DIAL Deployment Manager Backend configuration

Deployment Manager Backend configures cluster access, image builds, workload lifecycles, storage, and authentication through Spring Boot properties and environment variables. This reference is for platform engineers who deploy the backend. For the settings on DIAL Admin and in the cluster, start with Configuration overview.

Version scope

Defaults below are checked against Backend 0.22.0 application.yml, with behavior described in that release's configuration reference. The YAML is authoritative where its defaults differ from the reference tables: for example, Knative startup is 60 seconds and informer resync is 600 seconds.

The development reference is newer than this release and removes the NIM configuration. The 0.22.0 reference table lists KServe's informer interval as K8S_NIM_DEPLOYMENT_INFORMER_RESYNC_INTERVAL_SEC, but the released YAML reads K8S_KSERVE_DEPLOYMENT_INFORMER_RESYNC_INTERVAL_SEC; the tables below follow the YAML.

Spring configuration

Environment variables, external YAML/properties, command-line arguments, and Java system properties can supply configuration. SPRING_CONFIG_ADDITIONAL_LOCATION=file:/config/override.yml adds an external file. Normal Spring precedence applies; external files do not override higher-priority environment variables or command-line options.

Full Kubernetes templates can be overridden through Spring configuration, including service accounts, pod security, volumes, annotations, and resource defaults. For example:

app:
  knative-service-config:
    spec:
      template:
        spec:
          serviceAccountName: managed-workload
          automountServiceAccountToken: false

Kubernetes connection and RBAC

Variable or property	Default	Description
K8S_CONNECT_TYPE	CONFIG_FILE	CONFIG_FILE or TOKEN.
app.kubernetes.config_file.kube-config	${user.home}/.kube/config	Kubeconfig path for file-based access. Mount the file and override this property when needed.
K8S_DEPLOY_CONTEXT	—	Kubeconfig context for managed resources.
K8S_MASTER_URL	—	Kubernetes API URL; required in token mode.
K8S_OAUTH_TOKEN	—	Kubernetes credential; required in token mode.
K8S_BUILD_NAMESPACE	default	Namespace for build, copy, and analysis jobs.

The backend needs permissions in each enabled workload namespace, not only its own namespace. The upstream RBAC reference covers jobs, pods/logs/events, secrets, Knative Services, NIMService, and InferenceService resources. Workload metrics additionally use pod proxy access and metrics.k8s.io; Cilium enforcement needs policy permissions. The full security-model guide includes the broader bindings for these features.

Security

Variable	Default	Description
CONFIG_REST_SECURITY_MODE	none	oidc, basic, or none. Use oidc for Admin's forwarded user tokens.
SECURITY_ROLES_MAPPING	{"ConfigAdmin":["FULL_ADMIN"],"admin":["FULL_ADMIN"]}	Default mapping from identity-provider roles to backend roles.
CLAIMS_EMAIL_KEY	unique_name	Default email claim.
SECURITY_USER_CLAIM	oid	Default principal claim; Keycloak commonly uses sub instead.
SECURITY_REQUIRE_EMAIL	false	Require an email claim.
DISABLE_SWAGGER_AUTHORIZATION	false	Disable Swagger UI authorization.

FULL_ADMIN allows modifying operations. READ_ONLY_ADMIN is the read-only backend role. Configure these mappings on Deployment Manager independently of the Admin Frontend role names and Core admin rules. Basic authentication uses Spring's spring.security.user.name and spring.security.user.password properties.

Identity providers

Configure one or more named providers. The table uses property names; environment equivalents follow Spring binding, for example PROVIDERS_KEYCLOAK_ISSUER, PROVIDERS_KEYCLOAK_JWKSETURI, and PROVIDERS_KEYCLOAK_ROLECLAIMS.

Property	Description
providers.<name>.issuer	Accepted issuer(s), matching the token's iss.
providers.<name>.jwk-set-uri	JWKS URL for signature validation.
providers.<name>.user-info-endpoint	User-info endpoint for opaque tokens, as an alternative to JWKS validation.
providers.<name>.audiences	Accepted aud values.
providers.<name>.role-claims	Comma-separated claim paths from which roles are read.
providers.<name>.roles-mapping	Provider-specific role mapping, merged with defaults; the provider wins for overlapping keys.
providers.<name>.principal-claim	Override the principal claim for this provider.
providers.<name>.email-claims	Email claim paths; used by providers that require them, such as GCP.
providers.<name>.aliases	Azure issuer aliases.

Without an effective role mapping, authenticated requests are denied with 403. See the OIDC example for a Keycloak configuration aligned with Admin.

API-key authentication

API-key authentication is optional and requires OIDC security mode. The backend validates an Api-Key header through Core's GET /v1/user/info. It does not maintain its own store of API keys.

Variable	Default	Description
API_KEY_ENABLED	false	Accept Core API keys alongside OIDC tokens.
API_KEY_CORE_URL	—	Required Core base URL when enabled.
API_KEY_CACHE_TTL_SECONDS	60	Cache lifetime for successful introspection. Revocation can take up to this interval to be observed.
API_KEY_CACHE_MAX_SIZE	10000	Maximum cached introspection results.
API_KEY_REQUEST_TIMEOUT_MS	3000	Core introspection timeout, in milliseconds.
API_KEY_ROLES_MAPPING	—	Maps project-key roles to backend roles.
API_KEY_STARTUP_PROBE	true	Probe Core at startup; unreachable Core aborts startup.

Project-key callers use API_KEY_ROLES_MAPPING. JWT-rooted per-request keys use the default OIDC role, principal, and email mappings instead. At least one of those role mappings must be nonempty. When both Authorization and Api-Key are present, the token path takes precedence.

Core non-success responses and malformed user-info responses become 401; transport failures become 503. Failures are not cached. See the upstream API-key reference for the two response shapes and mapping examples.

Database

The backend stores image definitions, deployment state, and audit revisions in its database. Flyway applies migrations at startup; Hibernate validates the schema.

Variable	Default	Description
DATASOURCE_VENDOR	H2	H2, POSTGRES, or MS_SQL_SERVER.
DATASOURCE_AUTH_TYPE	basic	basic, azure, or gcp.
H2_FILE	./deployment_manager	H2 file path.
H2_OPS	CIPHER=AES;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE	H2 connection options.
H2_DATASOURCE_MASTER_KEY	—	H2 encryption master key.
H2_DATASOURCE_ENCRYPTED_FILE_KEY	—	H2 encrypted file key.
H2_DATASOURCE_PASSWORD	—	H2 password. The H2 user is sa.
POSTGRES_HOST, POSTGRES_PORT	localhost, 5432	PostgreSQL endpoint.
POSTGRES_DATABASE, POSTGRES_OPS	testdb, empty	Database and JDBC query options.
POSTGRES_DATASOURCE_USERNAME, POSTGRES_DATASOURCE_PASSWORD	postgres, postgres	PostgreSQL basic credentials.
MS_SQL_SERVER_HOST, MS_SQL_SERVER_PORT	localhost, 1433	SQL Server endpoint.
MS_SQL_SERVER_DATABASE, MS_SQL_SERVER_OPS	testdb, encrypt=false;	Database and connection options. Use encrypted transport in production.
MS_SQL_SERVER_DATASOURCE_USERNAME, MS_SQL_SERVER_DATASOURCE_PASSWORD	sa, SQLServerPassword1	SQL Server basic credentials.
SPRING_JPA_HIBERNATE_DDL_AUTO	validate	Schema validation strategy.
SPRING_FLYWAY_ENABLED	true	Enable migrations for the selected vendor.
AUTH_AZURE_TYPE	none	Azure authentication type: none, credential, cli, or managed.
AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET	—	Azure credentials when required by the selected authentication type.

Warning

H2 is intended for development and testing. Its file-copy backup/restore is unreliable; use PostgreSQL or SQL Server for production and keep database backups together with the cluster and registry recovery plan. Replace the example/default database credentials.

SQL Server's upstream configuration recommends a case-sensitive, accent-sensitive collation such as SQL_Latin1_General_CP1_CS_AS. Standard Spring datasource properties can override the generated JDBC URL. Migration locations are selected from datasource.vendor; the DB_VENDOR name in the upstream documentation table is not used by the 0.22.0 YAML.

Image builds and registries

Variable or property	Default	Description
DOCKER_REGISTRY	test-docker-registry	Registry into which images are built or copied. Set it for the deployment.
DOCKER_REGISTRY_PROTOCOL	https	Registry transport.
DOCKER_REGISTRY_AUTH	NONE	NONE or BASIC.
DOCKER_REGISTRY_USER, DOCKER_REGISTRY_PASSWORD	—	Credentials for basic registry authentication.
TRUSTED_PRIVATE_REGISTRIES	—	JSON array of source registries: registry, optional protocol, authScheme, user, and password.
AUTO_PULL_SECRET_ENABLED	true	Create and attach pull secrets for credentialed primary/trusted registries used by image-based deployments and chained transformer images.
TRUSTED_PRIVATE_GIT_REPOS	—	JSON array of scoped Git credentials; see Private Git repositories.
GIT_CLONE_IMAGE	alpine/git:2.52.0	Clone container image; needs Git and an SSH client for SSH access.
app.builder-rootless-image	moby/buildkit:v0.27.1-rootless	Rootless BuildKit image.
app.builder-root-image	moby/buildkit:v0.27.1	Privileged root builder image.
app.analyser-image	anchore/syft:v1.40.0	Image analyzer.
app.copy-image	quay.io/skopeo/stable:v1.21.0	Image copy/push tool.
app.docker-config-path	/kaniko/.docker/config.json	Credential mount path inside build containers.
IMAGE_NAME_FORMAT	app-%s	Built image name; must contain %s for the definition ID.
RESOURCE_NAME_PREFIX	Empty	Prefix for generated resources. Do not change it on an existing installation: existing images and Kubernetes resources will no longer be found under their expected names.
PIPELINE_RUNNER_MAX_LOG_COUNT, PIPELINE_RUNNER_MAX_LOG_LENGTH	10000, 10000	Limits on build-log entries and entry length.
SECRETS_VOLUME_MOUNT_PATH	/etc/secrets	Secret-file mount location for managed workloads.

The MCP proxy image variables select the stdio wrapper executable artifacts. They do not select the BuildKit image or the MCP server's own image.

Private Git repositories

Entries use host and optional path to scope credentials. HTTPS/HTTP credentials use user and token; SSH credentials use sshKeyPath and sshKnownHostsPath, with files mounted into the backend. Store credential values in secrets, for example Helm manager.secrets.

[
  {"host":"git.example.com","path":"team/service-a","user":"builder","token":"<REPOSITORY_TOKEN>"},
  {"host":"git.example.com","path":"team","user":"builder","token":"<GROUP_TOKEN>"}
]

An exact host wins over parent domains, then the longest matching host wins. Within that host, an exact repository path wins over a group prefix, which wins over a host-wide credential. Host matching is case-insensitive; paths are case-sensitive. Duplicate (host, path, authentication type) scopes fail startup in 0.21.0 and later. See Backend 0.21.0.

Build and workload templates

The following Spring properties expose the remaining build defaults and full Kubernetes specs. Their structure is in the release YAML; external configuration can override individual fields.

Property	Default / purpose
app.image-label	latest
app.image-build-timeout-sec, app.image-build-stop-timeout-sec	300, 45 seconds
app.image-build-logs-size-limit	1000
app.heartbeat-period-sec	30 seconds
app.max-error-log-lines, app.max-error-log-chars	20, 1000
app.build.secrets.git	Credential/config filenames and mount locations used by build jobs.
app.builder-job-config, app.analyzer-job-config, app.copy-image-job-config	Kubernetes Job templates, with backoffLimit: 0, no service-account token mount, and restartPolicy: Never.
app.init-builder-container-config, app.builder-root-container-config, app.builder-rootless-container-config	Clone/build container specs, including commands, mounts, and security contexts. The root builder is privileged; the rootless builder runs as UID/GID 1000.
app.push-container-config, app.analyzer-container-config, app.copy-image-container-config, app.builder-secret-config	Push/analyze/copy container and build Secret templates.
app.knative-service-config, app.knative-service-container-config	Full Knative Service and container specs. Default container requests: 250m CPU, 250M memory, 500M ephemeral storage; limits: 1000m, 4G, 1G.
app.inference-service-config, app.text-classification-transformer-container-config	KServe predictor and optional transformer specs.
app.nim-service-config, app.nim-service-expose-ingress-config	NIMService and ingress specs in 0.22.0.

Workload deployment

Variable	Default	Description
K8S_KNATIVE_ENABLED	true	Enable Knative container deployments.
K8S_KNATIVE_DEPLOYMENT_NAMESPACE	default	Target namespace.
K8S_KNATIVE_DEPLOYMENT_STARTUP_TIMEOUT_SEC	60	Startup timeout.
K8S_KNATIVE_DEPLOYMENT_UNDEPLOY_TIMEOUT_SEC	300	Undeploy timeout.
K8S_KNATIVE_DEPLOYMENT_INFORMER_RESYNC_INTERVAL_SEC	600	Informer resync interval.
K8S_KNATIVE_DEPLOYMENT_READY_GRACE_PERIOD_SEC	15	Delay after Ready=False before reporting a crash; 0 disables the grace period.
K8S_KSERVE_ENABLED	false	Enable KServe inference deployments.
K8S_KSERVE_DEPLOYMENT_NAMESPACE	default	KServe namespace; upstream documents a 14-character limit.
K8S_KSERVE_DEPLOYMENT_STARTUP_TIMEOUT_SEC	3600	Inference startup timeout.
K8S_KSERVE_DEPLOYMENT_INFORMER_RESYNC_INTERVAL_SEC	600	Informer resync interval.
K8S_KSERVE_DEPLOYMENT_USE_CLUSTER_INTERNAL_URL	true	Resolve a cluster-internal service URL.
K8S_NIM_ENABLED	false	Enable NIM in 0.22.0.
K8S_NIM_DEPLOYMENT_NAMESPACE	default	NIM target namespace.
K8S_NIM_DEPLOYMENT_STARTUP_TIMEOUT_SEC	3600	NIM startup timeout.
K8S_NIM_DEPLOYMENT_INFORMER_RESYNC_INTERVAL_SEC	600	Informer resync interval.
K8S_NIM_DEPLOYMENT_USE_CLUSTER_INTERNAL_URL	true	Resolve cluster-internal NIM URLs.
K8S_NIM_CLUSTER_HOST	—	Host for external ingress in standalone NIM mode.
K8S_NIM_DEPLOYMENT_URL_SCHEMA	—	Optional URL scheme override; accepts a scheme with or without ://.
K8S_NIM_DEPLOYMENT_KSERVE_MODE_ENABLED	false	Use NIM's KServe integration instead of standalone mode.
K8S_NIM_INGRESS_CLASS_NAME	nginx	Ingress class for standalone external NIM exposure.
NIM_SERVICE_NGC_SECRET, NIM_SERVICE_NGC_AUTH_SECRET	ngc-secret, ngc-api-secret	NGC pull/auth Secret names.
DEPLOYMENT_HEALTHCHECK_ENABLED	true	Enable deployment health checks.
DEPLOYMENT_RESERVED_ENV_NAMES	PORT,K_SERVICE,K_CONFIGURATION,K_REVISION	Reserved workload environment variable names.
KNATIVE_SERVICE_DEFAULT_INITIAL_SCALE, KNATIVE_SERVICE_DEFAULT_MIN_SCALE, KNATIVE_SERVICE_DEFAULT_MAX_SCALE	1, 0, 1	Default Knative scaling annotations.
KNATIVE_SERVICE_DEFAULT_WINDOW	300s	Autoscaling window.
KSERVE_SERVICE_DEFAULT_INITIAL_SCALE, KSERVE_SERVICE_DEFAULT_MIN_REPLICAS, KSERVE_SERVICE_DEFAULT_MAX_REPLICAS	1, 1, 1	KServe scaling defaults.

Startup deadlines

Variable	Default	Description
DEPLOYMENT_PROGRESS_DEADLINE_DEFAULT_INITIAL_DELAY	0	Default probe initial delay, in seconds.
DEPLOYMENT_PROGRESS_DEADLINE_DEFAULT_PERIOD	10	Default probe period, in seconds.
DEPLOYMENT_PROGRESS_DEADLINE_DEFAULT_FAILURE_THRESHOLD	3	Default failed-probe threshold.
DEPLOYMENT_PROGRESS_DEADLINE_BUFFER_SECONDS	30	Additional startup allowance.

With a startup probe, the progress deadline is initialDelay + period × failureThreshold + buffer, using these defaults for omitted fields. For KServe and NIM without a startup probe, 0.22.0 uses the workload's startup timeout plus the buffer.

Model integrations and resource limits

Variable	Default	Description
HUGGINGFACE_BASE_URL	https://huggingface.co	Hugging Face API base URL.
HUGGINGFACE_API_TOKEN	—	Token for Hugging Face access.
HUGGINGFACE_TAG_CACHE_DURATION	24h	Model-tag cache lifetime.
HUGGINGFACE_DEFAULT_ALLOWED_DOMAINS	huggingface.co,transfer.xethub.hf.co,cas-server.xethub.hf.co	Default model-download domains.
MCP_REGISTRY_BASE_URL	https://registry.modelcontextprotocol.io	MCP Registry API.
MCP_REGISTRY_MAX_PAGES_TO_SCAN	25	Registry pagination scan limit.
INFERENCE_TEXT_CLASSIFICATION_TRANSFORMER_IMAGE	—	Required before deploying a chained text-classification model.
INFERENCE_TEXT_CLASSIFICATION_TRANSFORMER_CPU_REQUEST, INFERENCE_TEXT_CLASSIFICATION_TRANSFORMER_CPU_LIMIT	100m, 500m	Transformer CPU defaults.
INFERENCE_TEXT_CLASSIFICATION_TRANSFORMER_MEMORY_REQUEST, INFERENCE_TEXT_CLASSIFICATION_TRANSFORMER_MEMORY_LIMIT	256Mi, 512Mi	Transformer memory defaults.
RESOURCES_MAX_CPU_IN_CORES, RESOURCES_MAX_MEMORY_IN_MB, RESOURCES_MAX_NVIDIA_GPU	10, 100000, 5	Validation ceilings for requested resources.
RESOURCES_STORAGE_MAX_SIZE	200Gi	NIM storage ceiling in 0.22.0.

Node pools

Variable	Default	Description
NODE_POOLS	Empty	YAML list of scheduling presets.
NODE_POOL_DEFAULT	Empty	Default pool ID for new deployments.
NODE_POOL_DEFAULT_MODEL	Empty	Model-serving default pool ID; takes precedence over the catch-all default.

Each entry needs a unique immutable id and display name. Optional description, nodeSelector, affinity, and tolerations describe scheduling. Selectors and affinity replace template values; tolerations append to existing values. These are scheduling presets for existing Kubernetes nodes, not a node-provisioning service.

- id: cpu-pool
  name: CPU pool
  nodeSelector:
    workload: cpu
- id: gpu-pool
  name: GPU pool
  nodeSelector:
    workload: gpu
  tolerations:
    - key: dedicated
      operator: Equal
      value: gpu
      effect: NoSchedule

Defaults are persisted when a deployment is created. Changing a default does not migrate existing deployments. Changing a pool's scheduling fields affects deployments using it on their next redeploy; changing its display name is safe. Renaming its id breaks references. The old NODE_POOL_LABEL_KEY has no effect.

Network policy

CILIUM_NETWORK_POLICIES_ENABLED defaults to false. When enabled, the backend creates Cilium policies for build jobs and workloads using configured global and per-image/per-container domain rules. Cilium must be installed and the backend must have policy RBAC. UI domain lists alone do not enable enforcement. See the upstream Cilium deployment guide.

Reconciliation, cleanup, and transfers

Variable	Default	Description
RESOURCE_CLEANER_CRON, COMPONENT_CLEANER_CRON	0 0 5 * * *	Daily cleanup schedules.
RESOURCE_CLEANER_TAKE_SIZE	100	Resource cleanup batch size.
RESOURCE_CLEANER_SCHEDULER_LOCK_AT_MOST_FOR, COMPONENT_CLEANER_SCHEDULER_LOCK_AT_MOST_FOR	10m	Maximum scheduler lock durations.
DEPLOYMENT_RECONCILE_BACKGROUND_CRON	0 */15 * * * *	Background reconciliation schedule.
DEPLOYMENT_RECONCILE_BACKGROUND_LOCK_AT_MOST	5m	Maximum background lock duration.
DEPLOYMENT_RECONCILE_BACKGROUND_STALE_THRESHOLD_MINS	10	Pending-state age before a fallback sync.
DEPLOYMENT_RECONCILE_ON_STARTUP_ENABLED	true	Reconcile state at startup.
DEPLOYMENT_RECONCILE_ON_STARTUP_BATCH_SIZE, DEPLOYMENT_RECONCILE_ON_STARTUP_CONCURRENCY	50, 2	Startup reconciliation batch size and concurrency.
DEPLOYMENT_RECONCILE_EXECUTOR_THREAD_POOL_SIZE, DEPLOYMENT_RECONCILE_EXECUTOR_QUEUE_CAPACITY	5, 100	Reconciliation worker limits.
DEPLOYMENT_RECONCILE_EXECUTOR_THREAD_NAME_PREFIX	k8s-reconciliation-pool	Worker thread name prefix.
CONFIG_EXPORT_FILE_NAME, CONFIG_EXPORT_ZIP_NAME	dm-config.json, deployment-manager-config.zip	Export artifact names.
HTTP_CLIENT_CONNECT_TIMEOUT	30000	MCP introspection client connection timeout, in milliseconds.
HTTP_CLIENT_READ_TIMEOUT, HTTP_CLIENT_WRITE_TIMEOUT	60000, 60000	MCP introspection client I/O timeouts, in milliseconds.

SSE heartbeat interval is set by app.sse.heartbeat.interval, default 10000 ms. Spring MVC's asynchronous request timeout is spring.mvc.async.request-timeout, default 600000 ms.

Workload metrics

GET /api/v1/deployments/{id}/metrics reports workload health and usage, separately from backend process metrics. Missing exporters or timed-out blocks produce partial availability; they do not imply that every metric is zero.

Variable	Default	Description
METRICS_SCRAPE_ENABLED	true	Enable metrics snapshots; disabled requests return 400.
METRICS_SCRAPE_TIMEOUT_MS	10000	Per-pod/exporter scrape budget. Must be positive.
METRICS_SCRAPE_CACHE_TTL_MS	5000	Per-deployment snapshot cache lifetime. Must be positive.
METRICS_SCRAPE_RESOURCE_USAGE_ENABLED	true	CPU/memory from metrics-server.
METRICS_SCRAPE_GPU_ENABLED	true	GPU utilization and framebuffer memory for GPU workloads.
METRICS_SCRAPE_GPU_DCGM_NAMESPACE	gpu-operator	DCGM exporter namespace.
METRICS_SCRAPE_GPU_DCGM_POD_SELECTOR	app=nvidia-dcgm-exporter	Exporter pod label selector.
METRICS_SCRAPE_GPU_DCGM_PORT	9400	Exporter port; must be positive.
METRICS_SCRAPE_GPU_DCGM_METRICS_PATH	/metrics	Exporter metrics path.
METRICS_SCRAPE_GPU_DCGM_POD_LABEL, METRICS_SCRAPE_GPU_DCGM_NAMESPACE_LABEL	pod, namespace	Metric labels used to attribute GPU series to workload pods.

Inference workloads additionally expose serving-quality metrics. The available fields depend on the engine and task. metrics-server supplies pod resource usage; DCGM supplies GPU metrics. They are independent dependencies.

Backend observability

Health, logging, and runtime

Variable	Default	Description
SERVER_PORT	8080	Spring HTTP port; health is at /api/v1/health.
MANAGEMENT_SERVER_PORT	9464	Actuator port; Prometheus is at /actuator/prometheus.
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE	prometheus,health	Exposed Actuator endpoints.
MANAGEMENT_ENDPOINT_HEALTH_SHOW_DETAILS	always	Health detail visibility.
APP_LOG_LEVEL, SPRING_SECURITY_LOG_LEVEL, HIBERNATE_SQL_LOG_LEVEL, HIBERNATE_BINDER_LOG_LEVEL	INFO	Application, security, SQL, and binder log levels.
TOMCAT_ACCESSLOG_ENABLED	false	Enable Tomcat access logs; pattern is configurable with server.tomcat.accesslog.pattern.
LOG_CONFIG_PATH, LOG_CONFIG_INTERVAL	log-config/logging.levels.json, 10	Dynamic logger configuration path and poll interval, in seconds.
CUSTOMIZABLE_TRACE_INTERCEPTOR_ENABLED	true	Enable method execution logging.
CUSTOMIZABLE_TRACE_INTERCEPTOR_ENTER_MESSAGE, CUSTOMIZABLE_INTERCEPTOR_EXIT_MESSAGE, CUSTOMIZABLE_TRACE_INTERCEPTOR_EXCEPTION_MESSAGE	Release YAML templates	Entry/exit/exception log templates; the exit variable intentionally lacks TRACE in its name.
DEBUG_OPTS	Empty	JVM options passed by the container entrypoint.

When trace context is available, the backend returns a W3C traceparent response header for request correlation. This is distinct from the workload metrics endpoint and Admin Frontend's Node.js telemetry.

OpenTelemetry

Spring Boot 4 provides the backend's OpenTelemetry integration. Prometheus remains available independently of OTLP export.

Variable	Default	Description
OTEL_EXPORT_ENABLED	false	Default for all OTLP signal switches.
OTEL_TRACES_EXPORT_ENABLED, OTEL_LOGS_EXPORT_ENABLED, OTEL_METRICS_EXPORT_ENABLED	Value of OTEL_EXPORT_ENABLED	Enable each signal independently.
OTEL_EXPORTER_OTLP_ENDPOINT	http://localhost:4318	Collector base URL without trailing slash; signal paths are appended.
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, OTEL_EXPORTER_OTLP_LOGS_ENDPOINT, OTEL_EXPORTER_OTLP_METRICS_ENDPOINT	Base URL + /v1/traces, /v1/logs, /v1/metrics	Full per-signal URL overrides.
OTEL_EXPORTER_OTLP_TRANSPORT	http	http or grpc for traces/logs. Metrics always use HTTP.
OTEL_TRACES_SAMPLING_PROBABILITY	1.0	Parent-based trace sampling probability, from 0 to 1.
OTEL_SERVICE_NAME	dial-deployment-manager-backend	Telemetry service name.
OTEL_RESOURCE_ATTRIBUTES	—	Additional resource attributes. Use OTEL_SERVICE_NAME for the service name.

OTEL_EXPORT_ENABLED=true
OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318
OTEL_EXPORTER_OTLP_TRANSPORT=http

With gRPC traces/logs, use the collector's gRPC endpoint and separately set the full HTTP metrics URL or disable metrics export. Older OTEL_SDK_DISABLED, OTEL_*_EXPORTER, OTEL_EXPORTER_OTLP_PROTOCOL, and OTEL_EXPORTER_OTLP_HEADERS settings do not configure this integration. Collector authentication headers require the Spring per-signal headers properties documented upstream.

Further reading

• MCP proxy configuration — executable images for stdio workloads
• Manage containers — create, run, and configure containers for adapters, apps, and MCPs
• Manage deployment images — add and configure the images that containers are built from
• Manage model servings — run Hugging Face and NVIDIA NIM models inside DIAL infrastructure