Helm
Solo Enterprise for agentregistry Helm values reference.
| Key | Type | Default | Description |
|---|---|---|---|
| affinity | object | {} | Affinity rules for pod assignment (overrides preset if set) |
| args | list | [] | Override default container args (evaluated as a template) |
| audit.authz.allowedDecisions | string | "sensitive" | Successful authorization decisions to emit. Denials and authz errors are always emitted when audit.enabled=true. none: emit no successful authorization allows. sensitive: emit successful reads of sensitive resources, such as Secret. all: emit every successful authorization allow. |
| audit.collector.affinity | object | {} | |
| audit.collector.containerSecurityContext.allowPrivilegeEscalation | bool | false | Container security context for the audit collector. |
| audit.collector.containerSecurityContext.runAsGroup | int | 10001 | |
| audit.collector.containerSecurityContext.runAsNonRoot | bool | true | |
| audit.collector.containerSecurityContext.runAsUser | int | 10001 | |
| audit.collector.enabled | bool | false | Deploy an in-cluster OTel Collector relay for audit events. Only effective when audit.enabled=true. |
| audit.collector.image.pullPolicy | string | "IfNotPresent" | |
| audit.collector.image.pullSecrets | list | [] | Image pull secrets for the collector image (in addition to global.imagePullSecrets). |
| audit.collector.image.repository | string | "otel/opentelemetry-collector-contrib" | |
| audit.collector.image.tag | string | "0.148.0" | |
| audit.collector.nodeSelector | object | {} | |
| audit.collector.persistence.directory | string | "/var/lib/otelcol/audit" | Directory used by the collector file-storage queue. |
| audit.collector.persistence.enabled | bool | true | Persist the collector queue across collector restarts. Disabling this makes queued audit events ephemeral. |
| audit.collector.persistence.size | string | "10Gi" | Size of the WAL PersistentVolumeClaim when persistence.enabled=true. |
| audit.collector.persistence.storageClass | string | "" | StorageClass for the WAL PVC ("" = cluster default). |
| audit.collector.podSecurityContext.fsGroup | int | 10001 | Pod security context for the audit collector. fsGroup must be able to write the persistent queue directory. |
| audit.collector.podSecurityContext.fsGroupChangePolicy | string | "OnRootMismatch" | |
| audit.collector.podSecurityContext.runAsGroup | int | 10001 | |
| audit.collector.podSecurityContext.runAsNonRoot | bool | true | |
| audit.collector.podSecurityContext.runAsUser | int | 10001 | |
| audit.collector.resources.limits.cpu | string | "500m" | |
| audit.collector.resources.limits.memory | string | "512Mi" | |
| audit.collector.resources.requests.cpu | string | "100m" | |
| audit.collector.resources.requests.memory | string | "128Mi" | |
| audit.collector.retryOnFailure.enabled | bool | true | Retry failed exports from the audit collector to the destination. |
| audit.collector.retryOnFailure.initialInterval | string | "5s" | Initial retry interval for failed exports. |
| audit.collector.retryOnFailure.maxElapsedTime | string | "0s" | Maximum elapsed retry time. 0 means retry indefinitely while records remain in the queue. |
| audit.collector.retryOnFailure.maxInterval | string | "30s" | Maximum retry interval for failed exports. |
| audit.collector.sendingQueue.batch.enabled | bool | true | Enable exporter-helper queue batching for audit exports. |
| audit.collector.sendingQueue.batch.flushTimeout | string | "5s" | Maximum time to wait before flushing a partial batch. |
| audit.collector.sendingQueue.batch.maxSize | int | 2048 | Maximum batch size before export. |
| audit.collector.sendingQueue.batch.minSize | int | 512 | Minimum batch size before export. |
| audit.collector.sendingQueue.batch.sizer | string | "items" | Batch sizing mode. Keep this item-based so log-record batch sizes are easy to reason about. |
| audit.collector.sendingQueue.blockOnOverflow | bool | false | Block producers instead of dropping when the queue is full. |
| audit.collector.sendingQueue.enabled | bool | true | Queue audit exports before forwarding to the destination. |
| audit.collector.sendingQueue.numConsumers | int | 4 | Number of queue consumers exporting batches concurrently. |
| audit.collector.sendingQueue.queueSize | int | 10000 | Maximum number of queued requests before overflow handling applies. |
| audit.collector.sendingQueue.sizer | string | "requests" | Queue sizing mode for the exporter helper. |
| audit.collector.service.type | string | "ClusterIP" | |
| audit.collector.tolerations | list | [] | |
| audit.destination.otlp.endpoint | string | "" | OTLP/gRPC receiver for audit events. Required when audit.enabled=true. |
| audit.destination.otlp.insecure | bool | false | Disable transport security when forwarding to the audit destination. |
| audit.enabled | bool | false | Enable control-plane audit event export from the AgentRegistry server. |
| automountServiceAccountToken | bool | true | Mount the service account token in the pod |
| aws | object | {"accessKeyId":"","enabled":false,"region":"","secretAccessKey":"","sessionToken":"","usePodIdentity":false} | AWS configuration. When enabled, all values must be provided. |
| aws.sessionToken | string | "" | Session token for AWS temporary credentials (e.g. from aws sso login + aws configure export-credentials). Leave empty for long-lived IAM user keys. |
| aws.usePodIdentity | bool | false | Use EKS Pod Identity for AWS credentials instead of explicit keys. When true, the chart skips creating the AWS credentials Secret. The pod’s service account must have a Pod Identity Association configured. |
| binary | object | {"agentgateway":{"bucket":"","host":"","name":"agentgateway","version":""},"agw-sync":{"bucket":"","host":"","name":"agw-sync","version":""},"sts":{"bucket":"","host":"","name":"agentregistry-sts","version":""}} | Per-binary download configuration for managed backends; URL composed as |
| binary.agentgateway.bucket | string | "" | Bucket override for this binary (default: global.binaryBucket) |
| binary.agentgateway.host | string | "" | Host override for this binary (default: global.binaryHost) |
| binary.agentgateway.name | string | "agentgateway" | Binary filename as published in the bucket |
| binary.agentgateway.version | string | "" | Version path segment (default: chart appVersion) |
| binary.agw-sync.bucket | string | "" | Bucket override for this binary (default: global.binaryBucket) |
| binary.agw-sync.host | string | "" | Host override for this binary (default: global.binaryHost) |
| binary.agw-sync.name | string | "agw-sync" | Binary filename as published in the bucket |
| binary.agw-sync.version | string | "" | Version path segment (default: chart appVersion) |
| binary.sts.bucket | string | "" | Bucket override for this binary (default: global.binaryBucket) |
| binary.sts.host | string | "" | Host override for this binary (default: global.binaryHost) |
| binary.sts.name | string | "agentregistry-sts" | Binary filename as published in the bucket |
| binary.sts.version | string | "" | Version path segment (default: chart appVersion) |
| clickhouse.auth.enabled | bool | true | Enable ClickHouse authentication |
| clickhouse.auth.password | string | "password" | ClickHouse password |
| clickhouse.auth.skipUserSetup | bool | false | Must be false so the subchart configures the default user with the password above. skipUserSetup: true leaves the insecure no-password default user, which breaks auth. |
| clickhouse.auth.username | string | "default" | ClickHouse username |
| clickhouse.containerSecurityContext | object | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true} | Container-level security context for ClickHouse containers (passed through to the ClickHouse subchart). |
| clickhouse.customConfig | object | {"concurrent_threads_soft_limit_num":1,"mark_cache_size":524288000} | Custom ClickHouse server configuration |
| clickhouse.database | object | {"name":"agentregistry"} | ClickHouse database name to create and connect to |
| clickhouse.enabled | bool | true | Enable ClickHouse deployment |
| clickhouse.image | object | {"repository":"clickhouse/clickhouse-server","tag":""} | ClickHouse image configuration |
| clickhouse.image.repository | string | "clickhouse/clickhouse-server" | ClickHouse image repository |
| clickhouse.image.tag | string | "" | ClickHouse image tag - empty so it uses the chart appVersion |
| clickhouse.keeper.enabled | bool | false | Enable ClickHouse Keeper / ZooKeeper |
| clickhouse.livenessProbe | object | {"initialDelaySeconds":10,"periodSeconds":15,"tcpSocket":{"port":"http"},"timeoutSeconds":1} | Liveness probe for ClickHouse |
| clickhouse.metrics | object | {"enabled":false} | Enable ClickHouse Prometheus metrics endpoint |
| clickhouse.persistentVolume.enabled | bool | false | Enable persistent storage for ClickHouse |
| clickhouse.ports | object | {"clickhouse":{"metrics":9363,"tcp":9000}} | ClickHouse network port configuration (passed through to the ClickHouse subchart) |
| clickhouse.ports.clickhouse.metrics | int | 9363 | Prometheus metrics port |
| clickhouse.ports.clickhouse.tcp | int | 9000 | Native TCP port for ClickHouse clients |
| clickhouse.profiles | object | {"default":{"@replace":"1","max_execution_time":60}} | User performance profiles |
| clickhouse.readinessProbe | object | {"httpGet":{"path":"/ping","port":"http"},"initialDelaySeconds":10,"periodSeconds":15,"timeoutSeconds":1} | Readiness probe for ClickHouse |
| clickhouse.replicasPerShard | int | 1 | Number of ClickHouse replicas |
| clickhouse.resources | object | {"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"250m","ephemeral-storage":"50Mi","memory":"512Mi"}} | Resource defaults for ClickHouse These defaults are intentionally conservative so the chart can install on smaller clusters. Increase them for production workloads based on dataset size, ingestion rate, and retention requirements. |
| clickhouse.securityContext | object | {"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":101,"runAsNonRoot":true,"runAsUser":101} | Pod-level security context for ClickHouse pods (passed through to the ClickHouse subchart). |
| clickhouse.shards | int | 1 | Number of ClickHouse shards |
| command | list | [] | Override default container command (evaluated as a template) |
| commonAnnotations | object | {} | Annotations to add to all deployed resources |
| commonLabels | object | {} | Labels to add to all deployed resources |
| config.agentGatewayPort | string | "21212" | Agent Gateway gRPC port |
| config.agentRegistryMcpPort | string | "31313" | Agent Registry MCP server port |
| config.requireCreateApproval | string | "false" | Stage non-admin tagged registry artifact writes for approval before production storage |
| config.serverAddress | string | ":8080" | Listen address for the HTTP server |
| containerSecurityContext.allowPrivilegeEscalation | bool | false | Allow privilege escalation |
| containerSecurityContext.capabilities.drop | list | ["ALL"] | Linux capabilities to drop |
| containerSecurityContext.enabled | bool | true | Enable container-level security context |
| containerSecurityContext.readOnlyRootFilesystem | bool | false | Mount root filesystem as read-only |
| containerSecurityContext.runAsGroup | int | 0 | Group ID to run the container as |
| containerSecurityContext.runAsNonRoot | bool | false | Prevent running as root |
| containerSecurityContext.runAsUser | int | 0 | User ID to run the container as |
| containerSecurityContext.seccompProfile.type | string | "RuntimeDefault" | Seccomp profile type |
| database.postgres.bundled | object | {"affinity":{},"image":{"name":"postgres","pullPolicy":"IfNotPresent","registry":"docker.io","repository":"library","tag":"18"},"nodeSelector":{},"resources":{"limits":{"cpu":"1","memory":"1Gi"},"requests":{"cpu":"250m","memory":"256Mi"}},"storage":"5Gi","tolerations":[]} | Bundled PostgreSQL — dev/eval only. Only consumed when type: bundled. |
| database.postgres.bundled.affinity | object | {} | Affinity for the bundled PostgreSQL pod. Empty by default. |
| database.postgres.bundled.image.name | string | "postgres" | Bundled PostgreSQL image name |
| database.postgres.bundled.image.pullPolicy | string | "IfNotPresent" | Bundled PostgreSQL image pull policy |
| database.postgres.bundled.image.registry | string | "docker.io" | Bundled PostgreSQL image registry |
| database.postgres.bundled.image.repository | string | "library" | Bundled PostgreSQL image repository (org/namespace) |
| database.postgres.bundled.image.tag | string | "18" | Bundled PostgreSQL image tag |
| database.postgres.bundled.nodeSelector | object | {} | Node selector for the bundled PostgreSQL pod. Empty by default. |
| database.postgres.bundled.resources | object | {"limits":{"cpu":"1","memory":"1Gi"},"requests":{"cpu":"250m","memory":"256Mi"}} | Resource requests/limits for the bundled PostgreSQL container |
| database.postgres.bundled.storage | string | "5Gi" | PersistentVolumeClaim size for the bundled PostgreSQL data directory |
| database.postgres.bundled.tolerations | list | [] | Tolerations for the bundled PostgreSQL pod. Empty by default. |
| database.postgres.external | object | {"secretRef":{"key":"AGENT_REGISTRY_DATABASE_URL","name":""},"url":""} | External (BYO) PostgreSQL configuration. Only consumed when type: external. |
| database.postgres.external.secretRef | object | {"key":"AGENT_REGISTRY_DATABASE_URL","name":""} | Source the connection string from an existing Secret instead of inlining it. Use this when credentials are managed by an external secret store (e.g. AWS Secrets Manager via External Secrets Operator) and synced into the cluster as a Secret. The chart does not create or manage this Secret. Mutually exclusive with external.url. On credential rotation, Kubernetes does NOT auto-restart the pod — pair with a controller such as stakater/Reloader if you need automatic restarts on Secret content changes. |
| database.postgres.external.secretRef.key | string | "AGENT_REGISTRY_DATABASE_URL" | Key within the Secret that holds the connection string. |
| database.postgres.external.secretRef.name | string | "" | Name of an existing Secret in the release namespace. Leave empty to disable. |
| database.postgres.external.url | string | "" | Inline connection string. Mutually exclusive with external.secretRef.name. |
| database.postgres.type | string | "bundled" | Backend type: “bundled” (deploy the chart’s in-cluster dev/eval Postgres pod) or “external” (connect to a Postgres you bring yourself; configure under external below). |
| dnsConfig | object | {} | DNS configuration for the pod |
| dnsPolicy | string | "" | DNS policy for the pod |
| extraEnvVars | list | [] | Array of extra environment variables for the Agent Registry container. Additive only — cannot override env vars the chart already renders. For credentialed fields use the dedicated knobs (e.g. database.postgres.external.secretRef, global.git.secretRef). |
| fullnameOverride | string | "agentregistry-enterprise" | Override the full name of the chart. Defaults to “agentregistry-enterprise”. Set to "" to fall back to release-name-driven naming. |
| global.binaryBucket | string | "agentregistry-enterprise" | Default bucket for binary downloads; per-binary bucket overrides take precedence |
| global.binaryHost | string | "https://storage.googleapis.com" | Default host for binary downloads; per-binary host overrides take precedence |
| global.git | object | {"secretRef":{"key":"GIT_TOKEN","name":"","usernameKey":""},"token":"","username":""} | Configuration for accessing private git repositories. Set either token to have the chart create a Secret, or secretRef.name to reference an existing Secret. The two fields are mutually exclusive. |
| global.git.secretRef | object | {"key":"GIT_TOKEN","name":"","usernameKey":""} | Reference to an existing Secret holding the git credentials, for users who would rather not put them in Helm values. |
| global.git.secretRef.key | string | "GIT_TOKEN" | Key in the existing Secret that holds the token. |
| global.git.secretRef.name | string | "" | Name of the existing Secret. When set, the chart does not create its own git Secret. |
| global.git.secretRef.usernameKey | string | "" | Optional key in the existing Secret that holds the username. Leave empty (the default) for token-only providers like GitHub. |
| global.git.token | string | "" | Token used to access private git repositories. The chart creates a Secret to hold this value. Must NOT contain ‘:’ – use the username field above for username+password auth instead of embedding USERNAME:TOKEN in the token. |
| global.git.username | string | "" | Username for git HTTPS basic auth. Leave empty for providers that accept the token as the username (e.g. GitHub PATs). Set for providers that require both a username and a token/password (e.g. GitLab): * GitLab Personal Access Token: username: oauth2 * GitLab Deploy Token: username: |
| global.imagePullSecrets | list | [] | Global Docker registry secret names |
| global.imageRegistry | string | "" | Global container image registry override |
| hostAliases | list | [] | Add custom entries to /etc/hosts |
| image.digest | string | "" | Agent Registry Enterprise image digest (overrides tag if set) |
| image.name | string | "server" | Agent Registry Enterprise image name |
| image.pullPolicy | string | "IfNotPresent" | Agent Registry Enterprise image pull policy |
| image.pullSecrets | list | [] | Agent Registry Enterprise image pull secrets |
| image.registry | string | "us-docker.pkg.dev" | Agent Registry Enterprise image registry |
| image.repository | string | "agentregistry/enterprise" | Agent Registry Enterprise image repository (org/path, excluding the image name) |
| image.tag | string | "" | Agent Registry Enterprise image tag (immutable tags recommended) |
| kagent.outboundAuth.oidc.clientId | string | "" | OIDC client ID used by AgentRegistry when minting client-credentials tokens for outbound calls to kagent. The client must allow the OAuth2 client_credentials grant and be authorized by kagent’s RBAC mapping. Defaults to oidc.clientId in the server when empty. |
| kagent.outboundAuth.oidc.clientSecret | string | "" | OIDC client secret used by AgentRegistry when minting client-credentials tokens for outbound calls to kagent. Defaults to oidc.clientSecret in the server when empty. |
| kagent.outboundAuth.oidc.insecureSkipVerify | string | "" | Skip TLS certificate verification for outbound kagent token minting. Defaults to oidc.insecureSkipVerify in the server when empty. |
| kagent.outboundAuth.oidc.issuer | string | "" | OIDC issuer URL used by AgentRegistry when minting client-credentials tokens for outbound calls to kagent. Defaults to oidc.issuer in the server when empty. |
| licensing.createSecret | bool | false | When true, create a Secret from licenseKey. When false, use the existing Secret named by secretName. If you use your own Secret, changing the Secret will only take effect when you restart the deployment: kubectl -n agentregistry rollout restart deployment/agentregistry-enterprise-server |
| licensing.licenseKey | string | nil | Enterprise AgentRegistry license key. Required only when createSecret is true. Contact Sales if you do not have one. |
| licensing.secretName | string | "enterprise-agentregistry-license" | Name of the Secret containing the Enterprise AgentRegistry license key. The Secret must contain the key enterprise-agentregistry-license-key. |
| lifecycleHooks | object | {} | Lifecycle hooks for the Agent Registry container |
| livenessProbe.enabled | bool | true | Enable liveness probe |
| livenessProbe.failureThreshold | int | 6 | Failure threshold for liveness check |
| livenessProbe.initialDelaySeconds | int | 30 | Initial delay before liveness check |
| livenessProbe.periodSeconds | int | 10 | Period between liveness checks |
| livenessProbe.successThreshold | int | 1 | Success threshold for liveness check |
| livenessProbe.timeoutSeconds | int | 5 | Timeout for the liveness check |
| nameOverride | string | "" | Override the name of the chart |
| nodeAffinityPreset.key | string | "" | Node label key for affinity |
| nodeAffinityPreset.type | string | "" | Node affinity preset type (soft or hard) |
| nodeAffinityPreset.values | list | [] | Node label values for affinity |
| nodeSelector | object | {} | Node labels for pod assignment |
| oidc.additionalScopes | string | "" | Additional OIDC scopes requested by the bundled browser UI login flow (space-separated, e.g. “groups”). The server does not request scopes. |
| oidc.clientId | string | "" | Backend OIDC client ID. Required by the server-side token validator. |
| oidc.clientSecret | string | "" | Optional backend OIDC client secret. Used for token introspection when the identity provider exposes an introspection endpoint; not required for JWKS-based token validation. |
| oidc.insecureSkipVerify | bool | false | Skip TLS certificate verification (not recommended for production) |
| oidc.issuer | string | "" | OIDC issuer URL. Required by the server for token validation and discovery during startup; also exposed to the bundled browser UI for login. Example: “https://keycloak.example.com/realms/my-realm" |
| oidc.publicClientId | string | "" | Browser UI OIDC client ID (public client, no secret). Required by the bundled UI login flow; the Go server does not use it for startup or token validation. |
| oidc.roleClaim | string | "groups" | Dot-path into JWT claims containing role names. The server converts this path into the CEL expression used to map JWT claims to registry RBAC roles. Only “.” is treated as a path separator; colons and other special characters are literal. Most deployments only need this field. Examples: “groups”, “realm_access.roles”, “cognito:groups” |
| oidc.roleMapper | string | "" | Advanced override: CEL expression for mapping OIDC claims to RBAC roles. When set, takes precedence over roleClaim. Most deployments should use roleClaim instead. The expression references the JWT claim map as jwt so the same expression is consumable by agentgateway authorization rules. Example: “has(jwt["groups"]) ? jwt["groups"].map(g, string(g)) : []” |
| oidc.superuserRole | string | "" | Role name that grants full registry admin access (superuser). Defaults to “admin” when empty. |
| podAffinityPreset | string | "" | Pod affinity preset (soft or hard) |
| podAnnotations | object | {} | Extra annotations for Agent Registry pods |
| podAntiAffinityPreset | string | "soft" | Pod anti-affinity preset (soft or hard) |
| podLabels | object | {} | Extra labels for Agent Registry pods |
| podSecurityContext.enabled | bool | true | Enable pod-level security context |
| podSecurityContext.fsGroup | int | 0 | Group ID for the pod filesystem |
| podSecurityContext.fsGroupChangePolicy | string | "Always" | Policy for changing fsGroup ownership |
| priorityClassName | string | "" | Priority class name for the Agent Registry pods |
| rbac.enabled | bool | true | Enable RBAC resource creation |
| rbac.extraRules | list | [] | Enterprise-only: extra rules appended to the Role or ClusterRole (e.g. for custom resources). |
| rbac.watchedNamespaces | list | [] | Namespaces Agent Registry is permitted to manage resources in. Empty list grants cluster-wide access via ClusterRole (default). Set to one or more namespaces to create a Role in each and restrict access accordingly. Note: read access to the cluster scoped APIs is always granted via ClusterRole regardless of this setting. |
| readinessProbe.enabled | bool | true | Enable readiness probe |
| readinessProbe.failureThreshold | int | 3 | Failure threshold for readiness check |
| readinessProbe.initialDelaySeconds | int | 10 | Initial delay before readiness check |
| readinessProbe.periodSeconds | int | 5 | Period between readiness checks |
| readinessProbe.successThreshold | int | 1 | Success threshold for readiness check |
| readinessProbe.timeoutSeconds | int | 3 | Timeout for the readiness check |
| replicaCount | int | 1 | Number of Agent Registry replicas |
| resources | object | {"limits":{"cpu":"1","memory":"1Gi"},"requests":{"cpu":"250m","memory":"256Mi"}} | Resource requests and limits for the Agent Registry container |
| revisionHistoryLimit | int | 10 | Number of old ReplicaSets to retain |
| schedulerName | string | "" | Name of the scheduler to use |
| secretStore | object | {"encryptionKeySecretRef":{"key":"SECRET_STORE_ENCRYPTION_KEY","name":""},"type":"Kubernetes"} | Secret store configuration. Selects the install-global backend that persists Secret resource payloads. |
| secretStore.encryptionKeySecretRef | object | {"key":"SECRET_STORE_ENCRYPTION_KEY","name":""} | Reference to a pre-created Secret holding the AES-256 encryption key, required when type=Database. The operator creates this Secret; the chart only references it (the key is never generated or templated here). |
| secretStore.encryptionKeySecretRef.key | string | "SECRET_STORE_ENCRYPTION_KEY" | Key within that Secret holding the hex-encoded 32-byte AES-256 key. |
| secretStore.encryptionKeySecretRef.name | string | "" | Name of the existing Secret in the install namespace. |
| secretStore.type | string | "Kubernetes" | Backend type: “Kubernetes” (stores payloads as core/v1.Secrets in the install namespace; relies on etcd encryption-at-rest) or “Database” (encrypts payloads in Postgres with an AES-256 key). |
| service.annotations | object | {} | Service annotations |
| service.clusterIP | string | "" | Specific cluster IP (set to None for headless) |
| service.externalTrafficPolicy | string | "Cluster" | External traffic policy |
| service.loadBalancerIP | string | "" | LoadBalancer IP |
| service.loadBalancerSourceRanges | list | [] | LoadBalancer allowed source ranges |
| service.nodePorts.grpc | string | "" | NodePort for gRPC (when type is NodePort) |
| service.nodePorts.http | string | "" | NodePort for HTTP (when type is NodePort) |
| service.nodePorts.mcp | string | "" | NodePort for MCP (when type is NodePort) |
| service.ports.grpc | int | 21212 | Agent Gateway gRPC port |
| service.ports.http | int | 12121 | HTTP port |
| service.ports.mcp | int | 31313 | MCP HTTP port |
| service.sessionAffinity | string | "None" | Session affinity (None or ClientIP) |
| service.sessionAffinityConfig | object | {} | Session affinity configuration |
| service.targetPorts.grpc | int | 21212 | gRPC container target port |
| service.targetPorts.http | int | 8080 | HTTP container target port |
| service.targetPorts.mcp | int | 31313 | MCP container target port |
| service.type | string | "ClusterIP" | Kubernetes Service type |
| serviceAccount.annotations | object | {} | ServiceAccount annotations |
| serviceAccount.automountServiceAccountToken | bool | true | Mount API token in the ServiceAccount |
| serviceAccount.create | bool | true | Create a dedicated ServiceAccount |
| serviceAccount.name | string | "" | Override the auto-generated ServiceAccount name |
| startupProbe.enabled | bool | true | Enable startup probe |
| startupProbe.failureThreshold | int | 30 | Failure threshold for startup check (controls max startup time) |
| startupProbe.initialDelaySeconds | int | 5 | Initial delay before startup check |
| startupProbe.periodSeconds | int | 5 | Period between startup checks |
| startupProbe.successThreshold | int | 1 | Success threshold for startup check |
| startupProbe.timeoutSeconds | int | 3 | Timeout for the startup check |
| telemetry | object | {"collector":{"affinity":{},"image":{"pullPolicy":"IfNotPresent","repository":"otel/opentelemetry-collector-contrib","tag":"0.148.0"},"livenessProbe":{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":5},"nodeSelector":{},"readinessProbe":{"failureThreshold":3,"initialDelaySeconds":5,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":5},"resources":{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"100m","memory":"256Mi"}},"tolerations":[]},"enabled":true,"k8sobjects":{"enabled":false},"service":{"annotations":{},"type":"ClusterIP"}} | OpenTelemetry Collector pipeline. Collects traces/logs/metrics and writes to ClickHouse. |
| telemetry.collector.affinity | object | {} | Affinity for the telemetry collector pod. Empty by default. |
| telemetry.collector.nodeSelector | object | {} | Node selector for the telemetry collector pod. Empty by default. |
| telemetry.collector.tolerations | list | [] | Tolerations for the telemetry collector pod. Empty by default. |
| telemetry.enabled | bool | true | Deploy the OTel Collector pipeline alongside Agent Registry |
| telemetry.k8sobjects | object | {"enabled":false} | Enable the k8sobjects receiver (watches Kubernetes resource changes). Should only be enabled on one collector per cluster to avoid duplicate data. |
| telemetry.service.annotations | object | {} | Service annotations (e.g. for AWS NLB configuration) |
| telemetry.service.type | string | "ClusterIP" | Kubernetes Service type for the OTel Collector |
| terminationGracePeriodSeconds | string | "" | Seconds the pod needs to terminate gracefully |
| tolerations | list | [] | Tolerations for pod assignment |
| topologySpreadConstraints | list | [] | Topology spread constraints for pod assignment |
| volumeMounts | list | [] | Additional volumeMounts on the output Deployment definition. |
| volumes | list | [] | Additional volumes on the output Deployment definition. |