Configure self-managed Lens

Set the Helm values, storage Secret, retention, ingest, Identity Service connection, and TLS trust for Lens.

You configure self-managed Lens with a Helm values file and the Secrets it references. The values file sets your tenant, instance, retention, and the Identity Service connection. The Secrets hold what shouldn't be in a values file: Redis URLs, tokens, and the license.

Helm values

This values file is the starting point for Deploy. It assumes an Identity Service release named ids in the same namespace. Save it as lens-values.yaml:

tenantId: default

instance:
  id: default

ingest:
  enabled: true

storage:
  existingSecret: lens-storage

license:
  existingSecret: lens-license

dataplane:
  # The Identity Service release's Service. In-cluster, it speaks plain HTTP.
  identityServiceBaseURL: http://ids-iris-identity-service:9200

identityService:
  allowInsecureTransport: true
  credential:
    existingSecret: lens-dp-credential

controlplane:
  internalToken:
    existingSecret: lens-internal-token

tests:
  enabled: true

To pull images from a mirror, set each repository to your registry. Keep each tag at the chart's version.

Every Secret value also has an existingSecretChecksum. Set it when you change the Secret's content, so the pods roll. See Rotate credentials.

Storage Secret

The storage Secret holds one configuration file per process. Each key is a file name:

Save the data-plane file as lens-dataplane-storage.yaml. Here streams and index share the records database:

storage:
  streams:
    urls:
      - rediss://<records-user>:<records-password>@<records-host>:<records-port>
  index:
    urls:
      - rediss://<records-user>:<records-password>@<records-host>:<records-port>
  content:
    urls:
      - rediss://<content-user>:<content-password>@<content-host>:<content-port>
  metadata:
    urls:
      - rediss://<metadata-user>:<metadata-password>@<metadata-host>:<metadata-port>

Save the control-plane file as lens-controlplane-storage.yaml:

storage:
  metadata:
    urls:
      - rediss://<metadata-user>:<metadata-password>@<metadata-host>:<metadata-port>
# Optional. The control plane checks the records database for Redis Search,
# Redis JSON, and noeviction at startup and on each retention change.
dram:
  urls:
    - rediss://<records-user>:<records-password>@<records-host>:<records-port>

Use the same metadata URL in both files. See Redis databases for what each role needs.

Retention

Lens keeps turn structure, timing, scores, and outcomes for instance.retention.indexRetention, and captured content for instance.retention.contentTTL. The read API offers time ranges that fit these windows. The windows must satisfy streamTrim < contentTTL ≤ indexRetention.

The control plane records these values on the instance at its first start. The data plane stamps each content expiry from contentTTL as rendered by Helm. To change retention after install, see Change retention.

Nothing trims the span streams yet, whatever streamTrim is set to.

Ingest

With ingest.enabled=false, the default, the data plane answers POST /iris/data/v1beta1/lens/v1/traces with 503, and the read API still works. Set ingest.enabled=true when you're ready for agents to send turns, and watch the records database's memory from then on.

TLS trust

No Lens workload terminates TLS. To use an https:// Identity Service URL, put a TLS-terminating proxy, gateway, or service mesh in front of the Identity Service.

When a certificate, for the Identity Service or a rediss:// database, is signed by a private CA, create a Secret that holds the CA bundle and set tls.caCertSecret to its name. Every workload mounts it at /etc/ssl/custom and trusts it in addition to the image's system CAs. Set tls.caCertSecretChecksum to roll the workloads when the bundle changes.

Identity Service in another namespace

The Identity Service release can run in another namespace. Then:

1. Set dataplane.identityServiceBaseURL to its fully qualified Service, such as http://ids-iris-identity-service.<identity-service-namespace>.svc:9200.
2. Set the Identity Service's productValidation.products.lens.baseURL to http://lens-redis-lens-controlplane.<namespace-name>.svc:9300.
3. Create the runtime credential and internal token Secrets with the same values in both namespaces. A pod mounts Secrets only from its own namespace.
4. Allow the Identity Service pods to reach the control plane on port 9300, and the data plane to reach the Identity Service.