DETalk to us →
ClusterPilot Docs
v0.0.1 RC · fcc5871
Start with:EvaluateInstallCreate a clusterOperateRecoverAutomate
Documentation/Administer
Administer · v0.0.1

Complete Helm configuration reference

Search every schema-backed v0.0.1 Helm value and understand the production-critical settings.

AudienceInstallers · platform administratorsReading timeReferenceCommands in contextNo terminal requiredReviewed sourcefcc5871 · 30 July 2026
RC

Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.

Configuration rules

  • ✓
    Render and review effective values before every install or upgrade
  • ✓
    Use Kubernetes Secret references for database, master key, S3 and agent bootstrap material
  • ✓
    Keep chart and runtime replica counts consistent
  • ✓
    Treat production startup validation as a safety control, not an obstacle
  • ✓
    Preserve the exact values, chart digest and release identity with the change record

Schema-backed values

134 of 134 schema-backed Helm values

global.registry.hostImages & registry

Schema-backed setting. Review the release values file and rendered output before applying an override.

global.registry.repositoryPrefixImages & registry

Schema-backed setting. Review the release values file and rendered output before applying an override.

global.imagePullSecretsImages & registry

Schema-backed setting. Review the release values file and rendered output before applying an override.

podSecurityStandards.enabledPod & network security

Schema-backed setting. Review the release values file and rendered output before applying an override.

podSecurityStandards.enforcePod & network security

Schema-backed setting. Review the release values file and rendered output before applying an override.

podSecurityStandards.auditPod & network security

Schema-backed setting. Review the release values file and rendered output before applying an override.

podSecurityStandards.warnPod & network security

Schema-backed setting. Review the release values file and rendered output before applying an override.

podSecurityStandards.additionalLabelsPod & network security

Schema-backed setting. Review the release values file and rendered output before applying an override.

networkPolicy.enabledPod & network security

Schema-backed setting. Review the release values file and rendered output before applying an override.

networkPolicy.api.ingressFromPod & network security

Schema-backed setting. Review the release values file and rendered output before applying an override.

networkPolicy.agent.ingressFromPod & network security

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.replicaCountAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.imageAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.serviceAccount.createAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.serviceAccount.nameAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.serviceAccount.annotationsAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.podAnnotationsAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.podLabelsAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.podSecurityContextAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.containerSecurityContextAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.resourcesAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.nodeSelectorAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.tolerationsAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.affinityAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.topologySpreadConstraintsAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.priorityClassNameAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.service.typeService & ingress

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.service.portService & ingress

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.service.annotationsService & ingress

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.ingress.enabledService & ingress

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.ingress.classNameService & ingress

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.ingress.annotationsService & ingress

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.ingress.hostsService & ingress

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.ingress.tlsService & ingress

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.pdb.enabledAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.pdb.minAvailableAPI workload

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.startupProbe.pathHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.startupProbe.periodSecondsHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.startupProbe.timeoutSecondsHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.startupProbe.failureThresholdHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.readinessProbe.pathHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.readinessProbe.periodSecondsHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.readinessProbe.timeoutSecondsHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.readinessProbe.failureThresholdHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.livenessProbe.portHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.livenessProbe.periodSecondsHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.livenessProbe.timeoutSecondsHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.livenessProbe.failureThresholdHealth probes

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.leaderElection.enabledRuntime

Required when API or worker replicas are greater than one.

api.runtime.leaderElection.retryIntervalSecondsRuntime

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.database.autoMigrateOnStartupDatabase

Keep false in production unless startup migration is an explicit operational decision.

api.runtime.database.migrationTimeoutSecondsDatabase

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.database.secretRefDatabase

Required. Reference a Secret containing the durable PostgreSQL connection string.

api.runtime.artifactStorage.providerArtifact storage

Required: filesystem or s3-compatible.

api.runtime.artifactStorage.filesystem.createPersistentVolumeClaimArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.filesystem.existingClaimArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.filesystem.sharedArtifact storage

Required when filesystem artifacts are used by more than one API or worker replica.

api.runtime.artifactStorage.filesystem.accessModesArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.filesystem.sizeArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.filesystem.storageClassNameArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.filesystem.rootPathArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.s3.serviceUrlArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.s3.regionArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.s3.bucketArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.s3.keyPrefixArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.s3.serverSideEncryptionArtifact storage

Required for S3-compatible storage: sse-s3 or sse-kms.

api.runtime.artifactStorage.s3.kmsKeyIdArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.s3.accessKeySecretRefArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.s3.secretKeySecretRefArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.requestTimeoutSecondsArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.maxRetriesArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.temporaryObjectRetentionSecondsArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.maxTotalStorageBytesArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.artifactStorage.reconciliationIntervalMinutesArtifact storage

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.operations.backupVerificationBlobSampleSizeRuntime

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.kubernetesOperations.featureFlags.enabledKubernetes operations

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.kubernetesOperations.featureFlags.readEnabledKubernetes operations

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.kubernetesOperations.featureFlags.mutationsEnabledKubernetes operations

Must remain false in v0.0.1; the built-in gateway is read-only.

api.runtime.kubernetesOperations.featureFlags.logsEnabledKubernetes operations

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.kubernetesOperations.featureFlags.execEnabledKubernetes operations

Must remain false in v0.0.1; no capable session gateway ships.

api.runtime.kubernetesOperations.featureFlags.portForwardEnabledKubernetes operations

Must remain false in v0.0.1; no capable session gateway ships.

api.runtime.kubernetesOperations.featureFlags.helmEnabledKubernetes operations

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.kubernetesOperations.featureFlags.helmMutationsEnabledKubernetes operations

Must remain false in v0.0.1.

api.runtime.kubernetesOperations.featureFlags.rbacAdminEnabledKubernetes operations

Must remain false in v0.0.1.

api.runtime.kubernetesOperations.featureFlags.secretWriteEnabledKubernetes operations

Must remain false in v0.0.1.

api.runtime.kubernetesOperations.gatewayTimeoutSecondsKubernetes operations

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.kubernetesOperations.agentGatewayEnabledKubernetes operations

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.kubernetesOperations.agentDispatchTimeoutSecondsKubernetes operations

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.secretMaterial.sourceModeSecrets

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.secretMaterial.supportsExternalSecretManagerInjectionSecrets

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.secretMaterial.supportsDirectExternalSecretManagerPullSecrets

Must remain false. External secret managers are operator-managed injection sources.

api.runtime.releaseMetadata.backendVersionRelease metadata

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.releaseMetadata.frontendVersionRelease metadata

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.releaseArtifacts.mirrorMetadataPathRelease metadata

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.releaseArtifacts.mirrorSyncEnforcementModeRelease metadata

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.releaseArtifacts.mirrorSyncFreshnessWarningHoursRelease metadata

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.releaseArtifacts.mirrorSyncFreshnessFailureHoursRelease metadata

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.conformanceRelease.allowPreSupportedCatalogSelectionRuntime

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.conformanceRelease.candidateCommitShaRuntime

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.buildMetadata.existingSecretRef.nameBuild identity

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.buildMetadata.existingSecretRef.optionalBuild identity

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.buildMetadata.versionBuild identity

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.buildMetadata.commitShaBuild identity

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.buildMetadata.buildTimestampUtcBuild identity

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.buildMetadata.sbomUrlBuild identity

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.buildMetadata.provenanceUrlBuild identity

Schema-backed setting. Review the release values file and rendered output before applying an override.

api.runtime.secrets.masterKeySecretRefSecrets

Required. Reference a base64-encoded 32-byte customer-managed protection key.

api.runtime.secrets.keyIdSecrets

Required and must not be local-dev outside development.

api.runtime.secrets.previousMasterKeysSecrets

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.enabledAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.imageAgent

Required digest-pinned clusterpilot-agent image; tag-only references are unsupported.

agent.serviceAccount.createAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.serviceAccount.nameAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.serviceAccount.annotationsAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.podAnnotationsAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.podLabelsAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.podSecurityContextAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.containerSecurityContextAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.resourcesAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.nodeSelectorAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.tolerationsAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.affinityAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.topologySpreadConstraintsAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.priorityClassNameAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.backendUrlAgent

Required reachable HTTPS control-plane URL.

agent.bootstrapTokenSecretRefAgent

Required for initial registration; keep token material out of values and logs.

agent.trustedCaSecretRef.nameAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.trustedCaSecretRef.keyAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.proxyUrlAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.noProxyAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.insecureSkipTlsVerifyAgent

Unsupported for production. Install the approved trust chain instead.

agent.healthBindAddressAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.healthPortAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

agent.logLevelAgent

Schema-backed setting. Review the release values file and rendered output before applying an override.

Production-critical environment keys

Runtime keyRequirement
ConnectionStrings__ClusterPilotRequired durable PostgreSQL connection
Hosting__ApiReplicas / Hosting__WorkerReplicasSet to actual placement counts
ControlPlane__LeaderElection__Enabledtrue when either replica count is greater than one
ArtifactStorage__Providerfilesystem or s3-compatible
Secrets__Protection__MasterKeyBase64-encoded 32-byte key
Secrets__Protection__KeyIdManaged key identity; not local-dev
Secrets__Protection__AllowInsecureDevelopmentFallbackfalse in Preprod and Production
Database__AutoMigrateOnStartupfalse recommended for controlled production migration

Flags that must remain off