Where Is the Configuration File

Renders overwrite — edit the template instead

At every startup, config/templates/*.template is rendered and overwrites the configuration locations of each component. If you edit the component-side files directly, they will disappear on the next startup. → How to change configuration

The Data Lake configuration is built with "two sources, one direction." The files the operator edits are fixed, and the configuration files inside the container are generated by multiplying those sources.

호스트 /etc/kopens/conf/*.template          ← 설정의 «형태» (빈칸이 뚫린 원본)
  × /etc/kopens/plantpulse-platform.env      ← 시크릿 (비밀번호 · API 키)
  × /etc/kopens/platform.node.env            ← 이 노드의 값 (IP · 모드)
  + 이미지 안 config/defaults.env            ← 비밀 아닌 기본값 (위에서 안 준 것만)
  ─────────────────────────────────────────
  → pd config render → /opt/kopens/plantpulse-platform/<module>/conf/…   (생성물)

pd start is always, without exception, rendered first. So even if you manually edit a generated file inside the container, it disappears on the next startup. On 2026-09-01, someone actually edited cassandra.yaml inside the container to enable authentication, but the file was reverted during regeneration, breaking authentication entirely.

The four master files

#	File	What it holds	Format	Who writes it
1	/etc/kopens/plantpulse-platform.env	Secrets — service account passwords · API keys · TLS passwords. Non-secret common values may also be placed here	VAR=값, one per line, no export. The two header lines (# generated: · # last rotation:) are managed by a tool	Created by install.sh, updated by passwd.sh. Non-secret lines are written directly by the operator
2	/etc/kopens/platform.node.env	Values true only for this box — PP_MASTER_IP · PP_KAFKA_ADVERTISED_HOST · DOCKER_PP_EXTERNAL_IP · PP_NODE_ID	Same format	Created by the installer from a template, then edited directly by the operator
3	/etc/kopens/conf/*.template	The shape of the configuration — originals of 33 engine configuration files	Each engine's syntax + ${PP_변수} placeholders	Seeded from the image at first startup, then edited directly by the operator
4	(in the image) plantpulse-datalake-cli/config/defaults.env	Non-secret defaults — ports · account names · directories · TLS settings	KEY=value	The product. The operator does not edit these; items 1 and 2 override them

Passwords don't change by editing files

Just editing the password line in the sidecar doesn't complete the change. For values where the server account is the master (like PostgreSQL · Aster TSDB), you must also change the server side, and getting the order wrong can prevent the platform from starting. bin/passwd.sh handles that order for you → Change passwords · API keys

The order in which values are determined

The order in which the host's bin/env.sh reads top-down is the priority. The later-read value wins.

Priority	Source	Why it wins
1 (highest)	/etc/kopens/platform.node.env	An unconditional assignment read after the sidecar
2	/etc/kopens/plantpulse-platform.env	VAR=값 unconditional assignment — also overrides shell export
3	export of the calling shell	Only when 1 and 2 don't specify that name
4 (lowest)	bin/env.sh's ${VAR:-기본값}	Only when nobody has specified it

That value goes through compose into the container as an environment variable, and inside the container the passed-in value beats defaults.env.

On an installed node, export is silently ignored

Methods of passing a value from the shell, like PP_PG_PASSWORD=새값 bin/up.sh, work only on nodes where the sidecar does not yet exist. If the sidecar already holds that name, the sidecar wins. There was an actual incident where somebody believed they'd changed it this way and moved on.

To see the current effective values and their sources on this box, don't simulate in your head—run this command. Secrets are masked by ****.

cd /opt/kopens/plantpulse-platform-docker
bin/env.sh --print

No sidecar inside the container

The /etc/kopens/plantpulse-platform.env file is not mounted into the container. Values only get in through this path: the host's bin/env.sh reads the sidecar, and compose passes them into the container as environment variables.

Two things follow from this.

• After editing the sidecar, you must recreate the container for the new values to take effect. The host's bin/restart-datalake.sh does that.
• A name that compose doesn't write won't reach the container no matter how much you put it in the sidecar. Which names reach it is determined by the compose/docker-compose.yml's x-pp-secrets anchors and the environment: blocks of the plantpulse-datalake service. Variable reference lists only the "names that reach."

If you run pd doctor inside the container, the sidecar line won't show up as "file not found"—it won't show at all. Instead, the all required secrets set line is the actual measurement—this is normal.

Template list — what renders where

The 33 templates of the host /etc/kopens/conf/ (23 top-level + cluster/ 10) go to the locations below. The master of this mapping table is inside the container at plantpulse-datalake-cli/config/render.map, and pd config list prints the rows corresponding to this node's mode.

Template	Rendered location (relative to PP_HOME)	MASTER	WORKER
valkey.conf	plantpulse-storage/cache/valkey/conf/valkey.conf	○	○ (cluster/)
postgresql.conf · pg_hba.conf	plantpulse-storage/db/postgres/conf/	○	○ (cluster/)
cassandra.yaml · jvm-server.options	plantpulse-storage/db/cassandra/conf/	○	○ (cluster/)
spark-env.sh · spark-defaults.conf · metrics.properties	plantpulse-analytics/spark/conf/	○	○
hive-site.xml · hive-auth.properties	plantpulse-analytics/spark/conf/	○	○ (cluster/)
hive-site.xml	plantpulse-analytics/hive/conf/hive-site.xml	○	—
kyuubi-defaults.conf	plantpulse-analytics/kyuubi/conf/	○	○
gravitino-iceberg-rest-server.conf	plantpulse-analytics/gravitino/conf/	○	—
kafka.properties · kafka-jaas.conf	plantpulse-messaging/kafka/config/kafka.properties · jaas.conf	○	—
hivemq.xml · plantpulse-mq-auth.properties	plantpulse-messaging/mqtt/conf/config.xml · auth.properties	○	—
plantpulse-timeseries-engine.conf	plantpulse-timeseries/engine/conf/ (under both names)	○	—
plantpulse-datalake-admin-api.properties	plantpulse-datalake-admin-api/config/	○	○ (cluster/)
workflow.yaml · application.yaml	plantpulse-workflow/temporal/config/ · kestra/config/	○	—
plantpulse-cep.properties	plantpulse-cep/config/	○	—
plantpulse-jdbc.properties · plantpulse-data-gateway.properties	plantpulse-data-gateway/config/	○	—

The cluster/ mark means the WORKER node uses a different template under /etc/kopens/conf/cluster/. For example, replicaof is absent from the MASTER's valkey.conf.template, while replicaof ${PP_MASTER_IP} ${PP_REDIS_PORT} is present in cluster/valkey.conf.template.

Template syntax

There are only three.

Syntax	Meaning
${PP_VAR}	If the value is missing, the entire render fails (exit 4). It does not fill in an empty value and move on
${PP_VAR:기본값} · ${PP_VAR:-기본값}	If the value is missing, use the default

Secrets cannot have inline defaults. There was an incident where an old renderer filled in empty values and moved on, resulting in an Aster TSDB with an empty-string password. So now it lists all missing names and stops.

Configuration not rendered — admin console account

The login account for the admin console is not included in any template. The admin-api process reads it directly from environment variables, to avoid creating another copy of the password on disk.

Variable	Where it comes from	Default
PP_DATALAKE_ADMIN_USER	defaults.env	admin
PP_DATALAKE_ADMIN_PASSWORD	Sidecar	Installs after 2026-09-05 use the same development default as the web console admin → Change initial password. Earlier installs are empty, so the console is off
PP_DATALAKE_ADMIN_API_KEY	Sidecar	None — if empty, only key authentication is disabled; browser login remains as-is

You cannot selectively enable/disable components

The variable PD_OPTIONS exists, but the current compose stack does not pass this value to the container. So a setup that starts only one component is currently not supported → FAQ

Related documents

• How to change configuration — the actual procedure
• Variable reference
• Path map