Cluster Advanced Settings

Overview

Cluster Advanced Settings allow you to fine-tune infrastructure-level parameters for your Qovery-managed Kubernetes clusters. These settings provide granular control over networking, logging, security, resource allocation, and cloud provider-specific features.

Cluster advanced settings are currently configured via the Qovery API. Console support is coming soon.

Cloud Provider Availability

Settings are tagged with their supported cloud providers:

AWS

Amazon Web Services

GCP

Google Cloud Platform

Azure

Microsoft Azure

Scaleway

Quick Reference

Settings by Category

Logs (7 settings)

Setting	Cloud Providers	Default	Description
`aws.cloudwatch.eks_logs_retention_days`	AWS	90	CloudWatch EKS logs retention
`aws.vpc.enable_s3_flow_logs`	AWS	false	Enable VPC flow logs to S3
`aws.vpc.flow_logs_retention_days`	AWS	365	VPC flow logs retention days
`loki.log_retention_in_week`	All	12	Kubernetes pods logs retention
`gcp.vpc.enable_flow_logs`	GCP	false	Enable VPC flow logs
`gcp.vpc.flow_logs_sampling`	GCP	0.0	VPC flow logs sampling rate
`object_storage.enable_logging`	AWS, GCP, Azure	false	Enable bucket logging

NGINX Ingress (17 settings)

Setting	Cloud Providers	Default	Description
`nginx.vcpu.request_in_milli_cpu`	All	200	NGINX CPU request (millicores)
`nginx.vcpu.limit_in_milli_cpu`	All	700	NGINX CPU limit (millicores)
`nginx.memory.request_in_mib`	All	768	NGINX memory request (MiB)
`nginx.memory.limit_in_mib`	All	768	NGINX memory limit (MiB)
`nginx.hpa.cpu_utilization_percentage_threshold`	All	50	HPA CPU threshold (%)
`nginx.hpa.min_number_instances`	All	2	Minimum NGINX replicas
`nginx.hpa.max_number_instances`	All	25	Maximum NGINX replicas
`nginx.controller.enable_client_ip`	All	false	Enable real IP module
`nginx.controller.enable_compression`	All	true	Enable Brotli compression
`nginx.controller.use_forwarded_headers`	All	false	Use X-Forwarded-For headers
`nginx.controller.compute_full_forwarded_for`	All	false	Append to X-Forwarded-For
`nginx.controller.log_format_upstream`	All	null	Custom log format
`nginx.controller.log_format_escaping`	All	Default	Log format escaping
`nginx.controller.http_snippet`	All	null	HTTP-level NGINX config
`nginx.controller.server_snippet`	All	null	Server-level NGINX config
`nginx.controller.limit_request_status_code`	All	null	Rate limit HTTP status
`nginx.controller.custom_http_errors`	All	null	Custom error pages

Load Balancer (9 settings)

Setting	Cloud Providers	Default	Description
`aws.eks.enable_alb_controller`	AWS	true	Enable AWS ALB controller
`aws.eks.alb_controller.vpa.vcpu.min_in_milli_cpu`	AWS	250	ALB controller min CPU
`aws.eks.alb_controller.vpa.vcpu.max_in_milli_cpu`	AWS	250	ALB controller max CPU
`aws.eks.alb_controller.vpa.memory.min_in_mib`	AWS	128	ALB controller min memory
`aws.eks.alb_controller.vpa.memory.max_in_mib`	AWS	128	ALB controller max memory
`load_balancer.size`	Scaleway	lb-s	Load balancer size
`nginx.default_backend.enabled`	All	false	Enable default backend
`nginx.default_backend.image_repository`	All	null	Default backend image
`nginx.default_backend.image_tag`	All	null	Default backend image tag

Database Access Control (12 settings)

Setting	Cloud Providers	Default	Description
`database.postgresql.deny_any_access`	AWS	false	Block all PostgreSQL access
`database.postgresql.allowed_cidrs`	AWS	0.0.0.0/0	PostgreSQL allowed CIDRs
`database.mysql.deny_any_access`	AWS	false	Block all MySQL access
`database.mysql.allowed_cidrs`	AWS	0.0.0.0/0	MySQL allowed CIDRs
`database.mongodb.deny_any_access`	AWS	false	Block all MongoDB access
`database.mongodb.allowed_cidrs`	AWS	0.0.0.0/0	MongoDB allowed CIDRs
`database.redis.deny_any_access`	AWS	false	Block all Redis access
`database.redis.allowed_cidrs`	AWS	0.0.0.0/0	Redis allowed CIDRs

Image Registry (3 settings)

Setting	Cloud Providers	Default	Description
`registry.image_retention_time`	AWS	31536000	Image retention (seconds)
`registry.mirroring_mode`	AWS	Service	Image mirroring mode
`cloud_provider.container_registry.tags`	All	Registry tags

IAM & Security (6 settings)

Setting	Cloud Providers	Default	Description
`aws.iam.enable_admin_group_sync`	AWS	true	Enable admin group sync
`aws.iam.admin_group`	AWS	Admins	IAM admin group name
`aws.iam.enable_sso`	AWS	false	Enable SSO support
`aws.iam.sso_role_arn`	AWS	""	SSO role ARN
`aws.eks.encrypt_secrets_kms_key_arn`	AWS	null	KMS key for secrets encryption
`k8s.api.allowed_public_access_cidrs`	AWS, GCP, Azure	[]	Kubernetes API CIDR whitelist

Service Resources (2 settings)

Setting	Cloud Providers	Default	Description
`allow_service_cpu_overcommit`	All	false	Allow CPU overcommit
`allow_service_ram_overcommit`	All	false	Allow memory overcommit

Miscellaneous (5 settings)

Setting	Cloud Providers	Default	Description
`dns.coredns.extra_config`	AWS, Scaleway, Azure	null	CoreDNS custom config
`aws.eks.ec2.metadata_imds`	AWS	required	IMDS version
`aws.eks.ec2.ami`	AWS	AmazonLinux2023	EC2 AMI type
`qovery.static_ip_mode`	AWS, GCP	false	Static IP for control plane
`storageclass.fast_ssd`	All	varies	Fast SSD storage class

Use the Settings by Category tables above to quickly find settings. The Cloud Providers column shows which cloud platforms support each setting.

Configuring Cluster Advanced Settings

Via Qovery API

Advanced settings are configured using the Qovery API:

curl -X PATCH "https://api.qovery.com/cluster/{cluster_id}/advancedSettings" \
  -H "Authorization: Token YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "loki.log_retention_in_week": 24,
    "nginx.hpa.min_number_instances": 3,
    "database.postgresql.deny_any_access": false,
    "database.postgresql.allowed_cidrs": ["10.0.0.0/16"]
  }'

Via Terraform

Use the Qovery Terraform Provider to manage cluster advanced settings as code:

resource "qovery_cluster" "my_cluster" {
  name                = "production-cluster"
  organization_id     = var.organization_id
  cloud_provider      = "AWS"
  region              = "us-east-1"

  advanced_settings_json = jsonencode({
    "loki.log_retention_in_week" = 24
    "nginx.hpa.min_number_instances" = 3
    "nginx.controller.enable_client_ip" = true
    "database.postgresql.deny_any_access" = false
    "database.postgresql.allowed_cidrs" = ["10.0.0.0/16"]
  })
}

After updating cluster advanced settings, you must redeploy the cluster for changes to take effect.

Detailed Settings Reference

Logs

aws.cloudwatch.eks_logs_retention_days

Cloud Provider: AWS Type: Integer Default: 90Maximum retention days in CloudWatch for EKS logs.Valid values: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 2192, 2557, 2922, 3288, 3653Example:

{
  "aws.cloudwatch.eks_logs_retention_days": 30
}

aws.vpc.enable_s3_flow_logs

Cloud Provider: AWS Type: Boolean Default: falseEnable flow logs on the cluster VPC and store them in an S3 bucket.Example:

{
  "aws.vpc.enable_s3_flow_logs": true
}

aws.vpc.flow_logs_retention_days

Cloud Provider: AWS Type: Integer Default: 365Set the number of retention days for flow logs. Set to 0 for unlimited retention.Example:

{
  "aws.vpc.flow_logs_retention_days": 90
}

loki.log_retention_in_week

Cloud Provider: All Type: Integer Default: 12 (84 days)Maximum Kubernetes pods (containers/applications/jobs/cronjobs) retention logs in weeks.Example:

{
  "loki.log_retention_in_week": 24
}

gcp.vpc.enable_flow_logs

Cloud Provider: GCP Type: Boolean Default: falseEnable VPC flow logs on the cluster VPC (on each VPC subnetwork). See GCP VPC logs flow documentation.Example:

{
  "gcp.vpc.enable_flow_logs": true
}

gcp.vpc.flow_logs_sampling

Cloud Provider: GCP Type: Float Default: 0.0Set VPC logs flow sampling percentage. Value should be within 0.0 (no sampling) to 1.0 (all logs) range.Example:

{
  "gcp.vpc.flow_logs_sampling": 0.5
}

object_storage.enable_logging

Cloud Provider: AWS, GCP, Azure Type: Boolean Default: falseActivate cluster buckets logging into a <bucket>-log bucket.See documentation for AWS and GCP.Example:

{
  "object_storage.enable_logging": true
}

DNS

dns.coredns.extra_config

Cloud Provider: AWS, Scaleway, Azure Type: String Default: nullAdditional configuration to add to CoreDNS. This can be used to customize DNS resolution rules on the cluster.Example:

{
  "dns.coredns.extra_config": "example.com:53 {\n    errors\n    cache 30\n    forward . 8.8.8.8 8.8.4.4\n}"
}

CoreDNS format:

example.com:53 {
    errors
    cache 30
    forward . 8.8.8.8 8.8.4.4
}

Image Registry

registry.image_retention_time

Cloud Provider: AWS Type: Integer Default: 31536000 (1 year)Allows you to specify an amount in seconds after which images in the default registry are deleted.

Changing this setting will only affect new ECR repositories created after the change. Existing repositories will not be affected.

Example:

{
  "registry.image_retention_time": 15768000
}

registry.mirroring_mode

Cloud Provider: AWS Type: String Default: ServiceAllows you to specify the image mirroring mode to be used for each image deployed on this cluster.Valid values: Service, ClusterExample:

{
  "registry.mirroring_mode": "Cluster"
}

cloud_provider.container_registry.tags

Cloud Provider: All Type: Map<String, String> Default: {}Add additional tags on the cluster dedicated registry.Example:

{
  "cloud_provider.container_registry.tags": {
    "Environment": "Production",
    "Team": "Platform"
  }
}

Network - Load Balancer

aws.eks.enable_alb_controller

Cloud Provider: AWS Type: Boolean Default: trueEnable the AWS ALB controller to manage the load balancer for the cluster.

Enabling this feature will create a 10 min max downtime on your application’s public access (time to delete, replace and propagate DNS of the new load balancer).

Requirements for custom VPCs (Qovery Managed VPC does not require these):

On public subnets: add label kubernetes.io/role/elb=1
On private subnets: add label kubernetes.io/role/internal-elb=1
On all subnets: add label kubernetes.io/cluster/<cluster-name>=shared

Example:

{
  "aws.eks.enable_alb_controller": true
}

aws.eks.alb_controller.vpa.vcpu.min_in_milli_cpu

Cloud Provider: AWS Type: Integer Default: 250Sets AWS ALB controller VPA (vertical pod autoscaling) vCPU minimum value in milli CPU.Example:

{
  "aws.eks.alb_controller.vpa.vcpu.min_in_milli_cpu": 500
}

aws.eks.alb_controller.vpa.vcpu.max_in_milli_cpu

Cloud Provider: AWS Type: Integer Default: 250Sets AWS ALB controller VPA (vertical pod autoscaling) vCPU maximum value in milli CPU.Example:

{
  "aws.eks.alb_controller.vpa.vcpu.max_in_milli_cpu": 1000
}

aws.eks.alb_controller.vpa.memory.min_in_mib

Cloud Provider: AWS Type: Integer Default: 128Sets AWS ALB controller VPA (vertical pod autoscaling) memory minimum value in mebibyte.Example:

{
  "aws.eks.alb_controller.vpa.memory.min_in_mib": 256
}

aws.eks.alb_controller.vpa.memory.max_in_mib

Cloud Provider: AWS Type: Integer Default: 128Sets AWS ALB controller VPA (vertical pod autoscaling) memory maximum value in mebibyte.Example:

{
  "aws.eks.alb_controller.vpa.memory.max_in_mib": 512
}

load_balancer.size

Cloud Provider: Scaleway Type: String Default: lb-sAllows you to specify the load balancer size in front of your cluster.Valid values:

lb-s: 200 Mbps
lb-gp-m: 500 Mbps
lb-gp-l: 1 Gbps
lb-gp-xl: 4 Gbps

Example:

{
  "load_balancer.size": "lb-gp-l"
}

Network - NGINX Ingress

NGINX Resources

Cloud Provider: AllConfigure CPU and memory resources for NGINX ingress controller pods:

Setting	Type	Default	Description
`nginx.vcpu.request_in_milli_cpu`	Integer	200	CPU request (millicores)
`nginx.vcpu.limit_in_milli_cpu`	Integer	700	CPU limit (millicores)
`nginx.memory.request_in_mib`	Integer	768	Memory request (MiB)
`nginx.memory.limit_in_mib`	Integer	768	Memory limit (MiB)

Example:

{
  "nginx.vcpu.request_in_milli_cpu": 500,
  "nginx.vcpu.limit_in_milli_cpu": 1000,
  "nginx.memory.request_in_mib": 1024,
  "nginx.memory.limit_in_mib": 2048
}

NGINX Horizontal Pod Autoscaling (HPA)

Cloud Provider: AllConfigure horizontal pod autoscaling for NGINX ingress controller:

Setting	Type	Default	Description
`nginx.hpa.cpu_utilization_percentage_threshold`	Integer	50	CPU threshold (%)
`nginx.hpa.min_number_instances`	Integer	2	Minimum replicas
`nginx.hpa.max_number_instances`	Integer	25	Maximum replicas

Example:

{
  "nginx.hpa.cpu_utilization_percentage_threshold": 70,
  "nginx.hpa.min_number_instances": 3,
  "nginx.hpa.max_number_instances": 50
}

nginx.controller.enable_client_ip

Cloud Provider: All Type: Boolean Default: falseEnables ngx_http_realip_module module to get the real client IP address.Example:

{
  "nginx.controller.enable_client_ip": true
}

nginx.controller.enable_compression

Cloud Provider: All Type: Boolean Default: trueEnables compression (Brotli) for HTTP responses. When disabled, content will not be compressed, which may increase bandwidth usage but reduce CPU load.Example:

{
  "nginx.controller.enable_compression": false
}

nginx.controller.use_forwarded_headers

Cloud Provider: All Type: Boolean Default: falsePasses incoming X-Forwarded-For header upstream. See documentation.Example:

{
  "nginx.controller.use_forwarded_headers": true
}

nginx.controller.compute_full_forwarded_for

Cloud Provider: All Type: Boolean Default: falseAppend the remote address to the X-Forwarded-For header instead of replacing it. See documentation.Example:

{
  "nginx.controller.compute_full_forwarded_for": true
}

nginx.controller.log_format_upstream

Cloud Provider: All Type: String Default: nullAllows to customize NGINX log-format.Example:

{
  "nginx.controller.log_format_upstream": "$remote_addr - $remote_user [$time_local] \"$request\" $status $body_bytes_sent"
}

nginx.controller.log_format_escaping

Cloud Provider: All Type: String Default: DefaultAllows to customize NGINX log-format-escaping setting.Valid values: Default, JSON, NoneExample:

{
  "nginx.controller.log_format_escaping": "JSON"
}

nginx.controller.http_snippet

Cloud Provider: All Type: String Default: nullAllows to customize NGINX http-snippet configuration.Used for cluster-level NGINX configuration that applies to all services.Example:

{
  "nginx.controller.http_snippet": "limit_req_zone \"$server_name\" zone=global:10m rate=10r/s;"
}

See Rate Limiting Guide for practical examples.

nginx.controller.server_snippet

Cloud Provider: All Type: String Default: nullAllows to customize NGINX server-snippet configuration.Used for server-level NGINX configuration.Example:

{
  "nginx.controller.server_snippet": "location / {\n    limit_req zone=global;\n}"
}

See Rate Limiting Guide for practical examples.

nginx.controller.limit_request_status_code

Cloud Provider: All Type: Integer Default: null (defaults to 503)Allows to customize NGINX limit-req-status-code.Commonly set to 429 (Too Many Requests) for rate limiting.Example:

{
  "nginx.controller.limit_request_status_code": 429
}

nginx.controller.custom_http_errors

Cloud Provider: All Type: String Default: nullAllows to customize NGINX custom-http-errors.Example:

{
  "nginx.controller.custom_http_errors": "404,503"
}

NGINX Default Backend

Cloud Provider: AllConfigure a custom default backend for NGINX:

Setting	Type	Default	Description
`nginx.default_backend.enabled`	Boolean	false	Enable default backend
`nginx.default_backend.image_repository`	String	null	Docker image repository
`nginx.default_backend.image_tag`	String	null	Docker image tag

If you don’t specify custom image repository and tag, ensure your cluster includes nodes with amd64 architecture.

Example:

{
  "nginx.default_backend.enabled": true,
  "nginx.default_backend.image_repository": "myregistry/custom-backend",
  "nginx.default_backend.image_tag": "1.0.0"
}

Network - Database Access Control

PostgreSQL Access Control

Cloud Provider: AWS Applies to: Container and Managed Databases

Setting	Type	Default	Description
`database.postgresql.deny_any_access`	Boolean	false	Deny all PostgreSQL access
`database.postgresql.allowed_cidrs`	Array	[“0.0.0.0/0”]	Allowed CIDR ranges

Managed databases: Access is removed instantly
Container databases: Access is removed only after redeployment

Example:

{
  "database.postgresql.deny_any_access": false,
  "database.postgresql.allowed_cidrs": ["10.0.0.0/16", "10.1.0.0/16"]
}

MySQL Access Control

Cloud Provider: AWS Applies to: Container and Managed Databases

Setting	Type	Default	Description
`database.mysql.deny_any_access`	Boolean	false	Deny all MySQL access
`database.mysql.allowed_cidrs`	Array	[“0.0.0.0/0”]	Allowed CIDR ranges

Managed databases: Access is removed instantly
Container databases: Access is removed only after redeployment

Example:

{
  "database.mysql.deny_any_access": false,
  "database.mysql.allowed_cidrs": ["10.0.0.0/16"]
}

MongoDB Access Control

Cloud Provider: AWS Applies to: Container and Managed Databases

Setting	Type	Default	Description
`database.mongodb.deny_any_access`	Boolean	false	Deny all MongoDB access
`database.mongodb.allowed_cidrs`	Array	[“0.0.0.0/0”]	Allowed CIDR ranges

Managed databases: Access is removed instantly
Container databases: Access is removed only after redeployment

Example:

{
  "database.mongodb.deny_any_access": false,
  "database.mongodb.allowed_cidrs": ["10.0.0.0/16"]
}

Redis Access Control

Cloud Provider: AWS Applies to: Container and Managed Databases

Setting	Type	Default	Description
`database.redis.deny_any_access`	Boolean	false	Deny all Redis access
`database.redis.allowed_cidrs`	Array	[“0.0.0.0/0”]	Allowed CIDR ranges

Managed databases: Access is removed instantly
Container databases: Access is removed only after redeployment

Example:

{
  "database.redis.deny_any_access": false,
  "database.redis.allowed_cidrs": ["10.0.0.0/16"]
}

Service Resources

allow_service_cpu_overcommit

Cloud Provider: All Type: Boolean Default: falseAuthorize CPU overcommit (limit > request) for services deployed within this cluster.

Using overcommit on pod resources can lead to instability on your cluster and we strongly discourage it. Be careful when using this feature.

Once enabled, you can update the service advanced setting resources.override.limit.cpu_in_mib.Example:

{
  "allow_service_cpu_overcommit": true
}

allow_service_ram_overcommit

Cloud Provider: All Type: Boolean Default: falseAuthorize memory overcommit (limit > request) for services deployed within this cluster.

Using overcommit on pod resources can lead to instability on your cluster and we strongly discourage it. Be careful when using this feature.

Once enabled, you can update the service advanced setting resources.override.limit.ram_in_mib.Example:

{
  "allow_service_ram_overcommit": true
}

IAM & Security

AWS IAM Admin Group

Cloud Provider: AWS

Setting	Type	Default	Description
`aws.iam.enable_admin_group_sync`	Boolean	true	Enable IAM admin group sync
`aws.iam.admin_group`	String	Admins	IAM admin group name

Configure IAM group permissions for cluster access. See IAM permissions setup.

aws.iam.admin_group must be set when enable_admin_group_sync is true.

Example:

{
  "aws.iam.enable_admin_group_sync": true,
  "aws.iam.admin_group": "QoveryAdmins"
}

AWS IAM SSO

Cloud Provider: AWS

Setting	Type	Default	Description
`aws.iam.enable_sso`	Boolean	false	Enable SSO support
`aws.iam.sso_role_arn`	String	""	SSO role ARN

Enable SSO sync allowing IAM users to connect to cluster using SSO.

aws.iam.sso_role_arn must be set when enable_sso is true.

Example:

{
  "aws.iam.enable_sso": true,
  "aws.iam.sso_role_arn": "arn:aws:iam::123456789012:role/QoverySSO"
}

aws.eks.encrypt_secrets_kms_key_arn

Cloud Provider: AWS Type: String Default: nullAllows you to activate KMS encryption of your Kubernetes secrets. Specify the key ARN of your AWS KMS key.

It won’t be possible to go back once this feature is activated.

Example:

{
  "aws.eks.encrypt_secrets_kms_key_arn": "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
}

k8s.api.allowed_public_access_cidrs

Cloud Provider: AWS, GCP, Azure Type: Array Default: []Contains additional CIDRs that should be whitelisted to access the Kubernetes API.

qovery.static_ip_mode should be set to true to make this setting effective.

Example:

{
  "k8s.api.allowed_public_access_cidrs": ["100.100.100.0/32", "200.200.200.0/24"]
}

Miscellaneous

aws.eks.ec2.metadata_imds

Cloud Provider: AWS Type: String Default: requiredSpecify the IMDS version you want to use.Valid values:

required: IMDS v2 only
optional: IMDS v1 and v2

Example:

{
  "aws.eks.ec2.metadata_imds": "optional"
}

aws.eks.ec2.ami

Cloud Provider: AWS Type: String Default: AmazonLinux2023Specify the AMI you want to use for EKS nodes.Valid values:

AmazonLinux2: Deprecated, not working after Kubernetes 1.32
AmazonLinux2023: Default Amazon AMI (recommended)
Bottlerocket: Focuses on security and maintainability

Example:

{
  "aws.eks.ec2.ami": "Bottlerocket"
}

qovery.static_ip_mode

Cloud Provider: AWS, GCP Type: Boolean Default: falseEnable the static IP mode for the Qovery control plane and automatically:

Activate the private endpoint on the Kubernetes API
Add the Qovery IP to the CIDR whitelist

If you need to connect to the Kubernetes cluster from your network, make sure to add your CIDR to k8s.api.allowed_public_access_cidrs.

DockerHub credentials are required to activate this feature. Configure them in Organization settings > Container registry.Why? DockerHub has a rate limit by IP. Since the Qovery control plane will be seen as a single IP, you need authenticated access to increase the limit.

Example:

{
  "qovery.static_ip_mode": true
}

storageclass.fast_ssd

Type: String Default: Cloud provider specificSpecify the Kubernetes storageClass to be used for storage attached to your container databases and applications.Example:

{
  "storageclass.fast_ssd": "gp3"
}

Best Practices

Start with Defaults

Begin with Qovery’s default cluster settings and only modify when you have a specific infrastructure requirement. Defaults are optimized for most use cases.

Test in Non-Production First

Always test cluster advanced settings changes in development or staging clusters before applying to production.

Document Your Changes

Keep track of why you changed specific cluster settings. This helps with troubleshooting and knowledge sharing across your infrastructure team.

Monitor After Changes

After modifying cluster advanced settings, closely monitor cluster health, resource usage, and service performance for 24-48 hours.

Use Infrastructure as Code

Manage cluster advanced settings through Terraform to maintain consistency and enable version control.

Security First - Database Access

Always configure allowed_cidrs for database access instead of allowing 0.0.0.0/0
Use VPC CIDR ranges for internal database access
Enable database access logs with object_storage.enable_logging

Security First - Network

Use k8s.api.allowed_public_access_cidrs to restrict Kubernetes API access
Enable nginx.controller.enable_client_ip for accurate IP-based security
Configure appropriate rate limiting with NGINX snippets
Enable VPC flow logs for audit trails

Cost Optimization

Set appropriate log retention periods to balance cost and compliance
Use image retention policies to clean up old container images
Configure NGINX HPA based on actual traffic patterns
Monitor VPC flow logs sampling to avoid excessive storage costs

High Availability

Set nginx.hpa.min_number_instances to at least 2 (default)
Configure appropriate NGINX resource limits for your traffic
Enable ALB controller on AWS for better load distribution
Use proper load balancer sizing on Scaleway

Observability

Enable VPC flow logs in production for network troubleshooting
Configure appropriate log retention for compliance requirements
Use custom NGINX log formats for better insights
Enable object storage logging for audit trails

Troubleshooting

Cluster Not Starting After Settings Change

Symptoms: Cluster deployment fails or becomes unavailable after modifying advanced settings.Common Causes:

Invalid NGINX snippet syntax
Incompatible resource allocations
Incorrect CIDR formatting in allowed_cidrs
Missing required settings (e.g., admin_group when sync enabled)

Resolution:

Check cluster deployment logs for specific error messages
Verify NGINX snippet syntax using NGINX documentation
Validate CIDR notation (e.g., 10.0.0.0/16)
Revert to default settings and apply changes incrementally
Contact Qovery support with cluster ID and settings applied

Database Access Denied After CIDR Change

Symptoms: Applications can’t connect to databases after changing allowed_cidrs.Troubleshooting:

For managed databases: Changes apply immediately, verify CIDR includes your application VPC
For container databases: Requires database redeployment to take effect
Verify CIDR format is correct (e.g., ["10.0.0.0/16"] not "10.0.0.0/16")
Check that deny_any_access is set to false
Verify database security groups in cloud provider console

Resolution:

Ensure application subnet is included in allowed_cidrs
For container databases, redeploy the database service
Check VPC peering configuration if using cross-VPC access

NGINX Ingress Not Working

Symptoms: Services not accessible, 502/503 errors, or NGINX pods not starting.Check:

NGINX pod status: kubectl get pods -n qovery
NGINX logs: Check cluster logs in Qovery Console
HPA status: kubectl get hpa -n qovery
Resource limits: Verify NGINX isn’t resource-constrained

Common Issues:

Invalid http_snippet or server_snippet syntax
Resource limits too low for traffic volume
HPA min/max instances misconfigured
Custom default backend image not accessible

Resolution:

Remove custom snippets and redeploy to isolate issue
Increase NGINX resource limits if pods are OOMKilled
Verify custom default backend image is publicly accessible
Check NGINX configuration: kubectl exec -n qovery nginx-pod -- nginx -T

Rate Limiting Not Working

Symptoms: Rate limits not enforced, all requests get through.Verify:

NGINX snippet syntax is correct in http_snippet and server_snippet
Cluster has been redeployed after settings change
Rate limit zone names match between declaration and usage
Using correct variable (e.g., $server_name vs $remote_addr)

Testing:

# Test rate limit with curl
for i in {1..20}; do curl -w "%{http_code}\n" https://your-app.com; done

See Rate Limiting Guide for detailed examples.

Static IP Mode Issues

Symptoms: Qovery control plane can’t connect to cluster after enabling static IP mode.Check:

DockerHub credentials configured in Organization settings
Private Kubernetes API endpoint is accessible
k8s.api.allowed_public_access_cidrs includes your IP if needed
No network policies blocking Qovery IP

Resolution:

Verify DockerHub credentials are valid
Add Qovery support IP to allowed CIDRs if provided
Check VPC routing and security groups
Contact Qovery support for static IP whitelist

IAM/SSO Connection Issues

Symptoms: Can’t connect to cluster using AWS SSO or IAM group.Verify:

aws.iam.admin_group matches your IAM group name exactly
IAM user is member of specified admin group
aws.iam.sso_role_arn is correct if using SSO
Cluster has been redeployed after IAM settings change

Test Connection:

# Download kubeconfig from Qovery Console
export KUBECONFIG=./kubeconfig.yaml
kubectl get nodes

Resolution:

Verify IAM group membership in AWS Console
Check IAM policy permissions include necessary Kubernetes access
Redeploy cluster to apply IAM configuration changes

Use Cases & Examples

Example 1: Production Cluster with Enhanced Security

{
  "loki.log_retention_in_week": 52,
  "aws.vpc.enable_s3_flow_logs": true,
  "aws.vpc.flow_logs_retention_days": 365,
  "object_storage.enable_logging": true,
  "database.postgresql.deny_any_access": false,
  "database.postgresql.allowed_cidrs": ["10.0.0.0/16"],
  "database.mysql.deny_any_access": false,
  "database.mysql.allowed_cidrs": ["10.0.0.0/16"],
  "k8s.api.allowed_public_access_cidrs": ["203.0.113.0/24"],
  "qovery.static_ip_mode": true,
  "aws.eks.encrypt_secrets_kms_key_arn": "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
}

Example 2: High-Traffic Cluster with Scaled NGINX

{
  "nginx.hpa.min_number_instances": 5,
  "nginx.hpa.max_number_instances": 50,
  "nginx.hpa.cpu_utilization_percentage_threshold": 60,
  "nginx.vcpu.request_in_milli_cpu": 500,
  "nginx.vcpu.limit_in_milli_cpu": 2000,
  "nginx.memory.request_in_mib": 1024,
  "nginx.memory.limit_in_mib": 2048,
  "nginx.controller.enable_compression": true
}

Example 3: Development Cluster with Relaxed Settings

{
  "loki.log_retention_in_week": 4,
  "registry.image_retention_time": 2592000,
  "nginx.hpa.min_number_instances": 2,
  "nginx.hpa.max_number_instances": 10,
  "database.postgresql.deny_any_access": false,
  "database.postgresql.allowed_cidrs": ["0.0.0.0/0"]
}

Example 4: Cluster with Custom Rate Limiting

{
  "nginx.controller.http_snippet": "limit_req_zone \"$server_name\" zone=global:10m rate=100r/s;",
  "nginx.controller.server_snippet": "location / {\n    limit_req zone=global burst=200 nodelay;\n}",
  "nginx.controller.limit_request_status_code": 429
}

See Rate Limiting Guide and IP Authorization Guide for more examples.

Next Steps

Service Advanced Settings

Configure service-level advanced settings

Rate Limiting Guide

Implement rate limiting with NGINX

IP Authorization Guide

Configure IP and header-based authorization

Cluster Management

Learn about cluster operations

Qovery API Reference

Explore the full Qovery API

Terraform Provider

Manage infrastructure as code

Overview

Account & Organization

Clusters & Cloud

Source Control

Projects & Environments

Services

Deployment & CI/CD

Secrets & Monitoring

Notifications

Networking & Advanced

​Overview

​Cloud Provider Availability

AWS

GCP

Azure

Scaleway

​Quick Reference

​Settings by Category

​Configuring Cluster Advanced Settings

​Via Qovery API

​Via Terraform

​Detailed Settings Reference

​Logs

​DNS

​Image Registry

​Network - Load Balancer

​Network - NGINX Ingress

​Network - Database Access Control

​Service Resources

​IAM & Security

​Miscellaneous

​Best Practices

​Troubleshooting

​Use Cases & Examples

​Example 1: Production Cluster with Enhanced Security

​Example 2: High-Traffic Cluster with Scaled NGINX

​Example 3: Development Cluster with Relaxed Settings

​Example 4: Cluster with Custom Rate Limiting

​Next Steps

Service Advanced Settings

Rate Limiting Guide

IP Authorization Guide

Cluster Management

Qovery API Reference

Terraform Provider

Overview

Cloud Provider Availability

Quick Reference

Settings by Category

Configuring Cluster Advanced Settings

Via Qovery API

Via Terraform

Detailed Settings Reference

Logs

DNS

Image Registry

Network - Load Balancer

Network - NGINX Ingress

Network - Database Access Control

Service Resources

IAM & Security

Miscellaneous

Best Practices

Troubleshooting

Use Cases & Examples

Example 1: Production Cluster with Enhanced Security

Example 2: High-Traffic Cluster with Scaled NGINX

Example 3: Development Cluster with Relaxed Settings

Example 4: Cluster with Custom Rate Limiting

Next Steps