diff --git a/docs/ai/sre-agent.mdx b/docs/ai/sre-agent.mdx index 73ad604a..bab1fa64 100644 --- a/docs/ai/sre-agent.mdx +++ b/docs/ai/sre-agent.mdx @@ -101,12 +101,12 @@ Configure `rcaAgentURL` in the `ClusterObservabilityPlane` resource so the UI kn Check that the SRE Agent pod is running: ```bash -kubectl get pods -n openchoreo-observability-plane -l app.kubernetes.io/component=ai-rca-agent +kubectl get pods -n openchoreo-observability-plane -l app.kubernetes.io/component=sre-agent ``` If you are using the default identity provider (ThunderID) and the default SQLite report storage, your setup is complete. -For a full, end-to-end walkthrough of setting up alerting with AI-powered root cause analysis, refer to the [URL Shortener sample](https://github.com/openchoreo/openchoreo/tree/main/samples/from-source/projects/url-shortener). +For a full, end-to-end walkthrough of setting up alerting with AI-powered root cause analysis, refer to the [URL Shortener sample](https://github.com/openchoreo/openchoreo/tree/main/samples/from-image/url-shortener).
Authentication and Authorization (External IdP) diff --git a/docs/reference/helm/control-plane.mdx b/docs/reference/helm/control-plane.mdx index 998ffaa8..67978513 100644 --- a/docs/reference/helm/control-plane.mdx +++ b/docs/reference/helm/control-plane.mdx @@ -8,208 +8,268 @@ sidebar_position: 1 Backstage UI configuration -| Parameter | Description | Type | Default | -| :-------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------- | :--------------------------------- | -| `backstage.affinity` | Affinity rules | `object` | `{}` | -| `backstage.auth.clientId` | OAuth client ID | `string` | `openchoreo-backstage-client` | -| `backstage.auth.redirectUrls` | OAuth redirect URLs | `array` | `[]` | -| `backstage.autoscaling.behavior.scaleDown.policies` | Scale-down policies | `array` | | -| `backstage.autoscaling.behavior.scaleDown.stabilizationWindowSeconds` | Stabilization window in seconds | `integer` | `300` | -| `backstage.autoscaling.behavior.scaleUp.policies` | Scale-up policies | `array` | | -| `backstage.autoscaling.behavior.scaleUp.selectPolicy` | Policy selection strategy | `string` | `Max` | -| `backstage.autoscaling.behavior.scaleUp.stabilizationWindowSeconds` | Stabilization window in seconds | `integer` | `0` | -| `backstage.autoscaling.enabled` | Enable HPA | `boolean` | `false` | -| `backstage.autoscaling.maxReplicas` | Maximum replicas | `integer` | `3` | -| `backstage.autoscaling.minReplicas` | Minimum replicas | `integer` | `1` | -| `backstage.autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization percentage | `integer` | `70` | -| `backstage.autoscaling.targetMemoryUtilizationPercentage` | Target memory utilization percentage | `integer` | `80` | -| `backstage.baseUrl` | Backstage public base URL | `string` | `http://openchoreo.invalid` | -| `backstage.containerSecurityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | -| `backstage.containerSecurityContext.appArmorProfile.type` | AppArmor profile type | `string` | `Unconfined` | -| `backstage.containerSecurityContext.capabilities.drop` | Capabilities to drop | `array` | | -| `backstage.containerSecurityContext.readOnlyRootFilesystem` | Read-only root filesystem | `boolean` | `false` | -| `backstage.containerSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | -| `backstage.database.postgresql.ssl` | Enable SSL for the PostgreSQL connection (sets PGSSLMODE=require) | `boolean` | `false` | -| `backstage.database.sqlite.mountPath` | Mount path for database directory inside container | `string` | `/app/.config/backstage` | -| `backstage.database.sqlite.persistence.accessMode` | PVC access mode | `string` | `ReadWriteOnce` | -| `backstage.database.sqlite.persistence.enabled` | Enable PVC for persistence (false = emptyDir) | `boolean` | `false` | -| `backstage.database.sqlite.persistence.size` | PVC storage size | `string` | `1Gi` | -| `backstage.database.sqlite.persistence.storageClassName` | Storage class name (empty = default storage class) | `string` | | -| `backstage.database.type` | Database type | `string` | `sqlite` | -| `backstage.enabled` | Enable Backstage UI deployment | `boolean` | `true` | -| `backstage.env` | Environment variables for the Backstage container | `array` | | -| `backstage.externalCI.jenkins.baseUrl` | Jenkins server base URL (e.g., https://jenkins.example.com) | `string` | | -| `backstage.externalCI.jenkins.enabled` | Enable Jenkins integration by injecting environment variables | `boolean` | `false` | -| `backstage.externalCI.jenkins.username` | Jenkins username for API authentication | `string` | | -| `backstage.extraEnv` | Additional environment variables to merge with the default env array. Use this instead of overriding backstage.env to avoid sparse array issues with --set. | `array` | | -| `backstage.features.auth.redirectFlow.enabled` | Enable experimental redirect flow - silently redirects to IDP instead of showing sign-in popup | `boolean` | `true` | -| `backstage.features.observability.enabled` | Enable Metrics, Traces, Runtime Logs tabs and RuntimeHealthCard in entity pages | `boolean` | `true` | -| `backstage.features.workflows.enabled` | Enable Workflows tab and WorkflowsOverviewCard in entity pages | `boolean` | `true` | -| `backstage.http.annotations` | HTTPRoute annotations | `object` | `{}` | -| `backstage.http.enabled` | Enable HTTPRoute | `boolean` | `true` | -| `backstage.http.hostnames` | HTTPRoute hostnames | `array` | `["openchoreo.invalid"]` | -| `backstage.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | -| `backstage.image.repository` | Docker image repository | `string` | `ghcr.io/openchoreo/openchoreo-ui` | -| `backstage.image.tag` | Image tag. If empty, uses Chart.AppVersion | `string` | | -| `backstage.metrics.enabled` | Enable Prometheus metrics | `boolean` | `true` | -| `backstage.metrics.serviceMonitor.enabled` | Create ServiceMonitor resource | `boolean` | `false` | -| `backstage.metrics.serviceMonitor.interval` | Scrape interval | `string` | `30s` | -| `backstage.metrics.serviceMonitor.labels.prometheus` | | `string` | `kube-prometheus` | -| `backstage.metrics.serviceMonitor.namespace` | Namespace for ServiceMonitor | `string` | `monitoring` | -| `backstage.metrics.serviceMonitor.relabelings` | Metric relabeling rules | `array` | `[]` | -| `backstage.metrics.serviceMonitor.scrapeTimeout` | Scrape timeout | `string` | `10s` | -| `backstage.name` | Static name for all backstage resources (Service, Deployment, etc.) | `string` | `backstage` | -| `backstage.networkPolicy.egress` | Egress rules | `array` | `[]` | -| `backstage.networkPolicy.enabled` | Enable NetworkPolicy | `boolean` | `false` | -| `backstage.networkPolicy.ingress` | Ingress rules | `array` | `[]` | -| `backstage.nodeSelector` | Node selector | `object` | `{}` | -| `backstage.openchoreoApi.url` | OpenChoreo API URL. If empty, auto-derived from internal service | `string` | | -| `backstage.podDisruptionBudget.enabled` | Enable PDB | `boolean` | `false` | -| `backstage.podDisruptionBudget.minAvailable` | Minimum available pods | `integer` | `1` | -| `backstage.podSecurityContext.fsGroup` | Filesystem group | `integer` | `1000` | -| `backstage.podSecurityContext.runAsGroup` | Group ID | `integer` | `1000` | -| `backstage.podSecurityContext.runAsNonRoot` | Run as non-root user | `boolean` | `true` | -| `backstage.podSecurityContext.runAsUser` | User ID | `integer` | `1000` | -| `backstage.podSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | -| `backstage.priorityClass.create` | Create a priority class | `boolean` | `false` | -| `backstage.priorityClass.name` | Priority class name | `string` | `openchoreo-backstage` | -| `backstage.priorityClass.value` | Priority class value | `integer` | `800000` | -| `backstage.replicas` | Number of Backstage replicas | `integer` | `1` | -| `backstage.resources.limits.cpu` | CPU limit | `string` | `2000m` | -| `backstage.resources.limits.memory` | Memory limit | `string` | `2Gi` | -| `backstage.resources.requests.cpu` | CPU request | `string` | `200m` | -| `backstage.resources.requests.memory` | Memory request | `string` | `256Mi` | -| `backstage.secretName` | Name of a Secret containing backstage credentials. Required keys: backend-secret, client-secret, jenkins-api-key. When database.type=postgresql, also requires: postgres-host, postgres-port, postgres-user, postgres-password, postgres-db. | `string` | | -| `backstage.service.nodePort` | NodePort (only used if service.type is NodePort) | `integer,null` | `null` | -| `backstage.service.port` | Service port | `integer` | `7007` | -| `backstage.service.type` | Service type | `string` | `ClusterIP` | -| `backstage.serviceAccount.annotations` | Service account annotations | `object` | `{}` | -| `backstage.serviceAccount.name` | Service account name | `string` | `openchoreo-backstage` | -| `backstage.tls.enabled` | Enable TLS/HTTPS for Backstage | `boolean` | `false` | -| `backstage.tolerations` | Tolerations | `array` | `[]` | -| `backstage.topologySpreadConstraints` | Topology spread constraints | `array` | | +| Parameter | Description | Type | Default | +| :-------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------- | :--------------------------------- | +| `backstage.affinity` | Affinity rules | `object` | `{}` | +| `backstage.appConfig` | Arbitrary Backstage app-config YAML injected as an additional config overlay. When non-empty the chart renders a ConfigMap named <release>-backstage-extra-config, mounts it at /app/app-config.extra.yaml, and appends --config app-config.extra.yaml to the startup args automatically. This is the preferred mechanism for operator-specific Backstage configuration (auth, integrations, etc.) without requiring a custom container image. WARNING: Do not store secrets here — this value is rendered into a ConfigMap (plaintext). Use Kubernetes Secrets or existing Secret refs (e.g. via extraEnv secretKeyRef) instead. | `object` | `{}` | +| `backstage.auth.clientId` | OAuth client ID | `string` | `openchoreo-backstage-client` | +| `backstage.auth.oidcScope` | Space-separated OIDC scopes for the OIDC provider (e.g. 'openid profile email') | `string` | `openid profile email` | +| `backstage.auth.redirectUrls` | OAuth redirect URLs | `array` | `[]` | +| `backstage.auth.scope` | Space-separated scopes for the OpenChoreo service token authenticator (e.g. 'openid' or 'api://client-id/.default openid') | `string` | | +| `backstage.auth.serviceClientId` | OAuth client ID for background service tasks (Catalog Provider). Uses a dedicated client independent from the user sign-in client. Defaults to auth.clientId for backward compatibility. | `string` | | +| `backstage.auth.serviceClientSecretKey` | Key within backstage.secretName that holds the service client secret. Defaults to 'client-secret' (same key as the sign-in client) for backward compatibility. Set to a different key (e.g. 'service-client-secret') when using a dedicated service client credential stored separately in the Secret. | `string` | `client-secret` | +| `backstage.autoscaling.behavior.scaleDown.policies` | Scale-down policies | `array` | | +| `backstage.autoscaling.behavior.scaleDown.stabilizationWindowSeconds` | Stabilization window in seconds | `integer` | `300` | +| `backstage.autoscaling.behavior.scaleUp.policies` | Scale-up policies | `array` | | +| `backstage.autoscaling.behavior.scaleUp.selectPolicy` | Policy selection strategy | `string` | `Max` | +| `backstage.autoscaling.behavior.scaleUp.stabilizationWindowSeconds` | Stabilization window in seconds | `integer` | `0` | +| `backstage.autoscaling.enabled` | Enable HPA | `boolean` | `false` | +| `backstage.autoscaling.maxReplicas` | Maximum replicas | `integer` | `3` | +| `backstage.autoscaling.minReplicas` | Minimum replicas | `integer` | `1` | +| `backstage.autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization percentage | `integer` | `70` | +| `backstage.autoscaling.targetMemoryUtilizationPercentage` | Target memory utilization percentage | `integer` | `80` | +| `backstage.baseUrl` | Backstage public base URL | `string` | `http://openchoreo.invalid` | +| `backstage.catalogSync.frequency` | Frequency in seconds between periodic full syncs of the OpenChoreo catalog provider. With the event-forwarder enabled, this acts as a safety net for any events missed; with it disabled, this is the only sync mechanism and you may want a much smaller value (e.g. 60). | `integer` | `300` | +| `backstage.containerSecurityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | +| `backstage.containerSecurityContext.appArmorProfile.type` | AppArmor profile type | `string` | `Unconfined` | +| `backstage.containerSecurityContext.capabilities.drop` | Capabilities to drop | `array` | | +| `backstage.containerSecurityContext.readOnlyRootFilesystem` | Read-only root filesystem | `boolean` | `false` | +| `backstage.containerSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | +| `backstage.database.postgresql.ssl` | Enable SSL for the PostgreSQL connection (sets PGSSLMODE=require) | `boolean` | `false` | +| `backstage.database.sqlite.mountPath` | Mount path for database directory inside container | `string` | `/app/.config/backstage` | +| `backstage.database.sqlite.persistence.accessMode` | PVC access mode | `string` | `ReadWriteOnce` | +| `backstage.database.sqlite.persistence.enabled` | Enable PVC for persistence (false = emptyDir) | `boolean` | `false` | +| `backstage.database.sqlite.persistence.size` | PVC storage size | `string` | `1Gi` | +| `backstage.database.sqlite.persistence.storageClassName` | Storage class name (empty = default storage class) | `string` | | +| `backstage.database.type` | Database type | `string` | `sqlite` | +| `backstage.enabled` | Enable Backstage UI deployment | `boolean` | `true` | +| `backstage.env` | Environment variables for the Backstage container | `array` | | +| `backstage.externalCI.githubActions.apiBaseUrl` | GitHub API base URL. Leave empty for public GitHub (Backstage will derive `https://api.github.com` from the host). For GitHub Enterprise Server, set to `https://<host>/api/v3`. | `string` | | +| `backstage.externalCI.githubActions.enabled` | Enable GitHub Actions integration by injecting environment variables consumed by the Backstage GitHub integration | `boolean` | `false` | +| `backstage.externalCI.githubActions.host` | GitHub host. Use `github.com` for public GitHub or the hostname of your GitHub Enterprise Server (e.g., `ghe.example.com`). | `string` | `github.com` | +| `backstage.externalCI.githubActions.oauth.clientId` | GitHub OAuth App Client ID. When set, a `github` auth provider is registered so the GitHub Actions card can sign each user in via GitHub OAuth. The matching client secret must be provided via the Secret referenced by `backstage.secretName` under key `github-oauth-client-secret`. Leave empty to disable per-user GitHub sign-in. | `string` | | +| `backstage.externalCI.jenkins.baseUrl` | Jenkins server base URL (e.g., https://jenkins.example.com) | `string` | | +| `backstage.externalCI.jenkins.enabled` | Enable Jenkins integration by injecting environment variables | `boolean` | `false` | +| `backstage.externalCI.jenkins.username` | Jenkins username for API authentication | `string` | | +| `backstage.extraArgs` | Extra arguments appended to the Backstage node startup command after the built-in --config flags. Typically used to add additional --config <file> arguments for operator-provided app-config overlays. | `array` | `[]` | +| `backstage.extraEnv` | Additional environment variables to merge with the default env array. Use this instead of overriding backstage.env to avoid sparse array issues with --set. | `array` | | +| `backstage.extraVolumeMounts` | Extra volume mounts to add to the Backstage container. Use in conjunction with extraVolumes. | `array` | `[]` | +| `backstage.extraVolumes` | Extra volumes to add to the Backstage Pod. Follows standard Kubernetes volume spec. Use in conjunction with extraVolumeMounts to mount them into the container. | `array` | `[]` | +| `backstage.features.assistant.enabled` | Enable the Portal Assistant chat drawer + Logs-tab "Ask Portal Assistant" affordance. Maps to OPENCHOREO_FEATURES_ASSISTANT_ENABLED in the Backstage container. | `boolean` | `false` | +| `backstage.features.assistant.portalAssistantUrl` | Upstream URL the Backstage forwarder posts /chat and /warmup to. Leave empty to default to the in-cluster portal-assistant Service in the release namespace — override when the portal-assistant runs in a different cluster or namespace. Maps to OPENCHOREO_PORTAL_ASSISTANT_URL. | `string` | | +| `backstage.features.auth.redirectFlow.enabled` | Enable experimental redirect flow - silently redirects to IDP instead of showing sign-in popup | `boolean` | `true` | +| `backstage.features.observability.enabled` | Enable Metrics, Traces, Runtime Logs tabs and RuntimeHealthCard in entity pages | `boolean` | `true` | +| `backstage.features.workflows.enabled` | Enable Workflows tab and WorkflowsOverviewCard in entity pages | `boolean` | `true` | +| `backstage.http.annotations` | HTTPRoute annotations | `object` | `{}` | +| `backstage.http.enabled` | Enable HTTPRoute | `boolean` | `true` | +| `backstage.http.hostnames` | HTTPRoute hostnames | `array` | `["openchoreo.invalid"]` | +| `backstage.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | +| `backstage.image.repository` | Docker image repository | `string` | `ghcr.io/openchoreo/openchoreo-ui` | +| `backstage.image.tag` | Image tag. If empty, uses Chart.AppVersion | `string` | | +| `backstage.metrics.enabled` | Enable Prometheus metrics | `boolean` | `true` | +| `backstage.metrics.serviceMonitor.enabled` | Create ServiceMonitor resource | `boolean` | `false` | +| `backstage.metrics.serviceMonitor.interval` | Scrape interval | `string` | `30s` | +| `backstage.metrics.serviceMonitor.labels.prometheus` | | `string` | `kube-prometheus` | +| `backstage.metrics.serviceMonitor.namespace` | Namespace for ServiceMonitor | `string` | `monitoring` | +| `backstage.metrics.serviceMonitor.relabelings` | Metric relabeling rules | `array` | `[]` | +| `backstage.metrics.serviceMonitor.scrapeTimeout` | Scrape timeout | `string` | `10s` | +| `backstage.name` | Static name for all backstage resources (Service, Deployment, etc.) | `string` | `backstage` | +| `backstage.networkPolicy.egress` | Egress rules | `array` | `[]` | +| `backstage.networkPolicy.enabled` | Enable NetworkPolicy | `boolean` | `false` | +| `backstage.networkPolicy.ingress` | Ingress rules | `array` | `[]` | +| `backstage.nodeSelector` | Node selector | `object` | `{}` | +| `backstage.observability.wirelogs.streamTimeoutSeconds` | Hard cap in seconds on a single wirelogs SSE stream before the Backstage backend ends it. The UI shows soft warnings at ~1/3 and ~2/3 of this value and a toast when the server stops the stream. Maps to OPENCHOREO_OBSERVABILITY_WIRELOGS_STREAM_TIMEOUT_SECONDS in the Backstage container. | `integer` | `900` | +| `backstage.openchoreoApi.url` | OpenChoreo API URL. If empty, auto-derived from internal service | `string` | | +| `backstage.podDisruptionBudget.enabled` | Enable PDB | `boolean` | `false` | +| `backstage.podDisruptionBudget.minAvailable` | Minimum available pods | `integer` | `1` | +| `backstage.podSecurityContext.fsGroup` | Filesystem group | `integer` | `1000` | +| `backstage.podSecurityContext.runAsGroup` | Group ID | `integer` | `1000` | +| `backstage.podSecurityContext.runAsNonRoot` | Run as non-root user | `boolean` | `true` | +| `backstage.podSecurityContext.runAsUser` | User ID | `integer` | `1000` | +| `backstage.podSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | +| `backstage.priorityClass.create` | Create a priority class | `boolean` | `false` | +| `backstage.priorityClass.name` | Priority class name | `string` | `openchoreo-backstage` | +| `backstage.priorityClass.value` | Priority class value | `integer` | `800000` | +| `backstage.replicas` | Number of Backstage replicas | `integer` | `1` | +| `backstage.resources.limits.cpu` | CPU limit | `string` | `2000m` | +| `backstage.resources.limits.memory` | Memory limit | `string` | `2Gi` | +| `backstage.resources.requests.cpu` | CPU request | `string` | `200m` | +| `backstage.resources.requests.memory` | Memory request | `string` | `256Mi` | +| `backstage.secretName` | Name of a Secret containing backstage credentials. Required keys: backend-secret, client-secret, jenkins-api-key. Optional keys: github-actions-token (required when externalCI.githubActions.enabled=true), service-client-secret (if backstage.auth.serviceClientSecretKey is set to a different key). When database.type=postgresql, also requires: postgres-host, postgres-port, postgres-user, postgres-password, postgres-db. | `string` | | +| `backstage.service.nodePort` | NodePort (only used if service.type is NodePort) | `integer,null` | `null` | +| `backstage.service.port` | Service port | `integer` | `7007` | +| `backstage.service.type` | Service type | `string` | `ClusterIP` | +| `backstage.serviceAccount.annotations` | Service account annotations | `object` | `{}` | +| `backstage.serviceAccount.name` | Service account name | `string` | `openchoreo-backstage` | +| `backstage.tls.enabled` | Enable TLS/HTTPS for Backstage | `boolean` | `false` | +| `backstage.tolerations` | Tolerations | `array` | `[]` | +| `backstage.topologySpreadConstraints` | Topology spread constraints | `array` | | ## Cluster Gateway Cluster Gateway configuration - manages WebSocket connections from cluster agents -| Parameter | Description | Type | Default | -| :-------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------- | :----------------------------------- | -| `clusterGateway.affinity` | Affinity rules | `object` | `{}` | -| `clusterGateway.heartbeatInterval` | Heartbeat interval for agent connections | `string` | `30s` | -| `clusterGateway.heartbeatTimeout` | Heartbeat timeout for agent connections | `string` | `90s` | -| `clusterGateway.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | -| `clusterGateway.image.repository` | Docker image repository | `string` | `ghcr.io/openchoreo/cluster-gateway` | -| `clusterGateway.image.tag` | Image tag. If empty, uses Chart.AppVersion | `string` | | -| `clusterGateway.internalMtls.caSecretName` | Name of the secret holding the internal CA used to sign and verify internal API client certificates | `string` | `cluster-gateway-internal-ca` | -| `clusterGateway.internalMtls.clientCertDuration` | Internal API client certificate validity duration (90 days) | `string` | `2160h` | -| `clusterGateway.internalMtls.clientCertRenewBefore` | Internal API client certificate renewal threshold (15 days before expiry) | `string` | `360h` | -| `clusterGateway.internalMtls.enabled` | Require and verify client certificates on the cluster gateway internal API. Disabling this restores unauthenticated access to the internal API - for development only. | `boolean` | `true` | -| `clusterGateway.logLevel` | Log level | `string` | `info` | -| `clusterGateway.name` | Name of the cluster gateway deployment | `string` | `cluster-gateway` | -| `clusterGateway.nodeSelector` | Node selector | `object` | `{}` | -| `clusterGateway.podSecurityContext.fsGroup` | Filesystem group | `integer` | `1000` | -| `clusterGateway.podSecurityContext.runAsNonRoot` | Run as non-root user | `boolean` | `true` | -| `clusterGateway.podSecurityContext.runAsUser` | User ID | `integer` | `1000` | -| `clusterGateway.port` | WebSocket port for agent connections | `integer` | `8443` | -| `clusterGateway.priorityClass.create` | Create a priority class | `boolean` | `false` | -| `clusterGateway.priorityClass.name` | Priority class name | `string` | `cluster-gateway` | -| `clusterGateway.priorityClass.value` | Priority class value | `integer` | `900000` | -| `clusterGateway.replicas` | Number of cluster gateway replicas. Must be `1` — the gateway holds cluster-agent WebSocket connections in process memory and cannot be horizontally scaled. Support for multiple replicas is planned for a future release. | `integer` | `1` | -| `clusterGateway.resources.limits.cpu` | CPU limit | `string` | `500m` | -| `clusterGateway.resources.limits.memory` | Memory limit | `string` | `256Mi` | -| `clusterGateway.resources.requests.cpu` | CPU request | `string` | `100m` | -| `clusterGateway.resources.requests.memory` | Memory request | `string` | `64Mi` | -| `clusterGateway.securityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | -| `clusterGateway.securityContext.capabilities.drop` | Capabilities to drop | `array` | | -| `clusterGateway.securityContext.readOnlyRootFilesystem` | Read-only root filesystem | `boolean` | `true` | -| `clusterGateway.service.clusterIP` | Cluster IP (set to None for headless service) | `string,null` | `null` | -| `clusterGateway.service.loadBalancerIP` | LoadBalancer IP (only used if service.type is LoadBalancer) | `string,null` | `null` | -| `clusterGateway.service.nodePort` | NodePort (only used if service.type is NodePort) | `integer,null` | `null` | -| `clusterGateway.service.port` | Service port | `integer` | `8443` | -| `clusterGateway.service.type` | Service type | `string` | `ClusterIP` | -| `clusterGateway.serviceAccount.annotations` | Service account annotations | `object` | `{}` | -| `clusterGateway.serviceAccount.create` | Create a service account | `boolean` | `true` | -| `clusterGateway.serviceAccount.name` | Service account name | `string` | `cluster-gateway` | -| `clusterGateway.tls.dnsNames` | DNS names for the certificate | `array` | | -| `clusterGateway.tls.duration` | Certificate validity duration (90 days) | `string` | `2160h` | -| `clusterGateway.tls.enabled` | Enable TLS | `boolean` | `true` | -| `clusterGateway.tls.issuerRef.kind` | Issuer kind | `string` | `Issuer` | -| `clusterGateway.tls.issuerRef.name` | Issuer name | `string` | `cluster-gateway-selfsigned-issuer` | -| `clusterGateway.tls.renewBefore` | Certificate renewal threshold (15 days before expiry) | `string` | `360h` | -| `clusterGateway.tls.secretName` | TLS secret name | `string` | `cluster-gateway-tls` | -| `clusterGateway.tls.skipClientCertVerify` | Deprecated: has no effect. Agent certificates are always verified per plane CR; use clusterGateway.internalMtls.enabled to control internal API verification. Will be removed in a future release. | `boolean` | `false` | -| `clusterGateway.tlsRoute.enabled` | Enable TLSRoute for cluster gateway | `boolean` | `false` | -| `clusterGateway.tlsRoute.hosts` | Hostnames for TLSRoute | `array` | `[]` | -| `clusterGateway.tolerations` | Tolerations | `array` | `[]` | +| Parameter | Description | Type | Default | +| :-------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------- | :----------------------------------- | +| `clusterGateway.affinity` | Affinity rules | `object` | `{}` | +| `clusterGateway.heartbeatInterval` | Heartbeat interval for agent connections | `string` | `30s` | +| `clusterGateway.heartbeatTimeout` | Heartbeat timeout for agent connections | `string` | `90s` | +| `clusterGateway.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | +| `clusterGateway.image.repository` | Docker image repository | `string` | `ghcr.io/openchoreo/cluster-gateway` | +| `clusterGateway.image.tag` | Image tag. If empty, uses Chart.AppVersion | `string` | | +| `clusterGateway.internalMtls.caSecretName` | Name of the secret holding the internal CA used to sign and verify internal API client certificates | `string` | `cluster-gateway-internal-ca` | +| `clusterGateway.internalMtls.clientCertDuration` | Internal API client certificate validity duration (90 days) | `string` | `2160h` | +| `clusterGateway.internalMtls.clientCertRenewBefore` | Internal API client certificate renewal threshold (15 days before expiry) | `string` | `360h` | +| `clusterGateway.internalMtls.enabled` | Require and verify client certificates on the cluster gateway internal API. Disabling this restores unauthenticated access to the internal API - for development only. | `boolean` | `true` | +| `clusterGateway.logLevel` | Log level | `string` | `info` | +| `clusterGateway.name` | Name of the cluster gateway deployment | `string` | `cluster-gateway` | +| `clusterGateway.nodeSelector` | Node selector | `object` | `{}` | +| `clusterGateway.podSecurityContext.fsGroup` | Filesystem group | `integer` | `1000` | +| `clusterGateway.podSecurityContext.runAsNonRoot` | Run as non-root user | `boolean` | `true` | +| `clusterGateway.podSecurityContext.runAsUser` | User ID | `integer` | `1000` | +| `clusterGateway.port` | WebSocket port for agent connections | `integer` | `8443` | +| `clusterGateway.priorityClass.create` | Create a priority class | `boolean` | `false` | +| `clusterGateway.priorityClass.name` | Priority class name | `string` | `cluster-gateway` | +| `clusterGateway.priorityClass.value` | Priority class value | `integer` | `900000` | +| `clusterGateway.replicas` | Number of cluster gateway replicas. Must be 1 - the gateway holds cluster-agent WebSocket connections in process memory and cannot be horizontally scaled. Provide support in upcoming release. | `integer` | `1` | +| `clusterGateway.resources.limits.cpu` | CPU limit | `string` | `500m` | +| `clusterGateway.resources.limits.memory` | Memory limit | `string` | `256Mi` | +| `clusterGateway.resources.requests.cpu` | CPU request | `string` | `100m` | +| `clusterGateway.resources.requests.memory` | Memory request | `string` | `64Mi` | +| `clusterGateway.securityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | +| `clusterGateway.securityContext.capabilities.drop` | Capabilities to drop | `array` | | +| `clusterGateway.securityContext.readOnlyRootFilesystem` | Read-only root filesystem | `boolean` | `true` | +| `clusterGateway.service.clusterIP` | Cluster IP (set to None for headless service) | `string,null` | `null` | +| `clusterGateway.service.loadBalancerIP` | LoadBalancer IP (only used if service.type is LoadBalancer) | `string,null` | `null` | +| `clusterGateway.service.nodePort` | NodePort (only used if service.type is NodePort) | `integer,null` | `null` | +| `clusterGateway.service.port` | Service port | `integer` | `8443` | +| `clusterGateway.service.type` | Service type | `string` | `ClusterIP` | +| `clusterGateway.serviceAccount.annotations` | Service account annotations | `object` | `{}` | +| `clusterGateway.serviceAccount.create` | Create a service account | `boolean` | `true` | +| `clusterGateway.serviceAccount.name` | Service account name | `string` | `cluster-gateway` | +| `clusterGateway.tls.dnsNames` | DNS names for the certificate | `array` | | +| `clusterGateway.tls.duration` | Certificate validity duration (90 days) | `string` | `2160h` | +| `clusterGateway.tls.enabled` | Enable TLS | `boolean` | `true` | +| `clusterGateway.tls.issuerRef.kind` | Issuer kind | `string` | `Issuer` | +| `clusterGateway.tls.issuerRef.name` | Issuer name | `string` | `cluster-gateway-selfsigned-issuer` | +| `clusterGateway.tls.renewBefore` | Certificate renewal threshold (15 days before expiry) | `string` | `360h` | +| `clusterGateway.tls.secretName` | TLS secret name | `string` | `cluster-gateway-tls` | +| `clusterGateway.tls.skipClientCertVerify` | Deprecated: has no effect. Agent certificates are always verified per plane CR; use clusterGateway.internalMtls.enabled to control internal API verification. Will be removed in a future release. | `boolean` | `false` | +| `clusterGateway.tlsRoute.enabled` | Enable TLSRoute for cluster gateway | `boolean` | `false` | +| `clusterGateway.tlsRoute.hosts` | Hostnames for TLSRoute | `array` | `[]` | +| `clusterGateway.tolerations` | Tolerations | `array` | `[]` | +| `clusterGateway.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | ## Controller Manager Controller Manager configuration - the main controller for OpenChoreo CRDs -| Parameter | Description | Type | Default | -| :---------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------- | :------------- | :------------------------------------------------------------------------ | -| `controllerManager.affinity` | Affinity rules for pod scheduling | `object` | `{}` | -| `controllerManager.autoscaling.behavior.scaleDown.policies` | Scale-down policies | `array` | | -| `controllerManager.autoscaling.behavior.scaleDown.stabilizationWindowSeconds` | Stabilization window in seconds before scaling down | `integer` | `300` | -| `controllerManager.autoscaling.behavior.scaleUp.policies` | Scale-up policies | `array` | | -| `controllerManager.autoscaling.behavior.scaleUp.selectPolicy` | Policy selection strategy | `string` | `Max` | -| `controllerManager.autoscaling.behavior.scaleUp.stabilizationWindowSeconds` | Stabilization window in seconds before scaling up | `integer` | `0` | -| `controllerManager.autoscaling.enabled` | Enable Horizontal Pod Autoscaler | `boolean` | `false` | -| `controllerManager.autoscaling.maxReplicas` | Maximum number of replicas | `integer` | `3` | -| `controllerManager.autoscaling.minReplicas` | Minimum number of replicas | `integer` | `1` | -| `controllerManager.autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization percentage for scaling | `integer` | `70` | -| `controllerManager.autoscaling.targetMemoryUtilizationPercentage` | Target memory utilization percentage for scaling | `integer` | `80` | -| `controllerManager.clusterGateway.tls.caPath` | Path to the CA certificate file | `string` | `/etc/cluster-gateway/ca.crt` | -| `controllerManager.clusterGateway.tls.caSecret` | Name of the secret containing the CA certificate | `string` | `cluster-gateway-ca` | -| `controllerManager.clusterGateway.tls.clientCertPath` | Path to the client certificate used for mTLS to the cluster gateway internal API | `string` | `/etc/cluster-gateway-client/tls.crt` | -| `controllerManager.clusterGateway.tls.clientKeyPath` | Path to the client private key used for mTLS to the cluster gateway internal API | `string` | `/etc/cluster-gateway-client/tls.key` | -| `controllerManager.clusterGateway.tls.clientSecret` | Name of the secret containing the controller-manager client certificate for the cluster gateway internal API | `string` | `controller-manager-cluster-gateway-client-tls` | -| `controllerManager.clusterGateway.url` | Cluster gateway service URL | `string` | `https://cluster-gateway.openchoreo-control-plane.svc.cluster.local:8444` | -| `controllerManager.containerSecurityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | -| `controllerManager.containerSecurityContext.appArmorProfile.type` | AppArmor profile type | `string` | `Unconfined` | -| `controllerManager.containerSecurityContext.capabilities.drop` | Capabilities to drop | `array` | | -| `controllerManager.containerSecurityContext.readOnlyRootFilesystem` | Mount root filesystem as read-only | `boolean` | `false` | -| `controllerManager.containerSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | -| `controllerManager.image.pullPolicy` | Image pull policy | `string` | `Always` | -| `controllerManager.image.repository` | Docker image repository | `string` | `ghcr.io/openchoreo/controller` | -| `controllerManager.image.tag` | Image tag. If empty, uses Chart.AppVersion | `string` | | -| `controllerManager.manager.args` | Command-line arguments for the controller-manager | `array` | | -| `controllerManager.manager.env.enableWebhooks` | Enable admission webhooks | `string` | `true` | -| `controllerManager.metrics.enabled` | Enable Prometheus metrics endpoint | `boolean` | `true` | -| `controllerManager.metrics.serviceMonitor.enabled` | Create a ServiceMonitor resource for Prometheus Operator | `boolean` | `false` | -| `controllerManager.metrics.serviceMonitor.interval` | Scrape interval | `string` | `30s` | -| `controllerManager.metrics.serviceMonitor.labels.prometheus` | | `string` | `kube-prometheus` | -| `controllerManager.metrics.serviceMonitor.namespace` | Namespace where ServiceMonitor should be created | `string` | `monitoring` | -| `controllerManager.metrics.serviceMonitor.relabelings` | Metric relabeling rules | `array` | `[]` | -| `controllerManager.metrics.serviceMonitor.scrapeTimeout` | Scrape timeout | `string` | `10s` | -| `controllerManager.name` | Name of the controller-manager deployment | `string` | `controller-manager` | -| `controllerManager.networkPolicy.egress` | Egress rules for the NetworkPolicy | `array` | `[]` | -| `controllerManager.networkPolicy.enabled` | Enable NetworkPolicy | `boolean` | `false` | -| `controllerManager.networkPolicy.ingress` | Ingress rules for the NetworkPolicy | `array` | `[]` | -| `controllerManager.nodeSelector` | Node selector for pod scheduling | `object` | `{}` | -| `controllerManager.podDisruptionBudget.enabled` | Enable PodDisruptionBudget | `boolean` | `false` | -| `controllerManager.podDisruptionBudget.minAvailable` | Minimum number of pods that must be available | `integer` | `1` | -| `controllerManager.podSecurityContext.fsGroup` | Filesystem group for volumes | `integer` | `1000` | -| `controllerManager.podSecurityContext.runAsGroup` | Group ID to run the container as | `integer` | `1000` | -| `controllerManager.podSecurityContext.runAsNonRoot` | Run container as non-root user | `boolean` | `true` | -| `controllerManager.podSecurityContext.runAsUser` | User ID to run the container as | `integer` | `1000` | -| `controllerManager.podSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | -| `controllerManager.priorityClass.create` | Create a priority class for the controller-manager | `boolean` | `false` | -| `controllerManager.priorityClass.name` | Priority class name | `string` | `openchoreo-controller-manager` | -| `controllerManager.priorityClass.value` | Priority class value (higher = more priority) | `integer` | `1000000` | -| `controllerManager.replicas` | Number of controller-manager replicas | `integer` | `1` | -| `controllerManager.resources.limits.cpu` | CPU limit | `string` | `1000m` | -| `controllerManager.resources.limits.memory` | Memory limit | `string` | `1Gi` | -| `controllerManager.resources.requests.cpu` | CPU request | `string` | `200m` | -| `controllerManager.resources.requests.memory` | Memory request | `string` | `256Mi` | -| `controllerManager.service.nodePort` | NodePort (only used if service.type is NodePort) | `integer,null` | `null` | -| `controllerManager.service.port` | Service port | `integer` | `8080` | -| `controllerManager.service.type` | Service type | `string` | `ClusterIP` | -| `controllerManager.serviceAccount.annotations` | Annotations to add to the service account | `object` | `{}` | -| `controllerManager.serviceAccount.create` | Create a service account for the controller-manager | `boolean` | `true` | -| `controllerManager.tolerations` | Tolerations for pod scheduling | `array` | `[]` | -| `controllerManager.topologySpreadConstraints` | Topology spread constraints for pod distribution across zones and nodes | `array` | | +| Parameter | Description | Type | Default | +| :---------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------ | :------------- | :------------------------------------------------------------------------ | +| `controllerManager.affinity` | Affinity rules for pod scheduling | `object` | `{}` | +| `controllerManager.autoscaling.behavior.scaleDown.policies` | Scale-down policies | `array` | | +| `controllerManager.autoscaling.behavior.scaleDown.stabilizationWindowSeconds` | Stabilization window in seconds before scaling down | `integer` | `300` | +| `controllerManager.autoscaling.behavior.scaleUp.policies` | Scale-up policies | `array` | | +| `controllerManager.autoscaling.behavior.scaleUp.selectPolicy` | Policy selection strategy | `string` | `Max` | +| `controllerManager.autoscaling.behavior.scaleUp.stabilizationWindowSeconds` | Stabilization window in seconds before scaling up | `integer` | `0` | +| `controllerManager.autoscaling.enabled` | Enable Horizontal Pod Autoscaler | `boolean` | `false` | +| `controllerManager.autoscaling.maxReplicas` | Maximum number of replicas | `integer` | `3` | +| `controllerManager.autoscaling.minReplicas` | Minimum number of replicas | `integer` | `1` | +| `controllerManager.autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization percentage for scaling | `integer` | `70` | +| `controllerManager.autoscaling.targetMemoryUtilizationPercentage` | Target memory utilization percentage for scaling | `integer` | `80` | +| `controllerManager.clusterGateway.tls.caPath` | Path to the CA certificate file | `string` | `/etc/cluster-gateway/ca.crt` | +| `controllerManager.clusterGateway.tls.caSecret` | Name of the secret containing the CA certificate | `string` | `cluster-gateway-ca` | +| `controllerManager.clusterGateway.tls.clientCertPath` | Path to the client certificate used for mTLS to the cluster gateway internal API | `string` | `/etc/cluster-gateway-client/tls.crt` | +| `controllerManager.clusterGateway.tls.clientKeyPath` | Path to the client private key used for mTLS to the cluster gateway internal API | `string` | `/etc/cluster-gateway-client/tls.key` | +| `controllerManager.clusterGateway.tls.clientSecret` | Name of the secret containing the controller-manager client certificate for the cluster gateway internal API | `string` | `controller-manager-cluster-gateway-client-tls` | +| `controllerManager.clusterGateway.tls.insecure` | Skip TLS verification of the cluster gateway. For development only. | `boolean` | `false` | +| `controllerManager.clusterGateway.url` | Cluster gateway service URL | `string` | `https://cluster-gateway.openchoreo-control-plane.svc.cluster.local:8444` | +| `controllerManager.containerSecurityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | +| `controllerManager.containerSecurityContext.appArmorProfile.type` | AppArmor profile type | `string` | `Unconfined` | +| `controllerManager.containerSecurityContext.capabilities.drop` | Capabilities to drop | `array` | | +| `controllerManager.containerSecurityContext.readOnlyRootFilesystem` | Mount root filesystem as read-only | `boolean` | `false` | +| `controllerManager.containerSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | +| `controllerManager.image.pullPolicy` | Image pull policy | `string` | `Always` | +| `controllerManager.image.repository` | Docker image repository | `string` | `ghcr.io/openchoreo/controller` | +| `controllerManager.image.tag` | Image tag. If empty, uses Chart.AppVersion | `string` | | +| `controllerManager.manager.args` | Command-line arguments for the controller-manager | `array` | | +| `controllerManager.manager.env.enableWebhooks` | Enable admission webhooks | `string` | `true` | +| `controllerManager.metrics.enabled` | Enable Prometheus metrics endpoint | `boolean` | `true` | +| `controllerManager.metrics.serviceMonitor.enabled` | Create a ServiceMonitor resource for Prometheus Operator | `boolean` | `false` | +| `controllerManager.metrics.serviceMonitor.interval` | Scrape interval | `string` | `30s` | +| `controllerManager.metrics.serviceMonitor.labels.prometheus` | | `string` | `kube-prometheus` | +| `controllerManager.metrics.serviceMonitor.namespace` | Namespace where ServiceMonitor should be created | `string` | `monitoring` | +| `controllerManager.metrics.serviceMonitor.relabelings` | Metric relabeling rules | `array` | `[]` | +| `controllerManager.metrics.serviceMonitor.scrapeTimeout` | Scrape timeout | `string` | `10s` | +| `controllerManager.name` | Name of the controller-manager deployment | `string` | `controller-manager` | +| `controllerManager.networkPolicy.egress` | Egress rules for the NetworkPolicy | `array` | `[]` | +| `controllerManager.networkPolicy.enabled` | Enable NetworkPolicy | `boolean` | `false` | +| `controllerManager.networkPolicy.ingress` | Ingress rules for the NetworkPolicy | `array` | `[]` | +| `controllerManager.nodeSelector` | Node selector for pod scheduling | `object` | `{}` | +| `controllerManager.podDisruptionBudget.enabled` | Enable PodDisruptionBudget | `boolean` | `false` | +| `controllerManager.podDisruptionBudget.minAvailable` | Minimum number of pods that must be available | `integer` | `1` | +| `controllerManager.podSecurityContext.fsGroup` | Filesystem group for volumes | `integer` | `1000` | +| `controllerManager.podSecurityContext.runAsGroup` | Group ID to run the container as | `integer` | `1000` | +| `controllerManager.podSecurityContext.runAsNonRoot` | Run container as non-root user | `boolean` | `true` | +| `controllerManager.podSecurityContext.runAsUser` | User ID to run the container as | `integer` | `1000` | +| `controllerManager.podSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | +| `controllerManager.preStopSleepSeconds` | Seconds to sleep before SIGTERM during pod shutdown, giving kube-apiserver time to de-register the webhook endpoint; set 0 to disable | `integer` | `10` | +| `controllerManager.priorityClass.create` | Create a priority class for the controller-manager | `boolean` | `false` | +| `controllerManager.priorityClass.name` | Priority class name | `string` | `openchoreo-controller-manager` | +| `controllerManager.priorityClass.value` | Priority class value (higher = more priority) | `integer` | `1000000` | +| `controllerManager.replicas` | Number of controller-manager replicas | `integer` | `1` | +| `controllerManager.resources.limits.cpu` | CPU limit | `string` | `1000m` | +| `controllerManager.resources.limits.memory` | Memory limit | `string` | `1Gi` | +| `controllerManager.resources.requests.cpu` | CPU request | `string` | `200m` | +| `controllerManager.resources.requests.memory` | Memory request | `string` | `256Mi` | +| `controllerManager.service.nodePort` | NodePort (only used if service.type is NodePort) | `integer,null` | `null` | +| `controllerManager.service.port` | Service port | `integer` | `8080` | +| `controllerManager.service.type` | Service type | `string` | `ClusterIP` | +| `controllerManager.serviceAccount.annotations` | Annotations to add to the service account | `object` | `{}` | +| `controllerManager.serviceAccount.create` | Create a service account for the controller-manager | `boolean` | `true` | +| `controllerManager.strategy.rollingUpdate.maxSurge` | Maximum extra pods allowed during a rolling update | `integer` | `1` | +| `controllerManager.strategy.rollingUpdate.maxUnavailable` | Maximum pods that can be unavailable during a rolling update | `integer` | `0` | +| `controllerManager.terminationGracePeriodSeconds` | Seconds Kubernetes waits before force-killing the pod; must exceed preStopSleepSeconds plus webhook drain time | `integer` | `30` | +| `controllerManager.tolerations` | Tolerations for pod scheduling | `array` | `[]` | +| `controllerManager.topologySpreadConstraints` | Topology spread constraints for pod distribution across zones and nodes | `array` | | + +## Event Forwarder + +Event-forwarder configuration — watches OpenChoreo Kubernetes resources via informers and forwards change-notification webhooks to subscribers (typically Backstage's events plugin) for near-real-time catalog updates. + +| Parameter | Description | Type | Default | +| :----------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------- | :----------------------------------- | +| `eventForwarder.affinity` | Affinity rules for pod scheduling | `object` | `{}` | +| `eventForwarder.config.logging.level` | | `string` | `info` | +| `eventForwarder.config.server.port` | | `integer` | `8080` | +| `eventForwarder.config.webhooks.endpoints` | Webhook endpoints that receive resource change notifications. Default targets the in-cluster Backstage Service (same namespace, default service name "backstage" on port 7007). Override for external consumers, a renamed Backstage Service, or to fan out to multiple subscribers. Each endpoint may define its own optional `retry` block: - url: https://example.com/hook retry: maxAttempts: 3 backoffMs: 500 When omitted (the default for the Backstage entry below), the forwarder makes a single attempt per event and gives up on failure — Backstage's periodic full sync reconciles missed events. Add `retry` only for endpoints that have no equivalent reconciliation mechanism of their own. | `array` | | +| `eventForwarder.containerSecurityContext.allowPrivilegeEscalation` | | `boolean` | `false` | +| `eventForwarder.containerSecurityContext.readOnlyRootFilesystem` | | `boolean` | `true` | +| `eventForwarder.enabled` | Enable the event-forwarder component. Disabling it stops the event-forwarder pod from being deployed and signals Backstage to skip its event subscriptions, falling back to poll-only catalog sync. | `boolean` | `true` | +| `eventForwarder.image.pullPolicy` | | `string` | `IfNotPresent` | +| `eventForwarder.image.repository` | | `string` | `ghcr.io/openchoreo/event-forwarder` | +| `eventForwarder.image.tag` | | `string` | | +| `eventForwarder.name` | Name of the event-forwarder Deployment / ServiceAccount / ClusterRole resources | `string` | `event-forwarder` | +| `eventForwarder.nodeSelector` | Node selector for pod scheduling | `object` | `{}` | +| `eventForwarder.podSecurityContext.runAsNonRoot` | | `boolean` | `true` | +| `eventForwarder.podSecurityContext.runAsUser` | | `integer` | `65532` | +| `eventForwarder.resources.limits.cpu` | | `string` | `200m` | +| `eventForwarder.resources.limits.memory` | | `string` | `256Mi` | +| `eventForwarder.resources.requests.cpu` | | `string` | `50m` | +| `eventForwarder.resources.requests.memory` | | `string` | `64Mi` | +| `eventForwarder.serviceAccount.annotations` | Annotations to add to the service account | `object` | `{}` | +| `eventForwarder.serviceAccount.create` | | `boolean` | `true` | +| `eventForwarder.serviceAccount.name` | | `string` | | +| `eventForwarder.tolerations` | Tolerations for pod scheduling | `array` | `[]` | +| `eventForwarder.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | + +## Features + +Feature flags shared across the control plane (API server and Backstage). + +| Parameter | Description | Type | Default | +| :---------------------------------- | :--------------------------------------------------------------------------------- | :-------- | :------ | +| `features.secretManagement.enabled` | Enable the Secret management API and Backstage UI for managing data-plane secrets. | `boolean` | `false` | ## Fullname Override @@ -227,6 +287,7 @@ KGateway (Gateway API) configuration. kgateway is installed separately; these va | :---------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :-------- | :--------------------- | | `gateway.annotations` | Annotations added to the Gateway resource. Use this to configure cert-manager, external-dns, or other integrations. | `object` | `{}` | | `gateway.enabled` | Enable Gateway CR creation | `boolean` | `true` | +| `gateway.gatewayClassName` | GatewayClass name to reference in the Gateway CR | `string` | `kgateway` | | `gateway.httpPort` | HTTP listener port | `integer` | `80` | | `gateway.httpsPort` | HTTPS listener port | `integer` | `443` | | `gateway.infrastructure` | Gateway infrastructure configuration passed to the generated Service. Used to configure cloud provider load balancer settings via annotations. Example for AWS with Elastic IP: infrastructure: annotations: service.beta.kubernetes.io/aws-load-balancer-type: "external" service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip" service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing" service.beta.kubernetes.io/aws-load-balancer-eip-allocations: "eipalloc-xxx" | `object` | | @@ -238,9 +299,11 @@ KGateway (Gateway API) configuration. kgateway is installed separately; these va Global values shared across all components -| Parameter | Description | Type | Default | -| :-------------------- | :--------------------------------------------------- | :------- | :------ | -| `global.commonLabels` | Labels applied to all resources created by the chart | `object` | `{}` | +| Parameter | Description | Type | Default | +| :------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------- | :------ | +| `global.commonLabels` | Labels applied to all resources created by the chart | `object` | `{}` | +| `global.imagePullSecrets` | Image pull secrets applied to all first-party pods, for pulling images from authenticated private registries. Entries are LocalObjectReferences (name only). | `array` | `[]` | +| `global.imageRegistry` | Registry override for all first-party container images. When set, it replaces the registry host of each image repository. May include a path (e.g. registry.example.com/ghcr.io) for path-preserving mirrors. Empty uses each image's default registry. | `string` | | ## Kubernetes Cluster Domain @@ -263,122 +326,165 @@ Metrics service configuration OpenChoreo API server configuration -| Parameter | Description | Type | Default | -| :----------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------- | :--------------------------------------------------------- | -| `openchoreoApi.affinity` | Affinity rules | `object` | `{}` | -| `openchoreoApi.autoscaling.behavior.scaleDown.policies` | Scale-down policies | `array` | | -| `openchoreoApi.autoscaling.behavior.scaleDown.stabilizationWindowSeconds` | Stabilization window in seconds | `integer` | `300` | -| `openchoreoApi.autoscaling.behavior.scaleUp.policies` | Scale-up policies | `array` | | -| `openchoreoApi.autoscaling.behavior.scaleUp.selectPolicy` | Policy selection strategy | `string` | `Max` | -| `openchoreoApi.autoscaling.behavior.scaleUp.stabilizationWindowSeconds` | Stabilization window in seconds | `integer` | `0` | -| `openchoreoApi.autoscaling.enabled` | Enable Horizontal Pod Autoscaler | `boolean` | `false` | -| `openchoreoApi.autoscaling.maxReplicas` | Maximum number of replicas | `integer` | `3` | -| `openchoreoApi.autoscaling.minReplicas` | Minimum number of replicas | `integer` | `1` | -| `openchoreoApi.autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization percentage | `integer` | `70` | -| `openchoreoApi.autoscaling.targetMemoryUtilizationPercentage` | Target memory utilization percentage | `integer` | `80` | -| `openchoreoApi.config.logging.add_source` | Include source file and line number in log entries | `boolean` | `false` | -| `openchoreoApi.config.logging.format` | Log output format: json, text | `string` | `json` | -| `openchoreoApi.config.logging.level` | Minimum log level: debug, info, warn, error | `string` | `info` | -| `openchoreoApi.config.mcp.enabled` | Enable the MCP server for AI-friendly tool interfaces | `boolean` | `true` | -| `openchoreoApi.config.mcp.toolsets` | List of enabled MCP toolsets. Each toolset exposes a group of related operations. Allowed toolsets: namespace, project, component, deployment, build, pe | `array` | `["namespace","project","component","deployment","build"]` | -| `openchoreoApi.config.security.authentication.jwt.clock_skew` | Allowed clock skew when validating token expiration times | `string` | `0s` | -| `openchoreoApi.config.security.authentication.jwt.jwks.refresh_interval` | How often to refresh the JWKS from the remote URL | `string` | `1h` | -| `openchoreoApi.config.security.authentication.jwt.jwks.skip_tls_verify` | Skip TLS certificate verification when fetching JWKS | `boolean` | `false` | -| `openchoreoApi.config.security.authorization.bootstrap.mappings` | Default role-to-entitlement mappings to create at installation | `array` | `[]` | -| `openchoreoApi.config.security.authorization.bootstrap.roles` | Default authorization roles to create at installation | `array` | `[]` | -| `openchoreoApi.config.security.authorization.cache.enabled` | Enable caching of authorization decisions | `boolean` | `false` | -| `openchoreoApi.config.security.authorization.cache.ttl` | How long to cache authorization decisions | `string` | `5m` | -| `openchoreoApi.config.security.authorization.resync_interval` | Interval for periodic full resync of authorization policies. Acts as a safety net to recover from missed events. Set to "0" to disable. | `string` | `10m` | -| `openchoreoApi.config.security.subjects.service_account.display_name` | | `string` | `Service Account` | -| `openchoreoApi.config.security.subjects.service_account.mechanisms.jwt.entitlement.claim` | | `string` | `sub` | -| `openchoreoApi.config.security.subjects.service_account.mechanisms.jwt.entitlement.display_name` | | `string` | `Client ID` | -| `openchoreoApi.config.security.subjects.service_account.priority` | | `integer` | `2` | -| `openchoreoApi.config.security.subjects.user.display_name` | | `string` | `User` | -| `openchoreoApi.config.security.subjects.user.mechanisms.jwt.entitlement.claim` | | `string` | `groups` | -| `openchoreoApi.config.security.subjects.user.mechanisms.jwt.entitlement.display_name` | | `string` | `User Group` | -| `openchoreoApi.config.security.subjects.user.priority` | | `integer` | `1` | -| `openchoreoApi.config.server.bind_address` | Address to bind the HTTP server to | `string` | `0.0.0.0` | -| `openchoreoApi.config.server.port` | Port to listen on for HTTP requests | `integer` | `8080` | -| `openchoreoApi.config.server.publicUrl` | Public URL for the API server | `string` | `http://api.openchoreo.invalid` | -| `openchoreoApi.config.server.timeouts.idle` | Maximum time to wait for the next request when keep-alives are enabled | `string` | `60s` | -| `openchoreoApi.config.server.timeouts.read` | Maximum duration for reading the entire request, including the body | `string` | `15s` | -| `openchoreoApi.config.server.timeouts.shutdown` | Maximum duration to wait for active connections to close during shutdown | `string` | `30s` | -| `openchoreoApi.config.server.timeouts.write` | Maximum duration before timing out writes of the response | `string` | `15s` | -| `openchoreoApi.config.server.tls.cert_file` | Path to the TLS certificate file | `string` | | -| `openchoreoApi.config.server.tls.enabled` | Enable TLS for the HTTP server | `boolean` | `false` | -| `openchoreoApi.config.server.tls.key_file` | Path to the TLS private key file | `string` | | -| `openchoreoApi.containerSecurityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | -| `openchoreoApi.containerSecurityContext.appArmorProfile.type` | AppArmor profile type | `string` | `Unconfined` | -| `openchoreoApi.containerSecurityContext.capabilities.drop` | Capabilities to drop | `array` | | -| `openchoreoApi.containerSecurityContext.readOnlyRootFilesystem` | Read-only root filesystem | `boolean` | `false` | -| `openchoreoApi.containerSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | -| `openchoreoApi.database.path` | Path to the SQLite database file | `string` | `/var/lib/openchoreo/data/controlplane.db` | -| `openchoreoApi.enabled` | Enable the OpenChoreo API server | `boolean` | `true` | -| `openchoreoApi.http.annotations` | HTTPRoute annotations | `object` | `{}` | -| `openchoreoApi.http.enabled` | Enable HTTPRoute | `boolean` | `true` | -| `openchoreoApi.http.hostnames` | HTTPRoute hostnames | `array` | `["api.openchoreo.invalid"]` | -| `openchoreoApi.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | -| `openchoreoApi.image.repository` | Docker image repository | `string` | `ghcr.io/openchoreo/openchoreo-api` | -| `openchoreoApi.image.tag` | Image tag. If empty, uses Chart.AppVersion | `string` | | -| `openchoreoApi.metrics.enabled` | Enable Prometheus metrics | `boolean` | `true` | -| `openchoreoApi.metrics.serviceMonitor.enabled` | Create ServiceMonitor resource | `boolean` | `false` | -| `openchoreoApi.metrics.serviceMonitor.interval` | Scrape interval | `string` | `30s` | -| `openchoreoApi.metrics.serviceMonitor.labels.prometheus` | | `string` | `kube-prometheus` | -| `openchoreoApi.metrics.serviceMonitor.namespace` | Namespace for ServiceMonitor | `string` | `monitoring` | -| `openchoreoApi.metrics.serviceMonitor.relabelings` | Metric relabeling rules | `array` | `[]` | -| `openchoreoApi.metrics.serviceMonitor.scrapeTimeout` | Scrape timeout | `string` | `10s` | -| `openchoreoApi.name` | Static name for all openchoreo-api resources (Service, Deployment, ClusterRole, etc.) | `string` | `openchoreo-api` | -| `openchoreoApi.networkPolicy.egress` | Egress rules | `array` | `[]` | -| `openchoreoApi.networkPolicy.enabled` | Enable NetworkPolicy | `boolean` | `false` | -| `openchoreoApi.networkPolicy.ingress` | Ingress rules | `array` | `[]` | -| `openchoreoApi.nodeSelector` | Node selector | `object` | `{}` | -| `openchoreoApi.podDisruptionBudget.enabled` | Enable PodDisruptionBudget | `boolean` | `false` | -| `openchoreoApi.podDisruptionBudget.minAvailable` | Minimum available pods | `integer` | `1` | -| `openchoreoApi.podSecurityContext.fsGroup` | Filesystem group | `integer` | `1000` | -| `openchoreoApi.podSecurityContext.runAsGroup` | Group ID | `integer` | `1000` | -| `openchoreoApi.podSecurityContext.runAsNonRoot` | Run as non-root user | `boolean` | `true` | -| `openchoreoApi.podSecurityContext.runAsUser` | User ID | `integer` | `1000` | -| `openchoreoApi.podSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | -| `openchoreoApi.priorityClass.create` | Create a priority class | `boolean` | `false` | -| `openchoreoApi.priorityClass.name` | Priority class name | `string` | `openchoreo-api` | -| `openchoreoApi.priorityClass.value` | Priority class value | `integer` | `900000` | -| `openchoreoApi.replicas` | Number of API server replicas | `integer` | `1` | -| `openchoreoApi.resources.limits.cpu` | CPU limit | `string` | `1000m` | -| `openchoreoApi.resources.limits.memory` | Memory limit | `string` | `1Gi` | -| `openchoreoApi.resources.requests.cpu` | CPU request | `string` | `200m` | -| `openchoreoApi.resources.requests.memory` | Memory request | `string` | `256Mi` | -| `openchoreoApi.service.nodePort` | NodePort (only used if service.type is NodePort) | `integer,null` | `null` | -| `openchoreoApi.service.port` | Service port | `integer` | `8080` | -| `openchoreoApi.service.type` | Service type | `string` | `ClusterIP` | -| `openchoreoApi.serviceAccount.annotations` | Annotations to add to the service account | `object` | `{}` | -| `openchoreoApi.serviceAccount.name` | Service account name (always created when openchoreoApi.enabled is true) | `string` | `openchoreo-api` | -| `openchoreoApi.tolerations` | Tolerations | `array` | `[]` | -| `openchoreoApi.topologySpreadConstraints` | Topology spread constraints | `array` | | +| Parameter | Description | Type | Default | +| :----------------------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------- | :------------------------------------------------------------------------- | +| `openchoreoApi.affinity` | Affinity rules | `object` | `{}` | +| `openchoreoApi.autoscaling.behavior.scaleDown.policies` | Scale-down policies | `array` | | +| `openchoreoApi.autoscaling.behavior.scaleDown.stabilizationWindowSeconds` | Stabilization window in seconds | `integer` | `300` | +| `openchoreoApi.autoscaling.behavior.scaleUp.policies` | Scale-up policies | `array` | | +| `openchoreoApi.autoscaling.behavior.scaleUp.selectPolicy` | Policy selection strategy | `string` | `Max` | +| `openchoreoApi.autoscaling.behavior.scaleUp.stabilizationWindowSeconds` | Stabilization window in seconds | `integer` | `0` | +| `openchoreoApi.autoscaling.enabled` | Enable Horizontal Pod Autoscaler | `boolean` | `false` | +| `openchoreoApi.autoscaling.maxReplicas` | Maximum number of replicas | `integer` | `3` | +| `openchoreoApi.autoscaling.minReplicas` | Minimum number of replicas | `integer` | `1` | +| `openchoreoApi.autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization percentage | `integer` | `70` | +| `openchoreoApi.autoscaling.targetMemoryUtilizationPercentage` | Target memory utilization percentage | `integer` | `80` | +| `openchoreoApi.clusterGateway.enabled` | Enable cluster gateway client integration | `boolean` | `true` | +| `openchoreoApi.clusterGateway.tls.caPath` | Path inside the pod where the cluster gateway CA certificate is mounted | `string` | `/etc/cluster-gateway/ca.crt` | +| `openchoreoApi.clusterGateway.tls.caSecret` | Name of the secret holding the cluster gateway CA certificate | `string` | `cluster-gateway-ca` | +| `openchoreoApi.clusterGateway.tls.clientCertPath` | Path inside the pod where the client certificate for the cluster gateway internal API is mounted | `string` | `/etc/cluster-gateway-client/tls.crt` | +| `openchoreoApi.clusterGateway.tls.clientKeyPath` | Path inside the pod where the client private key for the cluster gateway internal API is mounted | `string` | `/etc/cluster-gateway-client/tls.key` | +| `openchoreoApi.clusterGateway.tls.clientSecret` | Name of the secret containing the openchoreo-api client certificate for the cluster gateway internal API | `string` | `openchoreo-api-cluster-gateway-client-tls` | +| `openchoreoApi.clusterGateway.tls.insecure` | Skip TLS verification of the cluster gateway. For development only. | `boolean` | `false` | +| `openchoreoApi.clusterGateway.url` | Cluster gateway service URL the API server connects to | `string` | `https://cluster-gateway.openchoreo-control-plane.svc.cluster.local:8444` | +| `openchoreoApi.config.logging.add_source` | Include source file and line number in log entries | `boolean` | `false` | +| `openchoreoApi.config.logging.format` | Log output format: json, text | `string` | `json` | +| `openchoreoApi.config.logging.level` | Minimum log level: debug, info, warn, error | `string` | `info` | +| `openchoreoApi.config.mcp.enabled` | Enable the MCP server for AI-friendly tool interfaces | `boolean` | `true` | +| `openchoreoApi.config.mcp.toolsets` | List of enabled MCP toolsets. Each toolset exposes a group of related operations. Allowed toolsets: namespace, project, component, deployment, build, pe, resource | `array` | `["namespace","project","component","deployment","build","pe","resource"]` | +| `openchoreoApi.config.security.authentication.jwt.clock_skew` | Allowed clock skew when validating token expiration times | `string` | `0s` | +| `openchoreoApi.config.security.authentication.jwt.jwks.refresh_interval` | How often to refresh the JWKS from the remote URL | `string` | `1h` | +| `openchoreoApi.config.security.authentication.jwt.jwks.skip_tls_verify` | Skip TLS certificate verification when fetching JWKS | `boolean` | `false` | +| `openchoreoApi.config.security.authorization.bootstrap.image` | Container image for the authz bootstrap job. Only needs to run `kubectl apply`, so any kubectl image works; override for airgapped/mirrored registries. | `string` | `registry.k8s.io/kubectl:v1.36.0` | +| `openchoreoApi.config.security.authorization.bootstrap.mappings` | Default role-to-entitlement mappings to create at installation | `array` | `[]` | +| `openchoreoApi.config.security.authorization.bootstrap.roles` | Default authorization roles to create at installation | `array` | `[]` | +| `openchoreoApi.config.security.authorization.cache.enabled` | Enable caching of authorization decisions | `boolean` | `false` | +| `openchoreoApi.config.security.authorization.cache.ttl` | How long to cache authorization decisions | `string` | `5m` | +| `openchoreoApi.config.security.authorization.resync_interval` | Interval for periodic full resync of authorization policies. Acts as a safety net to recover from missed events. Set to "0" to disable. | `string` | `10m` | +| `openchoreoApi.config.security.subjects.service_account.display_name` | | `string` | `Service Account` | +| `openchoreoApi.config.security.subjects.service_account.mechanisms.jwt.entitlement.claim` | | `string` | `sub` | +| `openchoreoApi.config.security.subjects.service_account.mechanisms.jwt.entitlement.display_name` | | `string` | `Client ID` | +| `openchoreoApi.config.security.subjects.service_account.priority` | | `integer` | `2` | +| `openchoreoApi.config.security.subjects.user.display_name` | | `string` | `User` | +| `openchoreoApi.config.security.subjects.user.mechanisms.jwt.entitlement.claim` | | `string` | `groups` | +| `openchoreoApi.config.security.subjects.user.mechanisms.jwt.entitlement.display_name` | | `string` | `User Group` | +| `openchoreoApi.config.security.subjects.user.priority` | | `integer` | `1` | +| `openchoreoApi.config.server.bind_address` | Address to bind the HTTP server to | `string` | `0.0.0.0` | +| `openchoreoApi.config.server.port` | Port to listen on for HTTP requests | `integer` | `8080` | +| `openchoreoApi.config.server.publicUrl` | Public URL for the API server | `string` | `http://api.openchoreo.invalid` | +| `openchoreoApi.config.server.timeouts.idle` | Maximum time to wait for the next request when keep-alives are enabled | `string` | `60s` | +| `openchoreoApi.config.server.timeouts.read` | Maximum duration for reading the entire request, including the body | `string` | `15s` | +| `openchoreoApi.config.server.timeouts.shutdown` | Maximum duration to wait for active connections to close during shutdown | `string` | `30s` | +| `openchoreoApi.config.server.timeouts.write` | Maximum duration before timing out writes of the response | `string` | `15s` | +| `openchoreoApi.config.server.tls.cert_file` | Path to the TLS certificate file | `string` | | +| `openchoreoApi.config.server.tls.enabled` | Enable TLS for the HTTP server | `boolean` | `false` | +| `openchoreoApi.config.server.tls.key_file` | Path to the TLS private key file | `string` | | +| `openchoreoApi.containerSecurityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | +| `openchoreoApi.containerSecurityContext.appArmorProfile.type` | AppArmor profile type | `string` | `Unconfined` | +| `openchoreoApi.containerSecurityContext.capabilities.drop` | Capabilities to drop | `array` | | +| `openchoreoApi.containerSecurityContext.readOnlyRootFilesystem` | Read-only root filesystem | `boolean` | `false` | +| `openchoreoApi.containerSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | +| `openchoreoApi.database.path` | Path to the SQLite database file | `string` | `/var/lib/openchoreo/data/controlplane.db` | +| `openchoreoApi.enabled` | Enable the OpenChoreo API server | `boolean` | `true` | +| `openchoreoApi.http.annotations` | HTTPRoute annotations | `object` | `{}` | +| `openchoreoApi.http.enabled` | Enable HTTPRoute | `boolean` | `true` | +| `openchoreoApi.http.hostnames` | HTTPRoute hostnames | `array` | `["api.openchoreo.invalid"]` | +| `openchoreoApi.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | +| `openchoreoApi.image.repository` | Docker image repository | `string` | `ghcr.io/openchoreo/openchoreo-api` | +| `openchoreoApi.image.tag` | Image tag. If empty, uses Chart.AppVersion | `string` | | +| `openchoreoApi.metrics.enabled` | Enable Prometheus metrics | `boolean` | `true` | +| `openchoreoApi.metrics.serviceMonitor.enabled` | Create ServiceMonitor resource | `boolean` | `false` | +| `openchoreoApi.metrics.serviceMonitor.interval` | Scrape interval | `string` | `30s` | +| `openchoreoApi.metrics.serviceMonitor.labels.prometheus` | | `string` | `kube-prometheus` | +| `openchoreoApi.metrics.serviceMonitor.namespace` | Namespace for ServiceMonitor | `string` | `monitoring` | +| `openchoreoApi.metrics.serviceMonitor.relabelings` | Metric relabeling rules | `array` | `[]` | +| `openchoreoApi.metrics.serviceMonitor.scrapeTimeout` | Scrape timeout | `string` | `10s` | +| `openchoreoApi.name` | Static name for all openchoreo-api resources (Service, Deployment, ClusterRole, etc.) | `string` | `openchoreo-api` | +| `openchoreoApi.networkPolicy.egress` | Egress rules | `array` | `[]` | +| `openchoreoApi.networkPolicy.enabled` | Enable NetworkPolicy | `boolean` | `false` | +| `openchoreoApi.networkPolicy.ingress` | Ingress rules | `array` | `[]` | +| `openchoreoApi.nodeSelector` | Node selector | `object` | `{}` | +| `openchoreoApi.podDisruptionBudget.enabled` | Enable PodDisruptionBudget | `boolean` | `false` | +| `openchoreoApi.podDisruptionBudget.minAvailable` | Minimum available pods | `integer` | `1` | +| `openchoreoApi.podSecurityContext.fsGroup` | Filesystem group | `integer` | `1000` | +| `openchoreoApi.podSecurityContext.runAsGroup` | Group ID | `integer` | `1000` | +| `openchoreoApi.podSecurityContext.runAsNonRoot` | Run as non-root user | `boolean` | `true` | +| `openchoreoApi.podSecurityContext.runAsUser` | User ID | `integer` | `1000` | +| `openchoreoApi.podSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | +| `openchoreoApi.priorityClass.create` | Create a priority class | `boolean` | `false` | +| `openchoreoApi.priorityClass.name` | Priority class name | `string` | `openchoreo-api` | +| `openchoreoApi.priorityClass.value` | Priority class value | `integer` | `900000` | +| `openchoreoApi.replicas` | Number of API server replicas | `integer` | `1` | +| `openchoreoApi.resources.limits.cpu` | CPU limit | `string` | `1000m` | +| `openchoreoApi.resources.limits.memory` | Memory limit | `string` | `1Gi` | +| `openchoreoApi.resources.requests.cpu` | CPU request | `string` | `200m` | +| `openchoreoApi.resources.requests.memory` | Memory request | `string` | `256Mi` | +| `openchoreoApi.service.nodePort` | NodePort (only used if service.type is NodePort) | `integer,null` | `null` | +| `openchoreoApi.service.port` | Service port | `integer` | `8080` | +| `openchoreoApi.service.type` | Service type | `string` | `ClusterIP` | +| `openchoreoApi.serviceAccount.annotations` | Annotations to add to the service account | `object` | `{}` | +| `openchoreoApi.serviceAccount.name` | Service account name (always created when openchoreoApi.enabled is true) | `string` | `openchoreo-api` | +| `openchoreoApi.tolerations` | Tolerations | `array` | `[]` | +| `openchoreoApi.topologySpreadConstraints` | Topology spread constraints | `array` | | + +## Portal Assistant + +Optional Portal Assistant chat agent. Disabled by default; enable to opt in. + +| Parameter | Description | Type | Default | +| :------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :-------- | :---------------------------------------------------------------------- | +| `portalAssistant.affinity` | Affinity rules for pod scheduling | `object` | `{}` | +| `portalAssistant.authConfigConfigMap` | | `string` | | +| `portalAssistant.config.authzTimeoutSeconds` | | `integer` | `30` | +| `portalAssistant.config.logLevel` | | `string` | `INFO` | +| `portalAssistant.config.maxConcurrentChats` | | `integer` | `20` | +| `portalAssistant.config.observerApiUrl` | | `string` | `http://observer.openchoreo-observability-plane.svc.cluster.local:8080` | +| `portalAssistant.config.openchoreoApiUrl` | | `string` | `http://openchoreo-api.openchoreo-control-plane.svc.cluster.local:8080` | +| `portalAssistant.config.rcaAgentApiUrl` | | `string` | | +| `portalAssistant.config.reasoningEffort` | OpenAI gpt-5 / o-series reasoning effort. One of "minimal" / "low" / "medium" / "high"; empty string leaves the model on its default (medium for gpt-5-mini). N=5 A/B on 2026-05-15 showed "low" cuts build_failure chat latency from 28 s mean to 12 s mean with no quality regression on the env-var-pinpoint grade — same diagnosis shape, 2-4x tighter variance. Set empty to use the provider default; non-reasoning models ignore the value safely. | `string` | `low` | +| `portalAssistant.config.recursionLimit` | langgraph recursion_limit — bounds the worst-case per-turn supersteps before the framework aborts with GraphRecursionError and the recover_with_fallback path returns a tool-less reply. 0 means "use the per-case defaults in builder.py" (build_failure / runtime_debug both set to 15 today). N=5 A/B on 2026-05-15 measured: build_failure typically uses 8-9 supersteps with occasional 11+ outliers, so setting this to 10 aborted 40 % of build chats; 15 has 5 supersteps of headroom without measurable regression. Set to a higher value (e.g. 25-30) only when a future chat shape genuinely needs the extra budget. | `integer` | `15` | +| `portalAssistant.cors.allowedOrigins` | CORS allowed origins | `array` | `[]` | +| `portalAssistant.enabled` | | `boolean` | `false` | +| `portalAssistant.extraEnvs` | | `array` | | +| `portalAssistant.http.enabled` | | `boolean` | `true` | +| `portalAssistant.http.hostnames` | HTTPRoute hostnames | `array` | `[]` | +| `portalAssistant.image.pullPolicy` | | `string` | `IfNotPresent` | +| `portalAssistant.image.repository` | | `string` | `ghcr.io/openchoreo/portal-assistant` | +| `portalAssistant.image.tag` | | `string` | | +| `portalAssistant.llm.baseUrl` | Optional OpenAI-compatible base URL. Set to route LLM calls through the ai-gateway-agentgateway module (e.g. http://agentgateway-proxy.openchoreo-data-plane) instead of the provider directly; the provider key is then managed at the gateway and the secret's PORTAL_ASSISTANT_LLM_API_KEY may be a placeholder. | `string` | | +| `portalAssistant.llm.modelName` | | `string` | | +| `portalAssistant.llm.secretName` | | `string` | | +| `portalAssistant.name` | | `string` | `portal-assistant` | +| `portalAssistant.nodeSelector` | Node selector for pod scheduling | `object` | `{}` | +| `portalAssistant.replicas` | | `integer` | `1` | +| `portalAssistant.resources.limits.cpu` | | `string` | `1000m` | +| `portalAssistant.resources.limits.memory` | | `string` | `1Gi` | +| `portalAssistant.resources.requests.cpu` | | `string` | `100m` | +| `portalAssistant.resources.requests.memory` | | `string` | `256Mi` | +| `portalAssistant.service.port` | | `integer` | `8080` | +| `portalAssistant.service.type` | Service type | `string` | `ClusterIP` | +| `portalAssistant.tolerations` | Tolerations for pod scheduling | `array` | `[]` | +| `portalAssistant.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | ## Security Common security configuration shared across all components -| Parameter | Description | Type | Default | -| :-------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------- | :-------- | :--------------------------------------------------- | -| `security.authServerBaseUrl` | Base URL for the authorization server (used for OAuth metadata) | `string` | | -| `security.authz.enabled` | Enable authorization using Casbin. Policies are loaded from ClusterAuthzRole, AuthzRole, ClusterAuthzRoleBinding, and AuthzRoleBinding CRDs. | `boolean` | `true` | -| `security.enabled` | Global security toggle - when disabled, authentication is turned off for all components | `boolean` | `true` | -| `security.jwt.audience` | Expected audience claim in JWT tokens | `string` | | -| `security.oidc.authorizationUrl` | OIDC authorization endpoint URL | `string` | `http://thunder.openchoreo.invalid/oauth2/authorize` | -| `security.oidc.externalClients` | External client configurations for authentication | `array` | | -| `security.oidc.issuer` | OIDC provider issuer URL | `string` | `http://thunder.openchoreo.invalid` | -| `security.oidc.jwksUrl` | OIDC JWKS URL for token validation | `string` | `http://thunder.openchoreo.invalid/oauth2/jwks` | -| `security.oidc.tokenUrl` | OIDC token endpoint URL | `string` | `http://thunder.openchoreo.invalid/oauth2/token` | -| `security.oidc.wellKnownEndpoint` | OIDC well-known configuration endpoint URL | `string` | | - -## Wait Job - -Wait job configuration for Helm hooks - -| Parameter | Description | Type | Default | -| :-------------- | :---------------------------- | :------- | :----------------------------- | -| `waitJob.image` | Container image for wait jobs | `string` | `bitnamilegacy/kubectl:1.32.4` | +| Parameter | Description | Type | Default | +| :----------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------- | :--------------------------------------------------- | +| `security.authServerBaseUrl` | Base URL for the authorization server (used for OAuth metadata) | `string` | | +| `security.authz.enabled` | Enable authorization using Casbin. Policies are loaded from ClusterAuthzRole, AuthzRole, ClusterAuthzRoleBinding, and AuthzRoleBinding CRDs. | `boolean` | `true` | +| `security.enabled` | Global security toggle - when disabled, authentication is turned off for all components | `boolean` | `true` | +| `security.jwt.audience` | Expected audience claim in JWT tokens | `string` | | +| `security.oidc.authorizationUrl` | OIDC authorization endpoint URL | `string` | `http://thunder.openchoreo.invalid/oauth2/authorize` | +| `security.oidc.externalClients` | External client configurations for authentication | `array` | | +| `security.oidc.issuer` | OIDC provider issuer URL | `string` | `http://thunder.openchoreo.invalid` | +| `security.oidc.jwksUrl` | OIDC JWKS URL for token validation | `string` | `http://thunder.openchoreo.invalid/oauth2/jwks` | +| `security.oidc.jwksUrlTlsInsecureSkipVerify` | Skip TLS verification for JWKS URL | `boolean` | `false` | +| `security.oidc.mcpOAuthScopes` | OAuth scopes advertised by the MCP endpoint via the protected-resource metadata (RFC 9728) and the WWW-Authenticate 401 challenge. MCP clients prefer this list over the authorization server's scopes_supported, which can be over-broad (e.g. Cognito pool-level scopes). | `array` | | +| `security.oidc.tokenUrl` | OIDC token endpoint URL | `string` | `http://thunder.openchoreo.invalid/oauth2/token` | +| `security.oidc.uidResolverTlsInsecureSkipVerify` | Skip TLS verification for the UID resolver OAuth token endpoint (for self-signed certs) | `boolean` | `false` | +| `security.oidc.wellKnownEndpoint` | OIDC well-known configuration endpoint URL | `string` | | ## Webhook Service diff --git a/docs/reference/helm/data-plane.mdx b/docs/reference/helm/data-plane.mdx index 0eb49ac2..9573079c 100644 --- a/docs/reference/helm/data-plane.mdx +++ b/docs/reference/helm/data-plane.mdx @@ -4,123 +4,102 @@ description: Helm chart values reference for openchoreo-data-plane. sidebar_position: 2 --- -## Dependencies - -This chart depends on the following sub-charts. For full configuration options of each dependency, please refer to their official documentation. - -| Name | Version | Repository | Condition | -| :-------------------------------------------------------------------------- | :------ | :------------------------------------------------------------------------------------------------------- | :------------------------------ | -| [kube-prometheus-stack](https://prometheus-community.github.io/helm-charts) | 81.6.3 | [https://prometheus-community.github.io/helm-charts](https://prometheus-community.github.io/helm-charts) | `kube-prometheus-stack.enabled` | - ## Cluster Agent Cluster Agent configuration for WebSocket connection to control plane cluster gateway -| Parameter | Description | Type | Default | -| :------------------------------------------------------ | :----------------------------------------------------------------------------------------------------------------------------------------- | :------------- | :------------------------------------------------------------------------- | -| `clusterAgent.affinity` | Affinity rules for pod scheduling | `object` | `{}` | -| `clusterAgent.heartbeatInterval` | Interval between heartbeat messages to control plane | `string` | `30s` | -| `clusterAgent.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | -| `clusterAgent.image.repository` | Cluster agent image repository | `string` | `ghcr.io/openchoreo/cluster-agent` | -| `clusterAgent.image.tag` | Image tag. Empty uses Chart.AppVersion. | `string` | | -| `clusterAgent.logLevel` | Log level for cluster agent | `string` | `info` | -| `clusterAgent.name` | Name of the cluster agent deployment | `string` | `cluster-agent-dataplane` | -| `clusterAgent.nodeSelector` | Node selector for pod scheduling | `object` | `{}` | -| `clusterAgent.planeID` | Logical plane identifier shared across multiple CRs connecting to the same physical plane. Defaults to Helm release name if not specified. | `string` | `default` | -| `clusterAgent.planeType` | Type of plane this agent manages | `string` | `dataplane` | -| `clusterAgent.podAnnotations` | Annotations to add to cluster agent pods | `object` | `{}` | -| `clusterAgent.podDisruptionBudget.enabled` | Enable PodDisruptionBudget for cluster agent | `boolean` | `false` | -| `clusterAgent.podDisruptionBudget.maxUnavailable` | Maximum number of pods that can be unavailable | `integer,null` | `null` | -| `clusterAgent.podDisruptionBudget.minAvailable` | Minimum number of pods that must be available | `integer` | `1` | -| `clusterAgent.podSecurityContext.fsGroup` | Group ID for volume mounts | `integer` | `1000` | -| `clusterAgent.podSecurityContext.runAsNonRoot` | Run container as non-root user | `boolean` | `true` | -| `clusterAgent.podSecurityContext.runAsUser` | User ID to run container as | `integer` | `1000` | -| `clusterAgent.priorityClass.create` | Create a PriorityClass for cluster agent | `boolean` | `false` | -| `clusterAgent.priorityClass.name` | PriorityClass name | `string` | `cluster-agent-dataplane` | -| `clusterAgent.priorityClass.value` | Priority value (higher = more important) | `integer` | `900000` | -| `clusterAgent.rbac.create` | Create RBAC resources (ClusterRole, ClusterRoleBinding) | `boolean` | `true` | -| `clusterAgent.reconnectDelay` | Delay before attempting reconnection after disconnect | `string` | `5s` | -| `clusterAgent.replicas` | Number of cluster agent replicas (typically 1 per data plane) | `integer` | `1` | -| `clusterAgent.resources.limits.cpu` | CPU limit for the agent | `string` | `100m` | -| `clusterAgent.resources.limits.memory` | Memory limit for the agent | `string` | `256Mi` | -| `clusterAgent.resources.requests.cpu` | CPU request for the agent | `string` | `50m` | -| `clusterAgent.resources.requests.memory` | Memory request for the agent | `string` | `128Mi` | -| `clusterAgent.securityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | -| `clusterAgent.securityContext.capabilities.drop` | Capabilities to drop from container | `array` | `["ALL"]` | -| `clusterAgent.securityContext.readOnlyRootFilesystem` | Mount root filesystem as read-only | `boolean` | `true` | -| `clusterAgent.serverUrl` | WebSocket URL of the cluster gateway in control plane | `string` | `wss://cluster-gateway.openchoreo-control-plane.svc.cluster.local:8443/ws` | -| `clusterAgent.serviceAccount.annotations` | Annotations to add to the service account | `object` | `{}` | -| `clusterAgent.serviceAccount.create` | Create a service account for the cluster agent | `boolean` | `true` | -| `clusterAgent.serviceAccount.name` | Service account name | `string` | `cluster-agent-dataplane` | -| `clusterAgent.tls.caSecretName` | CA secret name for signing agent client certificates. If empty, self-signed certs will be generated (required for multi-cluster setup). | `string` | `cluster-gateway-ca` | -| `clusterAgent.tls.clientSecretName` | Secret name for client certificate (typically same as secretName) | `string` | `cluster-agent-tls` | -| `clusterAgent.tls.duration` | Certificate validity duration | `string` | `2160h` | -| `clusterAgent.tls.enabled` | Enable TLS for agent-gateway communication | `boolean` | `true` | -| `clusterAgent.tls.generateCerts` | Generate client certificates locally using cert-manager with a self-signed CA | `boolean` | `true` | -| `clusterAgent.tls.renewBefore` | Time before expiry to renew certificate | `string` | `360h` | -| `clusterAgent.tls.secretName` | Secret name for client certificate and key | `string` | `cluster-agent-tls` | -| `clusterAgent.tls.serverCAConfigMap` | ConfigMap name containing server CA certificate for verifying gateway | `string` | `cluster-gateway-ca` | -| `clusterAgent.tolerations` | Tolerations for pod scheduling | `array` | `[]` | +| Parameter | Description | Type | Default | +| :------------------------------------------------------ | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------- | :------------------------------------------------------------------------- | +| `clusterAgent.affinity` | Affinity rules for pod scheduling | `object` | `{}` | +| `clusterAgent.extraEnvs` | Additional environment variables to set in the cluster agent container. Each entry must specify exactly one of 'value' (literal) or 'valueFrom.secretKeyRef' (reference to an existing Kubernetes Secret). | `array` | `[]` | +| `clusterAgent.heartbeatInterval` | Interval between heartbeat messages to control plane | `string` | `30s` | +| `clusterAgent.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | +| `clusterAgent.image.repository` | Cluster agent image repository | `string` | `ghcr.io/openchoreo/cluster-agent` | +| `clusterAgent.image.tag` | Image tag. Empty uses Chart.AppVersion. | `string` | | +| `clusterAgent.logLevel` | Log level for cluster agent | `string` | `info` | +| `clusterAgent.name` | Name of the cluster agent deployment | `string` | `cluster-agent-dataplane` | +| `clusterAgent.nodeSelector` | Node selector for pod scheduling | `object` | `{}` | +| `clusterAgent.planeID` | Logical plane identifier shared across multiple CRs connecting to the same physical plane. Defaults to Helm release name if not specified. | `string` | `default` | +| `clusterAgent.planeType` | Type of plane this agent manages | `string` | `dataplane` | +| `clusterAgent.podAnnotations` | Annotations to add to cluster agent pods | `object` | `{}` | +| `clusterAgent.podDisruptionBudget.enabled` | Enable PodDisruptionBudget for cluster agent | `boolean` | `false` | +| `clusterAgent.podDisruptionBudget.maxUnavailable` | Maximum number of pods that can be unavailable | `integer,null` | `null` | +| `clusterAgent.podDisruptionBudget.minAvailable` | Minimum number of pods that must be available | `integer` | `1` | +| `clusterAgent.podSecurityContext.fsGroup` | Group ID for volume mounts | `integer` | `1000` | +| `clusterAgent.podSecurityContext.runAsNonRoot` | Run container as non-root user | `boolean` | `true` | +| `clusterAgent.podSecurityContext.runAsUser` | User ID to run container as | `integer` | `1000` | +| `clusterAgent.priorityClass.create` | Create a PriorityClass for cluster agent | `boolean` | `false` | +| `clusterAgent.priorityClass.name` | PriorityClass name | `string` | `cluster-agent-dataplane` | +| `clusterAgent.priorityClass.value` | Priority value (higher = more important) | `integer` | `900000` | +| `clusterAgent.rbac.create` | Create RBAC resources (ClusterRole, ClusterRoleBinding) | `boolean` | `true` | +| `clusterAgent.reconnectDelay` | Delay before attempting reconnection after disconnect | `string` | `5s` | +| `clusterAgent.replicas` | Number of cluster agent replicas (typically 1 per data plane) | `integer` | `1` | +| `clusterAgent.resources.limits.cpu` | CPU limit for the agent | `string` | `100m` | +| `clusterAgent.resources.limits.memory` | Memory limit for the agent | `string` | `256Mi` | +| `clusterAgent.resources.requests.cpu` | CPU request for the agent | `string` | `50m` | +| `clusterAgent.resources.requests.memory` | Memory request for the agent | `string` | `128Mi` | +| `clusterAgent.securityContext.allowPrivilegeEscalation` | Prevent privilege escalation | `boolean` | `false` | +| `clusterAgent.securityContext.capabilities.drop` | Capabilities to drop from container | `array` | `["ALL"]` | +| `clusterAgent.securityContext.readOnlyRootFilesystem` | Mount root filesystem as read-only | `boolean` | `true` | +| `clusterAgent.serverUrl` | WebSocket URL of the cluster gateway in control plane | `string` | `wss://cluster-gateway.openchoreo-control-plane.svc.cluster.local:8443/ws` | +| `clusterAgent.serviceAccount.annotations` | Annotations to add to the service account | `object` | `{}` | +| `clusterAgent.serviceAccount.create` | Create a service account for the cluster agent | `boolean` | `true` | +| `clusterAgent.serviceAccount.name` | Service account name | `string` | `cluster-agent-dataplane` | +| `clusterAgent.tls.caSecretName` | CA secret name for signing agent client certificates. If empty, self-signed certs will be generated (required for multi-cluster setup). | `string` | `cluster-gateway-ca` | +| `clusterAgent.tls.clientSecretName` | Secret name for client certificate (typically same as secretName) | `string` | `cluster-agent-tls` | +| `clusterAgent.tls.duration` | Certificate validity duration | `string` | `2160h` | +| `clusterAgent.tls.enabled` | Enable TLS for agent-gateway communication | `boolean` | `true` | +| `clusterAgent.tls.generateCerts` | Generate client certificates locally using cert-manager with a self-signed CA | `boolean` | `true` | +| `clusterAgent.tls.renewBefore` | Time before expiry to renew certificate | `string` | `360h` | +| `clusterAgent.tls.secretName` | Secret name for client certificate and key | `string` | `cluster-agent-tls` | +| `clusterAgent.tls.serverCAConfigMap` | ConfigMap name containing server CA certificate for verifying gateway | `string` | `cluster-gateway-ca` | +| `clusterAgent.tolerations` | Tolerations for pod scheduling | `array` | `[]` | +| `clusterAgent.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | ## Gateway -Kubernetes Gateway API configuration. Creates a Gateway CR for HTTP/HTTPS traffic routing. - -| Parameter | Description | Type | Default | -| :---------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------- | :-------- | :--------------------------------------------------------- | -| `gateway.annotations` | Annotations added to the Gateway resource. Use this to configure cert-manager, external-dns, or other integrations. | `object` | `{}` | -| `gateway.enabled` | Enable Gateway CR creation | `boolean` | `true` | -| `gateway.gatewayClassName` | GatewayClass name to reference in the Gateway CR | `string` | `kgateway` | -| `gateway.httpPort` | Port for the HTTP listener on the gateway | `integer` | `80` | -| `gateway.httpsPort` | Port for the HTTPS listener on the gateway | `integer` | `443` | -| `gateway.infrastructure` | Gateway infrastructure configuration passed to the generated Service. Used to configure cloud provider load balancer settings via annotations. | `object` | `{"labels":{"openchoreo.dev/system-component":"gateway"}}` | -| `gateway.tls.certificateRefs` | TLS certificate references for the HTTPS listener. Each entry references a Secret containing the TLS cert/key pair. | `array` | | -| `gateway.tls.enabled` | Enable HTTPS listener on the gateway. When false, only the HTTP listener is created. | `boolean` | `true` | -| `gateway.tls.hostname` | Hostname pattern for the HTTPS listener (SNI matching) | `string` | `*.openchoreoapis.invalid` | +KGateway API gateway configuration. Provides HTTP/HTTPS traffic routing using Kubernetes Gateway API and Envoy proxy. + +| Parameter | Description | Type | Default | +| :--------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------- | :---------------------------------------------- | +| `gateway.agentgateway.enabled` | Enable Agent Gateway for AI agent connectivity | `boolean` | `false` | +| `gateway.annotations` | Annotations added to the Gateway resource. Use this to configure cert-manager, external-dns, or other integrations. | `object` | `{}` | +| `gateway.controller.image.pullPolicy` | Image pull policy for the controller container | `string` | `IfNotPresent` | +| `gateway.controller.image.registry` | Container registry for the controller image. Empty uses default registry. | `string` | | +| `gateway.controller.image.repository` | Image repository name for the gateway controller | `string` | `kgateway` | +| `gateway.controller.image.tag` | Image tag. Empty uses Chart.AppVersion. | `string` | | +| `gateway.controller.logLevel` | Log level for the gateway controller | `string` | `info` | +| `gateway.controller.replicaCount` | Number of gateway controller replicas | `integer` | `1` | +| `gateway.controller.resources.limits.cpu` | CPU limit for the controller | `string` | `200m` | +| `gateway.controller.resources.limits.memory` | Memory limit for the controller | `string` | `256Mi` | +| `gateway.controller.resources.requests.cpu` | CPU request for the controller | `string` | `100m` | +| `gateway.controller.resources.requests.memory` | Memory request for the controller | `string` | `128Mi` | +| `gateway.controller.service.ports.agwGrpc` | Agent gateway gRPC port | `integer` | `9978` | +| `gateway.controller.service.ports.grpc` | gRPC port for xDS communication | `integer` | `9977` | +| `gateway.controller.service.ports.health` | Health check endpoint port | `integer` | `9093` | +| `gateway.controller.service.ports.metrics` | Metrics endpoint port | `integer` | `9092` | +| `gateway.controller.service.type` | Service type for the gateway controller | `string` | `ClusterIP` | +| `gateway.enabled` | Enable Gateway CR creation | `boolean` | `true` | +| `gateway.gatewayClassName` | GatewayClass name to reference in the Gateway CR | `string` | `kgateway` | +| `gateway.httpPort` | Port for the HTTP listener on the gateway | `integer` | `80` | +| `gateway.httpsPort` | Port for the HTTPS listener on the gateway | `integer` | `443` | +| `gateway.infrastructure.labels` | | `object` | `{"openchoreo.dev/system-component":"gateway"}` | +| `gateway.tls.certificateRefs` | TLS certificate references for the HTTPS listener. Each entry references a Secret containing the TLS cert/key pair. | `array` | | +| `gateway.tls.enabled` | Enable HTTPS listener on the gateway. When false, only the HTTP listener is created. | `boolean` | `true` | +| `gateway.tls.hostname` | Hostname pattern for the HTTPS listener (SNI matching) | `string` | `*.openchoreoapis.invalid` | +| `gateway.tlsPassthrough.enabled` | Enable the TLS passthrough listener. When false, no passthrough listener is created. | `boolean` | `false` | +| `gateway.tlsPassthrough.hostname` | Hostname pattern for the TLS passthrough listener (SNI matching). When empty, the listener matches all SNIs. Must encompass the TLSRoute hostnames (e.g. "\*.openchoreoapis.invalid"). | `string` | `*.openchoreoapis.invalid` | +| `gateway.tlsPassthrough.port` | Port for the TLS passthrough listener. Must differ from httpsPort when the HTTPS (Terminate) listener is also enabled. | `integer` | `8443` | ## Global Global values shared across all components in the data plane -| Parameter | Description | Type | Default | -| :-------------------- | :------------------------------------------------------------ | :------- | :------ | -| `global.commonLabels` | Common labels applied to all resources deployed by this chart | `object` | `{}` | - -## Kube Prometheus Stack - -For full configuration options, please refer to the [official chart documentation](https://prometheus-community.github.io/helm-charts). - -Prometheus stack configuration (kube-prometheus-stack sub-chart). Provides metrics collection for workload observability. - -| Parameter | Description | Type | Default | -| :------------------------------------------------------------------- | :----------------------------------------------------------------------------------- | :-------- | :------------------------- | -| `kube-prometheus-stack.alertmanager.enabled` | Enable Alertmanager for alert management (not used by OpenChoreo) | `boolean` | `false` | -| `kube-prometheus-stack.cleanPrometheusOperatorObjectNames` | Produce cleaner resource names without redundant prefixes | `boolean` | `true` | -| `kube-prometheus-stack.coreDns.enabled` | Enable CoreDNS metrics collection | `boolean` | `false` | -| `kube-prometheus-stack.crds.enabled` | Install Prometheus Operator CRDs (ServiceMonitor, PodMonitor, etc.) | `boolean` | `true` | -| `kube-prometheus-stack.defaultRules.create` | Create default alerting rules (disabled - OpenChoreo uses custom rules) | `boolean` | `false` | -| `kube-prometheus-stack.enabled` | Enable the Prometheus monitoring stack for metrics collection | `boolean` | `false` | -| `kube-prometheus-stack.fullnameOverride` | Override the full name of Prometheus stack resources | `string` | `openchoreo-observability` | -| `kube-prometheus-stack.grafana.enabled` | Enable Grafana dashboards (not used by OpenChoreo - use observability plane instead) | `boolean` | `false` | -| `kube-prometheus-stack.kube-state-metrics.collectors` | Kubernetes resource types to collect metrics from | `array` | `["pods"]` | -| `kube-prometheus-stack.kube-state-metrics.fullnameOverride` | Override the full name of kube-state-metrics resources | `string` | `kube-state-metrics` | -| `kube-prometheus-stack.kube-state-metrics.metricAllowlist` | Specific metrics to collect (allowlist filter) | `array` | | -| `kube-prometheus-stack.kube-state-metrics.metricLabelsAllowlist` | Pod labels to include in metrics for filtering by OpenChoreo resources | `array` | | -| `kube-prometheus-stack.kubeApiServer.enabled` | Enable API server metrics collection | `boolean` | `false` | -| `kube-prometheus-stack.kubeControllerManager.enabled` | Enable controller manager metrics collection | `boolean` | `false` | -| `kube-prometheus-stack.kubeEtcd.enabled` | Enable etcd metrics collection | `boolean` | `false` | -| `kube-prometheus-stack.kubeProxy.enabled` | Enable kube-proxy metrics collection | `boolean` | `false` | -| `kube-prometheus-stack.kubeScheduler.enabled` | Enable scheduler metrics collection | `boolean` | `false` | -| `kube-prometheus-stack.nodeExporter.enabled` | Enable node-level metrics collection | `boolean` | `false` | -| `kube-prometheus-stack.prometheus.agentMode` | Run Prometheus in agent mode for lightweight remote-write only operation | `boolean` | `true` | -| `kube-prometheus-stack.prometheus.enabled` | Deploy a Prometheus instance (requires Prometheus Operator) | `boolean` | `true` | -| `kube-prometheus-stack.prometheus.prometheusSpec.remoteWrite` | Remote write endpoints for forwarding metrics to external storage | `array` | | -| `kube-prometheus-stack.prometheusOperator.enabled` | Enable Prometheus Operator for managing Prometheus instances | `boolean` | `true` | -| `kube-prometheus-stack.prometheusOperator.fullnameOverride` | Override the full name of Prometheus Operator resources | `string` | `prometheus-operator` | -| `kube-prometheus-stack.prometheusOperator.resources.limits.cpu` | CPU limit for Prometheus Operator | `string` | `40m` | -| `kube-prometheus-stack.prometheusOperator.resources.limits.memory` | Memory limit for Prometheus Operator | `string` | `50Mi` | -| `kube-prometheus-stack.prometheusOperator.resources.requests.cpu` | CPU request for Prometheus Operator | `string` | `20m` | -| `kube-prometheus-stack.prometheusOperator.resources.requests.memory` | Memory request for Prometheus Operator | `string` | `30Mi` | +| Parameter | Description | Type | Default | +| :------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------- | :------ | +| `global.commonLabels` | Common labels applied to all resources deployed by this chart | `object` | `{}` | +| `global.imagePullSecrets` | Image pull secrets applied to all first-party pods, for pulling images from authenticated private registries. Entries are LocalObjectReferences (name only). | `array` | `[]` | +| `global.imageRegistry` | Registry override for all first-party container images. When set, it replaces the registry host of each image repository. May include a path (e.g. registry.example.com/ghcr.io) for path-preserving mirrors. Empty uses each image's default registry. | `string` | | ## Kubernetes Cluster Domain diff --git a/docs/reference/helm/observability-plane.mdx b/docs/reference/helm/observability-plane.mdx index 46de6393..ac099333 100644 --- a/docs/reference/helm/observability-plane.mdx +++ b/docs/reference/helm/observability-plane.mdx @@ -57,47 +57,86 @@ Cluster Agent configuration for WebSocket-based communication with the control p | `clusterAgent.tls.serverCAConfigMap` | Name of the ConfigMap containing server CA certificate | `string` | `cluster-gateway-ca` | | `clusterAgent.tls.serverCAValue` | Inline server CA certificate in PEM format (for multi-cluster setups) | `string` | | | `clusterAgent.tolerations` | Tolerations for pod scheduling | `array` | `[]` | +| `clusterAgent.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | ## Controller Manager Configuration for the observability plane controller manager that reconciles ObservabilityAlertRules and other CRDs -| Parameter | Description | Type | Default | -| :-------------------------------------------------------------------- | :---------------------------------------------------------------------- | :-------- | :------------------------------------------------------------------------ | -| `controllerManager.affinity` | Affinity rules for pod scheduling | `object` | `{}` | -| `controllerManager.clusterGateway.enabled` | Enable cluster gateway integration for multi-cluster setups | `boolean` | `false` | -| `controllerManager.clusterGateway.tls.caConfigMap` | Name of the ConfigMap containing the gateway CA certificate | `string` | `cluster-gateway-ca` | -| `controllerManager.clusterGateway.tls.caPath` | Path to the CA certificate file for gateway verification | `string` | `/etc/cluster-gateway/ca.crt` | -| `controllerManager.clusterGateway.url` | URL of the cluster gateway service in the control plane | `string` | `https://cluster-gateway.openchoreo-control-plane.svc.cluster.local:8443` | -| `controllerManager.containerSecurityContext.allowPrivilegeEscalation` | Prevent privilege escalation within the container | `boolean` | `false` | -| `controllerManager.containerSecurityContext.capabilities.drop` | Capabilities to drop from the container | `array` | `["ALL"]` | -| `controllerManager.containerSecurityContext.readOnlyRootFilesystem` | Mount root filesystem as read-only | `boolean` | `false` | -| `controllerManager.containerSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | -| `controllerManager.deploymentPlane` | Identifier for this deployment plane type | `string` | `observabilityplane` | -| `controllerManager.enabled` | Enable or disable the controller manager deployment | `boolean` | `true` | -| `controllerManager.image.pullPolicy` | Image pull policy for the controller manager container | `string` | `IfNotPresent` | -| `controllerManager.image.repository` | Container image repository for the controller manager | `string` | `ghcr.io/openchoreo/controller` | -| `controllerManager.image.tag` | Container image tag (defaults to Chart.AppVersion if empty) | `string` | | -| `controllerManager.manager.args` | Command line arguments passed to the controller manager | `array` | | -| `controllerManager.manager.env.enableWebhooks` | Enable or disable admission webhooks | `string` | `false` | -| `controllerManager.name` | Name of the controller manager deployment and associated resources | `string` | `controller-manager` | -| `controllerManager.nodeSelector` | Node selector for pod scheduling constraints | `object` | `{}` | -| `controllerManager.podSecurityContext.fsGroup` | Group ID for filesystem access | `integer` | `1000` | -| `controllerManager.podSecurityContext.runAsGroup` | Group ID to run the container process | `integer` | `1000` | -| `controllerManager.podSecurityContext.runAsNonRoot` | Require the container to run as a non-root user | `boolean` | `true` | -| `controllerManager.podSecurityContext.runAsUser` | User ID to run the container process | `integer` | `1000` | -| `controllerManager.priorityClass.create` | Create a priority class for the controller manager | `boolean` | `false` | -| `controllerManager.priorityClass.name` | Name of the priority class | `string` | `observabilityplane-controller-manager` | -| `controllerManager.priorityClass.value` | Priority value (higher values indicate higher priority) | `integer` | `900000` | -| `controllerManager.replicas` | Number of controller manager pod replicas | `integer` | `1` | -| `controllerManager.resources.limits.cpu` | CPU limit for the controller manager | `string` | `500m` | -| `controllerManager.resources.limits.memory` | Memory limit for the controller manager | `string` | `512Mi` | -| `controllerManager.resources.requests.cpu` | CPU request for the controller manager | `string` | `100m` | -| `controllerManager.resources.requests.memory` | Memory request for the controller manager | `string` | `256Mi` | -| `controllerManager.serviceAccount.annotations` | Annotations to add to the service account | `object` | `{}` | -| `controllerManager.serviceAccount.create` | Create a dedicated service account for the controller manager | `boolean` | `true` | -| `controllerManager.tolerations` | Tolerations for pod scheduling on tainted nodes | `array` | `[]` | -| `controllerManager.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | +| Parameter | Description | Type | Default | +| :-------------------------------------------------------------------- | :---------------------------------------------------------------------- | :-------- | :-------------------------------------- | +| `controllerManager.affinity` | Affinity rules for pod scheduling | `object` | `{}` | +| `controllerManager.containerSecurityContext.allowPrivilegeEscalation` | Prevent privilege escalation within the container | `boolean` | `false` | +| `controllerManager.containerSecurityContext.capabilities.drop` | Capabilities to drop from the container | `array` | `["ALL"]` | +| `controllerManager.containerSecurityContext.readOnlyRootFilesystem` | Mount root filesystem as read-only | `boolean` | `false` | +| `controllerManager.containerSecurityContext.seccompProfile.type` | Seccomp profile type | `string` | `RuntimeDefault` | +| `controllerManager.deploymentPlane` | Identifier for this deployment plane type | `string` | `observabilityplane` | +| `controllerManager.enabled` | Enable or disable the controller manager deployment | `boolean` | `true` | +| `controllerManager.image.pullPolicy` | Image pull policy for the controller manager container | `string` | `IfNotPresent` | +| `controllerManager.image.repository` | Container image repository for the controller manager | `string` | `ghcr.io/openchoreo/controller` | +| `controllerManager.image.tag` | Container image tag (defaults to Chart.AppVersion if empty) | `string` | | +| `controllerManager.manager.args` | Command line arguments passed to the controller manager | `array` | | +| `controllerManager.manager.env.enableWebhooks` | Enable or disable admission webhooks | `string` | `false` | +| `controllerManager.name` | Name of the controller manager deployment and associated resources | `string` | `controller-manager` | +| `controllerManager.nodeSelector` | Node selector for pod scheduling constraints | `object` | `{}` | +| `controllerManager.podSecurityContext.fsGroup` | Group ID for filesystem access | `integer` | `1000` | +| `controllerManager.podSecurityContext.runAsGroup` | Group ID to run the container process | `integer` | `1000` | +| `controllerManager.podSecurityContext.runAsNonRoot` | Require the container to run as a non-root user | `boolean` | `true` | +| `controllerManager.podSecurityContext.runAsUser` | User ID to run the container process | `integer` | `1000` | +| `controllerManager.priorityClass.create` | Create a priority class for the controller manager | `boolean` | `false` | +| `controllerManager.priorityClass.name` | Name of the priority class | `string` | `observabilityplane-controller-manager` | +| `controllerManager.priorityClass.value` | Priority value (higher values indicate higher priority) | `integer` | `900000` | +| `controllerManager.replicas` | Number of controller manager pod replicas | `integer` | `1` | +| `controllerManager.resources.limits.cpu` | CPU limit for the controller manager | `string` | `500m` | +| `controllerManager.resources.limits.memory` | Memory limit for the controller manager | `string` | `512Mi` | +| `controllerManager.resources.requests.cpu` | CPU request for the controller manager | `string` | `100m` | +| `controllerManager.resources.requests.memory` | Memory request for the controller manager | `string` | `256Mi` | +| `controllerManager.serviceAccount.annotations` | Annotations to add to the service account | `object` | `{}` | +| `controllerManager.serviceAccount.create` | Create a dedicated service account for the controller manager | `boolean` | `true` | +| `controllerManager.tolerations` | Tolerations for pod scheduling on tainted nodes | `array` | `[]` | +| `controllerManager.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | + +## Fin Ops Agent + +FinOps Agent Configuration + +| Parameter | Description | Type | Default | +| :-------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------- | :---------------------------------------------------------------------- | +| `finOpsAgent.affinity` | Affinity rules for pod scheduling | `object` | `{}` | +| `finOpsAgent.analysisTimeoutSeconds` | Analysis timeout in seconds | `integer` | `600` | +| `finOpsAgent.authz.timeoutSeconds` | Authorization request timeout in seconds | `integer` | `30` | +| `finOpsAgent.cors.allowedOrigins` | List of allowed origins for CORS requests. Empty list disables CORS. | `array` | | +| `finOpsAgent.enabled` | Enable FinOps agent deployment | `boolean` | `false` | +| `finOpsAgent.extraEnvs` | Extra environment variables for the FinOps agent container | `array` | | +| `finOpsAgent.http.enabled` | Enable HTTPRoute | `boolean` | `true` | +| `finOpsAgent.http.hostnames` | HTTPRoute hostnames | `array` | | +| `finOpsAgent.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | +| `finOpsAgent.image.repository` | Container image repository | `string` | `ghcr.io/openchoreo/finops-agent` | +| `finOpsAgent.image.tag` | Container image tag (defaults to Chart.AppVersion if empty) | `string` | | +| `finOpsAgent.llmBaseUrl` | Optional OpenAI-compatible base URL for LLM calls. Set this to route through the ai-gateway-agentgateway module (e.g., http://agentgateway-proxy.openchoreo-data-plane) instead of calling the provider directly. When set, the provider API key is managed at the gateway and LLM_API_KEY may be a placeholder. | `string` | | +| `finOpsAgent.llmName` | LLM model name (e.g., gpt-5.2) | `string` | | +| `finOpsAgent.logLevel` | Log level for the FinOps agent | `string` | `INFO` | +| `finOpsAgent.maxConcurrentAnalyses` | Maximum number of concurrent analyses | `integer` | `5` | +| `finOpsAgent.nodeSelector` | Node selector for pod scheduling | `object` | `{}` | +| `finOpsAgent.oauth.clientId` | OAuth2 client ID registered with the IDP | `string` | `openchoreo-finops-agent` | +| `finOpsAgent.oauth.scope` | Optional OAuth2 scope to request in the client credentials token request | `string` | | +| `finOpsAgent.observabilityMcpServerUrl` | Observability MCP Server URL | `string` | `http://observer:8080/mcp` | +| `finOpsAgent.openchoreoApiUrl` | OpenChoreo API URL for authorization service | `string` | `http://api.openchoreo.invalid:8080` | +| `finOpsAgent.opencostMcpServerUrl` | OpenCost MCP Server URL | `string` | `http://opencost.openchoreo-observability-plane.svc.cluster.local:8081` | +| `finOpsAgent.remediationEnabled` | Enable remediation capability (synthesizes a ResourceChange action from overprovisioning recommendations) | `boolean` | `false` | +| `finOpsAgent.replicas` | Number of FinOps agent replicas | `integer` | `1` | +| `finOpsAgent.reportBackend` | Report storage backend type | `string` | `sqlite` | +| `finOpsAgent.resources.limits.cpu` | CPU limit | `string` | `250m` | +| `finOpsAgent.resources.limits.memory` | Memory limit | `string` | `1536Mi` | +| `finOpsAgent.resources.requests.cpu` | CPU request | `string` | `100m` | +| `finOpsAgent.resources.requests.memory` | Memory request | `string` | `1024Mi` | +| `finOpsAgent.secretName` | Name of an existing Secret injected via envFrom into the FinOps agent container. Required keys - LLM_API_KEY, OAUTH_CLIENT_SECRET. Optional keys - SQL_BACKEND_URI (when reportBackend is postgresql). | `string` | `finops-agent` | +| `finOpsAgent.service.port` | Service port | `integer` | `8080` | +| `finOpsAgent.service.type` | Service type | `string` | `ClusterIP` | +| `finOpsAgent.sqliteStorageSize` | PVC storage size for SQLite (only used when reportBackend is sqlite) | `string` | `128Mi` | +| `finOpsAgent.tlsInsecureSkipVerify` | Skip TLS certificate verification for MCP server connections (use for self-signed certs) | `boolean` | `false` | +| `finOpsAgent.tolerations` | Tolerations for pod scheduling | `array` | `[]` | +| `finOpsAgent.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | ## Gateway @@ -107,6 +146,7 @@ Gateway resource configuration for observability plane routing | :-------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------- | :--------------------- | | `gateway.annotations` | Annotations added to the Gateway resource. Use this to configure cert-manager, external-dns, or other integrations. | `object` | `{}` | | `gateway.enabled` | Enable Gateway CR creation | `boolean` | `true` | +| `gateway.gatewayClassName` | GatewayClass name to reference in the Gateway CR | `string` | `kgateway` | | `gateway.httpPort` | HTTP listener port | `integer` | `80` | | `gateway.httpsPort` | HTTPS listener port | `integer` | `443` | | `gateway.infrastructure` | Gateway infrastructure configuration passed to the generated Service. Used to configure cloud provider load balancer settings via annotations. Example for AWS with Elastic IP: infrastructure: annotations: service.beta.kubernetes.io/aws-load-balancer-type: "external" | `object` | | @@ -121,10 +161,12 @@ Gateway resource configuration for observability plane routing Global values shared across all components in the observability plane -| Parameter | Description | Type | Default | -| :------------------------ | :----------------------------------------------------------- | :------- | :-------------- | -| `global.commonLabels` | Common labels applied to all resources created by this chart | `object` | `{}` | -| `global.installationMode` | Installation mode of OpenChoreo | `string` | `singleCluster` | +| Parameter | Description | Type | Default | +| :------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------- | :-------------- | +| `global.commonLabels` | Common labels applied to all resources created by this chart | `object` | `{}` | +| `global.imagePullSecrets` | Image pull secrets applied to all first-party pods, for pulling images from authenticated private registries. Entries are LocalObjectReferences (name only). | `array` | `[]` | +| `global.imageRegistry` | Registry override for all first-party container images. When set, it replaces the registry host of each image repository. May include a path (e.g. registry.example.com/ghcr.io) for path-preserving mirrors. Empty uses each image's default registry. | `string` | | +| `global.installationMode` | Installation mode of OpenChoreo | `string` | `singleCluster` | ## Kubernetes Cluster Domain @@ -136,14 +178,16 @@ Kubernetes cluster domain used for service discovery DNS resolution ## Observer -OpenChoreo Observer service configuration - REST API that abstracts OpenSearch for logging, metrics, and tracing +OpenChoreo Observer service configuration - REST API that abstracts observability backends for logging, metrics, and tracing via adapters | Parameter | Description | Type | Default | | :------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :-------- | :------------------------------------------- | +| `observer.affinity` | Affinity rules for pod scheduling | `object` | `{}` | | `observer.alertStoreBackend` | Alert entry storage backend for fired alerts | `string` | `sqlite` | | `observer.alertStoreSqliteSize` | PVC size for SQLite alert entry storage | `string` | `128Mi` | +| `observer.alertSuppressionWindow` | Duration within which duplicate alerts for the same alert rule are suppressed. Set to "0" to disable. | `string` | `1h` | | `observer.authzTlsInsecureSkipVerify` | Skip TLS certificate verification when calling the control plane authz service (use for self-signed certs) | `boolean` | `false` | -| `observer.controlPlaneApiUrl` | Control plane API base URL used by observer | `string` | `http://api.openchoreo.localhost:8080` | +| `observer.controlPlaneApiUrl` | Control plane API base URL used by observer | `string` | `http://api.openchoreo.invalid:8080` | | `observer.cors.allowedOrigins` | List of allowed origins for CORS requests. Empty list disables CORS. | `array` | | | `observer.extraEnvs` | Extra environment variables for the Observer container | `array` | | | `observer.http.enabled` | Enable HTTPRoute | `boolean` | `true` | @@ -155,7 +199,9 @@ OpenChoreo Observer service configuration - REST API that abstracts OpenSearch f | `observer.logLevel` | Log level for the Observer service | `string` | `info` | | `observer.logsAdapter.timeout` | Timeout for logs adapter requests | `string` | `30s` | | `observer.logsAdapter.url` | URL of the logs adapter service | `string` | `http://logs-adapter:9098` | +| `observer.nodeSelector` | Node selector for pod scheduling | `object` | `{}` | | `observer.oauthClientId` | OAuth2 client ID used by the Observer when calling the control plane API | `string` | `openchoreo-observer-resource-reader-client` | +| `observer.oauthScope` | Optional OAuth2 scope to request in the client credentials token request | `string` | | | `observer.replicas` | Number of Observer pod replicas | `integer` | `1` | | `observer.resources.limits.cpu` | CPU limit for the Observer | `string` | `200m` | | `observer.resources.limits.memory` | Memory limit for the Observer | `string` | `200Mi` | @@ -165,62 +211,65 @@ OpenChoreo Observer service configuration - REST API that abstracts OpenSearch f | `observer.security.subjectTypes` | Subject type configurations for JWT subject resolution | `array` | | | `observer.service.port` | Service port for the Observer API | `integer` | `8080` | | `observer.service.type` | Kubernetes service type | `string` | `ClusterIP` | +| `observer.tolerations` | Tolerations for pod scheduling | `array` | `[]` | +| `observer.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | | `observer.tracingAdapter.timeout` | Timeout for tracing adapter requests | `string` | `30s` | | `observer.tracingAdapter.url` | URL of the tracing adapter service | `string` | `http://tracing-adapter:9100` | -:::note -The Observer includes a **uid-resolver** component that uses the OAuth2 `client_credentials` grant to call the control plane API for component/project/environment identity resolution. -The relevant values are `observer.oauthClientId`, the `UID_RESOLVER_OAUTH_CLIENT_SECRET` key in `observer.secretName` secret, and `security.oidc.tokenUrl`. -When using an external identity provider, refer to [Observer External IDP Configuration](../../platform-engineer-guide/observability-alerting.mdx#observer-external-idp-configuration) for setup steps. -::: - ## Rca AI-powered Root Cause Analysis agent configuration -| Parameter | Description | Type | Default | -| :------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :-------- | :------------------------------------- | -| `rca.authz.timeoutSeconds` | Authorization request timeout in seconds | `integer` | `30` | -| `rca.cors.allowedOrigins` | List of allowed origins for CORS requests. Empty list disables CORS. | `array` | | -| `rca.enabled` | Enable SRE Agent deployment | `boolean` | `false` | -| `rca.extraEnvs` | Extra environment variables for the SRE Agent container | `array` | | -| `rca.http.enabled` | Enable HTTPRoute | `boolean` | `true` | -| `rca.http.hostnames` | HTTPRoute hostnames | `array` | | -| `rca.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | -| `rca.image.repository` | Container image repository | `string` | `ghcr.io/openchoreo/ai-rca-agent` | -| `rca.image.tag` | Container image tag (defaults to Chart.AppVersion if empty) | `string` | | -| `rca.llm.modelName` | LLM model name (e.g., gpt-5.2) | `string` | | -| `rca.logLevel` | Log level for the SRE Agent | `string` | `INFO` | -| `rca.name` | Name of the SRE Agent deployment | `string` | `ai-rca-agent` | -| `rca.oauth.clientId` | OAuth2 client ID registered with the IDP | `string` | `openchoreo-rca-agent` | -| `rca.observerApiUrl` | Observer API base URL | `string` | `http://observer:8080` | -| `rca.openchoreoApiUrl` | OpenChoreo API base URL used by the SRE Agent | `string` | `http://api.openchoreo.localhost:8080` | -| `rca.remedAgent` | Enable remediation agent | `boolean` | `true` | -| `rca.replicas` | Number of SRE Agent replicas | `integer` | `1` | -| `rca.reportBackend` | Report storage backend type | `string` | `sqlite` | -| `rca.resources.limits.cpu` | CPU limit | `string` | `250m` | -| `rca.resources.limits.memory` | Memory limit | `string` | `1536Mi` | -| `rca.resources.requests.cpu` | CPU request | `string` | `100m` | -| `rca.resources.requests.memory` | Memory request | `string` | `1024Mi` | -| `rca.secretName` | Name of an existing Secret injected via envFrom into the SRE Agent container. Required keys - RCA_LLM_API_KEY, OAUTH_CLIENT_SECRET. Optional keys - SQL_BACKEND_URI (when reportBackend is postgresql). | `string` | `rca-agent-secret` | -| `rca.service.port` | Service port | `integer` | `8080` | -| `rca.service.type` | Service type | `string` | `ClusterIP` | -| `rca.sqliteStorageSize` | PVC storage size for SQLite (only used when reportBackend is sqlite) | `string` | `128Mi` | +| Parameter | Description | Type | Default | +| :------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------- | :----------------------------------- | +| `rca.affinity` | Affinity rules for pod scheduling | `object` | `{}` | +| `rca.authz.timeoutSeconds` | Authorization request timeout in seconds | `integer` | `30` | +| `rca.cors.allowedOrigins` | List of allowed origins for CORS requests. Empty list disables CORS. | `array` | | +| `rca.enabled` | Enable RCA agent deployment | `boolean` | `false` | +| `rca.extraEnvs` | Extra environment variables for the RCA agent container | `array` | | +| `rca.http.enabled` | Enable HTTPRoute | `boolean` | `true` | +| `rca.http.hostnames` | HTTPRoute hostnames | `array` | | +| `rca.image.pullPolicy` | Image pull policy | `string` | `IfNotPresent` | +| `rca.image.repository` | Container image repository | `string` | `ghcr.io/openchoreo/sre-agent` | +| `rca.image.tag` | Container image tag (defaults to Chart.AppVersion if empty) | `string` | | +| `rca.llm.baseUrl` | Optional OpenAI-compatible base URL for LLM calls. Set this to route through the ai-gateway-agentgateway module (e.g., http://agentgateway-proxy.openchoreo-data-plane) instead of calling the provider directly. When set, the provider API key is managed at the gateway and RCA_LLM_API_KEY may be a placeholder. | `string` | | +| `rca.llm.modelName` | LLM model name (e.g., gpt-5.2) | `string` | | +| `rca.logLevel` | Log level for the RCA agent | `string` | `INFO` | +| `rca.name` | Name of the RCA agent deployment | `string` | `sre-agent` | +| `rca.nodeSelector` | Node selector for pod scheduling | `object` | `{}` | +| `rca.oauth.clientId` | OAuth2 client ID registered with the IDP | `string` | `openchoreo-rca-agent` | +| `rca.oauth.scope` | Optional OAuth2 scope to request in the client credentials token request | `string` | | +| `rca.observerApiUrl` | Observer API base URL | `string` | `http://observer:8080` | +| `rca.openchoreoApiUrl` | OpenChoreo API base URL used by rca-agent | `string` | `http://api.openchoreo.invalid:8080` | +| `rca.remedAgent` | Enable remediation agent | `boolean` | `true` | +| `rca.replicas` | Number of RCA agent replicas | `integer` | `1` | +| `rca.reportBackend` | Report storage backend type | `string` | `sqlite` | +| `rca.resources.limits.cpu` | CPU limit | `string` | `250m` | +| `rca.resources.limits.memory` | Memory limit | `string` | `1536Mi` | +| `rca.resources.requests.cpu` | CPU request | `string` | `100m` | +| `rca.resources.requests.memory` | Memory request | `string` | `1024Mi` | +| `rca.secretName` | Name of an existing Secret injected via envFrom into the RCA agent container. Required keys - RCA_LLM_API_KEY, OAUTH_CLIENT_SECRET. Optional keys - SQL_BACKEND_URI (when reportBackend is postgresql). | `string` | `rca-agent-secret` | +| `rca.service.port` | Service port | `integer` | `8080` | +| `rca.service.type` | Service type | `string` | `ClusterIP` | +| `rca.sqliteStorageSize` | PVC storage size for SQLite (only used when reportBackend is sqlite) | `string` | `128Mi` | +| `rca.tolerations` | Tolerations for pod scheduling | `array` | `[]` | +| `rca.topologySpreadConstraints` | Topology spread constraints for pod distribution across failure domains | `array` | `[]` | ## Security Common security configuration shared across all components -| Parameter | Description | Type | Default | -| :----------------------------------------------- | :-------------------------------------------------------------------------------------- | :-------- | :------ | -| `security.enabled` | Global security toggle - when disabled, authentication is turned off for all components | `boolean` | `true` | -| `security.jwt.audience` | Expected audience claim in JWT tokens | `string` | | -| `security.oidc.authServerBaseUrl` | Base URL for the authorization server (used for OAuth metadata) | `string` | | -| `security.oidc.issuer` | OIDC issuer URL | `string` | | -| `security.oidc.jwksUrl` | JWKS URL for token verification | `string` | | -| `security.oidc.jwksUrlTlsInsecureSkipVerify` | Skip TLS verification for JWKS URL | `string` | `false` | -| `security.oidc.tokenUrl` | OIDC token endpoint URL | `string` | | -| `security.oidc.uidResolverTlsInsecureSkipVerify` | Skip TLS verification for the UID resolver OAuth token endpoint (for self-signed certs) | `string` | `false` | +| Parameter | Description | Type | Default | +| :----------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------- | :------ | +| `security.enabled` | Global security toggle - when disabled, authentication is turned off for all components | `boolean` | `true` | +| `security.jwt.audience` | Expected audience claim in JWT tokens | `string` | | +| `security.oidc.authServerBaseUrl` | Base URL for the authorization server (used for OAuth metadata) | `string` | | +| `security.oidc.issuer` | OIDC issuer URL | `string` | | +| `security.oidc.jwksUrl` | JWKS URL for token verification | `string` | | +| `security.oidc.jwksUrlTlsInsecureSkipVerify` | Skip TLS verification for JWKS URL | `string` | `false` | +| `security.oidc.mcpOAuthScopes` | OAuth scopes advertised by the observer's MCP endpoint via the protected-resource metadata (RFC 9728) and WWW-Authenticate 401 challenge. Leave empty to use the default (openid profile email). | `array` | | +| `security.oidc.tokenUrl` | OIDC token endpoint URL | `string` | | +| `security.oidc.uidResolverTlsInsecureSkipVerify` | Skip TLS verification for the UID resolver OAuth token endpoint (for self-signed certs) | `string` | `false` | ## Tls diff --git a/docs/reference/helm/workflow-plane.mdx b/docs/reference/helm/workflow-plane.mdx index c494b24d..f737bf82 100644 --- a/docs/reference/helm/workflow-plane.mdx +++ b/docs/reference/helm/workflow-plane.mdx @@ -10,7 +10,7 @@ This chart depends on the following sub-charts. For full configuration options o | Name | Version | Repository | Condition | | :----------------------------------------------------- | :------ | :--------------------------------------------------------------------------- | :-------- | -| [argo-workflows](https://argoproj.github.io/argo-helm) | 0.45.2 | [https://argoproj.github.io/argo-helm](https://argoproj.github.io/argo-helm) | - | +| [argo-workflows](https://argoproj.github.io/argo-helm) | 1.0.18 | [https://argoproj.github.io/argo-helm](https://argoproj.github.io/argo-helm) | - | ## Argo Workflows @@ -79,19 +79,14 @@ Cluster Agent configuration for agent-based communication with control plane | `clusterAgent.tls.secretName` | Secret containing client certificate and key | `string` | `cluster-agent-tls` | | `clusterAgent.tls.serverCAConfigMap` | ConfigMap containing server CA certificate for verifying gateway | `string` | `cluster-gateway-ca` | | `clusterAgent.tolerations` | Tolerations for cluster agent pods | `array` | | +| `clusterAgent.topologySpreadConstraints` | Topology spread constraints for cluster agent pods | `array` | | ## Global Global configuration values shared across all components -| Parameter | Description | Type | Default | -| :-------------------- | :------------------------------------- | :------- | :------ | -| `global.commonLabels` | Common labels to add to every resource | `object` | | - -## Wait Job - -Wait job configuration for post-install hooks - -| Parameter | Description | Type | Default | -| :-------------- | :-------------------------------------------------------- | :------- | :----------------------------- | -| `waitJob.image` | Container image used for wait jobs (must contain kubectl) | `string` | `bitnamilegacy/kubectl:1.32.4` | +| Parameter | Description | Type | Default | +| :------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------- | :------ | +| `global.commonLabels` | Common labels to add to every resource | `object` | | +| `global.imagePullSecrets` | Image pull secrets applied to all first-party pods, for pulling images from authenticated private registries. Entries are LocalObjectReferences (name only). | `array` | `[]` | +| `global.imageRegistry` | Registry override for all first-party container images. When set, it replaces the registry host of each image repository. May include a path (e.g. registry.example.com/ghcr.io) for path-preserving mirrors. Empty uses each image's default registry. | `string` | |