Helm Values Reference

These are the settings you can put in your values file, with their defaults. Set a key in your values file to override its default; anything you leave out keeps the default shown here. The platform guides start from a values file with the validated settings for each platform: RKE2, kubeadm and OpenShift / OKD.

The same list, for the chart version you install, is in the chart: helm show values <install-dir>/charts/<version>-<build>/aisec (the chart directory from the installation guide) prints every setting with its comments.

Release and namespace

Key	Type	Description	Default
nameOverride	string	Override the release-name-derived resource name prefix	""
deployTimestamp	string	Set to force a rollout on helm upgrade even when the rendered spec is otherwise unchanged	"" (no annotation rendered, no effect)
namespaceOverride	string	Override the namespace for all chart resources; leave empty to use -n <ns> from the helm command	""
namespace.create	bool	Let the chart create and own the release namespace	false
namespace.podSecurity.enforce	string	Pod Security Standard enforce level applied to the namespace	"restricted"
namespace.podSecurity.audit	string	Pod Security Standard audit level applied to the namespace	"restricted"
namespace.podSecurity.warn	string	Pod Security Standard warn level applied to the namespace	"restricted"

Storage

Key	Type	Description	Default
storage.createStorageClass	bool	Create a local-path-retain StorageClass (reclaimPolicy: Retain) for clusters without one	true
storage.className	string	StorageClass name used by all PVCs unless overridden per-component	"local-path-retain"

Defaults for all product pods

Key	Type	Description	Default
default.labels	object	Extra labels applied to every chart-managed resource	{}
default.image.registry	string	Registry for the AISec app images (console, extraction, classify, lc)	"northamerica-northeast2-docker.pkg.dev/superna-579/oci/aisecurity"
default.image.pullPolicy	string	Image pull policy for the AISec app images	"IfNotPresent"
default.image.pullSecrets	list	Image pull secrets for the AISec app images	[]
default.readOnlyRootFilesystem	bool	Mount every container's root filesystem read-only; validate per image before enabling	false
default.podSecurityContext.runAsNonRoot	bool	Require containers to run as a non-root user	true
default.podSecurityContext.runAsUser	int	User ID containers run as — keep pinned on every platform, including OpenShift	1000
default.podSecurityContext.runAsGroup	int	Group ID containers run as — keep pinned on every platform, including OpenShift	1000
default.podSecurityContext.fsGroup	int	Group ID that owns mounted volumes — keep pinned on every platform, including OpenShift	1000
default.podSecurityContext.seccompProfile.type	string	Seccomp profile type applied to the pod	"RuntimeDefault"

Image registry credentials

Key	Type	Description	Default
imageRegistry.createPullSecret	bool	Generate an imagePullSecret and attach it to every pod	false
imageRegistry.server	string	Private registry hostname	""
imageRegistry.username	string	Registry username	""
imageRegistry.password	string	Registry password	""
imageRegistry.email	string	Registry account email (required by the dockerconfigjson format)	""

Console

Key	Type	Description	Default
console.extraEnv	object	Arbitrary extra env vars rendered into the console ConfigMap (e.g. future feature flags) — lets a values override expose a new console env var without a chart template change.	{}
console.image.name	string	Console image repository	"aisec-console"
console.image.tag	string	Console image tag	"1.0.0"
console.image.digest	string	Console image digest ("sha256:..."); takes priority over tag when set	""
console.initImage.registry	string	Registry for the init-container image; a public image, does not use default.image.registry	"docker.io"
console.initImage.name	string	Init-container image repository	"library/busybox"
console.initImage.tag	string	Init-container image tag	"1.37"
console.service.type	string	Console Service type — ClusterIP+Ingress is the only supported path	"ClusterIP"
console.service.httpPort	int	Console UI + REST API port	8081
console.service.healthPort	int	Dedicated health-connector port	8082
console.service.nodePort	int	NodePort used only when service.type is NodePort (valid range 30000-32767)	30081
console.service.loadBalancerIP	string	Static IP used only when service.type is LoadBalancer (MetalLB/cloud)	""
console.heap.initial	string	JVM initial heap size (JAVA_HEAP_INITIAL)	"512m"
console.heap.max	string	JVM max heap size (JAVA_HEAP_MAX); keep console.resources.limits.memory well above this for JVM overhead	"8g"
console.resources.requests	object	Console container resource requests	{"cpu":"500m","memory":"1Gi"}
console.resources.limits	object	Console container resource limits; leave headroom above heap.max for JVM overhead	{"memory":"12Gi"}
console.persistence.size	string	Size of the console's /data PVC (keystores, settings, agent keys, reports)	"10Gi"
console.persistence.storageClass	string	StorageClass for the console PVC; falls back to storage.className when empty	""
console.auditWorkspace.sizeLimit	string	Size limit of the console's ephemeral audit scratch volume (emptyDir)	"5Gi"
console.probes.path	string	HTTP path used by the startup, readiness, and liveness probes below	"/api/version"
console.probes.startup	object	Startup probe timing (periodSeconds, failureThreshold) — covers JVM + application warmup	{"failureThreshold":12,"periodSeconds":10}
console.probes.readiness	object	Readiness probe timing (initialDelaySeconds, periodSeconds, failureThreshold)	{"failureThreshold":3,"initialDelaySeconds":20,"periodSeconds":10}
console.probes.liveness	object	Liveness probe timing (initialDelaySeconds, periodSeconds, failureThreshold)	{"failureThreshold":5,"initialDelaySeconds":45,"periodSeconds":30}

Pipeline agents

Key	Type	Description	Default
pipeline.waitForConsole	bool	Add a wait-for-console init container to all agent pods that polls /api/version before the agent starts, avoiding a restart loop on fresh installs where agents start before the console HTTP endpoint is ready	true
pipeline.terminationGracePeriodSeconds	int	Grace period (seconds) for pod shutdown; must be long enough for the preStop hook (deregisters the agent from the console) to complete before SIGTERM is sent	30
pipeline.commonEnv.AGENT_LOG_LEVEL	string	Log level applied to every pipeline agent	"INFO"
pipeline.commonEnv.WORKER_COUNT	string	Worker thread/process count applied to every pipeline agent	"4"
pipeline.stages.extraction.enabled	bool	Enable the extraction agent stage	true
pipeline.stages.extraction.workload	string	StatefulSet so the per-pod PVC persists the agent's minted token across restarts	"StatefulSet"
pipeline.stages.extraction.replicas	int	Extraction agent replica count	1
pipeline.stages.extraction.image.name	string	Extraction agent image repository	"extraction-agent"
pipeline.stages.extraction.image.tag	string	Extraction agent image tag	"1.0.0"
pipeline.stages.extraction.image.digest	string	Extraction agent image digest ("sha256:..."); takes priority over tag when set	""
pipeline.stages.extraction.resources.requests	object	Extraction agent resource requests	{"cpu":"500m","memory":"512Mi"}
pipeline.stages.extraction.resources.limits	object	Extraction agent resource limits	{"memory":"2Gi"}
pipeline.stages.extraction.persistence.size	string	Size of the extraction agent's per-pod PVC (/var/lib/argus — agent token + state)	"1Gi"
pipeline.stages.extraction.persistence.storageClass	string	StorageClass for the extraction agent PVC; falls back to storage.className when empty	""
pipeline.stages.extraction.ports	list	Ports exposed by the extraction agent: agent ingress (9101), in-pod Tika (9998), metrics (9100)	[9100,9101,9998]
pipeline.stages.extraction.agentKey	string	Pre-minted agent token; leave empty for self-enrollment via the shared enrollment token	""
pipeline.stages.extraction.env.AGENT_STAGE	string	Pipeline stage identifier reported by this agent	"extraction"
pipeline.stages.extraction.env.AGENT_MAX_CONCURRENT_JOBS	string	Maximum concurrent extraction jobs per pod	"4"
pipeline.stages.extraction.probe	object	Startup/health probe: TCP check on the agent ingress port, which only opens once Tika is ready; startupFailureThreshold covers slow/CPU-starved dev environments	{"port":9101,"startupFailureThreshold":60,"type":"tcp"}
pipeline.stages.extraction.scratch.enabled	bool	Enable the ephemeral processing scratch volume	true
pipeline.stages.extraction.scratch.type	string	Scratch volume type — emptyDir, or pvc for large ingest volumes	"emptyDir"
pipeline.stages.extraction.scratch.sizeLimit	string	Scratch volume size limit	"10Gi"
pipeline.stages.extraction.scratch.paths[0]	string	Tika fork watchdog scratch (java.io.tmpdir)	"/tmp/tika-scratch"
pipeline.stages.extraction.scratch.paths[1]	string	Pipeline file staging + tmpjanitor sweep target	"/tmp/argus-pipeline"
pipeline.stages.classify.enabled	bool	Enable the classify agent stage	true
pipeline.stages.classify.workload	string	StatefulSet so the per-pod PVC persists the agent's minted token across restarts	"StatefulSet"
pipeline.stages.classify.replicas	int	Classify agent replica count	2
pipeline.stages.classify.image.name	string	Classify agent image repository	"classify-agent"
pipeline.stages.classify.image.tag	string	Classify agent image tag	"1.0.0"
pipeline.stages.classify.image.digest	string	Classify agent image digest ("sha256:..."); takes priority over tag when set	""
pipeline.stages.classify.resources.requests	object	Classify agent resource requests	{"cpu":"1","memory":"2Gi"}
pipeline.stages.classify.resources.limits	object	Classify agent resource limits	{"memory":"10Gi"}
pipeline.stages.classify.persistence.size	string	Size of the classify agent's per-pod PVC (/var/lib/argus — agent token + state)	"1Gi"
pipeline.stages.classify.persistence.storageClass	string	StorageClass for the classify agent PVC; falls back to storage.className when empty	""
pipeline.stages.classify.ports	list	Ports exposed by the classify agent: agent ingress (9101), uvicorn classify API (5012), metrics (9100)	[9100,9101,5012]
pipeline.stages.classify.agentKey	string	Pre-minted agent token; leave empty for self-enrollment via the shared enrollment token	""
pipeline.stages.classify.env.AGENT_STAGE	string	Pipeline stage identifier reported by this agent	"classify"
pipeline.stages.classify.env.AGENT_MAX_CONCURRENT_JOBS	string	Maximum concurrent classify jobs per pod	"2"
pipeline.stages.classify.probe	object	Health probe: HTTP POST to /classify; startupFailureThreshold covers Presidio model load (~60s)	{"body":"{\"text\":\"healthcheck\",\"threshold\":0.5}","path":"/classify","port":5012,"startupFailureThreshold":8,"type":"httpPost"}
pipeline.stages.classify.scratch.enabled	bool	Enable the ephemeral processing scratch volume	true
pipeline.stages.classify.scratch.type	string	Scratch volume type — emptyDir, or pvc for large ingest volumes	"emptyDir"
pipeline.stages.classify.scratch.sizeLimit	string	Scratch volume size limit	"4Gi"
pipeline.stages.classify.scratch.paths[0]	string	Pipeline file staging + tmpjanitor sweep target	"/tmp/argus-pipeline"
pipeline.stages.lc.enabled	bool	Enable the linguistic-coherence (lc) agent stage	true
pipeline.stages.lc.workload	string	StatefulSet so the per-pod PVC persists the agent's minted token across restarts	"StatefulSet"
pipeline.stages.lc.replicas	int	LC agent replica count	2
pipeline.stages.lc.image.name	string	LC agent image repository	"lc-agent"
pipeline.stages.lc.image.tag	string	LC agent image tag	"1.0.0"
pipeline.stages.lc.image.digest	string	LC agent image digest ("sha256:..."); takes priority over tag when set	""
pipeline.stages.lc.resources.requests	object	LC agent resource requests	{"cpu":"4","memory":"12Gi"}
pipeline.stages.lc.resources.limits	object	LC agent resource limits — large multi-chunk documents need headroom for the transient scoring memory peak	{"memory":"12Gi"}
pipeline.stages.lc.persistence.size	string	Size of the LC agent's per-pod PVC (/var/lib/argus — agent token + state)	"1Gi"
pipeline.stages.lc.persistence.storageClass	string	StorageClass for the LC agent PVC; falls back to storage.className when empty	""
pipeline.stages.lc.ports	list	Ports exposed by the LC agent: agent ingress (9101), uvicorn lc API (5019), metrics (9100)	[9100,9101,5019]
pipeline.stages.lc.agentKey	string	Pre-minted agent token; leave empty for self-enrollment via the shared enrollment token	""
pipeline.stages.lc.env.AGENT_STAGE	string	Pipeline stage identifier reported by this agent	"lc"
pipeline.stages.lc.env.AGENT_MAX_CONCURRENT_JOBS	string	Maximum concurrent lc jobs per pod	"2"
pipeline.stages.lc.env.LC_APP_MAX_CONCURRENCY	string	Maximum concurrent requests the lc application itself will process	"2"
pipeline.stages.lc.env.LC_INTERNAL_PARALLELISM	string	Internal model parallelism within a single lc request	"3"
pipeline.stages.lc.probe	object	Health probe: HTTP POST to /analyze/text; startupFailureThreshold covers HF model load (~120s)	{"body":"{\"text\":\"healthcheck\",\"filename\":\"hc.txt\",\"mime_type\":\"text/plain\"}","path":"/analyze/text","port":5019,"startupFailureThreshold":16,"type":"httpPost"}
pipeline.stages.lc.scratch.enabled	bool	Enable the ephemeral processing scratch volume	true
pipeline.stages.lc.scratch.type	string	Scratch volume type — emptyDir, or pvc for large ingest volumes	"emptyDir"
pipeline.stages.lc.scratch.sizeLimit	string	Scratch volume size limit	"4Gi"
pipeline.stages.lc.scratch.paths[0]	string	Pipeline file staging + tmpjanitor sweep target	"/tmp/argus-pipeline"

PostgreSQL

Key	Type	Description	Default
postgres.enabled	bool	Enable the bundled Postgres cluster (CloudNativePG)	true
postgres.database	string	Postgres database name	"aisec"
postgres.owner	string	Postgres database owner role	"aisec"
postgres.instances	int	Number of Postgres instances (CNPG HA) — needs 3 worker nodes for real HA	1
postgres.image.registry	string	Postgres image registry; set explicitly so this doesn't fall back to default.image.registry	"ghcr.io/cloudnative-pg"
postgres.image.name	string	Postgres image repository	"postgresql"
postgres.image.tag	string	Postgres image tag — pinned to a fixed, known version instead of CNPG's own auto-selected default	"17.10"
postgres.image.digest	string	Postgres image digest ("sha256:..."); takes priority over tag when set	""
postgres.storage.size	string	Size of the Postgres data PVC	"100Gi"
postgres.storage.storageClass	string	StorageClass for the Postgres PVC; falls back to storage.className when empty	""
postgres.resources.requests	object	Postgres container resource requests	{"cpu":"250m","memory":"512Mi"}
postgres.resources.limits	object	Postgres container resource limits	{"cpu":"1","memory":"1Gi"}

ClickHouse

Key	Type	Description	Default
clickhouse.enabled	bool	Enable the bundled ClickHouse installation (Altinity operator)	true
clickhouse.httpPort	int	ClickHouse HTTP port	8123
clickhouse.user	string	ClickHouse username	"aisec"
clickhouse.database	string	ClickHouse database name	"aisec"
clickhouse.image.registry	string	Registry for the ClickHouse image; a public image, does not use default.image.registry	"docker.io"
clickhouse.image.name	string	ClickHouse image repository	"clickhouse/clickhouse-server"
clickhouse.image.tag	string	ClickHouse image tag — pinned to the 26.3 LTS branch's latest patch	"26.3.10.62"
clickhouse.image.digest	string	ClickHouse image digest ("sha256:..."); takes priority over tag when set	""
clickhouse.storage.size	string	Size of the ClickHouse data PVC	"500Gi"
clickhouse.storage.storageClass	string	StorageClass for the ClickHouse PVC; falls back to storage.className when empty	""
clickhouse.resources.requests	object	ClickHouse container resource requests	{"cpu":"2","memory":"8Gi"}
clickhouse.resources.limits	object	ClickHouse container resource limits	{"cpu":"4","memory":"48Gi"}
clickhouse.shardsCount	int	Number of ClickHouse shards	1
clickhouse.retentionConfig	bool	System-log retention config (files/clickhouse/), injected into the CHI — caps unbounded system._log growth via logger=warning + TTLs on the system tables	true
clickhouse.podSecurityContext.runAsUser	int	User ID the ClickHouse container runs as — keep pinned on every platform, including OpenShift	101
clickhouse.podSecurityContext.runAsGroup	int	Group ID the ClickHouse container runs as — keep pinned on every platform, including OpenShift	101
clickhouse.podSecurityContext.fsGroup	int	Group ID that owns the ClickHouse data volume — keep pinned on every platform, including OpenShift	101

Exposing the console (Ingress and Route)

Key	Type	Description	Default
ingress.enabled	bool	Enable the console Ingress. On OpenShift, either this (with className: openshift-default, relying on the ingress-to-route sync controller) or route.enabled below works — both confirmed live, see K8S-INSTALL-GUIDE.md's OpenShift section	true
ingress.className	string	Ingress class: "nginx", "haproxy", "openshift-default" (OpenShift's ingress-to-route sync), or any custom class	""
ingress.host	string	Console hostname	"aisec.local"
ingress.path	string	Ingress path	"/"
ingress.annotations	object	Extra annotations, merged last — always wins over controllerDefaults below	{}
ingress.tls.enabled	bool	Enable TLS on the Ingress	true
ingress.tls.secretName	string	TLS secret name; auto-generated when tls.generate is true	"<fullname>-tls" (when tls.generate is true)
ingress.tls.generate	bool	Generate a self-signed TLS certificate at install time (no cert-manager needed); the certificate is preserved across upgrades so browsers don't see a new cert each time	true
ingress.tls.forceRedirect	bool	Inject an ssl-redirect annotation automatically when tls.enabled is true	true
ingress.controllerDefaults.nginx."nginx.ingress.kubernetes.io/proxy-body-size"	string	Maximum request body size accepted by the ingress-nginx controller	"100m"
ingress.controllerDefaults.nginx."nginx.ingress.kubernetes.io/proxy-read-timeout"	string	Upstream read timeout (seconds) for the ingress-nginx controller	"3600"
ingress.controllerDefaults.nginx."nginx.ingress.kubernetes.io/proxy-send-timeout"	string	Upstream send timeout (seconds) for the ingress-nginx controller	"3600"
ingress.controllerDefaults.haproxy."haproxy.org/client-max-body-size"	string	Maximum request body size accepted by the HAProxy Technologies controller	"100m"
ingress.controllerDefaults.haproxy."haproxy.org/timeout-client"	string	Client timeout for the HAProxy Technologies controller	"3600s"
ingress.controllerDefaults.haproxy."haproxy.org/timeout-server"	string	Server timeout for the HAProxy Technologies controller	"3600s"
route.enabled	bool	Enable an OpenShift Route; set this true AND ingress.enabled false together on OpenShift	false
route.host	string	Console hostname for the Route	""
route.tls.termination	string	Route TLS termination mode: edge, passthrough, or reencrypt	"edge"
route.tls.insecureEdgeTerminationPolicy	string	HTTP-to-HTTPS behavior — Redirect, or None to allow plain HTTP	"Redirect"

Secrets

Key	Type	Description	Default
secrets.create	bool	Let the chart create its Secrets; set false when supplying your own (External Secrets, sealed-secrets)	true
secrets.postgres.username	string	Postgres username	"aisec"
secrets.postgres.password	string	Postgres password	auto-generated (randAlphaNum) if left empty
secrets.clickhouse.password	string	ClickHouse password	auto-generated (randAlphaNum) if left empty
secrets.enrollmentToken	string	Per-customer agent enrollment token, presented by every agent on first boot	auto-generated (unique per install) if left empty
secrets.agentKek	string	Per-install key-encryption-key used to encrypt each agent's cached token at rest	auto-generated (unique per install) if left empty
secrets.attestationKey	string	Shared secret for AI support bot attestation; left empty disables attestation signing entirely	""

Operators

Key	Type	Description	Default
operators.cnpg.install	bool	Deploy the bundled CloudNativePG controller (CRD: postgresql.cnpg.io/v1)	true
operators.clickhouse.install	bool	Deploy the bundled Altinity ClickHouse operator (CRD: clickhouse.altinity.com/v1)	true
cloudnative-pg.image.repository	string	CloudNativePG operator image repository (full path, registry included)	"ghcr.io/cloudnative-pg/cloudnative-pg"
cloudnative-pg.image.tag	string	CloudNativePG operator image tag	"1.30.0"
cloudnative-pg.config.clusterWide	bool	Let the CNPG operator watch every namespace on the cluster instead of just this release's own	false
altinity-clickhouse-operator.operator.image.registry	string	Optional registry prefix for the Altinity operator image; empty uses Docker Hub directly	""
altinity-clickhouse-operator.operator.image.repository	string	Altinity ClickHouse operator image repository	"altinity/clickhouse-operator"
altinity-clickhouse-operator.operator.image.tag	string	Altinity ClickHouse operator image tag	"0.27.1"
altinity-clickhouse-operator.metrics.image.registry	string	Optional registry prefix for the Altinity metrics-exporter image; empty uses Docker Hub directly	""
altinity-clickhouse-operator.metrics.image.repository	string	Altinity metrics-exporter sidecar image repository	"altinity/metrics-exporter"
altinity-clickhouse-operator.metrics.image.tag	string	Altinity metrics-exporter sidecar image tag	"0.27.1"

Availability and scheduling

Key	Type	Description	Default
podDisruptionBudget.enabled	bool	Create a PodDisruptionBudget for every workload with replicas > 1	true
podDisruptionBudget.minAvailable	int	Minimum available pods to maintain during a voluntary disruption	1
topologySpread.enabled	bool	Add a hostname topologySpreadConstraint per multi-replica agent stage	false
scheduling.nodeSelector	object	Node selector applied to all workloads	{}
scheduling.affinity	object	Affinity rules applied to all workloads (only nodeAffinity reaches Postgres/ClickHouse)	{}
scheduling.tolerations	list	Tolerations applied to all workloads	[]

Network policy

Key	Type	Description	Default
networkPolicy.enabled	bool	Enable default-deny NetworkPolicies plus the explicit allows below	false
networkPolicy.dnsNamespace	string	Namespace where CoreDNS runs; egress :53 is allowed to it from all pods	"kube-system"
networkPolicy.ingressControllerNamespace	string	Ingress controller namespace, allowed to reach console :8081; empty allows :8081 from ANY namespace	""
networkPolicy.dataTierOperatorNamespaces	list	CNPG + Altinity operator namespaces, allowed to reach Postgres/ClickHouse (e.g. ["cnpg-system", "kube-system"])	[]
networkPolicy.apiServerCidrs	list	Kubernetes API server IPs, allowed for the console's cluster-scan egress	["0.0.0.0/0"]
networkPolicy.consoleExternal.cidrs	list	CIDRs the console is allowed to reach externally (PowerScale/ECS mgmt, CVE feeds)	["0.0.0.0/0"]
networkPolicy.consoleExternal.ports	list	Ports the console is allowed to reach externally	[443,4443]
networkPolicy.extraction.sftpCidrs	list	CIDRs the extraction agent is allowed to reach over SFTP (PowerScale data interface)	["0.0.0.0/0"]
networkPolicy.extraction.sftpPort	int	SFTP port	22
networkPolicy.extraction.s3Cidrs	list	CIDRs the extraction agent is allowed to reach over S3 (ECS/ObjectScale endpoint)	["0.0.0.0/0"]
networkPolicy.extraction.s3Ports	list	S3 ports	[443,9020,9021]

Service account and RBAC

Key	Type	Description	Default
serviceAccount.create	bool	Create a ServiceAccount for the console	true
serviceAccount.name	string	ServiceAccount name override	"<fullname>-console"
serviceAccount.annotations	object	Extra annotations for the ServiceAccount	{}
rbac.create	bool	Create the console's ClusterRole/ClusterRoleBinding (needed for cluster scanning)	true