-
Notifications
You must be signed in to change notification settings - Fork 75
Expand file tree
/
Copy pathprofiles.yml
More file actions
116 lines (109 loc) · 4.92 KB
/
Copy pathprofiles.yml
File metadata and controls
116 lines (109 loc) · 4.92 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
# Development and testing profiles for NiPyAPI
# These profiles provide working configurations for Docker-based development
#
# Format Support: This file uses YAML, but JSON is also supported since JSON is a subset of YAML
#
# Certificate Configuration:
# - Simple configuration: Use shared ca_path, client_cert, client_key for both NiFi and Registry
# - Complex PKI: Use per-service nifi_ca_path/registry_ca_path, nifi_client_cert/registry_client_cert, etc.
# - Per-service values take precedence over shared values if specified
# - Environment variables can override any certificate path (see security.rst docs)
#
# Examples:
# - Shared CA, different client certs: Set ca_path, then nifi_client_cert + registry_client_cert
# - Different CAs: Set nifi_ca_path + registry_ca_path (ca_path becomes fallback)
# - Environment override: NIFI_CA_CERT_PATH=/custom/nifi-ca.pem overrides nifi_ca_path
single-user:
nifi_url: https://localhost:9443/nifi-api
registry_url: http://localhost:18080/nifi-registry-api
registry_internal_url: http://registry-single:18080
nifi_user: einstein
nifi_pass: password1234
registry_user: null # Not used for HTTP Registry (no auth required)
registry_pass: null # Not used for HTTP Registry (no auth required)
# NiFi uses HTTPS with self-signed certs, Registry uses HTTP (no auth needed)
nifi_verify_ssl: false # Accept self-signed certificates
registry_verify_ssl: false
suppress_ssl_warnings: true # Suppress warnings in development
# No client certificates needed for single-user basic auth
ca_path: null
client_cert: null
client_key: null
client_key_password: null
# Per-service certificates (complex PKI) - defaults to shared if not specified
nifi_ca_path: null
registry_ca_path: null
nifi_client_cert: null
registry_client_cert: null
nifi_client_key: null
registry_client_key: null
nifi_client_key_password: null
registry_client_key_password: null
# NiFi proxy identity for Registry communication (null = no proxy needed)
nifi_proxy_identity: null
# OIDC-specific configuration (OAuth2 Resource Owner Password Credentials flow)
oidc_token_endpoint: null
oidc_client_id: null
oidc_client_secret: null
secure-ldap:
nifi_url: https://localhost:9444/nifi-api
registry_url: https://localhost:18444/nifi-registry-api
registry_internal_url: https://registry-ldap:18443
nifi_user: einstein
nifi_pass: password
registry_user: einstein
registry_pass: password
ca_path: "resources/certs/client/ca.pem"
suppress_ssl_warnings: true # Supress self-signed certificate warnings
nifi_proxy_identity: "C=US, O=NiPyAPI, CN=nifi"
secure-mtls:
nifi_url: https://localhost:9445/nifi-api
registry_url: https://localhost:18445/nifi-registry-api
registry_internal_url: https://registry-mtls:18443
ca_path: "resources/certs/client/ca.pem"
client_cert: "resources/certs/client/client.crt"
client_key: "resources/certs/client/client.key"
client_key_password: ""
suppress_ssl_warnings: true # Supress self-signed certificate warnings
nifi_proxy_identity: "C=US, O=NiPyAPI, CN=nifi"
secure-oidc:
nifi_url: https://localhost:9446/nifi-api
registry_url: http://localhost:18446/nifi-registry-api
registry_internal_url: http://registry-oidc:18080
nifi_user: einstein
nifi_pass: password1234
registry_user: einstein
registry_pass: password1234
ca_path: "resources/certs/client/ca.pem"
suppress_ssl_warnings: true # Supress self-signed certificate warnings
# OIDC-specific configuration (OAuth2 Resource Owner Password Credentials flow)
oidc_token_endpoint: "http://localhost:8080/realms/nipyapi/protocol/openid-connect/token"
oidc_client_id: "nipyapi-client"
oidc_client_secret: "nipyapi-secret"
# Bearer token profile - simplest possible configuration
# Use when you have a pre-obtained JWT token (e.g., from CI/CD, identity provider)
# This is ideal for GitHub Actions, Kubernetes jobs, or any environment with injected tokens
bearer-token:
nifi_url: https://nifi.example.com/nifi-api
nifi_bearer_token: null # Set via NIFI_BEARER_TOKEN environment variable
nifi_verify_ssl: true
# GitHub CI/CD profile - NiFi only, for testing Git-based registry workflows
# Uses GitHub Registry Client instead of NiFi Registry
# GitHub registry configuration is handled by nipyapi-actions, not nipyapi profiles
github-cicd:
nifi_url: https://localhost:9447/nifi-api
nifi_user: einstein
nifi_pass: password1234
nifi_verify_ssl: false
suppress_ssl_warnings: true
# No NiFi Registry - using GitHub as flow registry
registry_url: null
# Example profile using NiFi CLI properties file integration
cli-properties:
# Load configuration from existing NiFi CLI properties file
nifi_cli_properties_file: "nifi-cli-oidc.properties"
# Use extracted CA certificate for SSL verification from resources/certs/extract_jks_certs.sh
nifi_ca_path: "resources/certs/extracted/ca.pem"
# Development SSL settings (disable for self-signed certificates)
nifi_verify_ssl: false
suppress_ssl_warnings: true