Set Up a Self-Hosted Resolver - Confidence Documentation

A self-hosted resolver runs in your network and resolves flags without a network call to Confidence. You can run one resolver as a shared service or deploy it as a sidecar next to each application instance.

Create API Client Credentials

The resolver uses API client credentials to authenticate with Confidence and report operational data.

Go to API clients

In Confidence, select Admin, then select API clients under Identity and access management.

Create an API client

Select Create and enter a name, such as “self-hosted resolver.”

Assign the resolver role

Go to Admin > Policies and create a policy for the API client. Assign the Flags Resolver Sidecar role.

Store the credentials

Store the client ID and client secret in your secret manager.

Flags Resolver Sidecar is the current name of the predefined role. The role applies whether you deploy the resolver as a shared service or a sidecar.

Create a Resolver Configuration

The resolver configuration provides an encrypted state file. Confidence keeps the state file up to date as your flags and targeting rules change.

Go to self-hosted resolver configurations

In Confidence, select Admin, then select Self-hosted resolver configurations under Identity and access management.

Create a configuration

Select Create configuration, enter a display name, and select Create.

Store the deployment values

Copy the state URI and reveal the encryption key. Store both values in your secret manager.

Treat the state URI and encryption key as secrets. The URI can contain signed query parameters. Don’t print the complete URI in logs or diagnostics.

Run With Docker

Save the four deployment values in confidence-resolver.env:

CONFIDENCE_RESOLVER_STATE_URL=<state URI>
CONFIDENCE_RESOLVER_STATE_ENCRYPTION_KEY=<encryption key>
CONFIDENCE_CLIENT_ID=<client ID>
CONFIDENCE_CLIENT_SECRET=<client secret>

The state encryption key must be a 64-character hexadecimal key. Run the resolver without adding secrets to your shell history:

docker run --rm \
  -p 8090:8090 \
  --env-file ./confidence-resolver.env \
  europe-docker.pkg.dev/spotify-confidence/public/flags-resolver-sidecar:latest

The resolver is available at http://localhost:8090. The example uses the Europe Artifact Registry mirror. You can instead use the Asia or United States mirror:

asia-docker.pkg.dev/spotify-confidence/public/flags-resolver-sidecar:latest
us-docker.pkg.dev/spotify-confidence/public/flags-resolver-sidecar:latest

The registry region only determines which mirror serves the image.

Deploy in Kubernetes

You can run the resolver as a shared Kubernetes service or as a sidecar. The following example adds it as a sidecar to an existing pod:

spec:
  containers:
    - name: my-service
      image: gcr.io/my-service/image:latest

    - name: confidence-resolver
      image: europe-docker.pkg.dev/spotify-confidence/public/flags-resolver-sidecar:latest
      env:
        - name: CONFIDENCE_RESOLVER_STATE_URL
          valueFrom:
            secretKeyRef:
              name: confidence-resolver-state
              key: url
        - name: CONFIDENCE_RESOLVER_STATE_ENCRYPTION_KEY
          valueFrom:
            secretKeyRef:
              name: confidence-resolver-state
              key: encryption-key
        - name: CONFIDENCE_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: confidence-api-client
              key: client-id
        - name: CONFIDENCE_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: confidence-api-client
              key: client-secret
      ports:
        - name: http
          containerPort: 8090
      readinessProbe:
        exec:
          command: ["/bin/grpc_health_probe", "-addr=:5990"]
        initialDelaySeconds: 5
      livenessProbe:
        exec:
          command: ["/bin/grpc_health_probe", "-addr=:5990"]
        initialDelaySeconds: 10
      resources:
        requests:
          cpu: 1
          memory: 256M
        limits:
          cpu: 2
          memory: 512M

The resolver becomes ready after it downloads and decrypts its first state file. It checks for new state every 30 seconds by default. It uses the state file’s ETag in conditional requests. An HTTP 304 Not Modified response skips the reload. If a later refresh fails, the resolver continues to use the last successfully loaded state.

Configure Your SDK

Point a Confidence server SDK at the resolver HTTP address. For example, use http://localhost:8090 when the resolver runs as a sidecar:

const confidence = Confidence.create({
  clientSecret: '<flags-client-secret>',
  resolveBaseUrl: 'http://localhost:8090',
  // ...
});

Use the address of your resolver service when you run it as a shared deployment.

Rotate State Credentials

Rotate the state URI and encryption key without interrupting flag resolution:

Start credentials rotation

Open the menu for the active configuration and select Start credentials rotation. The existing configuration remains published.

Create the replacement

Create a replacement configuration and store its state URI and encryption key.

Deploy the replacement values

Update your resolver deployment. Confirm that every instance is ready and uses the replacement configuration.

Complete the sunset

Open the retiring configuration’s menu and select Complete sunset.

Completing the sunset stops publication of that configuration. Its encryption key might no longer be available. You can’t reverse this action.

Stop Apply Log Propagation

By default, the resolver sends apply logs to Confidence for exposure and experiment analysis. Set CONFIDENCE_SEND_APPLY_LOGS to false to keep apply data within your network. The resolver continues to accept and validate ApplyFlags requests. It doesn’t send assignment events or apply distinct counts to Confidence. It continues to send aggregate operational metadata, including the apply request rate.

Disabling apply logs degrades Confidence functionality. Confidence can’t observe which entities were exposed to each variant. Exposure counts, experiment results, and rollout monitoring will be missing or incomplete.

This setting doesn’t disable resolve telemetry or resolver-state synchronization. For more information, see Data Transfer.

Local Resolution Reference

Compare in-process and self-hosted resolution

Data Transfer

Understand flag resolution data flow

Manage API Clients

Manage API clients and credentials

SDKs Reference

Configure SDK integrations

​Create API Client Credentials

​Create a Resolver Configuration

​Run With Docker

​Deploy in Kubernetes

​Configure Your SDK

​Rotate State Credentials

​Stop Apply Log Propagation

​Related Resources

Local Resolution Reference

Data Transfer

Manage API Clients

SDKs Reference

Create API Client Credentials

Create a Resolver Configuration

Run With Docker

Deploy in Kubernetes

Configure Your SDK

Rotate State Credentials

Stop Apply Log Propagation

Related Resources