inspection settings | RigFabTech docs

What inspection needs from you before it installs. It goes in one small file, inspection.yaml, which you pass to helm install and helm upgrade after site.yaml, as Install shows.

Starter file

inspection.yaml holds every setting on this page with its description. Save it, replace each <PLACEHOLDER> and remove the optional lines you don't need. inspection.schema.json describes the file to editors that check YAML against a JSON schema.

Secret settings

Passwords, keys and other values to keep private.

Name	Required	Description
`AZURE_AD_CLIENT_ID`	Yes	The application (client) ID of inspection's app registration at Microsoft Entra ID, which people sign in with and other services request tokens for
`AZURE_AD_CLIENT_SECRET`	Yes	The client secret of the app registration people sign in to inspection with at Microsoft Entra ID
`AZURE_AD_TENANT_ID`	Yes	Your Microsoft Entra tenant's ID
`DELETE_GROUP_ID`	Yes	The object ID of the Microsoft Entra group whose members are inspection's administrators: they may edit and delete any record, completed ones included, and generate AI reports
`LLM_API_KEY`	Yes	The API key inspection calls your LLM gateway with to write photo descriptions, 8D analyses and AI reports

Give them in one of two ways, never both.

In production, in a Secret of your own. A values file with passwords in it tends to end up in git, and Helm keeps a copy of the values you pass in its release record in the cluster. Write the values to a file, inspection.env, one NAME=value per line with each value as it is, without quotes, then create the Secret and delete the file:

kubectl create secret generic inspection-settings --namespace rft-app-inspection --from-env-file=inspection.env
rm inspection.env

In inspection.yaml, give only the Secret's name:

secrets:
  existingSecret: inspection-settings

To keep the Secret in git or a secret store instead, create it with External Secrets Operator, SOPS or Sealed Secrets, with the same keys.

The Secret needs a key for every required name above. When one is missing, the product's pods don't start: kubectl --namespace rft-app-inspection get pods shows CreateContainerConfigError or Init:CreateContainerConfigError, and kubectl --namespace rft-app-inspection describe pods names the missing key. Add it and the pods start by themselves. After you change a value in the Secret, restart the product with kubectl --namespace rft-app-inspection rollout restart deployment.

To get started, in the values file. Under secrets in inspection.yaml, as the starter file has them. The chart keeps them in the Secret inspection-env.

Made for you

The platform makes these once and keeps them in the Secret inspection-generated. There is nothing to set.

NEXTAUTH_SECRET

In site.yaml

inspection answers on inspection.<domain>, under your global.rigfab.domain. To give it another name, set global.rigfab.hosts.inspection to the full host name.

inspection reaches these services on your network. Say where each answers, once, in site.yaml; the products may reach only those addresses and ports:

global:
  rigfab:
    site:
      destinations:
        llm-gateway: {cidrs: [<ADDRESS>/32], ports: [<PORT>]}

Check before you install

Once the base chart is installed, and before you install or upgrade this product:

rft check --chart oci://registry.rigfab.com/rft/apps/inspection/charts/inspection --version <VERSION> --release inspection --namespace rft-app-inspection --values site.yaml --values inspection.yaml

It renders the chart with your files and asks the cluster whether it would accept the result, and changes nothing. A setting that is missing or misspelt in your files stops it with a message that names the setting. It doesn't look inside a Secret of your own. A misspelt name under global.rigfab is the base chart's to refuse, so check site.yaml with the base chart after every change to it, as Install shows.