Skip to main content

Console Helm values

Configure the console chart with these Helm values.

This reference lists values declared in the chart's default values.yaml. Templates can also accept optional settings and inherited global values.

Chart: toolhive-cloud-ui. Chart version: 0.24.0. Generated from the platform source at v0.24.0.

Values​

replicaCount​

Type: int

Default: 1

Number of replicas for the deployment. Ignored when ha.enabled or autoscaling.enabled is true.

ha​

Type: object

Default value
antiAffinityPreset: soft
enabled: false
podDisruptionBudget:
  minAvailable: 1
replicaCount: 2

High availability: replica count, PodDisruptionBudget and anti-affinity together. The render fails if ha.enabled is true with fewer than 2 replicas, since a PDB without spare replicas blocks every node drain.

ha.enabled​

Type: bool

Default: false

Enable HA mode: uses ha.replicaCount, creates a PodDisruptionBudget, and spreads replicas across nodes and zones.

ha.replicaCount​

Type: int

Default: 2

Replica count used when ha.enabled is true.

ha.podDisruptionBudget.minAvailable​

Type: int

Default: 1

Minimum number of pods that must remain available.

ha.antiAffinityPreset​

Type: string

Default: "soft"

Node anti-affinity: "soft" (preferred) or "hard" (required). Zone spreading is always preferred only.

image.repository​

Type: string

Default value
image-proxy.stacklok.com/proxy/stacklok-enterprise/ghcr.io/stacklok/stacklok-enterprise/cloud-ui

Image repository. Override to pull from your own mirror.

image.tag​

Type: string

Default: ""

Image tag (defaults to .Chart.AppVersion when empty).

image.pullPolicy​

Type: string

Default: "IfNotPresent"

Pull from registry if available, use local image if not

imagePullSecrets​

Type: list

Default: []

Extra image pull Secrets for the cloud-ui pod. On Replicated installs the SDK pull secret is added automatically; list only additional registries here.

nameOverride​

Type: string

Default: ""

Override the name of the chart

fullnameOverride​

Type: string

Default: ""

Override the full name of the resources

serviceAccount.create​

Type: bool

Default: false

Specifies whether a service account should be created

serviceAccount.automount​

Type: bool

Default: true

Automatically mount a ServiceAccount's API credentials

serviceAccount.annotations​

Type: object

Default: {}

Annotations to add to the service account

serviceAccount.name​

Type: string

Default: ""

The name of the service account to use (if not set and create is true, a name is generated using the fullname template)

podAnnotations​

Type: object

Default: {}

Annotations to add to the pod

podLabels​

Type: object

Default: {}

Labels to add to the pod

podSecurityContext​

Type: object

Default value
fsGroup: 1001
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
  type: RuntimeDefault

Security context for the pod

securityContext​

Type: object

Default value
allowPrivilegeEscalation: false
capabilities:
  drop:
    - ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1001

Security context for the container

runtimeWritableDirs​

Type: object

Default: {"nextCache":{"sizeLimit":""},"tmp":{"sizeLimit":""}}

Size limits for the writable emptyDir volumes at /tmp and /app/.next/cache, which Next.js needs under the read-only root filesystem. Empty means unbounded.

service.type​

Type: string

Default: "ClusterIP"

Kubernetes service type

service.port​

Type: int

Default: 80

Service port

service.targetPort​

Type: int

Default: 3000

Container target port

service.nodePort​

Type: string

Default: nil

NodePort (only used if type is NodePort, range: 30000-32767)

resources​

Type: object

Default: {"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}

Resource limits and requests for the container

startupProbe​

Type: object

Default value
failureThreshold: 30
httpGet:
  path: /
  port: http
initialDelaySeconds: 0
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 3

Startup probe configuration (checks if app is ready to start)

livenessProbe​

Type: object

Default value
failureThreshold: 3
httpGet:
  path: /
  port: http
initialDelaySeconds: 0
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5

Liveness probe configuration (checks if app is alive)

readinessProbe​

Type: object

Default value
failureThreshold: 3
httpGet:
  path: /
  port: http
initialDelaySeconds: 0
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 3

Readiness probe configuration (checks if app can receive traffic)

autoscaling.enabled​

Type: bool

Default: false

Enable Horizontal Pod Autoscaler

autoscaling.minReplicas​

Type: int

Default: 1

Minimum number of replicas

autoscaling.maxReplicas​

Type: int

Default: 5

Maximum number of replicas

autoscaling.targetCPUUtilizationPercentage​

Type: int

Default: 80

Target CPU utilization percentage

volumes​

Type: list

Default: []

Additional volumes for the pod

volumeMounts​

Type: list

Default: []

Additional volume mounts for the container

nodeSelector​

Type: object

Default: {}

Node labels for pod assignment

tolerations​

Type: list

Default: []

Tolerations for pod assignment

affinity​

Type: object

Default: {}

Affinity rules for pod assignment

networkPolicy​

Type: object

Default: {"allowExternalEgress":true,"egress":[],"enabled":false}

NetworkPolicy, off by default. Enable it on clusters whose policy engine attaches a deny-all policy to pods that have none.

networkPolicy.allowExternalEgress​

Type: bool

Default: true

Allow all egress traffic. Every destination is a URL you configure, so set false and list them in egress to lock egress down.

networkPolicy.egress​

Type: list

Default: []

Egress rules (NetworkPolicyEgressRule shape) applied when allowExternalEgress is false. Must cover DNS and every configured destination; a missing one fails silently.

apiBaseUrl​

Type: string

Default: ""

Base URL of the Registry Server API. Required.

oidc​

Type: object

Default: {"additionalProviders":[]}

OIDC configuration. The primary provider comes from global.stacklok.primaryIdp, including its private-CA caBundleRef. Restart the pods after changing the CA bundle's contents.

oidc.additionalProviders​

Type: list

Default: []

Additional OIDC providers. Empty means single-provider mode.

betterAuth​

Type: object

Default: {"existingSecret":"","existingSecretKey":"secret","secret":"","url":""}

Better Auth session management

betterAuth.secret​

Type: string

Default: ""

Token encryption secret as a plain value, at least 32 characters long. Required unless existingSecret is set. Prefer a Kubernetes Secret via existingSecret. Generate a value with openssl rand -base64 32.

betterAuth.existingSecret​

Type: string

Default: ""

Existing Secret holding the token encryption secret. Takes precedence over secret.

betterAuth.existingSecretKey​

Type: string

Default: "secret"

Key within existingSecret holding the token encryption secret.

betterAuth.url​

Type: string

Default: ""

Public, browser-reachable URL of the console, used for authentication callbacks. Required.

enterpriseManagerUrl​

Type: string

Default: ""

Base URL of Enterprise Manager. Required for the administration pages, which fail without it. Empty inherits global.stacklok.enterpriseManager.url. Once set, only an active Directory profile may sign in.

gatewayApiUrl​

Type: string

Default: ""

Legacy AI Gateway management API URL, server-to-server (models, liveness). Read only when AI Gateway v2 isn't installed (global.stacklok.aiGatewayV2.enabled); then required, here or via the config server's gateway.api_url (which wins), for the gateway pages. Do not also set GATEWAY_* vars in env: that duplicates the entry.

gatewayProxyUrl​

Type: string

Default: ""

Public AI Gateway proxy URL shown in the CLI setup command and the "My Usage" banner. With AI Gateway v2 installed it is also the console's gateway backend, so it must reach AI Gateway v2. Empty inherits global.stacklok.aiGatewayV2.url while AI Gateway v2 is installed. The config server's gateway.proxy_url wins over both when set.

connectorGatewayUrl​

Type: string

Default: ""

Connector Gateway control-plane API URL, e.g. http://<release>-connector-gateway-control-plane.<namespace>:8090 (not the data-plane Service). The Connectors pages also need global.stacklok.connectorGateway.enabled. The value is tpl-evaluated.

thvCliOidcIssuerUrl​

Type: string

Default: ""

OIDC issuer URL used by the console's Stacklok CLI setup instructions. Set this and thvCliOidcClientId to enable the setup wizard.

thvCliOidcClientId​

Type: string

Default: ""

Public OAuth client ID used by the Stacklok CLI with PKCE. Set this and thvCliOidcIssuerUrl to enable the console's setup wizard.

thvCliOidcAudience​

Type: string

Default: ""

Optional OAuth audience included in the CLI setup command. Set it when the LLM gateway requires a specific JWT audience; empty omits the option.

thvCliOidcCallbackPort​

Type: string

Default: ""

Local OAuth callback port included in the CLI setup command. Set it to match the redirect URI registered with your IdP; empty uses the CLI default of 8666.

redisUrl​

Type: string

Default: ""

External Redis URL for server-side caching, e.g. "redis://:password@redis.example.com:6379/0". Without it the SKILL.md preview is hidden. The URL embeds the password in the pod spec; prefer redisUrlExistingSecret.

redisUrlExistingSecret​

Type: string

Default: ""

Existing Secret holding the full Redis URL. Takes precedence over redisUrl.

redisUrlExistingSecretKey​

Type: string

Default: "redis-url"

Key within redisUrlExistingSecret holding the connection URL.

branding​

Type: object

Default: {"config":{"enabled":false,"json":{}},"faviconUrl":"","logoUrl":"","name":""}

Branding. Prefer the file-based config block; config.json values win over name/logoUrl/faviconUrl.

branding.config​

Type: object

Default: {"enabled":false,"json":{}}

Branding JSON mounted at /etc/branding/config.json: app_name, logo_url, favicon_url and design_tokens.

branding.name​

Type: string

Default: ""

Simple overrides without a ConfigMap. Overridden by config.json.

env​

Type: list

Default: []

Additional env vars. Prefer the structured keys above.

envFrom​

Type: list

Default: []

Environment variables from ConfigMaps or Secrets