Values reference
Reference for charts/openbox/values.yaml. Validated by values.schema.json at chart install time — any required-but-missing value blocks helm install.
Top-level structure
global: # cross-cutting settings (registry, ingress, pull secrets)
postgresql: # Bitnami sub-chart — in-cluster Postgres
openbox-backend: # platform REST API
openbox-core: # agent orchestration (5-container pod)
openbox-fe: # frontend web app
identity-service: # Keycloak IAM
opa-app: # Open Policy Agent
guardrails-api: # guardrails orchestrator
model-host-detect-pii: # PII classifier
model-host-nsfw: # NSFW classifier
model-host-toxicity: # toxicity classifier
global
| Key | Type | Default | Notes |
|---|---|---|---|
global.imageRegistry | string | "" | If set, prefixed to all sub-chart images (private registry / mirror) |
global.imagePullSecrets | array | [] | K8s Secret names to attach for pulling private images |
global.ingress.type | enum | istio | One of nginx, traefik, istio, none |
global.ingress.className | string | matches type | Override ingressClassName if your controller uses a non-default class |
global.ingress.domain | string | required if ingress != none | Base domain, e.g. openbox.example.com |
global.ingress.annotations | map | {} | Extra annotations (WAF, ALB, cert-manager, etc.) |
global.ingress.tls.secretName | string | "" | Existing K8s TLS Secret |
global.ingress.tls.certManager.clusterIssuer | string | "" | If set, cert-manager provisions the TLS cert |
postgresql (Bitnami sub-chart)
| Key | Type | Default | Notes |
|---|---|---|---|
postgresql.enabled | boolean | true | Set false to skip in-cluster Postgres (use RDS/Cloud SQL instead) |
postgresql.auth.postgresPassword | string | required if enabled | Superuser password |
postgresql.auth.password | string | required if enabled | App user password |
postgresql.auth.username | string | openbox | App user |
postgresql.auth.database | string | openbox | Default DB name |
postgresql.primary.persistence.storageClass | string | default SC | Override for tiered storage |
postgresql.primary.persistence.size | string | 20Gi | Volume size |
Full Bitnami reference: charts.bitnami.com/bitnami/postgresql.
openbox-backend
| Key | Type | Default | Notes |
|---|---|---|---|
openbox-backend.enabled | boolean | true | Disable to run without the platform REST API (headless mode) |
openbox-backend.replicaCount | int | 1 | Static replica count (ignored if HPA enabled) |
openbox-backend.image.repository | string | ghcr.io/openbox-ai/openbox-backend | Container image |
openbox-backend.image.tag | string | matches appVersion | Pin explicit version in prod |
openbox-backend.resources | map | see values.yaml | Requests/limits per container |
openbox-backend.autoscaling.enabled | boolean | true | HPA on/off |
openbox-backend.autoscaling.minReplicas | int | 1 | HPA floor |
openbox-backend.autoscaling.maxReplicas | int | 8 | HPA ceiling |
openbox-backend.autoscaling.targetCPUUtilizationPercentage | int | 70 | Scale-up threshold |
openbox-backend.db.host | string | "" (uses in-cluster PG) | Override to point at external DB |
openbox-backend.db.port | int | 5432 | External DB port |
openbox-backend.db.name | string | openbox | External DB name |
openbox-backend.db.userSecretRef | string | "" | K8s Secret containing username + password |
openbox-backend.serviceAccount.annotations | map | {} | IRSA / Workload Identity annotations |
openbox-backend.env.KMS_KEY_ARN | string | "" | KMS CMK ARN (AWS envelope encryption) |
openbox-backend.env.OPA_BUNDLE_BUCKET | string | "" | S3 bucket name for OPA bundles |
openbox-core
Same shape as openbox-backend (image, resources, autoscaling, serviceAccount, env). Additional:
| Key | Type | Default | Notes |
|---|---|---|---|
openbox-core.redis.external.host | string | "" (uses in-cluster) | Override to point at ElastiCache / Memorystore |
openbox-core.redis.external.port | int | 6379 | External Redis port |
openbox-core.temporal.mode | enum | cloud | One of cloud, self-hosted |
openbox-core.temporal.cloud.namespace | string | "" | Required if mode=cloud |
openbox-core.temporal.cloud.address | string | "" | e.g. ns.acct.tmprl.cloud:7233 |
openbox-core.temporal.cloud.tlsSecretRef | string | "" | K8s Secret with tls.crt + tls.key |
openbox-core.temporal.server.replicas | int | 4 | Self-hosted Temporal server pod count |
openbox-fe
Same shape as openbox-backend. No DB or Temporal wiring — pure frontend.
identity-service
| Key | Type | Default | Notes |
|---|---|---|---|
identity-service.enabled | boolean | true | Disable if using external OIDC provider |
identity-service.secret.stringData.KC_DB_PASSWORD | string | required if enabled | Keycloak DB password |
identity-service.secret.stringData.KC_BOOTSTRAP_ADMIN_PASSWORD | string | required if enabled | Bootstrap admin password (rotate immediately after install) |
identity-service.db.host | string | "" | Point at external DB (else uses in-cluster Postgres) |
identity-service.replicaCount | int | 3 | Keycloak HA — keep ≥ 3 in prod |
opa-app
| Key | Type | Default | Notes |
|---|---|---|---|
opa-app.enabled | boolean | true | — |
opa-app.bundleSource.type | enum | s3 | One of s3, http, file |
opa-app.bundleSource.s3.bucket | string | "" | Required if type=s3 |
opa-app.bundleSource.s3.pollingInterval | string | 1m | How often to re-fetch bundle |
guardrails-api
| Key | Type | Default | Notes |
|---|---|---|---|
guardrails-api.enabled | boolean | true | — |
guardrails-api.autoscaling.minReplicas | int | 2 | Keep ≥ 2 for HA — most-scaled service |
guardrails-api.autoscaling.maxReplicas | int | 10 | — |
guardrails-api.llamafirewall.enabled | boolean | true | Set false to skip GPU deep-model detection |
guardrails-api.llamafirewall.vllm.gpu | string | nvidia.com/gpu: 1 | Resource name/count for GPU |
model-host-* (detect-pii, nsfw, toxicity)
Same shape each:
| Key | Type | Default | Notes |
|---|---|---|---|
model-host-NAME.enabled | boolean | true | Toggle individual classifier |
model-host-NAME.replicaCount | int | 1 | Static replicas (ignored if HPA on) |
model-host-NAME.resources.requests.memory | string | 3.5Gi | Each model host needs ~3.5 GiB RAM |
model-host-NAME.autoscaling.enabled | boolean | true | HPA on/off |
model-host-NAME.autoscaling.maxReplicas | int | 10 | — |
Argo Rollouts (canary strategy)
| Key | Type | Default | Notes |
|---|---|---|---|
openbox-guardrails-service.rollout.enabled | boolean | true | Set false if cluster lacks Argo Rollouts CRD |
openbox-guardrails-service.rollout.steps | array | see values.yaml | Canary steps (weights + pause) |
Full defaults
For the definitive default values (auto-updated per release), see charts/openbox/values.yaml and the JSON Schema at charts/openbox/values.schema.json.
Any key not listed above is a sub-chart internal and safe to override without breaking the umbrella.