Connector Gateway Helm values
Configure the Connector Gateway chart with these Helm values.
This reference lists values declared in the chart's default values.yaml.
Templates can also accept optional settings and inherited global values.
Chart: connector-gateway. Chart version: 0.24.0. Generated from the platform
source at v0.24.0.
Values
replicaCount
Type: int
Default: 1
Number of replicas for the deployment
image.repository
Type: string
Default value
image-proxy.stacklok.com/proxy/stacklok-enterprise/ghcr.io/stacklok/stacklok-enterprise/connector-gateway
Container image repository. Customers running their own mirror override this.
image.tag
Type: string
Default: ""
Image tag (defaults to appVersion if empty)
image.pullPolicy
Type: string
Default: "IfNotPresent"
Image pull policy
imagePullSecrets
Type: list
Default: []
Extra image pull Secrets for the pod. On Replicated installs the SDK's
enterprise-pull-secret is merged in automatically; list only additional
registries here.
nameOverride
Type: string
Default: ""
Override the name of the chart
fullnameOverride
Type: string
Default: ""
Override the full name of the resources
serviceAccount.create
Type: bool
Default: true
Create a ServiceAccount. The gateway uses its token to verify internalApi callers and to authenticate to Directory, metering ingest and enterprise-manager.
serviceAccount.automount
Type: bool
Default: true
Mount the ServiceAccount token. Required: the gateway reads it.
serviceAccount.annotations
Type: object
Default: {}
Annotations to add to the service account
serviceAccount.name
Type: string
Default: ""
The name of the service account to use (if not set and create is true, a name is generated using the fullname template)
podAnnotations
Type: object
Default: {}
Annotations to add to the pod
podLabels
Type: object
Default: {}
Labels to add to the pod
podSecurityContext
Type: object
Default value
fsGroup: 65532
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
seccompProfile:
type: RuntimeDefault
Security context for the pod (the image runs as nonroot UID 65532)
securityContext
Type: object
Default value
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65532
Security context for the container
service.type
Type: string
Default: "ClusterIP"
Kubernetes service type
service.port
Type: int
Default: 8443
Service port
service.targetPort
Type: int
Default: 8443
Container port serving /gw/mcp, /health and /readyz.
controlPlane
Type: object
Default: {"enabled":true,"port":8090,"type":"ClusterIP"}
Control plane (per-user connector-configuration API) on its own port and
<fullname>-control-plane Service. It serves only when
enterpriseConfig.directory is set and is fail-closed without auth; disable only
for a data-plane-only deployment.
controlPlane.enabled
Type: bool
Default: true
Enable the control-plane port + Service
controlPlane.type
Type: string
Default: "ClusterIP"
Control-plane Service type
controlPlane.port
Type: int
Default: 8090
Control-plane port, used by both the container and the Service.
internalApi
Type: object
Default value
allowedSubjects: []
audience: connector-gateway-internal
deriveEnterpriseManagerSubject: false
enabled: false
issuer: ''
port: 8091
type: ClusterIP
Internal service-to-service API (e.g. enterprise-manager refreshing a
Connector's tool list), authenticated with a projected ServiceAccount token
carrying audience from a subject in allowedSubjects. Under
networkPolicy.allowExternalEgress: false, allow the kube-apiserver in
networkPolicy.egress or every call is rejected as unauthenticated.
internalApi.enabled
Type: bool
Default: false
Enable the internal listener, its Service, and the app-config section.
internalApi.port
Type: int
Default: 8091
Internal listener port, used by both the container and the Service.
internalApi.type
Type: string
Default: "ClusterIP"
Internal Service type. Keep ClusterIP: this API is for in-cluster callers only.
internalApi.audience
Type: string
Default: "connector-gateway-internal"
The aud claim a caller's token must carry. Must equal the enterprise-manager chart's directory.connectorGateway.tokenAudience.
internalApi.allowedSubjects
Type: list
Default: []
ServiceAccount subjects (system:serviceaccount:<namespace>:<name>) permitted
to call; required when enabled. Each can revoke any User's stored upstream
tokens on this gateway. A set list replaces the derived one, so include
enterprise-manager's subject yourself.
internalApi.deriveEnterpriseManagerSubject
Type: bool
Default: false
When allowedSubjects is empty, derive the same-release enterprise-manager's subject. The umbrella sets this; leave false standalone so an empty list is refused.
internalApi.issuer
Type: string
Default: ""
Expected iss claim. Empty skips the issuer check.
telemetry
Type: object
Default value
metrics:
port: 9464
otlp:
enabled: false
endpoint: ''
insecure: false
loggingEnabled: false
tracingEnabled: false
prometheus:
enabled: false
Metrics export. Both exporters default off.
telemetry.otlp.enabled
Type: bool
Default: false
Push metrics to an OTLP collector.
telemetry.otlp.endpoint
Type: string
Default: ""
Collector endpoint (e.g. "otel-collector.observability:4318"). Required when otlp.enabled, tracingEnabled or loggingEnabled is true.
telemetry.otlp.insecure
Type: bool
Default: false
Disable TLS on the OTLP connection. Only for a collector on a trusted private network.
telemetry.otlp.tracingEnabled
Type: bool
Default: false
Push traces to the OTLP collector. Requires endpoint.
telemetry.otlp.loggingEnabled
Type: bool
Default: false
Push logs to the OTLP collector in addition to stderr. Requires endpoint.
telemetry.prometheus.enabled
Type: bool
Default: false
Expose /metrics on the dedicated metrics.port listener (never the control-plane port).
telemetry.metrics
Type: object
Default: {"port":9464}
Dedicated /metrics listener, bound when prometheus.enabled is true.
resources
Type: object
Default:
{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"100m","memory":"256Mi"}}
Resource limits and requests for the container
startupProbe
Type: object
Default value
failureThreshold: 60
httpGet:
path: /health
port: http
initialDelaySeconds: 0
periodSeconds: 2
successThreshold: 1
timeoutSeconds: 5
Startup probe. Holds off liveness until startup Directory registration and the first catalog refresh finish, which can take ~94s before /health binds. Keep failureThreshold x periodSeconds above that, or the kubelet kills a slow but healthy boot.
livenessProbe
Type: object
Default value
failureThreshold: 3
httpGet:
path: /health
port: http
initialDelaySeconds: 0
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
Liveness probe on /health. Startup is covered by startupProbe.
readinessProbe
Type: object
Default value
failureThreshold: 3
httpGet:
path: /readyz
port: http
initialDelaySeconds: 0
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 3
Readiness probe on /readyz, which returns 503 until the first Connector catalog refresh from Directory succeeds. An unready pod also drops out of the control-plane Service.
vmcpConfig
Type: object
Default value
aggregation:
conflictResolution: prefix
conflictResolutionConfig:
prefixFormat: '{workload}_'
groupRef: ''
incomingAuth:
type: anonymous
name: connector-gateway
outgoingAuth:
source: discovered
vMCP configuration the gateway loads at startup. Strict-decoded: unknown fields
are rejected. Backends always come from Directory Connectors. Leaving audit
unset falls back to global.stacklok.audit; setting it here in any shape
overrides that in full.
vmcpConfig.groupRef
Type: string
Default: ""
MCPGroup name, used for status/logging only.
vmcpConfig.outgoingAuth
Type: object
Default: {"source":"discovered"}
outgoingAuth.backends and outgoingAuth.default are ignored (one startup WARN when set): every backend's auth comes from its Directory Connector.
enterpriseConfig
Type: string
Default: nil
Enterprise-only configuration (authServer, directory, outbox, metering, redis,
...), strict-decoded by the gateway. gateway.id and authServer.issuer are
chart-owned (from global.stacklok.connectorGatewayId and
global.stacklok.authServerIssuer); setting either here is refused at render.
appConfig
Type: object
Default: {}
Inline AppConfig override, deep-merged over the chart-computed document; keys
here win. Set logLevel: debug to raise log verbosity. primaryIdp overrides
global.stacklok.primaryIdp per install; its clientClaim is limited to
cid/client_id/azp/appid unless clientClaimAllowUnsafe: true. For an Entra v2.0
issuer the chart renders clientClaim azp and subjectClaim oid (scopes must
include profile) and refuses other values.
appConfig:
featureFlags:
aiGateway: true
# primaryIdp:
# clientClaim: azp
redis
Type: object
Default: {"host":""}
Per-subchart Redis/Valkey topology override of global.redis. Auth always comes from global.redis. Empty fields inherit.
redis.host
Type: string
Default: ""
Hostname (or IP/CNAME) of the external Redis/Valkey instance. Empty inherits
global.redis.host.
config.mountPath
Type: string
Default: "/etc/connector-gateway/config"
Directory the vMCP config ConfigMap is mounted into.
config.fileName
Type: string
Default: "vmcp.yaml"
File name of the rendered vMCP config within mountPath.
config.enterpriseFileName
Type: string
Default: "enterprise.yaml"
File name of the rendered app-config document within mountPath.
nodeSelector
Type: object
Default: {}
Node labels for pod assignment
tolerations
Type: list
Default: []
Tolerations for pod assignment
affinity
Type: object
Default: {}
Affinity rules for pod assignment
directoryTLS
Type: object
Default value
audience: directory-service
caBundle:
key: ca.crt
secretName: ''
enabled: false
expirationSeconds: 3600
mountPath: /etc/directory-tls
tokenMountPath: /var/run/secrets/directory
Chart-managed transport to Directory's gRPC API: mounts the CA bundle, projects an audience-bound ServiceAccount token, and writes the matching enterpriseConfig.directory.tls paths. When enabled, a hand-written directory.tls is refused. A rotated CA bundle takes effect only after a pod restart; the token refreshes in place.
directoryTLS.enabled
Type: bool
Default: false
Enable the chart-managed directory transport: the CA bundle mount, the projected ServiceAccount token, and the app-config paths that name them.
directoryTLS.caBundle.secretName
Type: string
Default: ""
Secret holding the PEM bundle that verifies Directory's serving certificate. Required when enabled. Use a CA-only Secret, not cert-manager's <fullname>-grpc-tls, which also holds the serving private key.
directoryTLS.caBundle.key
Type: string
Default: "ca.crt"
Key within that Secret holding the PEM bundle; also names the mounted file. Must be non-empty and not tls.key.
directoryTLS.mountPath
Type: string
Default: "/etc/directory-tls"
Directory the CA bundle Secret is mounted into.
directoryTLS.tokenMountPath
Type: string
Default: "/var/run/secrets/directory"
Directory the projected ServiceAccount token is mounted into (as token).
directoryTLS.audience
Type: string
Default: "directory-service"
Audience Directory's caller-auth gate expects. Fixed on the Directory side, so changing it breaks every call. Must be non-empty.
directoryTLS.expirationSeconds
Type: int
Default: 3600
Requested projected-token lifetime. Minimum 600: the API server rejects the Pod below that.
primaryIdpCA
Type: object
Default: {"mountPath":"/etc/primary-idp-ca"}
Mount location for the primary IdP CA bundle set by
global.stacklok.primaryIdp.caBundleRef. Prefer a CA-only source (key: tls.key
is refused). Rotating the bundle's contents in place needs a manual pod restart.
primaryIdpCA.mountPath
Type: string
Default: "/etc/primary-idp-ca"
Directory the primary IdP CA bundle is mounted into.
meteringTokenProjection
Type: object
Default value
audience: metering-ingest
enabled: false
expirationSeconds: 3600
mountPath: /var/run/secrets/metering
Chart-managed ServiceAccount token for the metering ingest. When enterpriseConfig.outbox.enabled is true, enable this, set enterpriseConfig.metering.insecure, or mount your own token via extraVolumes, or the render fails.
meteringTokenProjection.enabled
Type: bool
Default: false
Project the token and mount it at <mountPath>/token.
meteringTokenProjection.mountPath
Type: string
Default: "/var/run/secrets/metering"
Directory the projected ServiceAccount token is mounted into.
meteringTokenProjection.audience
Type: string
Default: "metering-ingest"
Audience the metering ingest expects. Fixed on the ingest side; do not change.
meteringTokenProjection.expirationSeconds
Type: int
Default: 3600
Requested projected-token lifetime. Minimum 600.
extraEnv
Type: list
Default: []
Additional environment variables for the container. Setting HTTP_PROXY/HTTPS_PROXY moves the private-address SSRF guard to the proxy: exclude Connector endpoints via NO_PROXY or enforce the deny-list at the proxy.
extraVolumes
Type: list
Default: []
Additional volumes to attach to the pod.
extraVolumeMounts
Type: list
Default: []
Additional volume mounts for the container. Names must match an entry in
extraVolumes.
kek
Type: object
Default value
activeVersion: ''
allowGenerateOnUpgrade: false
existingSecret: ''
generate: false
keyringGeneration: ''
value: ''
KEK for embedded auth-server envelope encryption. Required when the effective
AppConfig enables authServer. Choose exactly one source below; losing or
replacing the key makes existing credentials unreadable. See
Rotate the encryption key.
kek.existingSecret
Type: string
Default: ""
Existing Secret in the release namespace with key material under kek. The
chart does not manage it. Required for Argo CD and render-and-apply workflows.
Restart pods after changing its content; retain old versions during rotation.
kek.value
Type: string
Default: ""
Inline, base64-encoded key material. Accepted decoded forms:
single key base64 of 32 random bytes openssl rand -base64 32 version map
base64 of {"1":"<base64 32B>","2":"<base64 32B>"}
Rotation requires the version map. Prefer existingSecret; Helm release data
and helm get values expose inline values.
kek.generate
Type: bool
Default: false
Generate and preserve a version-1 key on a live Helm install. Do not use with
helm template, Argo CD, or other render-and-apply workflows because they
cannot preserve a key through lookup.
kek.allowGenerateOnUpgrade
Type: bool
Default: false
Allow generation during an upgrade only for a confirmed first enable. A lookup miss can also mean missing Secret RBAC or a client-only renderer.
kek.activeVersion
Type: string
Default: ""
Keyring version new writes seal under; empty means the highest present. Pin it during a two-phase rotation so no replica writes under a key a peer cannot yet read.
kek.keyringGeneration
Type: string
Default: ""
Free-form token hashed into the pod checksum to force a rollout. Required in existingSecret and generate modes, where Secret content changes are invisible to the chart: bump it on every rotation phase one.
authServerKeys
Type: object
Default value
allowGenerateOnUpgrade: false
existingSecret: ''
generate: false
rotatedHmacSecretKeys: []
rotatedSigningKeys: []
Durable key material for the embedded auth server. Required when the effective
AppConfig enables authServer. Choose exactly one source below.
authServerKeys.existingSecret
Type: string
Default: ""
Existing Secret in the release namespace containing signing-key.pem (PEM ECDSA
private key) and hmac-secret (at least 32 bytes, e.g.
openssl rand 32 > hmac-secret). The chart does not manage it. Required for
Argo CD and render-and-apply workflows.
authServerKeys.generate
Type: bool
Default: false
Generate and preserve an ECDSA P-256 signing key and a separate 32-byte HMAC
secret on a live Helm install. Do not use with helm template, Argo CD, or
other render-and-apply workflows because they cannot preserve generated material
through lookup.
authServerKeys.allowGenerateOnUpgrade
Type: bool
Default: false
Allow generation during an upgrade only for a confirmed first enable. A lookup miss can also mean missing Secret RBAC or a client-only renderer.
authServerKeys.rotatedHmacSecretKeys
Type: list
Default: []
Keys in the existingSecret Secret holding retired HMAC secrets, still accepted for outstanding authorization codes and refresh tokens. Requires existingSecret.
authServerKeys.rotatedSigningKeys
Type: list
Default: []
Keys in the existingSecret Secret holding retired signing keys, still published in the JWKS. Requires existingSecret. Remove each once its tokens expire: a listed compromised key keeps forged tokens valid.
networkPolicy.enabled
Type: bool
Default: false
Enable a NetworkPolicy for the connector-gateway pod.
networkPolicy.allowExternalEgress
Type: bool
Default: true
Allow ALL egress. NetworkPolicies are additive, so true overrides any cluster
default-deny egress. Set false and populate egress to lock down this pod,
which holds the KEK and the primary-IdP client secret.
networkPolicy.egress
Type: list
Default: []
Egress rules (NetworkPolicyEgressRule shape) applied when allowExternalEgress is false. Must cover DNS and every IdP, Directory, backend, Redis and metering destination, plus the kube-apiserver when internalApi.enabled. A missing rule fails silently.