this is not supported when running with JBang.

Map<String,Set<String>>

What should happen if the application is started with a different build time configuration than it was compiled against. This may be useful to prevent misconfiguration. If this is set to warn the application will warn at start up. If this is set to fail the application will fail at start up. Native tests leveraging`@io.quarkus.test.junit.TestProfile` are always run with quarkus.configuration.build-time-mismatch-at-runtime = fail.

warn, fail

warn

If test results and status should be displayed in the console. If this is false results can still be viewed in the dev console.

boolean

true

Disables the ability to enter input on the console.

boolean

false

Disable the testing status/prompt message at the bottom of the console and log these messages to STDOUT instead. Use this option if your terminal does not support ANSI escape sequences.

boolean

false

If color should be enabled or disabled. If this is not present then an attempt will be made to guess if the terminal supports color

boolean

If set to true, writes a list of all reflective classes to META-INF

boolean

false

If set to a directory, all generated classes will be written into that directory

string

Global flag that can be used to disable all Dev Services. If this is set to false then Dev Services will not be used.

boolean

true

The Ide to use to open files from the DevUI. auto means that Quarkus will attempt to determine the Ide being used.

auto, idea, vscode, eclipse, netbeans

auto

Paths of library to load.

list of string

Whether or not Quarkus should enable its ability to not do a full restart when changes to classes are compatible with JVM instrumentation. If this is set to true, Quarkus will perform class redefinition when possible.

boolean

false

The names of additional resource files to watch for changes, triggering a reload on change. Directories are not supported.

list of string

Password used to use to connect to the remote dev-mode application

string

URL used to use to connect to the remote dev-mode application

string

The amount of time to wait for a remote dev connect or reconnect

Duration

30S

The amount of time to wait between attempts when connecting to the server side of remote dev

Duration

2S

The maximum number of attempts when connecting to the server side of remote dev

int

10

Whether or not logging metrics are published in case a metrics extension is present.

boolean

false

The default minimum log level.

Level

DEBUG

The log level of the root category, which is used as the default log level for all categories.

JBoss Logging supports Apache style log levels:

  • {@link org.jboss.logmanager.Level#FATAL}

  • {@link org.jboss.logmanager.Level#ERROR}

  • {@link org.jboss.logmanager.Level#WARN}

  • {@link org.jboss.logmanager.Level#INFO}

  • {@link org.jboss.logmanager.Level#DEBUG}

  • {@link org.jboss.logmanager.Level#TRACE}

In addition, it also supports the standard JDK log levels.

Level

INFO

Comma-separated, additional arguments to pass to the build process. If an argument includes the , symbol, it needs to be escaped, e.g. \\,

list of string

If the HTTP url handler should be enabled, allowing you to do URL.openConnection() for HTTP URLs

boolean

true

If the HTTPS url handler should be enabled, allowing you to do URL.openConnection() for HTTPS URLs

boolean

false

If all security services should be added to the native image

boolean

false

If -H:+InlineBeforeAnalysis flag will be added to the native-image run

boolean

true

Defines the user language used for building the native executable. Defaults to the system one.

string

${user.language:}

Defines the user country used for building the native executable. Defaults to the system one.

string

${user.country:}

Defines the file encoding as in -Dfile.encoding=…​ Native image runtime uses the host’s (i.e. build time) value of file.encoding system property. We intentionally default this to UTF-8 to avoid platform specific defaults to be picked up which can then result in inconsistent behavior in the generated native executable.

string

UTF-8

If all character sets should be added to the native image. This increases image size

boolean

false

The location of the Graal distribution

string

${GRAALVM_HOME:}

The location of the JDK

File

${java.home}

The maximum Java heap to be used during the native image generation

string

If the native image build should wait for a debugger to be attached before running. This is an advanced option and is generally only intended for those familiar with GraalVM internals

boolean

false

If the debug port should be published when building with docker and debug-build-process is true

boolean

true

If isolates should be enabled

boolean

true

If a JVM based 'fallback image' should be created if native image fails. This is not recommended, as this is functionally the same as just running the application in a JVM

boolean

false

If all META-INF/services entries should be automatically registered

boolean

false

If the bytecode of all proxies should be dumped for inspection

boolean

false

If this build should be done using a container runtime. Unless container-runtime is also set, docker will be used by default. If docker is not available or is an alias to podman, podman will be used instead as the default.

boolean

If this build is done using a remote docker daemon.

boolean

false

The docker image to use to do the image build

string

${platform.quarkus.native.builder-image}

The container runtime (e.g. docker) that is used to do an image based build. If this is set then a container build is always done.

docker, podman

Options to pass to the container runtime

list of string

If the resulting image should allow VM introspection

boolean

false

If full stack traces are enabled in the resulting image

boolean

true

If the reports on call paths and included packages/classes/methods should be generated

boolean

false

If exceptions should be reported with a full stack trace

boolean

true

If errors should be reported at runtime. This is a more relaxed setting, however it is not recommended as it means your application may fail at runtime if an unsupported feature is used by accident.

boolean

false

Don’t build a native image if it already exists. This is useful if you have already built an image and you want to use Quarkus to deploy it somewhere. Note that this is not able to detect if the existing image is outdated, if you have modified source or config and want a new image you must not use this flag.

boolean

false

A comma separated list of globs to match resource paths that should be added to the native image. Use slash (/) as a path separator on all platforms. Globs must not start with slash. By default, no resources are included. Example: Given that you have src/main/resources/ignored.png and src/main/resources/foo/selected.png in your source tree and one of your dependency JARs contains bar/some.txt file, with the following configuration quarkus.native.resources.includes = foo/**,bar/**/*.txt the files src/main/resources/foo/selected.png and bar/some.txt will be included in the native image, while src/main/resources/ignored.png will not be included. Supported glob features Feature Description * Matches a (possibly empty) sequence of characters that does not contain slash (/) ** Matches a (possibly empty) sequence of characters that may contain slash (/) ? Matches one character, but not slash [abc] Matches one character given in the bracket, but not slash [a-z] Matches one character from the range given in the bracket, but not slash [!abc] Matches one character not named in the bracket; does not match slash [a-z] Matches one character outside the range given in the bracket; does not match slash {one,two,three} Matches any of the alternating tokens separated by comma; the tokens may contain wildcards, nested alternations and ranges \ The escape character Note that there are three levels of escaping when passing this option via application.properties: . application.properties parser - MicroProfile Config list converter that splits the comma separated list - Glob parser All three levels use backslash (\) as the escaping character. So you need to use an appropriate number of backslashes depending on which level you want to escape. Note that Quarkus extensions typically include the resources they require by themselves. This option is useful in situations when the built-in functionality is not sufficient.

list of string

A comma separated list of globs to match resource paths that should not be added to the native image. Use slash (/) as a path separator on all platforms. Globs must not start with slash. Please refer to includes for details about the glob syntax. By default, no resources are excluded. Example: Given that you have src/main/resources/red.png and src/main/resources/foo/green.png in your source tree and one of your dependency JARs contains bar/blue.png file, with the following configuration quarkus.native.resources.includes = **/*.png quarkus.native.resources.excludes = foo/**,**/green.png the resource red.png will be available in the native image while the resources foo/green.png and bar/blue.png will not be available in the native image.

list of string

If debug is enabled and debug symbols are generated. The symbols will be generated in a separate .debug file.

boolean

false

Generate the report files for GraalVM Dashboard.

boolean

false

The requested output type. The default built in types are 'jar' (which will use 'fast-jar'), 'legacy-jar' for the pre-1.12 default jar packaging, 'uber-jar', 'native' and 'native-sources'.

string

jar

If the Implementation information should be included in the runner jar’s MANIFEST.MF.

boolean

true

The entry point of the application. This can either be a a fully qualified name of a standard Java class with a main method, or io.quarkus.runtime.QuarkusApplication. If your application has main classes annotated with io.quarkus.runtime.annotations.QuarkusMain then this can also reference the name given in the annotation, to avoid the need to specify fully qualified names in the config.

string

Files that should not be copied to the output artifact

list of string

List of all the dependencies that have been defined as optional to include into the final package of the application. Each optional dependency needs to be expressed in the following format: groupId:artifactId:classifier:type With the classifier and type being optional. If the type is missing, the artifact is assumed to be of type jar. This parameter is optional, if absent, no optional dependencies will be included into the final package of the application. For backward compatibility reasons, this parameter is ignored by default and can be enabled by setting the parameter quarkus.package.filter-optional-dependencies to true. This parameter is meant to be used in modules where multi-builds have been configured to avoid getting a final package with unused dependencies.

list of string

Flag indicating whether the optional dependencies should be filtered out or not. This parameter is meant to be used in modules where multi-builds have been configured to avoid getting a final package with unused dependencies.

boolean

false

The suffix that is applied to the runner jar and native images

string

-runner

The output folder in which to place the output, this is resolved relative to the build systems target directory.

string

The name of the final artifact

string

Whether to automate the creation of AppCDS. This has not effect when a native binary is needed and will be ignored in that case. Furthermore, this option only works for Java 11+ and is considered experimental for the time being. Finally, care must be taken to use the same exact JVM version when building and running the application.

boolean

false

When AppCDS generation is enabled, if this property is set, then the JVM used to generate the AppCDS file will be the JVM present in the container image. The builder image is expected to have have the 'java' binary on its PATH. This flag is useful when the JVM to be used at runtime is not the same exact JVM version as the one used to build the jar. Note that this property is consulted only when quarkus.package.create-appcds=true and it requires having docker available during the build.

string

This is an advanced option that only takes effect for the mutable-jar format. If this is specified a directory of this name will be created in the jar distribution. Users can place jar files in this directory, and when re-augmentation is performed these will be processed and added to the class-path. Note that before reaugmentation has been performed these jars will be ignored, and if they are updated the app should be reaugmented again.

string

This option only applies when using fast-jar or mutable-jar. If this option is true then a list of all the coordinates of the artifacts that made up this image will be included in the quarkus-app directory. This list can be used by vulnerability scanners to determine if your application has any vulnerable dependencies.

boolean

true

An advanced option that will decompile generated and transformed bytecode into the 'decompiled' directory. This is only taken into account when fast-jar is used.

boolean

false

The git hash to use to download the fernflower tool from https://jitpack.io/com/github/fesh0r/fernflower/

string

dbf407a655

The directory into which to save the fernflower tool if it doesn’t exist

string

${user.home}/.quarkus

If set to true, it will result in the Quarkus writing the transformed application bytecode to the build tool’s output directory. This is useful for post-build tools that need to scan the application bytecode - for example for offline code-coverage tools. For example, if using Maven, enabling this feature will result in the classes in target/classes being updated with the versions that result after Quarkus has applied its transformations. Setting this to true however, should be done with a lot of caution and only if subsequent builds are done in a clean environment (i.e. the build tool’s output directory has been completely cleaned).

boolean

false

Custom manifest sections to be added to the MANIFEST.MF file. An example of the user defined property: quarkus.package.manifest.manifest-sections.{Section-Name}.{Entry-Key1}={Value1} quarkus.package.manifest.manifest-sections.{Section-Name}.{Entry-Key2}={Value2}

Map<String,Map<String,String>>

groupId of the platform to use

string

io.quarkus.platform

artifactId of the platform to use

string

quarkus-bom

version of the platform to use

string

999-SNAPSHOT

The timeout to wait for running requests to finish. If this is not set then the application will exit immediately. Setting this timeout will incur a small performance penalty, as it requires active requests to be tracked.

Duration

Enable native SSL support.

boolean

If continuous testing is enabled. The default value is 'paused', which will allow you to start testing from the console or the Dev UI, but will not run tests on startup. If this is set to 'enabled' then testing will start as soon as the application has started. If this is 'disabled' then continuous testing is not enabled, and can’t be enabled without restarting the application.

paused, enabled, disabled

paused

If output from the running tests should be displayed in the console.

boolean

false

Tags that should be included for continuous testing.

list of string

Tags that should be excluded by default with continuous testing. This is ignored if include-tags has been set. Defaults to 'slow'

list of string

slow

Tests that should be included for continuous testing. This is a regular expression and is matched against the test class name (not the file name).

string

Tests that should be excluded with continuous testing. This is a regular expression and is matched against the test class name (not the file name). This is ignored if include-pattern has been set.

string

.*\.IT[^.]+|.*IT|.*ITCase

Changes tests to use the 'flat' ClassPath used in Quarkus 1.x versions. This means all Quarkus and test classes are loaded in the same ClassLoader, however it means you cannot use continuous testing. Note that if you find this necessary for your application then you may also have problems running in development mode, which cannot use a flat class path.

boolean

false

The profile to use when testing the native image

string

prod

The profile (dev, test or prod) to use when testing using @QuarkusTest

string

test

The tags this profile is associated with. When the quarkus.test.profile.tags System property is set (its value is a comma separated list of strings) then Quarkus will only execute tests that are annotated with a @TestProfile that has at least one of the supplied (via the aforementioned system property) tags.

list of string

Additional launch parameters to be used when Quarkus launches the produced artifact for @QuarkusIntegrationTest When the artifact is a jar, this string is passed right after the java command. When the artifact is a container, this string is passed right after the docker run command. When the artifact is a native binary, this string is passed right after the native binary name.

list of string

Used in @QuarkusIntegrationTest and NativeImageTest to determine how long the test will wait for the application to launch

Duration

PT1M

Configures the hang detection in @QuarkusTest. If no activity happens (i.e. no test callbacks are called) over this period then QuarkusTest will dump all threads stack traces, to help diagnose a potential hang. Note that the initial timeout (before Quarkus has started) will only apply if provided by a system property, as it is not possible to read all config sources until Quarkus has booted.

Duration

10M

The type of test to run, this can be either: quarkus-test: Only runs @QuarkusTest annotated test classes unit: Only runs classes that are not annotated with @QuarkusTest all: Runs both, running the unit tests first

unit, quarkus-test, all

all

If a class matches this pattern then it will be cloned into the Quarkus ClassLoader even if it is in a parent first artifact. This is important for collections which can contain objects from the Quarkus ClassLoader, but for most parent first classes it will just cause problems.

string

java\..*

If this is true then only the tests from the main application module will be run (i.e. the module that is currently running mvn quarkus:dev). If this is false then tests from all dependency modules will be run as well.

boolean

false

Modules that should be included for continuous testing. This is a regular expression and is matched against the module groupId:artifactId.

string

Modules that should be excluded for continuous testing. This is a regular expression and is matched against the module groupId:artifactId. This is ignored if include-module-pattern has been set.

string

The core thread pool size. This number of threads will always be kept alive.

int

1

Prefill core thread pool. The core thread pool will be initialised with the core number of threads at startup

boolean

true

The maximum number of threads. If this is not specified then it will be automatically sized to the greater of 8 * the number of available processors and 200. For example if there are 4 processors the max threads will be 200. If there are 48 processors it will be 384.

int

The queue size. For most applications this should be unbounded

int

The executor growth resistance. A resistance factor applied after the core pool is full; values applied here will cause that fraction of submissions to create new threads when no idle thread is available. A value of 0.0f implies that threads beyond the core size should be created as aggressively as threads within it; a value of 1.0f implies that threads beyond the core size should never be created.

float

0f

The shutdown timeout. If all pending work has not been completed by this time then additional threads will be spawned to attempt to finish any pending tasks, and the shutdown process will continue

Duration

1M

The amount of time to wait for thread pool shutdown before tasks should be interrupted. If this value is greater than or equal to the value for shutdown-timeout, then tasks will not be interrupted before the shutdown timeout occurs.

Duration

10S

The frequency at which the status of the thread pool should be checked during shutdown. Information about waiting tasks and threads will be checked and possibly logged at this interval. Setting this key to an empty value disables the shutdown check interval.

Duration

5

The amount of time a thread will stay alive with no work.

Duration

30S

Enable trusting all certificates. Disable by default.

boolean

false

Artifacts on the classpath that should also be indexed

Type

Default

The maven groupId of the artifact.

string

required

The maven artifactId of the artifact.

string

required

The maven classifier of the artifact.

string

Minimum logging categories

Type

Default

The minimum log level for this category. By default all categories are configured with DEBUG minimum level. To get runtime logging below DEBUG, e.g. TRACE, the minimum level has to be adjusted at build time, the right log level needs to be provided at runtime. As an example, to get TRACE logging, minimum level needs to be at TRACE and the runtime log level needs to match that.

InheritableLevel

inherit

Console logging

Type

Default

If console logging should be enabled

boolean

true

If console logging should go to System#err instead of System#out.

boolean

false

The log format. Note that this value will be ignored if an extension is present that takes control of console formatting (e.g. an XML or JSON-format extension).

string

%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}] (%t) %s%e%n

The console log level.

Level

ALL

Specify how much the colors should be darkened. Note that this value will be ignored if an extension is present that takes control of console formatting (e.g. an XML or JSON-format extension).

int

0

Indicates whether to log asynchronously

boolean

false

The queue length to use before flushing writing

int

512

Determine whether to block the publisher (rather than drop the message) when the queue is full

block, discard

block

File logging

Type

Default

If file logging should be enabled

boolean

false

The log format

string

%d{yyyy-MM-dd HH:mm:ss,SSS} %h %N[%i] %-5p [%c{3.}] (%t) %s%e%n

The level of logs to be written into the file.

Level

ALL

The name of the file in which logs will be written.

File

quarkus.log

Indicates whether to log asynchronously

boolean

false

The queue length to use before flushing writing

int

512

Determine whether to block the publisher (rather than drop the message) when the queue is full

block, discard

block

The maximum file size of the log file after which a rotation is executed.

MemorySize

10

The maximum number of backups to keep.

int

1

File handler rotation file suffix. When used, the file will be rotated based on its suffix. Example fileSuffix: .yyyy-MM-dd

string

Indicates whether to rotate log files on server initialization. You need to either set a max-file-size or configure a file-suffix for it to work.

boolean

true

Syslog logging

Type

Default

If syslog logging should be enabled

boolean

false

The IP address and port of the syslog server

host:port

localhost:514

The app name used when formatting the message in RFC5424 format

string

The name of the host the messages are being sent from

string

Sets the facility used when calculating the priority of the message as defined by RFC-5424 and RFC-3164

kernel, user-level, mail-system, system-daemons, security, syslogd, line-printer, network-news, uucp, clock-daemon, security2, ftp-daemon, ntp, log-audit, log-alert, clock-daemon2, local-use-0, local-use-1, local-use-2, local-use-3, local-use-4, local-use-5, local-use-6, local-use-7

user-level

Set the SyslogType syslog type this handler should use to format the message sent

rfc5424, rfc3164

rfc5424

Sets the protocol used to connect to the syslog server

tcp, udp, ssl-tcp

tcp

Set to true if the message being sent should be prefixed with the size of the message

boolean

false

Set to true if the message should be truncated

boolean

true

Enables or disables blocking when attempting to reconnect a org.jboss.logmanager.handlers.SyslogHandler.Protocol#TCP TCP or org.jboss.logmanager.handlers.SyslogHandler.Protocol#SSL_TCP SSL TCP protocol

boolean

false

The log message format

string

%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}] (%t) %s%e%n

The log level specifying, which message levels will be logged by syslog logger

Level

ALL

Indicates whether to log asynchronously

boolean

false

The queue length to use before flushing writing

int

512

Determine whether to block the publisher (rather than drop the message) when the queue is full

block, discard

block

Logging categories

Type

Default

The log level for this category. Note that to get log levels below INFO, the minimum level build time configuration option needs to be adjusted as well.

InheritableLevel

inherit

The names of the handlers to link to this category.

list of string

Specify whether or not this logger should send its output to its parent Logger

boolean

true

Console handlers

Type

Default

If console logging should be enabled

boolean

true

If console logging should go to System#err instead of System#out.

boolean

false

The log format. Note that this value will be ignored if an extension is present that takes control of console formatting (e.g. an XML or JSON-format extension).

string

%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}] (%t) %s%e%n

Level

ALL

Specify how much the colors should be darkened. Note that this value will be ignored if an extension is present that takes control of console formatting (e.g. an XML or JSON-format extension).

int

0

Indicates whether to log asynchronously

boolean

false

The queue length to use before flushing writing

int

512

Determine whether to block the publisher (rather than drop the message) when the queue is full

block, discard

block

File handlers

Type

Default

If file logging should be enabled

boolean

false

string

%d{yyyy-MM-dd HH:mm:ss,SSS} %h %N[%i] %-5p [%c{3.}] (%t) %s%e%n

The level of logs to be written into the file.

Level

ALL

The name of the file in which logs will be written.

File

quarkus.log

Indicates whether to log asynchronously

boolean

false

The queue length to use before flushing writing

int

512

Determine whether to block the publisher (rather than drop the message) when the queue is full

block, discard

block

The maximum file size of the log file after which a rotation is executed.

MemorySize

10

int

1

File handler rotation file suffix. When used, the file will be rotated based on its suffix. Example fileSuffix: .yyyy-MM-dd

string

Indicates whether to rotate log files on server initialization. You need to either set a max-file-size or configure a file-suffix for it to work.

boolean

true

Syslog handlers

Type

Default

If syslog logging should be enabled

boolean

false

The IP address and port of the syslog server

host:port

localhost:514

The app name used when formatting the message in RFC5424 format

string

The name of the host the messages are being sent from

string

Sets the facility used when calculating the priority of the message as defined by RFC-5424 and RFC-3164

kernel, user-level, mail-system, system-daemons, security, syslogd, line-printer, network-news, uucp, clock-daemon, security2, ftp-daemon, ntp, log-audit, log-alert, clock-daemon2, local-use-0, local-use-1, local-use-2, local-use-3, local-use-4, local-use-5, local-use-6, local-use-7

user-level

Set the SyslogType syslog type this handler should use to format the message sent

rfc5424, rfc3164

rfc5424

Sets the protocol used to connect to the syslog server

tcp, udp, ssl-tcp

tcp

Set to true if the message being sent should be prefixed with the size of the message

boolean

false

Set to true if the message should be truncated

boolean

true

Enables or disables blocking when attempting to reconnect a org.jboss.logmanager.handlers.SyslogHandler.Protocol#TCP TCP or org.jboss.logmanager.handlers.SyslogHandler.Protocol#SSL_TCP SSL TCP protocol

boolean

false

string

%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}] (%t) %s%e%n

The log level specifying, which message levels will be logged by syslog logger

Level

ALL

Indicates whether to log asynchronously

boolean

false

The queue length to use before flushing writing

int

512

Determine whether to block the publisher (rather than drop the message) when the queue is full

block, discard

block

Log cleanup filters - internal use

Type

Default

The message starts to match

list of string

inherit

The new log level for the filtered message, defaults to DEBUG

Level

DEBUG

Quarkus Extension for Spring Cloud Config Client

Type

Default

If enabled, will try to read the configuration from a Spring Cloud Config Server

boolean

false

If set to true, the application will not stand up if it cannot obtain configuration from the Config Server

boolean

false

The Base URI where the Spring Cloud Config Server is available

string

http://localhost:8888

The label to be used to pull remote configuration properties. The default is set on the Spring Cloud Config Server (generally "master" when the server uses a Git backend).

string

The amount of time to wait when initially establishing a connection before giving up and timing out. Specify 0 to wait indefinitely.

Duration

10S

The amount of time to wait for a read on a socket before an exception is thrown. Specify 0 to wait indefinitely.

Duration

60S

The username to be used if the Config Server has BASIC Auth enabled

string

The password to be used if the Config Server has BASIC Auth enabled

string

TrustStore to be used containing the SSL certificate used by the Config server Can be either a classpath resource or a file system path

path

Password of TrustStore to be used containing the SSL certificate used by the Config server

string

KeyStore to be used containing the SSL certificate for authentication with the Config server Can be either a classpath resource or a file system path

path

Password of KeyStore to be used containing the SSL certificate for authentication with the Config server

string

Password to recover key from KeyStore for SSL client authentication with the Config server If no value is provided, the key-store-password will be used

string

When using HTTPS and no keyStore has been specified, whether or not to trust all certificates

boolean

false

Custom headers to pass the Spring Cloud Config Server when performing the HTTP request

Map<String,String>

Quartz

Type

Default

Enable cluster mode or not. If enabled make sure to set the appropriate cluster properties.

boolean

false

The frequency (in milliseconds) at which the scheduler instance checks-in with other instances of the cluster.

long

15000

The type of store to use. When using StoreType#JDBC_CMT or StoreType#JDBC_TX configuration values make sure that you have the datasource configured. See Configuring your datasource for more information. To create Quartz tables, you can perform a schema migration via the Flyway extension using a SQL script matching your database picked from Quartz repository.

ram, jdbc-tx, jdbc-cmt

ram

The name of the datasource to use. Optionally needed when using the db store type. If not specified, defaults to using the default datasource.

string

The prefix for quartz job store tables. Ignored if using a ram store.

string

QRTZ_

The name of the Quartz instance.

string

QuarkusQuartzScheduler

The size of scheduler thread pool. This will initialize the number of worker threads in the pool.

int

25

Thread priority of worker threads in the pool.

int

5

Scheduler can be started in different modes: normal, forced or halted. By default, the scheduler is not started unless a io.quarkus.scheduler.Scheduled business method is found. If set to "forced", scheduler will be started even if no scheduled business methods are found. This is necessary for "pure" programmatic scheduling. Additionally, setting it to "halted" will behave just like forced mode but the scheduler will not start triggering jobs until an explicit start is called from the main scheduler. This is useful to programmatically register listeners before scheduler starts performing some work.

normal, forced, halted

normal

Trigger listeners

Type

Default

Class name for the configuration.

string

required

Map<String,String>

Job listeners

Type

Default

Class name for the configuration.

string

required

The properties passed to the class.

Map<String,String>

Plugins

Type

Default

Class name for the configuration.

string

required

The properties passed to the class.

Map<String,String>

Qute Templating

Type

Default

The list of suffixes used when attempting to locate a template file.

By default, engine.getTemplate("foo") would result in several lookups: foo, foo.html, foo.txt, etc.

list of string

qute.html,qute.txt,html,txt

The list of exclude rules used to intentionally ignore some parts of an expression when performing type-safe validation. An element value must have at least two parts separated by dot. The last part is used to match the property/method name. The prepended parts are used to match the class name. The value * can be used to match any name. Examples: - org.acme.Foo.name - exclude the property/method name on the org.acme.Foo class - org.acme.Foo.* - exclude any property/method on the org.acme.Foo class - *.age - exlude the property/method age on any class

list of string

The strategy used when a standalone expression evaluates to a "not found" value at runtime and the io.quarkus.qute.strict-rendering config property is set to false This strategy is never used when evaluating section parameters, e.g. {#if foo.name}. In such case, it’s the responsibility of the section to handle this situation appropriately. By default, the NOT_FOUND constant is written to the output. However, in the development mode the PropertyNotFoundStrategy#THROW_EXCEPTION is used by default, i.e. when the strategy is not specified.

default, noop, throw-exception, output-original

Specify whether the parser should remove standalone lines from the output. A standalone line is a line that contains at least one section tag, parameter declaration, or comment but no expression and no non-whitespace character.

boolean

true

If set to true then any expression that is evaluated to a Results.NotFound value will always result in a TemplateException and the rendering is aborted. Note that the quarkus.qute.property-not-found-strategy config property is completely ignored if strict rendering is enabled.

boolean

true

The additional map of suffixes to content types. This map is used when working with template variants. By default, the java.net.URLConnection#getFileNameMap() is used to determine the content type of a template file.

Map<String,String>

REST Client Reactive

Type

Default

Default scope for Rest Client Reactive. Use javax.enterprise.context.Dependent for spec-compliant behavior

string

javax.enterprise.context.ApplicationScoped

By default, RESTEasy Reactive uses text/plain content type for String values and application/json for everything else. MicroProfile Rest Client spec requires the implementations to always default to application/json. This build item disables the "smart" behavior of RESTEasy Reactive to comply to the spec

boolean

false

Whether or not providers (filters, etc) annotated with javax.ws.rs.ext.Provider should be automatically registered for all the clients in the application.

boolean

true

RESTEasy JAX-RS

Type

Default

The size of the output stream response buffer. If a response is larger than this and no content-length is provided then the request will be chunked. Larger values may give slight performance increases for large responses, at the expense of more memory usage.

int

8191

if set to true, access to all JAX-RS resources will be denied by default

boolean

false

If no security annotations are affecting a method then they will default to requiring these roles, (equivalent to adding an @RolesAllowed annotation with the roles to every endpoint class). The role of '**' means any authenticated user, which is equivalent to the io.quarkus.security.Authenticated annotation.

list of string

RESTEasy JAX-RS Common

Type

Default

If gzip is enabled

boolean

false

Maximum deflated file bytes size If the limit is exceeded, Resteasy will return Response with status 413("Request Entity Too Large")

MemorySize

10M

If this is true (the default) then JSON is set to the default media type. If a method has no produces/consumes and there is no builtin provider than can handle the type then we will assume the response should be JSON. Note that this will only take effect if a JSON provider has been installed, such as quarkus-resteasy-jsonb or quarkus-resteasy-jackson.

boolean

true

RESTEasy Multipart

Type

Default

Default charset. Note that the default value is UTF-8 which is different from RESTEasy’s default value US-ASCII.

Charset

UTF-8

string

text/plain

RESTEasy Reactive

Type

Default

Set this to define the application path that serves as the base URI for all JAX-RS resource URIs provided by @Path annotations when there are no @ApplicationPath annotations defined on Application classes. This value is always resolved relative to quarkus.http.root-path.

string

Charset

UTF-8

RESTEasy Reactive Common

Type

Default

The amount of memory that can be used to buffer input before switching to blocking IO.

MemorySize

10k

By default we assume a default produced media type of "text/plain" for String endpoint return types. If this is disabled, the default produced media type will be "[text/plain, */*]" which is more expensive due to negotiation.

boolean

true

When one of the quarkus-resteasy-reactive-jackson or quarkus-resteasy-reactive-jsonb extension are active and the result type of an endpoint is an application class or one of Collection, List, Set or Map, we assume the default return type is "application/json" if this configuration is enabled.

boolean

true

Whether or not annotations such @IfBuildTimeProfile, @IfBuildTimeProperty and friends will be taken into account when used on JAX-RS classes.

boolean

true

if set to true, access to all JAX-RS resources will be denied by default

boolean

false

If no security annotations are affecting a method then they will default to requiring these roles, (equivalent to adding an @RolesAllowed annotation with the roles to every endpoint class). The role of '**' means any authenticated user, which is equivalent to the io.quarkus.security.Authenticated annotation.

list of string

RESTEasy Server Common

Type

Default

If this is true then JAX-RS will use only a single instance of a resource class to service all requests. If this is false then it will create a new instance of the resource per request. If the resource class has an explicit CDI scope annotation then the value of this annotation will always be used to control the lifecycle of the resource class. IMPLEMENTATION NOTE: javax.ws.rs.Path turns into a CDI stereotype with singleton scope. As a result, if a user annotates a JAX-RS resource with a stereotype which has a different default scope the deployment fails with IllegalStateException.

boolean

true

Set this to override the default path for JAX-RS resources if there are no annotated application classes. This path is specified with a leading /, but is resolved relative to quarkus.http.root-path. - If quarkus.http.root-path=/ and quarkus.resteasy.path=/bar, the JAX-RS resource path will be /bar - If quarkus.http.root-path=/foo and quarkus.resteasy.path=/bar, the JAX-RS resource path will be /foo/bar

string

/

Ignore all explicit JAX-RS Application classes. As multiple JAX-RS applications are not supported, this can be used to effectively merge all JAX-RS applications.

boolean

false

Whether or not annotations such @IfBuildTimeProfile, @IfBuildTimeProperty and friends will be taken into account when used on JAX-RS classes.

boolean

true

Reactive DB2 client

Type

Default

Whether SSL/TLS is enabled.

boolean

false

Additional named datasources

Type

Default

boolean

false

Reactive MS SQL client

Type

Default

The desired size (in bytes) for TDS packets.

int

Additional named datasources

Type

Default

The desired size (in bytes) for TDS packets.

int

Reactive MySQL client

Type

Default

string

Collation for connections.

string

Desired security state of the connection to the server. See MySQL Reference Manual.

disabled, preferred, required, verify-ca, verify-identity

disabled

Additional named datasources

Type

Default

string

string

Desired security state of the connection to the server. See MySQL Reference Manual.

disabled, preferred, required, verify-ca, verify-identity

disabled

Reactive PostgreSQL client

Type

Default

The maximum number of inflight database commands that can be pipelined.

int

disable, allow, prefer, require, verify-ca, verify-full

disable

Additional named datasources

Type

Default

The maximum number of inflight database commands that can be pipelined.

int

disable, allow, prefer, require, verify-ca, verify-full

disable

Reactive datasource configuration

Type

Default

If we create a Reactive datasource for this datasource.

boolean

true

Whether prepared statements should be cached on the client side.

boolean

false

The datasource URL.

string

The datasource pool maximum size.

int

Whether all server certificates should be trusted.

boolean

false

PEM Trust config is disabled by default.

boolean

false

Comma-separated list of the trust certificate files (Pem format).

list of string

JKS config is disabled by default.

boolean

false

Path of the key file (JKS format).

string

string

PFX config is disabled by default.

boolean

false

Path to the key file (PFX format).

string

string

PEM Key/cert config is disabled by default.

boolean

false

Comma-separated list of the path to the key files (Pem format).

list of string

Comma-separated list of the path to the certificate files (Pem format).

list of string

JKS config is disabled by default.

boolean

false

Path of the key file (JKS format).

string

string

PFX config is disabled by default.

boolean

false

Path to the key file (PFX format).

string

string

The number of reconnection attempts when a pooled connection cannot be established on first try.

int

0

The interval between reconnection attempts when a pooled connection cannot be established on first try.

Duration

PT1S

The hostname verification algorithm to use in case the server’s identity should be checked. Should be HTTPS, LDAPS or an empty string.

string

The maximum time a connection remains unused in the pool before it is closed.

Duration

no timeout

Additional named datasources

Type

Default

If we create a Reactive datasource for this datasource.

boolean

true

Whether prepared statements should be cached on the client side.

boolean

false

string

The datasource pool maximum size.

int

Whether all server certificates should be trusted.

boolean

false

boolean

false

Comma-separated list of the trust certificate files (Pem format).

list of string

boolean

false

string

string

boolean

false

string

string

PEM Key/cert config is disabled by default.

boolean

false

Comma-separated list of the path to the key files (Pem format).

list of string

Comma-separated list of the path to the certificate files (Pem format).

list of string

boolean

false

string

string

boolean

false

string

string

The number of reconnection attempts when a pooled connection cannot be established on first try.

int

0

The interval between reconnection attempts when a pooled connection cannot be established on first try.

Duration

PT1S

The hostname verification algorithm to use in case the server’s identity should be checked. Should be HTTPS, LDAPS or an empty string.

string

The maximum time a connection remains unused in the pool before it is closed.

Duration

no timeout

Redis Client

Type

Default

Whether or not an health check is published in case the smallrye-health extension is present.

boolean

true

If DevServices has been explicitly enabled or disabled. DevServices is generally enabled by default, unless there is an existing configuration present. When DevServices is enabled Quarkus will attempt to automatically configure and start a database when running in Dev or Test mode and when Docker is running.

boolean

true

The container image name to use, for container based DevServices providers.

string

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

Indicates if the Redis server managed by Quarkus Dev Services is shared. When shared, Quarkus looks for running containers using label-based service discovery. If a matching container is found, it is used, and so a second one is not started. Otherwise, Dev Services for Redis starts a new container. The discovery uses the quarkus-dev-service-redis label. The value is configured using the service-name property. Container sharing is only used in dev mode.

boolean

true

The value of the quarkus-dev-service-redis label attached to the started container. This property is used when shared is set to true. In this case, before starting a container, Dev Services for Redis looks for a container with the quarkus-dev-service-redis label set to the configured value. If found, it will use this container instead of starting a new one. Otherwise it starts a new container with the quarkus-dev-service-redis label set to the specified value. This property is used when you need multiple shared Redis servers.

string

redis

The redis hosts to use while connecting to the redis server. Only the cluster mode will consider more than 1 element. The URI provided uses the following schema redis://[username:password@][host][:port][/database] Use quarkus.redis.hosts-provider-name to provide the hosts programmatically.

list of URI

redis://localhost:6379

The hosts provider bean name. It is the &#64;Named value of the hosts provider bean. It is used to discriminate if multiple io.quarkus.redis.client.RedisHostsProvider beans are available. Used when quarkus.redis.hosts is not set.

string

The maximum delay to wait before a blocking command to redis server times out

Duration

10s

The redis client type

standalone, sentinel, cluster

standalone

The master name (only considered in HA mode).

string

mymaster

The role name (only considered in HA mode).

master, replica, sentinel

master

Whether or not to use replicas nodes (only considered in Cluster mode).

never, share, always

never

The default password for cluster/sentinel connections. If not set it will try to extract the value from the current default #hosts.

string

The maximum size of the connection pool. When working with cluster or sentinel. This value should be at least the total number of cluster member (or number of sentinels + 1)

int

6

The maximum waiting requests for a connection from the pool.

int

24

The duration indicating how often should the connection pool cleaner executes.

Duration

The timeout for a connection recycling.

Duration

15S

Sets how much handlers is the client willing to queue. The client will always work on pipeline mode, this means that messages can start queueing. Using this configuration option, you can control how much backlog you’re willing to accept.

int

2048

Tune how much nested arrays are allowed on a redis response. This affects the parser performance.

int

32

The number of reconnection attempts when a pooled connection cannot be established on first try.

int

0

The interval between reconnection attempts when a pooled connection cannot be established on first try.

Duration

1S

The maximum time a connection remains unused in the pool before it is closed.

int

no timeout

Whether TCP keep alive is enabled

boolean

true

Whether TCP no delay is enabled

boolean

true

If DevServices has been explicitly enabled or disabled. DevServices is generally enabled by default, unless there is an existing configuration present. When DevServices is enabled Quarkus will attempt to automatically configure and start a database when running in Dev or Test mode and when Docker is running.

boolean

true

The container image name to use, for container based DevServices providers.

string

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

Indicates if the Redis server managed by Quarkus Dev Services is shared. When shared, Quarkus looks for running containers using label-based service discovery. If a matching container is found, it is used, and so a second one is not started. Otherwise, Dev Services for Redis starts a new container. The discovery uses the quarkus-dev-service-redis label. The value is configured using the service-name property. Container sharing is only used in dev mode.

boolean

true

The value of the quarkus-dev-service-redis label attached to the started container. This property is used when shared is set to true. In this case, before starting a container, Dev Services for Redis looks for a container with the quarkus-dev-service-redis label set to the configured value. If found, it will use this container instead of starting a new one. Otherwise it starts a new container with the quarkus-dev-service-redis label set to the specified value. This property is used when you need multiple shared Redis servers.

string

redis

The redis hosts to use while connecting to the redis server. Only the cluster mode will consider more than 1 element. The URI provided uses the following schema redis://[username:password@][host][:port][/database] Use quarkus.redis.hosts-provider-name to provide the hosts programmatically.

list of URI

redis://localhost:6379

The hosts provider bean name. It is the &#64;Named value of the hosts provider bean. It is used to discriminate if multiple io.quarkus.redis.client.RedisHostsProvider beans are available. Used when quarkus.redis.hosts is not set.

string

The maximum delay to wait before a blocking command to redis server times out

Duration

10s

standalone, sentinel, cluster

standalone

The master name (only considered in HA mode).

string

mymaster

The role name (only considered in HA mode).

master, replica, sentinel

master

Whether or not to use replicas nodes (only considered in Cluster mode).

never, share, always

never

The default password for cluster/sentinel connections. If not set it will try to extract the value from the current default #hosts.

string

The maximum size of the connection pool. When working with cluster or sentinel. This value should be at least the total number of cluster member (or number of sentinels + 1)

int

6

The maximum waiting requests for a connection from the pool.

int

24

The duration indicating how often should the connection pool cleaner executes.

Duration

The timeout for a connection recycling.

Duration

15S

Sets how much handlers is the client willing to queue. The client will always work on pipeline mode, this means that messages can start queueing. Using this configuration option, you can control how much backlog you’re willing to accept.

int

2048

Tune how much nested arrays are allowed on a redis response. This affects the parser performance.

int

32

The number of reconnection attempts when a pooled connection cannot be established on first try.

int

0

The interval between reconnection attempts when a pooled connection cannot be established on first try.

Duration

1S

The maximum time a connection remains unused in the pool before it is closed.

int

no timeout

boolean

true

boolean

true

SSL/TLS config

Type

Default

Whether SSL/TLS is enabled.

boolean

false

Enable trusting all certificates. Disabled by default.

boolean

false

PEM Trust config is disabled by default.

boolean

false

Comma-separated list of the trust certificate files (Pem format).

list of string

JKS config is disabled by default.

boolean

false

Path of the key file (JKS format).

string

string

PFX config is disabled by default.

boolean

false

Path to the key file (PFX format).

string

string

PEM Key/cert config is disabled by default.

boolean

false

Comma-separated list of the path to the key files (Pem format).

list of string

Comma-separated list of the path to the certificate files (Pem format).

list of string

JKS config is disabled by default.

boolean

false

Path of the key file (JKS format).

string

string

PFX config is disabled by default.

boolean

false

Path to the key file (PFX format).

string

string

The hostname verification algorithm to use in case the server’s identity should be checked. Should be HTTPS, LDAPS or an empty string.

string

boolean

false

Enable trusting all certificates. Disabled by default.

boolean

false

boolean

false

Comma-separated list of the trust certificate files (Pem format).

list of string

boolean

false

string

string

boolean

false

string

string

PEM Key/cert config is disabled by default.

boolean

false

Comma-separated list of the path to the key files (Pem format).

list of string

Comma-separated list of the path to the certificate files (Pem format).

list of string

boolean

false

string

string

boolean

false

string

string

The hostname verification algorithm to use in case the server’s identity should be checked. Should be HTTPS, LDAPS or an empty string.

string

Scheduler - tasks

Type

Default

The syntax used in CRON expressions.

cron4j, quartz, unix, spring

quartz

Scheduled task metrics will be enabled if a metrics extension is present and this value is true.

boolean

false

If schedulers are enabled.

boolean

true

Security

Type

Default

List of security providers to enable for reflection

list of string

If set to true, access to all methods of beans that have any security annotations on other members will be denied by default. E.g. if enabled, in the following bean, methodB will be denied. `@`ApplicationScoped public class A { `@`RolesAllowed("admin") public void methodA() { …​ } public void methodB() { …​ } }

boolean

false

SmallRye GraphQL

Type

Default

The rootPath under which queries will be served. Default to graphql By default, this value will be resolved as a path relative to ${quarkus.http.root-path}.

string

graphql

Enable metrics. By default this is false. If set to true, a metrics extension is required.

boolean

Enable tracing. By default this will be enabled if the tracing extension is added.

boolean

Enable validation. By default this will be enabled if the Hibernate Validator extension is added.

boolean

Enable eventing. Allow you to receive events on bootstrap and execution.

boolean

false

Enable GET Requests. Allow queries via HTTP GET.

boolean

Enable Query parameter on POST Requests. Allow POST request to override or supply values in a query parameter.

boolean

Change the type naming strategy.

default, merge-inner-class, full

default

List of extension fields that should be included in the error response. By default none will be included. Examples of valid values include [exception,classification,code,description,validationErrorType,queryPath]

list of string

List of Runtime Exceptions class names that should show the error message. By default Runtime Exception messages will be hidden and a generic Server Error message will be returned.

list of string

List of Checked Exceptions class names that should hide the error message. By default Checked Exception messages will show the exception message.

list of string

The default error message that will be used for hidden exception messages. Defaults to "Server Error"

string

Print the data fetcher exception to the log file. Default true in dev and test mode, default false in prod.

boolean

Make the schema available over HTTP.

boolean

true

Include the Scalar definitions in the schema.

boolean

false

Include the schema internal definition in the schema.

boolean

false

Include Directives in the schema.

boolean

false

Include Introspection Types in the schema.

boolean

false

Log the payload (and optionally variables) to System out.

off, query-only, query-and-variables

off

Set the Field visibility.

string

default

Exceptions that should be unwrapped (class names).

list of string

If GraphQL UI should be enabled. By default, GraphQL UI is enabled if it is included (see always-include).

boolean

true

SmallRye GraphQL UI configuration

Type

Default

The path where GraphQL UI is available. The value / is not allowed as it blocks the application from serving anything else. By default, this URL will be resolved as a path relative to ${quarkus.http.non-application-root-path}.

string

graphql-ui

Always include the UI. By default this will only be included in dev and test. Setting this to true will also include the UI in Prod

boolean

false

SmallRye GraphQL Client

Type

Default

The URL location of the target GraphQL service.

string

HTTP headers to add when communicating with the target GraphQL service. Right now, this only works for the dynamic client.

Map<String,String>

SmallRye Health

Type

Default

Whether or not extensions published health check should be enabled.

boolean

true

Whether or not to include the Liveness and Readiness Health endpoints in the generated OpenAPI document

boolean

false

Root path for health-checking endpoints. By default, this value will be resolved as a path relative to ${quarkus.http.non-application-root-path}.

string

health

The relative path of the liveness health-checking endpoint. By default, this value will be resolved as a path relative to ${quarkus.smallrye-health.rootPath}.

string

live

The relative path of the readiness health-checking endpoint. By default, this value will be resolved as a path relative to ${quarkus.smallrye-health.rootPath}.

string

ready

The relative path of the health group endpoint. By default, this value will be resolved as a path relative to ${quarkus.smallrye-health.rootPath}.

string

group

The relative path of the wellness health-checking endpoint. By default, this value will be resolved as a path relative to ${quarkus.smallrye-health.rootPath}.

string

well

The relative path of the startup health-checking endpoint. By default, this value will be resolved as a path relative to ${quarkus.smallrye-health.rootPath}.

string

started

Whether the context should be propagated to each health check invocation.

boolean

false

If Health UI should be enabled. By default, Health UI is enabled if it is included (see always-include).

boolean

true

SmallRye Health UI configuration

Type

Default

The path where Health UI is available. The value / is not allowed as it blocks the application from serving anything else. By default, this value will be resolved as a path relative to ${quarkus.http.non-application-root-path}.

string

health-ui

Always include the UI. By default this will only be included in dev and test. Setting this to true will also include the UI in Prod

boolean

false

SmallRye JWT

Type

Default

The MP-JWT configuration object

boolean

true

The name of the java.security.Provider that supports SHA256withRSA signatures

string

SunRsaSign

Enable this property if fetching the remote keys can be a time consuming operation. Do not enable it if you use the local keys.

boolean

false

SmallRye Metrics

Type

Default

The path to the metrics handler.

string

metrics

Whether or not metrics published by Quarkus extensions should be enabled.

boolean

true

Apply Micrometer compatibility mode, where instead of regular 'base' and 'vendor' metrics, Quarkus exposes the same 'jvm' metrics that Micrometer does. Application metrics are unaffected by this mode. The use case is to facilitate migration from Micrometer-based metrics, because original dashboards for JVM metrics will continue working without having to rewrite them.

boolean

false

Whether or not detailed JAX-RS metrics should be enabled. See MicroProfile Metrics: Optional REST metrics.

boolean

false

SmallRye OpenAPI

Type

Default

The path at which to register the OpenAPI Servlet.

string

openapi

If set, the generated OpenAPI schema documents will be stored here on build. Both openapi.json and openapi.yaml will be stored here if this is set.

path

Do not run the filter only at startup, but every time the document is requested (dynamic).

boolean

false

Do not include the provided static openapi document (eg. META-INF/openapi.yaml)

boolean

false

A list of local directories that should be scanned for yaml and/or json files to be included in the static model. Example: META-INF/openapi/

list of path

basic, jwt, oidc, oauth2-implicit

Add a Security Scheme name to the generated OpenAPI document

string

SecurityScheme

Add a description to the Security Scheme

string

Authentication

This will automatically add the security requirement to all methods/classes that has a RolesAllowed annotation.

boolean

true

This will automatically add tags to operations based on the Java class name.

boolean

true

This will automatically add security based on the security extension included (if any).

boolean

true

Add a scheme value to the Basic HTTP Security Scheme

string

basic

Add a scheme value to the JWT Security Scheme

string

bearer

Add a scheme value to the JWT Security Scheme

string

JWT

Add a openIdConnectUrl value to the OIDC Security Scheme

string

Add a implicit flow refreshUrl value to the OAuth2 Security Scheme

string

Add an implicit flow authorizationUrl value to the OAuth2 Security Scheme

string

Add an implicit flow tokenUrl value to the OAuth2 Security Scheme

string

Override the openapi version in the Schema document

string

Specify the list of global servers that provide connectivity information

list of string

Set the title in Info tag in the Schema document

string

Set the version in Info tag in the Schema document

string

Set the description in Info tag in the Schema document

string

Set the terms of the service in Info tag in the Schema document

string

Set the contact email in Info tag in the Schema document

string

Set the contact name in Info tag in the Schema document

string

Set the contact url in Info tag in the Schema document

string

Set the license name in Info tag in the Schema document

string

Set the license url in Info tag in the Schema document

string

Set the strategy to automatically create an operation Id

method, class-method, package-class-method

Enable the openapi endpoint. By default it’s enabled.

boolean

true

SmallRye OpenTracing

Type

Default

string

http-path, class-method

class-method

SmallRye Reactive Messaging

Type

Default

Whether or not an health check is published in case the smallrye-health extension is present.

boolean

true

Whether or not Reactive Messaging metrics are published in case a metrics extension is present (default to false).

boolean

false

Enables or disables the strict validation mode.

boolean

false

SmallRye Reactive Messaging - AMQP Connector

Type

Default

If Dev Services for AMQP has been explicitly enabled or disabled. Dev Services are generally enabled by default, unless there is an existing configuration present. For AMQP, Dev Services starts a broker unless amqp-host or amqp-port are set or if all the Reactive Messaging AMQP channel are configured with host or port.

boolean

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

The image to use. Note that only quay.io/artemiscloud/activemq-artemis-broker images are supported. Check https://quay.io/repository/artemiscloud/activemq-artemis-broker to find the available versions.

string

quay.io/artemiscloud/activemq-artemis-broker:0.1.2

The value of the AMQ_EXTRA_ARGS environment variable to pass to the container.

string

--no-autotune --mapped --no-fsync

Indicates if the AMQP broker managed by Quarkus Dev Services is shared. When shared, Quarkus looks for running containers using label-based service discovery. If a matching container is found, it is used, and so a second one is not started. Otherwise, Dev Services for AMQP starts a new container. The discovery uses the quarkus-dev-service-amqp label. The value is configured using the service-name property. Container sharing is only used in dev mode.

boolean

true

The value of the quarkus-dev-service-aqmp label attached to the started container. This property is used when shared is set to true. In this case, before starting a container, Dev Services for AMQP looks for a container with the quarkus-dev-service-amqp label set to the configured value. If found, it will use this container instead of starting a new one. Otherwise it starts a new container with the quarkus-dev-service-amqp label set to the specified value. This property is used when you need multiple shared AMQP brokers.

string

amqp

SmallRye Reactive Messaging - Kafka Connector

Type

Default

Whether or not Kafka serializer/deserializer autodetection is enabled.

boolean

true

Enables the graceful shutdown in dev and test modes. The graceful shutdown waits until the inflight records have been processed and the offset committed to Kafka. While this setting is highly recommended in production, in dev and test modes, it’s disabled by default. This setting allows to re-enable it.

boolean

false

Swagger UI

Type

Default

The path where Swagger UI is available. The value / is not allowed as it blocks the application from serving anything else. By default, this value will be resolved as a path relative to ${quarkus.http.non-application-root-path}.

string

swagger-ui

If this should be included every time. By default this is only included when the application is running in dev mode.

boolean

false

If urls option is used, this will be the name of the default selection.

string

The html title for the page.

string

Swagger UI theme to be used.

original, feeling-blue, flattop, material, monokai, muted, newspaper, outline

A footer for the html page. Nothing by default.

string

If set to true, enables deep linking for tags and operations.

boolean

Controls the display of operationId in operations list. The default is false.

boolean

The default expansion depth for models (set to -1 completely hide the models).

int

The default expansion depth for the model on the model-example section.

int

Controls how the model is shown when the API is first rendered.

string

Controls the display of the request duration (in milliseconds) for "Try it out" requests.

boolean

Controls the default expansion setting for the operations and tags.

list, full, none

If set, enables filtering. The top bar will show an edit box that you can use to filter the tagged operations that are shown. Can be Boolean to enable or disable, or a string, in which case filtering will be enabled using that string as the filter expression. Filtering is case sensitive matching the filter expression anywhere inside the tag.

string

If set, limits the number of tagged operations displayed to at most this many. The default is to show all operations.

int

Apply a sort to the operation list of each API. It can be 'alpha' (sort by paths alphanumerically), 'method' (sort by HTTP method) or a function (see Array.prototype.sort() to know how sort function works). Default is the order returned by the server unchanged.

string

Controls the display of vendor extension (x-) fields and values for Operations, Parameters, and Schema.

boolean

Controls the display of extensions (pattern, maxLength, minLength, maximum, minimum) fields and values for Parameters.

boolean

Apply a sort to the tag list of each API. It can be 'alpha' (sort by paths alphanumerically) or a function (see Array.prototype.sort() to learn how to write a sort function). Two tag name strings are passed to the sorter for each pass. Default is the order determined by Swagger UI.

string

Provides a mechanism to be notified when Swagger UI has finished rendering a newly provided definition.

string

Set to false to deactivate syntax highlighting of payloads and cURL command, can be otherwise an object with the activate and theme properties.

string

string

MUST be a function. Function to intercept remote definition, "Try it out", and OAuth 2.0 requests. Accepts one argument requestInterceptor(request) and must return the modified request, or a Promise that resolves to the modified request.

string

If set, MUST be an array of command line options available to the curl command. This can be set on the mutated request in the requestInterceptor function.

list of string

MUST be a function. Function to intercept remote definition, "Try it out", and OAuth 2.0 responses. Accepts one argument responseInterceptor(response) and must return the modified response, or a Promise that resolves to the modified response.

string

If set to true, uses the mutated request returned from a requestInterceptor to produce the curl command in the UI, otherwise the request before the requestInterceptor was applied is used.

boolean

List of HTTP methods that have the "Try it out" feature enabled. An empty array disables "Try it out" for all operations. This does not filter the operations from the display.

list of HttpMethod

By default, Swagger UI attempts to validate specs against swagger.io’s online validator. You can use this parameter to set a different validator URL, for example for locally deployed validators (Validator Badge). Setting it to either none, 127.0.0.1 or localhost will disable validation.

string

If set to true, enables passing credentials, as defined in the Fetch standard, in CORS requests that are sent by the browser.

boolean

Function to set default values to each property in model. Accepts one argument modelPropertyMacro(property), property is immutable

string

Function to set default value to parameters. Accepts two arguments parameterMacro(operation, parameter). Operation and parameter are objects passed for context, both remain immutable

string

If set to true, it persists authorization data and it would not be lost on browser close/refresh

boolean

The name of a component available via the plugin system to use as the top-level layout for Swagger UI.

string

A list of plugin functions to use in Swagger UI.

list of string

A list of presets to use in Swagger UI.

list of string

OAuth default clientId - Used in the initOAuth method.

string

OAuth default clientSecret - Used in the initOAuth method.

string

OAuth1 Realm query parameter added to authorizationUrl and tokenUrl - Used in the initOAuth method.

string

OAuth application name, displayed in authorization popup - Used in the initOAuth method.

string

OAuth scope separator for passing scopes - Used in the initOAuth method.

string

OAuth Scopes, separated using the oauthScopeSeparator - Used in the initOAuth method.

string

OAuth additional query parameters added to authorizationUrl and tokenUrl - Used in the initOAuth method.

string

OAuth only activated for the accessCode flow. During the authorization_code request to the tokenUrl, pass the Client Password using the HTTP Basic Authentication scheme - Used in the initOAuth method.

boolean

OAuth only applies to authorizatonCode flows. Proof Key for Code Exchange brings enhanced security for OAuth public clients - Used in the initOAuth method.

boolean

Pre-authorize Basic Auth, programmatically set DefinitionKey for a Basic authorization scheme - Used in the preauthorizeBasic method.

string

Pre-authorize Basic Auth, programmatically set Username for a Basic authorization scheme - Used in the preauthorizeBasic method.

string

Pre-authorize Basic Auth, programmatically set Password for a Basic authorization scheme - Used in the preauthorizeBasic method.

string

Pre-authorize ApiKey Auth, programmatically set DefinitionKey for an API key or Bearer authorization scheme - Used in the preauthorizeApiKey method.

string

Pre-authorize ApiKey Auth, programmatically set ApiKeyValue for an API key or Bearer authorization scheme - Used in the preauthorizeApiKey method.

string

If Swagger UI is included, it should be enabled/disabled. By default, Swagger UI is enabled if it is included (see always-include).

boolean

true

The urls that will be included as options. By default the OpenAPI path will be used. Here you can override that and supply multiple urls that will appear in the TopBar plugin.

Map<String,String>

Undertow Servlet

Type

Default

The context path for Servlet content. This will determine the path used to resolve all Servlet-based resources, including JAX-RS resources - when using the Undertow extension in conjunction with RESTEasy. This path is specified with a leading /, but is resolved relative to quarkus.http.root-path. - If quarkus.http.root-path=/ and quarkus.servlet.context-path=/bar, the servlet path will be /bar - If quarkus.http.root-path=/foo and quarkus.servlet.context-path=/bar, the servlet path will be /foo/bar

string

The default charset to use for reading and writing requests

string

UTF-8

The buffer size to use for Servlet. If this is not specified the default will depend on the amount of available memory. If there is less than 64mb it will default to 512b heap buffer, less that 128mb 1k direct buffer and otherwise 16k direct buffers.

MemorySize

If Servlet should use direct buffers, this gives maximum performance but can be problematic in memory constrained environments

boolean

The maximum number of HTTP request parameters permitted for Servlet requests. If a client sends more than this number of parameters in a request, the connection is closed.

int

1000

Vault

Type

Default

If DevServices has been explicitly enabled or disabled. DevServices is generally enabled by default, unless there is an existing configuration present. When DevServices is enabled Quarkus will attempt to automatically configure and start a vault instance when running in Dev or Test mode and when Docker is running.

boolean

true

The container image name to use, for container based DevServices providers.

string

Optional fixed port the dev service will listen to. If not defined, the port will be chosen randomly.

int

Should the Transit secret engine be enabled

boolean

false

Should the PKI secret engine be enabled

boolean

false

Microprofile Config ordinal. This is provided as an alternative to the config_ordinal property defined by the specification, to make it easier and more natural for applications to override the default ordinal. The default value is higher than the file system or jar ordinals, but lower than env vars.

int

270

Vault server url. <p> Example: https://localhost:8200 <p> See also the documentation for the kv-secret-engine-mount-path property for some insights on how the full Vault url gets built.

URL

Renew grace period duration. <p> This value if used to extend a lease before it expires its ttl, or recreate a new lease before the current lease reaches its max_ttl. By default Vault leaseDuration is equal to 7 days (ie: 168h or 604800s). If a connection pool maxLifetime is set, it is reasonable to set the renewGracePeriod to be greater than the maxLifetime, so that we are sure we get a chance to renew leases before we reach the ttl. In any case you need to make sure there will be attempts to fetch secrets within the renewGracePeriod, because that is when the renewals will happen. This is particularly important for db dynamic secrets because if the lease reaches its ttl or max_ttl, the password of the db user will become invalid and it will be not longer possible to log in. This value should also be smaller than the ttl, otherwise that would mean that we would try to recreate leases all the time.

Duration

1H

Vault config source cache period. <p> Properties fetched from vault as MP config will be kept in a cache, and will not be fetched from vault again until the expiration of that period. This property is ignored if secret-config-kv-path is not set.

Duration

10M

List of comma separated vault paths in kv store, where all properties will be available as MP config properties as-is, with no prefix. <p> For instance, if vault contains property foo, it will be made available to the quarkus application as @ConfigProperty(name = "foo") String foo; <p> If 2 paths contain the same property, the last path will win. <p> For instance if <p> * secret/base-config contains foo=bar and * secret/myapp/config contains foo=myappbar, then <p> @ConfigProperty(name = "foo") String foo will have value myappbar with application properties quarkus.vault.secret-config-kv-path=base-config,myapp/config <p> See also the documentation for the kv-secret-engine-mount-path property for some insights on how the full Vault url gets built.

list of string

Maximum number of attempts when fetching MP Config properties on the initial connection.

int

1

Used to hide confidential infos, for logging in particular. Possible values are: <p> * low: display all secrets. * medium: display only usernames and lease ids (ie: passwords and tokens are masked). * high: hide lease ids and dynamic credentials username.

low, medium, high

medium

int

2

KV secret engine path. <p> This value is used when building the url path in the KV secret engine programmatic access (i.e. VaultKVSecretEngine) and the vault config source (i.e. fetching configuration properties from Vault). <p> For a v2 KV secret engine (default - see kv-secret-engine-version property) the full url is built from the expression <url>/v1/</kv-secret-engine-mount-path>/data/…​. <p> With property quarkus.vault.url=https://localhost:8200, the following call vaultKVSecretEngine.readSecret("foo/bar") would lead eventually to a GET on Vault with the following url: https://localhost:8200/v1/secret/data/foo/bar. <p> With a KV secret engine v1, the url changes to: <url>/v1/</kv-secret-engine-mount-path>/…​. <p> The same logic is applied to the Vault config source. With quarkus.vault.secret-config-kv-path=config/myapp The secret properties would be fetched from Vault using a GET on https://localhost:8200/v1/secret/data/config/myapp for a KV secret engine v2 (or https://localhost:8200/v1/secret/config/myapp for a KV secret engine v1). <p> see https://www.vaultproject.io/docs/secrets/kv/index.html

string

secret

Timeout to establish a connection with Vault.

Duration

5S

Request timeout on Vault.

Duration

5S

List of remote hosts that are not proxied when the client is configured to use a proxy. This list serves the same purpose as the JVM nonProxyHosts configuration. Entries can use the * wildcard character for pattern matching, e.g *.example.com matches www.example.com.

list of string

List of comma separated vault paths in kv store, where all properties will be available as prefixed MP config properties. <p> For instance if the application properties contains quarkus.vault.secret-config-kv-path.myprefix=config, and vault path secret/config contains foo=bar, then myprefix.foo will be available in the MP config. <p> If the same property is available in 2 different paths for the same prefix, the last one will win. <p> See also the documentation for the quarkus.vault.kv-secret-engine-mount-path property for some insights on how the full Vault url gets built.

list of string

required

Database credentials role, as defined by https://www.vaultproject.io/docs/secrets/databases/index.html

One of database-credentials-role or kv-path needs to be defined. not both.

string

A path in vault kv store, where we will find the kv-key.

One of database-credentials-role or kv-path needs to be defined. not both.

string

Key name to search in vault path kv-path. The value for that key is the credential.

kv-key should not be defined if kv-path is not.

string

password

Health check configuration

Type

Default

Whether or not an health check is published in case the smallrye-health extension is present.

boolean

false

Specifies if being a standby should still return the active status code instead of the standby status code.

boolean

false

Specifies if being a performance standby should still return the active status code instead of the performance standby status code.

boolean

false

Vault Enterprise

Type

Default

Vault Enterprise namespace <p> If set, this will add a X-Vault-Namespace header to all requests sent to the Vault server. <p> See https://www.vaultproject.io/docs/enterprise/namespaces

string

Authentication

Type

Default

Vault token, bypassing Vault authentication (kubernetes, userpass or approle). This is useful in development where an authentication mode might not have been set up. In production we will usually prefer some authentication such as userpass, or preferably kubernetes, where Vault tokens get generated with a TTL and some ability to revoke them. Lease renewal does not apply.

string

Client token wrapped in a wrapping token, such as what is returned by: vault token create -wrap-ttl=60s -policy=myapp client-token and client-token-wrapping-token are exclusive. Lease renewal does not apply.

string

Role Id for AppRole auth method. This property is required when selecting the app-role authentication type.

string

Secret Id for AppRole auth method. This property is required when selecting the app-role authentication type.

string

Wrapping token containing a Secret Id, obtained from: vault write -wrap-ttl=60s -f auth/approle/role/myapp/secret-id secret-id and secret-id-wrapping-token are exclusive

string

User for userpass auth method. This property is required when selecting the userpass authentication type.

string

Password for userpass auth method. This property is required when selecting the userpass authentication type.

string

Wrapping token containing a Password, obtained from: vault kv get -wrap-ttl=60s secret/ The key has to be 'password', meaning the password has initially been provisioned with: vault kv put secret/ password= password and password-wrapping-token are exclusive

string

Kubernetes authentication role that has been created in Vault to associate Vault policies, with Kubernetes service accounts and/or Kubernetes namespaces. This property is required when selecting the Kubernetes authentication type.

string

Location of the file containing the Kubernetes JWT token to authenticate against in Kubernetes authentication mode.

string

/var/run/secrets/kubernetes.io/serviceaccount/token

Allows configure Kubernetes authentication mount path.

string

auth/kubernetes

TLS

Type

Default

Allows to bypass certificate validation on TLS communications. If true this will allow TLS communications with Vault, without checking the validity of the certificate presented by Vault. This is discouraged in production because it allows man in the middle type of attacks.

boolean

Certificate bundle used to validate TLS communications with Vault. The path to a pem bundle file, if TLS is required, and trusted certificates are not set through javax.net.ssl.trustStore system property.

string

If true and Vault authentication type is kubernetes, TLS will be active and the cacert path will be set to /var/run/secrets/kubernetes.io/serviceaccount/ca.crt. If set, this setting will take precedence over property quarkus.vault.tls.ca-cert. This means that if Vault authentication type is kubernetes and we want to use quarkus.vault.tls.ca-cert or system property javax.net.ssl.trustStore, then this property should be set to false.

boolean

true

Transit Engine

Type

Default

Specifies the name of the key to use. By default this will be the property key alias. Used when the same transit key is used with different configurations. Such as in:

quarkus.vault.transit.key.my-foo-key.name=foo

quarkus.vault.transit.key.my-foo-key-with-prehashed.name=foo
quarkus.vault.transit.key.my-foo-key-with-prehashed.prehashed=true
...
transitSecretEngine.sign("my-foo-key", "my raw content");
or
transitSecretEngine.sign("my-foo-key-with-prehashed", "my already hashed content");

string

Set to true when the input is already hashed. Applies to sign operations.

boolean

When using a RSA key, specifies the RSA signature algorithm. Applies to sign operations.

string

Specifies the hash algorithm to use for supporting key types. Applies to sign operations.

string

Specifies the type of key to create for the encrypt operation. Applies to encrypt operations.

string

If enabled, the key will support convergent encryption, where the same plaintext creates the same ciphertext. Applies to encrypt operations.

string

WebSockets Client

Type

Default

The maximum amount of data that can be sent in a single frame. Messages larger than this must be broken up into continuation frames.

int

65536

If the websocket methods should be run in a worker thread. This allows them to run blocking tasks, however it will not be as fast as running directly in the IO thread.

boolean

false

gRPC

Type

Default

Whether or not metrics are published in case a metrics extension is present.

boolean

false

Start gRPC server in dev mode even if no gRPC services are implemented. By default set to true to ease incremental development of new services using dev mode.

boolean

true

Whether or not a health check on gRPC status is published in case the smallrye-health extension is present.

boolean

true

Whether or not the gRPC health check is exposed.

boolean

true

Configures the gRPC clients

Type

Default

int

9000

The host name / IP on which the service is exposed.

string

required

The classpath path or file path to a server certificate or certificate chain in PEM format.

path

The classpath path or file path to the corresponding certificate private key file in PEM format.

path

An optional trust store which holds the certificate information of the certificates to trust The trust store can be either on classpath or in an external file.

path

Whether plain-text should be used instead of TLS. Enables by default, except it TLS/SSL is configured. In this case, plain-text is disabled.

boolean

The duration after which a keep alive ping is sent.

Duration

The flow control window in bytes. Default is 1MiB.

int

The duration without ongoing RPCs before going to idle mode.

Duration

The amount of time the sender of of a keep alive ping waits for an acknowledgement.

Duration

Whether keep-alive will be performed when there are no outstanding RPC on a connection.

boolean

false

The max number of hedged attempts.

int

5

The max number of retry attempts. Retry must be explicitly enabled.

int

5

The maximum number of channel trace events to keep in the tracer for each channel or sub-channel.

int

The maximum message size allowed for a single gRPC frame (in bytes). Default is 4 MiB.

int

The maximum size of metadata allowed to be received (in bytes). Default is 8192B.

int

The negotiation type for the HTTP/2 connection. Accepted values are: TLS, PLAINTEXT_UPGRADE, PLAINTEXT

string

TLS

Overrides the authority used with TLS and HTTP virtual hosting.

string

The per RPC buffer limit in bytes used for retry.

long

Whether retry is enabled. Note that retry is disabled by default.

boolean

false

long

string

Use a custom load balancing policy. Accepted values are: pick_value, round_robin, grpclb

string

pick_first

The compression to use for each call. The accepted values are gzip and identity.

string

The deadline used for each call. The format uses the standard java.time.Duration format. You can also provide duration values starting with a number. In this case, if the value consists only of a number, the converter treats the value as seconds. Otherwise, PT is implicitly prepended to the value to obtain a standard java.time.Duration format.

Duration

Configure the gRPC server

Type

Default

The gRPC Server port.

int

9000

The gRPC Server port used for tests.

int

9001

The gRPC server host.

string

0.0.0.0

The gRPC handshake timeout.

Duration

The max inbound message size in bytes.

int

The max inbound metadata size in bytes

int

The classpath path or file path to a server certificate or certificate chain in PEM format.

path

The classpath path or file path to the corresponding certificate private key file in PEM format.

path

An optional key store which holds the certificate information instead of specifying separate files. The key store can be either on classpath or an external file.

path

An optional parameter to specify the type of the key store file. If not given, the type is automatically detected based on the file name.

string

A parameter to specify the password of the key store file. If not given, the default ("password") is used.

string

password

An optional trust store which holds the certificate information of the certificates to trust The trust store can be either on classpath or an external file.

path

An optional parameter to specify type of the trust store file. If not given, the type is automatically detected based on the file name.

string

A parameter to specify the password of the trust store file.

string

The cipher suites to use. If none is given, a reasonable default is selected.

list of string

The list of protocols to explicitly enable.

list of string

TLSv1.3,TLSv1.2

Configures the engine to require/request client authentication. NONE, REQUEST, REQUIRED

none, request, required

none

Disables SSL, and uses plain text instead. If disabled, configure the ssl configuration.

boolean

true

Whether ALPN should be used.

boolean

true

The path to the certificate file.

string

The path to the private key file.

string

Enables the gRPC Reflection Service. By default, the reflection service is only exposed in dev mode. This setting allows overriding this choice and enable the reflection service every time.

boolean

false

Number of gRPC server verticle instances. This is useful for scaling easily across multiple cores. The number should not exceed the amount of event loops.

int

1

Sets a custom keep-alive duration. This configures the time before sending a keepalive ping when there is no read activity.

Duration

gRPC compression, e.g. "gzip"

string

About the Duration format

The format for durations uses the standard java.time.Duration format. You can learn more about it in the Duration#parse() javadoc.

You can also provide duration values starting with a number. In this case, if the value consists only of a number, the converter treats the value as seconds. Otherwise, PT is implicitly prepended to the value to obtain a standard java.time.Duration format.

About the MemorySize format

A size configuration option recognises string in this format (shown as a regular expression): [0-9]+[KkMmGgTtPpEeZzYy]?. If no suffix is given, assume bytes.