Skip to main content

Values reference

Reference for charts/openbox/values.yaml. Validated by values.schema.json at chart install time — any required-but-missing value blocks helm install.

Top-level structure

global:            # cross-cutting settings (registry, ingress, pull secrets)
postgresql: # Bitnami sub-chart — in-cluster Postgres
openbox-backend: # platform REST API
openbox-core: # agent orchestration (5-container pod)
openbox-fe: # frontend web app
identity-service: # Keycloak IAM
opa-app: # Open Policy Agent
guardrails-api: # guardrails orchestrator
model-host-detect-pii: # PII classifier
model-host-nsfw: # NSFW classifier
model-host-toxicity: # toxicity classifier

global

KeyTypeDefaultNotes
global.imageRegistrystring""If set, prefixed to all sub-chart images (private registry / mirror)
global.imagePullSecretsarray[]K8s Secret names to attach for pulling private images
global.ingress.typeenumistioOne of nginx, traefik, istio, none
global.ingress.classNamestringmatches typeOverride ingressClassName if your controller uses a non-default class
global.ingress.domainstringrequired if ingress != noneBase domain, e.g. openbox.example.com
global.ingress.annotationsmap{}Extra annotations (WAF, ALB, cert-manager, etc.)
global.ingress.tls.secretNamestring""Existing K8s TLS Secret
global.ingress.tls.certManager.clusterIssuerstring""If set, cert-manager provisions the TLS cert

postgresql (Bitnami sub-chart)

KeyTypeDefaultNotes
postgresql.enabledbooleantrueSet false to skip in-cluster Postgres (use RDS/Cloud SQL instead)
postgresql.auth.postgresPasswordstringrequired if enabledSuperuser password
postgresql.auth.passwordstringrequired if enabledApp user password
postgresql.auth.usernamestringopenboxApp user
postgresql.auth.databasestringopenboxDefault DB name
postgresql.primary.persistence.storageClassstringdefault SCOverride for tiered storage
postgresql.primary.persistence.sizestring20GiVolume size

Full Bitnami reference: charts.bitnami.com/bitnami/postgresql.

openbox-backend

KeyTypeDefaultNotes
openbox-backend.enabledbooleantrueDisable to run without the platform REST API (headless mode)
openbox-backend.replicaCountint1Static replica count (ignored if HPA enabled)
openbox-backend.image.repositorystringghcr.io/openbox-ai/openbox-backendContainer image
openbox-backend.image.tagstringmatches appVersionPin explicit version in prod
openbox-backend.resourcesmapsee values.yamlRequests/limits per container
openbox-backend.autoscaling.enabledbooleantrueHPA on/off
openbox-backend.autoscaling.minReplicasint1HPA floor
openbox-backend.autoscaling.maxReplicasint8HPA ceiling
openbox-backend.autoscaling.targetCPUUtilizationPercentageint70Scale-up threshold
openbox-backend.db.hoststring"" (uses in-cluster PG)Override to point at external DB
openbox-backend.db.portint5432External DB port
openbox-backend.db.namestringopenboxExternal DB name
openbox-backend.db.userSecretRefstring""K8s Secret containing username + password
openbox-backend.serviceAccount.annotationsmap{}IRSA / Workload Identity annotations
openbox-backend.env.KMS_KEY_ARNstring""KMS CMK ARN (AWS envelope encryption)
openbox-backend.env.OPA_BUNDLE_BUCKETstring""S3 bucket name for OPA bundles

openbox-core

Same shape as openbox-backend (image, resources, autoscaling, serviceAccount, env). Additional:

KeyTypeDefaultNotes
openbox-core.redis.external.hoststring"" (uses in-cluster)Override to point at ElastiCache / Memorystore
openbox-core.redis.external.portint6379External Redis port
openbox-core.temporal.modeenumcloudOne of cloud, self-hosted
openbox-core.temporal.cloud.namespacestring""Required if mode=cloud
openbox-core.temporal.cloud.addressstring""e.g. ns.acct.tmprl.cloud:7233
openbox-core.temporal.cloud.tlsSecretRefstring""K8s Secret with tls.crt + tls.key
openbox-core.temporal.server.replicasint4Self-hosted Temporal server pod count

openbox-fe

Same shape as openbox-backend. No DB or Temporal wiring — pure frontend.

identity-service

KeyTypeDefaultNotes
identity-service.enabledbooleantrueDisable if using external OIDC provider
identity-service.secret.stringData.KC_DB_PASSWORDstringrequired if enabledKeycloak DB password
identity-service.secret.stringData.KC_BOOTSTRAP_ADMIN_PASSWORDstringrequired if enabledBootstrap admin password (rotate immediately after install)
identity-service.db.hoststring""Point at external DB (else uses in-cluster Postgres)
identity-service.replicaCountint3Keycloak HA — keep ≥ 3 in prod

opa-app

KeyTypeDefaultNotes
opa-app.enabledbooleantrue
opa-app.bundleSource.typeenums3One of s3, http, file
opa-app.bundleSource.s3.bucketstring""Required if type=s3
opa-app.bundleSource.s3.pollingIntervalstring1mHow often to re-fetch bundle

guardrails-api

KeyTypeDefaultNotes
guardrails-api.enabledbooleantrue
guardrails-api.autoscaling.minReplicasint2Keep ≥ 2 for HA — most-scaled service
guardrails-api.autoscaling.maxReplicasint10
guardrails-api.llamafirewall.enabledbooleantrueSet false to skip GPU deep-model detection
guardrails-api.llamafirewall.vllm.gpustringnvidia.com/gpu: 1Resource name/count for GPU

model-host-* (detect-pii, nsfw, toxicity)

Same shape each:

KeyTypeDefaultNotes
model-host-NAME.enabledbooleantrueToggle individual classifier
model-host-NAME.replicaCountint1Static replicas (ignored if HPA on)
model-host-NAME.resources.requests.memorystring3.5GiEach model host needs ~3.5 GiB RAM
model-host-NAME.autoscaling.enabledbooleantrueHPA on/off
model-host-NAME.autoscaling.maxReplicasint10

Argo Rollouts (canary strategy)

KeyTypeDefaultNotes
openbox-guardrails-service.rollout.enabledbooleantrueSet false if cluster lacks Argo Rollouts CRD
openbox-guardrails-service.rollout.stepsarraysee values.yamlCanary steps (weights + pause)

Full defaults

For the definitive default values (auto-updated per release), see charts/openbox/values.yaml and the JSON Schema at charts/openbox/values.schema.json.

Any key not listed above is a sub-chart internal and safe to override without breaking the umbrella.

Common customization patterns