Skip to main content

Feature Flags

Feature flags — or Flags for short — allow you to enable or disable certain features inside Morio.

Note that all flags are disabled by default, so you can only ever enable flags, even if that flag disables something.

For example, to disable the UI service, you can enable the HEADLESS_MORIO flag.

The full list of feature flags is included below.

DISABLE_IDP_APIKEY​

Enable this flag to disable the apikey identity provider thereby blocking authentication via API Keys.

DISABLE_IDP_LDAP​

Enable this flag to disable the ldap identity provider thereby blocking authentication via any LDAP backend.

DISABLE_IDP_LOCAL​

Enable this flag to disable the local identity provider thereby blocking authentication via local Morio accounts.

DISABLE_IDP_MRT​

Enable this flag to disable the mrt identity provider thereby blocking authentication via the Morio Root Token.

Note that if you enable this flag in your initial settings, you will have effectively locked yourself out of your Morio deployment unless you have also included an alternative identity provider.

As such, we recommend to not enable this flag until after you have made sure you have an alternative identity provider that you know is functioning as expected.

DISABLE_IDP_OIDC​

Enable this flag to disable the oidc identity provider thereby blocking authentication via any OpenID Connect backend.

DISABLE_ROOT_TOKEN​

Enable this flag to disable authenticating with the Morio Root Token ().

DISABLE_SERVICE_UI​

Enable this flag to disable the UI service and run Morio in headless mode where you can only use the API to manage it.

ENABLE_PROXY_LETSENCRYPT_CERTIFICATES​

Enable this flag to have Morio provision certificates from Let’s Encrypt.

This requires your Morio instance to be reachable over HTTP from the public internet to complete the HTTP challenge. It is in other words intended for Morio deployments on the internet.

ENFORCE_HTTP_MTLS​

Enable this feature flag to enforce on all HTTP endpoints.

The purpose of this feature flag is to add an extra layer of defence so prevent anyone from being able to establish an HTTP connection to your Morio instance. This is useful when deploying Morio in hostile environments, such as on the Internet.

The extra mTLS authentication comes in addition to Morio’s standard HTTP authentication, as described in the IAM guide. In other words, this is not a replacement for any other authentication, but adds an extra authentication layer.

SEED_ON_RELOAD​

Enable this flag to seed Morio when reloading.

This flag comes into play when you have have external.seed.git settings that make Morio clone a git repository locally.

By default, Morio will not re-clone the repository when you make a configuration change, or when you restart Morio. Instead, it will only update the git repository from the remote when you explicitly seed Morio through the seed API endpoint, (or via the UI which uses this endpoint under the hood).

When you enable this flag, Morio will seed whenever you restart it, or update its configuration.

warning

Even with this flag enabled, Morio will not reseed the data when it restarts in an unforeseen way, such as with a server reboot.

Understanding then this flag takes effect

When updating the Morio settings, there are three steps:

  • Core receives the configuration update request
  • Core will reseed if the RESEED_ON_RELOAD flag is set
  • Core will apply the new configuration

This means that if you change this flag in an update to the settings, it will not take effect until the next update.

In other words, the flag value of the running configuration is used, not the flag value of the new settings.

REQUIRE_CLIENT_INVITES​

Enable this flag to require clients to provide an invite code when joining the cluster.

By default, clients can join the cluster without restrictions. You merely install the Morio client and join it to the cluster.

If you need to guard against rogue client registration, you can enable this feature flag. Doing so will require clients to present an invite code. You can generate these invite codes through the API or UI.