For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
Solo UI relay
Review Helm values for the Solo UI relay Helm chart.
Review Helm values for the Solo UI relay Helm chart.
Overview
The relay chart deploys lightweight agent components for workload clusters in a multicluster Solo UI setup for Solo Enterprise for Istio, including:
- OpenTelemetry collector for telemetry collection and forwarding
- Tunnel client for secure communication with the management cluster
For more information, see the installation guide.
Required Values
The following values must be configured for the relay chart to function:
| Parameter | Description | Why Required |
|---|---|---|
cluster | Name of the workload cluster where this chart is deployed | Chart deployment will fail without cluster identification |
telemetry.fqdn | Management cluster telemetry endpoint, which is the external address of the solo-enterprise-telemetry-gateway Service | Cannot forward telemetry data without management cluster endpoint |
tunnel.fqdn | Management cluster tunnel endpoint, which is the external address of the solo-enterprise-tunnel Service. Releases that served this from solo-enterprise-ui must repoint it after upgrading the management cluster | Cannot establish secure tunnel without management cluster endpoint; required while tunnel.enabled is true (the default) |
Values
| Key | Type | Description | Default |
|---|---|---|---|
| cluster | string | Name of the workload cluster where this chart is deployed. The cluster name must only contain letters, digits, hyphens (-), and dots (.). It must start and end with a letter or digit and be between 1 and 253 characters. | "" |
| global.image.registry | string | Fallback registry for all solo-owned images. Excludes third party images. Per-image registry takes precedence when set. | "us-docker.pkg.dev/solo-public" |
| global.image.repository | string | Fallback repository for all solo-owned images. Excludes third party images. Per-image repository takes precedence when set. | "solo-enterprise" |
| global.image.tag | string | Fallback tag for all solo-owned images. Excludes third party images. Per-image tag takes precedence when set; falls back to chart version if both are unset. | "" |
| global.imagePullPolicy | string | Configure image pull policy for all images in this chart | "IfNotPresent" |
| istio | object | Istio ambient mode integration. When enabled (the default), relay pods are labeled with istio.io/dataplane-mode=ambient, so the workload cluster’s collectors can reach the management cluster’s global Services (tunnel server, telemetry gateway) over ambient multi-cluster mesh without any post-install labeling. Disable when installing into a cluster that is not running ambient mode. | {"ambient":{"enabled":true}} |
| istio.ambient.enabled | bool | Apply the ambient dataplane-mode label to relay pods automatically on install. | true |
| kubernetes.watchNamespaces | list | List of namespaces the relay k8sobjects collector should watch. When empty (default) the collector watches all namespaces (cluster-wide). When set, only the listed namespaces (plus the release namespace) are watched, and cluster-scoped resources (namespaces, nodes, customresourcedefinitions, gatewayclasses) are excluded. This setting scopes collection only; it does not change the chart’s RBAC. Installing the relay still requires cluster-wide permissions because the ClusterRole retains a wildcard rule required for control-plane lease operations. | [] |
| management | list | Management plane destinations for active-passive topologies. Each entry fans out telemetry and object history through its own OTLP exporter with its own sending queue (and persistent queue when enabled), and runs its own tunnel-client Deployment (solo-enterprise-tunnel-client- | [] |
| podSecurityContext | object | Default pod-level security context applied to all pods (can be overridden per-component) | {"runAsNonRoot":true} |
| products | object | Product integrations. These decide which telemetry this workload cluster collects and ships to the management cluster, so set the same products you enabled on the management chart. At least one is required, and a product left disabled collects nothing for that product. | {"agentgateway":{"enabled":false},"kagent":{"enabled":false},"mesh":{"enabled":false}} |
| products.agentgateway | object | Agentgateway Enterprise integration. Enable on workload clusters running agentgateway so its traces are shipped to the management cluster. When mesh is also enabled, the collector additionally keeps and transforms agentgateway’s north-south gateway metrics so they reach the Fleet Graph (the shared gateway scrape job collects them either way; disabling the flag drops them at the metric-name allowlist). | {"enabled":false} |
| products.agentgateway.enabled | bool | Enable agentgateway trace and metric collection in the relay telemetry pipeline. | false |
| products.kagent | object | Kagent Enterprise integration. Enable on workload clusters running kagent so its agent traces are shipped to the management cluster. | {"enabled":false} |
| products.kagent.enabled | bool | Enable kagent trace collection in the relay telemetry pipeline. | false |
| products.mesh | object | Service Mesh Enterprise integration. Enable on workload clusters running Istio so the collector scrapes the Istio data plane and ships its metrics to the management cluster. Metric collection happens for this product only, so a cluster without mesh does no Prometheus scraping at all. | {"enabled":false} |
| products.mesh.enabled | bool | Enable Istio metric collection in the relay telemetry pipeline. | false |
| securityContext | object | Default container-level security context applied to all containers (can be overridden per-container) | {"readOnlyRootFilesystem":true} |
| telemetry.collector.affinity | object | Affinity for the telemetry collector pods | {} |
| telemetry.collector.livenessProbe | object | Liveness probe configuration | {"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":5} |
| telemetry.collector.nodeSelector | object | Node selector for the telemetry collector pods | {} |
| telemetry.collector.persistentQueue.enabled | bool | Buffer exporter queues on a persistent volume and retry until delivery. Enabling this on an existing install with metrics enabled requires a one-time StatefulSet recreation (delete it with cascade=orphan, then upgrade) because volumeClaimTemplates are immutable; the upgrade fails early with the exact command. | false |
| telemetry.collector.persistentQueue.fsGroup | int | fsGroup added to the collector pod security contexts while a queue volume is mounted, so the collector (uid/gid 10001) can write a provisioned volume that arrives root-owned. Set to null on OpenShift, where the restricted SCC assigns a project-scoped GID instead. | 10001 |
| telemetry.collector.persistentQueue.queueSizeBytes | int | Logical byte cap for the queues of one collector pod, divided equally across its queue files, one per management destination per signal the collector ships (three for the telemetry collector when traces are collected, one for the k8sobjects collector, or two with self-monitoring). The chart also caps those files on disk at an equal share of 85% of size, so this must stay at or below that; the gap covers storage overhead. Raise both together to ride out longer outages. | 8000000000 |
| telemetry.collector.persistentQueue.size | string | Size of each queue volume. Whole or decimal number with a k, M, G, T, Ki, Mi, Gi, or Ti suffix. | "10Gi" |
| telemetry.collector.persistentQueue.storageClass | string | StorageClass for the queue volumes. Empty uses the cluster default. | "" |
| telemetry.collector.podSecurityContext | object | Pod-level security context for the telemetry collector workload. Empty (default) inherits the top-level podSecurityContext. When persistentQueue is enabled the chart adds fsGroup (persistentQueue.fsGroup) unless the effective context sets one, because the collector image runs as uid/gid 10001 and provisioned volumes arrive root-owned. | (uses global podSecurityContext) |
| telemetry.collector.readinessProbe | object | Readiness probe configuration | {"failureThreshold":3,"initialDelaySeconds":5,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":5} |
| telemetry.collector.replicaCount | int | Number of replicas. When metrics are collected, a single replica scrapes all Prometheus targets cluster-wide. Increase replicaCount and enable sharding to distribute scrape load across multiple replicas. | 1 |
| telemetry.collector.resources | object | Resources for the telemetry collector | {"limits":{"cpu":"500m","memory":"1024Mi"},"requests":{"cpu":"100m","memory":"300Mi"}} |
| telemetry.collector.securityContext | object | Container security context for telemetry collector | (uses global securityContext) |
| telemetry.collector.sharding | object | Sharding configuration for distributing Prometheus scrape targets across replicas. Sharding uses hashmod relabeling to ensure each target is scraped by exactly one collector. Requires metric collection (metrics.enabled=true and products.mesh.enabled=true) and replicaCount > 1. | {"enabled":false,"label":"__address__"} |
| telemetry.collector.sharding.enabled | bool | Enable sharding of collector targets | false |
| telemetry.collector.sharding.label | string | Label to hash for shard assignment. Common values: “address” (default), “pod”, “instance” | "__address__" |
| telemetry.collector.tolerations | list | Tolerations for the telemetry collector pods | [] |
| telemetry.extraExporters | object | Additional collector exporters, merged verbatim into the exporters: section of both collector configs. Reference them from telemetry.extraPipelines; they are not attached to the built-in pipelines. | {} |
| telemetry.extraPipelines | object | Additional collector pipelines, merged verbatim into the service.pipelines: section of both collector configs. | {} |
| telemetry.fqdn | string | Management cluster telemetry endpoint, which is the external address of the solo-enterprise-telemetry-gateway Service in the management cluster. | "" |
| telemetry.image | object | Shared image configuration for all telemetry collectors | {"name":"opentelemetry-collector-contrib","pullPolicy":"","registry":"docker.io","repository":"otel","tag":"0.158.0"} |
| telemetry.image.name | string | Image name | "opentelemetry-collector-contrib" |
| telemetry.image.pullPolicy | string | Image pull policy | "" |
| telemetry.image.registry | string | Image registry | "docker.io" |
| telemetry.image.repository | string | Image repository | "otel" |
| telemetry.image.tag | string | OpenTelemetry collector image tag | "0.158.0" |
| telemetry.k8sobjects.affinity | object | Affinity for the k8sobjects collector pods | {} |
| telemetry.k8sobjects.enabled | bool | Enable the k8sobjects collector. Disabling this removes only the collector; the tunnel client is its own Deployment gated on tunnel.enabled. | true |
| telemetry.k8sobjects.livenessProbe | object | Liveness probe configuration | {"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":5} |
| telemetry.k8sobjects.nodeSelector | object | Node selector for the k8sobjects collector pods | {} |
| telemetry.k8sobjects.podSecurityContext | object | Pod-level security context for the k8sobjects collector pods. Empty (default) inherits the top-level podSecurityContext. When telemetry.collector.persistentQueue is enabled the chart adds fsGroup (persistentQueue.fsGroup) unless the effective context sets one, because the collector image runs as uid/gid 10001 and provisioned volumes arrive root-owned. | (uses global podSecurityContext) |
| telemetry.k8sobjects.readinessProbe | object | Readiness probe configuration | {"failureThreshold":3,"initialDelaySeconds":5,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":5} |
| telemetry.k8sobjects.replicaCount | int | Number of k8sobjects collector replicas. When greater than 1, the collector runs the k8s_leader_elector extension so exactly one replica watches at a time and the others stand by. A newly elected leader re-lists the watched objects, which is idempotent for the current-state tables. Incompatible with telemetry.collector.persistentQueue, whose k8sobjects queue volume allows one writer. | 1 |
| telemetry.k8sobjects.resources | object | Resources for the k8sobjects collector | {"limits":{"cpu":"200m","memory":"512Mi"},"requests":{"cpu":"50m","memory":"256Mi"}} |
| telemetry.k8sobjects.securityContext | object | Container security context for k8sobjects collector | (uses global securityContext) |
| telemetry.k8sobjects.tolerations | list | Tolerations for the k8sobjects collector pods | [] |
| telemetry.metrics.enabled | bool | Enable Prometheus metrics scraping. Only the Service Mesh Enterprise product collects metrics, so this is ignored unless products.mesh.enabled is true. | true |
| telemetry.port | int | Management cluster telemetry port | 4316 |
| telemetry.selfMonitoring.enabled | bool | Enable relay self-monitoring metrics export to management cluster | false |
| telemetry.traces.enabled | bool | Enable OTLP trace ingestion. Only the kagent Enterprise and agentgateway Enterprise products collect traces, so this is ignored unless products.kagent.enabled or products.agentgateway.enabled is true. | true |
| traces.verbose | bool | Enable verbose traces | false |
| tunnel.affinity | object | Affinity for the tunnel client pods. Empty (default) inherits telemetry.k8sobjects.affinity. | {} |
| tunnel.enabled | bool | Enable the tunnel client Deployment connecting this cluster to the management cluster. | true |
| tunnel.fqdn | string | Management cluster tunnel endpoint, which is the external address of the solo-enterprise-tunnel Service in the management cluster. Releases before the tunnel server had its own Deployment served this from the solo-enterprise-ui Service; after upgrading the management cluster, repoint this value (or the DNS name behind it) at solo-enterprise-tunnel. | "" |
| tunnel.image.name | string | Image name | "solo-enterprise-tunnel-client" |
| tunnel.image.pullPolicy | string | Image pull policy | "" |
| tunnel.image.registry | string | Registry for the tunnel client image. Overrides global.registry when set. | "" |
| tunnel.image.repository | string | Repository for the tunnel client image. Overrides global.repository when set. | "" |
| tunnel.image.tag | string | Tag for the tunnel client image. Overrides global.tag when set; falls back to chart version if both are unset. | "" |
| tunnel.livenessProbe | object | Liveness probe for the tunnel | {"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":5} |
| tunnel.livenessProbe.failureThreshold | int | Failure threshold for liveness probe | 3 |
| tunnel.livenessProbe.initialDelaySeconds | int | Initial delay seconds for liveness probe | 10 |
| tunnel.livenessProbe.periodSeconds | int | Period seconds for liveness probe | 10 |
| tunnel.livenessProbe.successThreshold | int | Success threshold for liveness probe | 1 |
| tunnel.livenessProbe.timeoutSeconds | int | Timeout seconds for liveness probe | 5 |
| tunnel.nodeSelector | object | Node selector for the tunnel client pods. Empty (default) inherits telemetry.k8sobjects.nodeSelector, which placed the tunnel client before it had its own Deployment. | {} |
| tunnel.podSecurityContext | object | Pod-level security context for the tunnel client pods. Empty (default) inherits telemetry.k8sobjects.podSecurityContext, which applied to the tunnel client before it had its own Deployment. | {} |
| tunnel.port | int | Management cluster tunnel port | 9000 |
| tunnel.readinessProbe | object | Readiness probe for the tunnel | {"failureThreshold":3,"initialDelaySeconds":5,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":5} |
| tunnel.readinessProbe.failureThreshold | int | Failure threshold for readiness probe | 3 |
| tunnel.readinessProbe.initialDelaySeconds | int | Initial delay seconds for readiness probe | 5 |
| tunnel.readinessProbe.periodSeconds | int | Period seconds for readiness probe | 10 |
| tunnel.readinessProbe.successThreshold | int | Success threshold for readiness probe | 1 |
| tunnel.readinessProbe.timeoutSeconds | int | Timeout seconds for readiness probe | 5 |
| tunnel.resources | object | Resources for the tunnel client. If this is set by the user, it will override all defaults from values.yaml | {"limits":{"cpu":"500m","memory":"1024Mi"},"requests":{"cpu":"100m","memory":"300Mi"}} |
| tunnel.resources.limits | object | Resources for the tunnel client. If this is set by the user, it will override all defaults from values.yaml. If this is set to null, it will not render the limits block. | {"cpu":"500m","memory":"1024Mi"} |
| tunnel.resources.limits.cpu | string | CPU limits for the tunnel client | "500m" |
| tunnel.resources.limits.memory | string | Memory limits for the tunnel client | "1024Mi" |
| tunnel.resources.requests | object | Resources for the tunnel client. If this is set by the user, it will override all defaults from values.yaml. If this is set to null, it will not render the requests block. | {"cpu":"100m","memory":"300Mi"} |
| tunnel.resources.requests.cpu | string | CPU requests for the tunnel client | "100m" |
| tunnel.resources.requests.memory | string | Memory requests for the tunnel client | "300Mi" |
| tunnel.securityContext | object | Container security context for the tunnel client | (uses global securityContext) |
| tunnel.tolerations | list | Tolerations for the tunnel client pods. Empty (default) inherits telemetry.k8sobjects.tolerations. | [] |