A price source is a configured connection to an SFTP server, a FIX session, Bloomberg or LSEG that fetches prices on your behalf, so the deployment must allow that traffic. The scheduler workload, the part of the platform that runs background jobs, opens every connection to a provider. Before the first source goes live, check five things: the address rules, a fixed outbound address for Bloomberg, the paths to each provider, a production secret store, and the stale-feed alert. The size and time caps work at their defaults, and you tune them only for larger deliveries. A source for a public SFTP, FIX, or vendor host needs no address-rule change. A provider on a private network does.
The Bloomberg and LSEG requests are built from each vendor's public documentation and have not run against the live services, so test them with your own vendor account in a non-production deployment before you rely on them.
This page is for the operator who owns the Helm release. For the feeds manager who creates sources through the Platform API, use Read and submit price feeds. For what a price source is and how its checks work, use the external price sources release note.
Settings you may change
Every setting sits in the priceSources section of the platform configuration. In the dalp chart the section is global.. Each value is a placeholder of the form ${VAR:-default}, so the matching PRICE_SOURCES_ variable on the pod moves it. A literal value in the chart pins the field, and the variable then has no effect. No tenant API reads or widens these settings.
The API pods and the scheduler pod read the same section. The API pods check the host of a source when you create or edit it. The scheduler pod checks again at every connection and enforces the caps.
# Illustrative values: allow a private proxy range and send vendor traffic through it.
global:
dalpApp:
config:
priceSources:
allowedEndpointCidrs: "10.20.0.0/16"
forwardProxyUrl: "http://10.20.4.10:3128"The endpoint allow list
By default a price source can reach public hosts only. The setting price, set by PRICE_, lists the address ranges that private providers sit in. It is empty by default. Write ranges in CIDR form, such as 10.20.0.0/16, separated by commas or spaces. The platform refuses a value that holds anything else.
Without an entry, the platform refuses a host that is, or resolves to, any of these:
A range that covers a metadata address does not lift the refusal for that address. If your provider sits in 169.254.0.0/16, the allow list admits it, and the metadata addresses inside that range stay refused.
The two places that check a host differ:
- The API checks the host as written when a feeds manager creates, edits, or activates a source. It does not resolve a name. A refusal answers 422 with DALP-14704.
- The scheduler resolves the name at every connection and checks every address the name returns. If any address is refused, the connection fails. The scheduler then connects to the address it checked, so a name that changes its answer between the check and the connection cannot reach an internal address. A host that resolves to a refused address is a configuration failure, and the delivery is recorded as
blocked_egress.
A vendor call follows at most five redirects, and never to another origin than the vendor's own.
If your network uses DNS64, which maps an IPv4 host into 64:ff9b::/96, add 64:ff9b::/96 to the list so a public IPv4 provider resolves. The IPv4 address embedded in such an address is still checked against the metadata ranges, the allow list, and internal ranges.
Plaintext FIX
A FIX source uses TLS or plaintext. The platform accepts plaintext only for a host inside the allow list. A plaintext source that names a host outside it answers 422 with DALP-14705. Because the API checks the host as written, name the counterparty by an IP address that the allow list covers. The scheduler repeats the test on the address the host resolves to.
Server name check for TLS
A FIX source with TLS carries a server name. The scheduler connects to the checked address and verifies the counterparty certificate against that server name. A certificate that does not verify is a configuration failure, and the source stops after three refusals in a row. The source has a server name field and no field for a certificate authority.
Size and time caps
Every delivery is read under a cap, so the scheduler rejects an oversized file at the cap. The scheduler reads a delivery into memory, so size the scheduler pod's memory limit before you raise a cap.
The row cap, maxRows, counts records in one delivery. A Bloomberg or LSEG delivery counts rows times price fields against it.
What happens when a delivery passes a cap:
- A file over
maxFileBytessettles asfailed_validation. The read stops one byte past the cap, so the platform never holds the rest. - A file or vendor result with more records than
maxRowssettles asfailed_validation. An SFTP directory with more entries thanmaxRowsfails the poll as a configuration failure. - A Bloomberg or LSEG request whose mapped ISINs times requested price fields pass
maxRowsfails as a configuration failure before the scheduler sends anything. - A compressed delivery that inflates past
maxInflatedBytesfails validation. - A FIX message with a repeating group over
maxFixGroupEntriesgets a session-level reject, and no part of it becomes an observation. A FIX message body overmaxFixBodyBytesis not read as a message, and the session fails as a data failure that the platform retries.
The scheduler also enforces fixed deadlines that have no setting.
A file read, vendor call, or vendor body that passes its deadline fails as transient, and the platform retries with backoff.
Bloomberg: a fixed egress address or a forward proxy
Bloomberg Data License accepts calls only from addresses you have registered with Bloomberg. The scheduler sends the calls to api.bloomberg.com over HTTPS. The address Bloomberg sees must therefore be one that does not change, and you register it in the Bloomberg Enterprise Console.
You have two ways to supply that address:
forwardProxyUrl, set by PRICE_, is empty by default, which connects directly. A value must be an http or https URL without credentials. It carries Bloomberg and LSEG traffic only. SFTP and FIX connections never use it. The proxy must forward HTTPS requests to the vendor host.
The proxy host passes the same guard as a provider host. A proxy on a private address, such as an in-cluster service, needs its range in allowedEndpointCidrs. The platform also resolves and checks the vendor host from the scheduler before it sends a request through the proxy, so the scheduler needs working name resolution for it.
If Bloomberg refuses the address, the platform shows it in three places:
- The delivery is recorded as
blocked_egress. Its detail names the address Bloomberg saw, when Bloomberg's answer states it. - The source reports a configuration failure and retries after one hour. After three refusals in a row the source stops until a feeds manager pauses and activates it.
- A connection test from the scheduler fails with the same reason and carries the address in its result.
Each Bloomberg call carries a signed token with a timestamp. If Bloomberg's clock differs from the scheduler's by more than 10 seconds, Bloomberg refuses the call. The platform then retries after five minutes and reports the skew. Keep the scheduler host clock synchronised.
Network paths to each provider
Only the scheduler workload opens these connections. It is the scheduler role of the dalp chart, and it runs one replica by default. If you restrict outbound traffic with a network policy of your own, allow these paths for it.
Every host name must resolve from the scheduler pod. For SFTP, a feeds manager accepts the server's host key fingerprint through the API before the first poll.
Secrets
A provider credential is stored through the platform's secret store, and no response, log, or error returns it. A feeds manager sets it with PUT /api/. The API pods write the credential and the scheduler pod reads it, so both pods must use the same secret store.
You choose one secret store for the deployment. Set secretManager.provider to local, aws, gcp, azure, or vault, and fill the block for the provider you chose. In the dalp chart the setting is global.. The local provider keeps secrets in the platform's own database and fits development. For production, choose the manager your organisation already runs. Secret-manager providers describes each choice. The platform keeps each source credential in its own entry and deletes the entries when a feeds manager retires the source.
If the scheduler cannot read the store, the source fails the fetch. An unreachable store is a transient failure that retries. A store that refuses the read for a reason a retry cannot fix is a configuration failure.
Observability
Price source logs share the category market-data.price-source. Search your log store for that category, then narrow by field.
The stale-feed signals are:
- The gauge
dalp_counts mapped feeds past their staleness bound, for eachmarket_ data_ stale_ price_ feeds chain_id. It has no source label. The operations case of kindstale-feednames the source and the cause. - The gauge
dalp_shows how far the indexer trails the chain head. While it passesmarket_ data_ price_ feed_ indexer_ lag_ seconds indexerLagBoundSeconds, the sweep makes no judgement on that chain and the first gauge keeps its last value. - The counter
dalp_counts sweep passes that could not judge every feed.market_ data_ stale_ sweep_ pass_ errors_ total
The observability chart ships two price source alert rules in its MarketData group. StalePriceFeeds fires at warning severity when the gauge stays over 0 for 15 minutes. Price fires when 10 or more passes fail within 15 minutes. The rules stay dormant until you enable them, as Alert rules are a deliberate second step explains. Observability describes how the platform exports logs, metrics, and traces to that stack.