Values reference
It covers the keys you actually set, which is a much shorter list than every key a chart accepts, and
states which of them are required. For anything not listed here, read the chart's own values.yaml
in the bundle.
There is no generated key-by-key reference. The charts carry no JSON schema yet, so nothing can be generated from one; when that changes this page will link to it.
How values are layered
Three files, applied in order, last one wins.
chart values.yaml the chart's own defaults, registry deliberately blank
values-onprem.yaml shipped in the bundle, points everything at a registry
your overrides what you set
Always pass -f values-onprem.yaml. The default values.yaml leaves the registry blank on
purpose, so installing without it cannot resolve images.
Put your overrides in a file rather than in --set arguments, because helm upgrade uses only what
you pass it. Anything set with --set last time and omitted this time reverts to the chart default.
helm get values g0s -n gen0sec # what the running release actually has
gen0sec-infra
Top-level keys: postgres-operator, strimzi-kafka-operator, synapse-operator, synapse,
rustfs, dragonfly.
| Key | Default | Set it when |
|---|---|---|
rustfs.storageclass.name | "", meaning the cluster default | You want a specific StorageClass |
rustfs.storageclass.dataStorageSize | 50Gi | Sizing the object store. Four drives per replica |
rustfs.storageclass.logStorageSize | 10Gi | Rarely |
rustfs.replicaCount | 3 | Fewer nodes. Erasure coding assumes they spread |
rustfs.clusterDomain | cluster.local | Your cluster uses a custom DNS domain |
dragonfly.extraArgs | [] | Adding --force_epoll when io_uring is blocked |
dragonfly.maxMemory | Chart default | Keep it comfortably under the memory limit, or the kubelet kills the pod before it can evict |
See Sizing storage for your retention.
gen0sec-data
Top-level keys: postgres, kafka, kafka2pg.
| Key | Default | Set it when |
|---|---|---|
postgres.numberOfInstances | 3 | Never below 3 in production |
postgres.volume.size | 50Gi | Sizing the database. This is the system of record, so it is the one to grow first |
postgres.volume.storageClass | "" | You want a specific StorageClass. Fast block storage |
postgres.resources | 1 vCPU / 2 GiB requested, 8 vCPU / 12 GiB limit | Tuning. The limit sets the per-node minimum |
kafka.replicas | 3 | Fewer nodes. Drop the replication factors together, or brokers refuse writes |
kafka.storage.size | 50Gi | Sizing the message log and the ingest buffer |
kafka.storage.class | "" | You want a specific StorageClass |
min.insync.replicas must stay below replicas. Reducing brokers without reducing the factors gives
you a cluster that schedules and then refuses every write.
gen0sec-platform
Top-level keys: global, migration, downloadProxy, services.
global
| Key | Default | Notes |
|---|---|---|
global.registry.host | registry.gen0sec.com | Rewritten by the bundler on the offline path |
global.registry.namespace | gen0sec | Every image lives under this |
global.imageTag | Empty | Required. Set it to the release version |
global.imagePullSecrets | gen0sec-registry | Must exist in both namespaces |
global.commonEnv.S3_ENDPOINT | The object store service URL | Must match the object store Service, which has a -svc suffix |
global.commonEnv.ARXIGNIS_DATA_URL | The same URL plus /platform-data | The bucket name must match the bucket you created |
global.commonEnv.REDIS_URL | The cache service URL | No credential in it, deliberately |
global.podSecurityContext | Non-root, uid 65532 | Do not weaken. See Hardening |
global.securityContext | Read-only root, no capabilities | Do not weaken |
global.ingress.className | synapse | The ingress controller the infra chart installs |
Publishing
Set by the single-entrypoint overlay, not by values-onprem.yaml, which
leaves every ingress disabled. Both are top level, and both are aliased into every rule the overlay
writes — which is why they are listed here rather than under services.
| Key | Default | Notes |
|---|---|---|
entrypointHost | gen0sec.internal | Required to publish anything. The one address that serves the dashboard and every agent-facing API. A rule with an empty host renders, and the controller then skips it with no event and no log line. It must also be the address people actually type: the dashboard derives its sign-in URL from it |
externalScheme | Unset | Set to https only when TLS terminates upstream of the Ingress — a cloud load balancer, a CDN, a tunnel. With no tls: block to read, the chart otherwise infers http while the browser is on https, and every sign-in is rejected with Invalid origin. Leave it unset when TLS terminates at the Ingress |
downloadProxy
| Key | Default | Notes |
|---|---|---|
downloadProxy.enabled | true | Turning it off is not supported |
downloadProxy.apiKeySecret.name | "" | Required. Empty is a silently broken deployment |
Full detail on Data relay. This is the single most consequential key in the chart.
services
Twenty-one entries. Each one accepts the same shape, and you rarely need to touch any of it.
| Key pattern | Notes |
|---|---|
services.<name>.enabled | threat-api is not shipped at this release |
services.<name>.replicaCount | 2 or 3 in production, 1 in the quickstart overlay |
services.<name>.resources | Requests and limits. See Sizing |
services.<name>.env | Per-service environment, including PORT |
services.<name>.ingress | Off by default. Set by the entrypoint overlay |
services.<name>.volumes, .volumeMounts | Do not remove these. They exist because the read-only root filesystem needs a writable path where each service expects one |
services.ui.enabled | true. The dashboard |
services.ui.entraId.enabled | false. Entra ID is in development and not supported at this release. See Sign-in and identity |
Several services default to writing into a path relative to their working directory, which fails on a read-only root filesystem. Each one has an explicit writable volume mounted where it writes. Those mounts are load-bearing, not leftovers.
Checking what a change will do
Always render before you apply.
helm template g0s $B/charts/gen0sec-platform-*.tgz -n gen0sec \
-f $B/values/gen0sec-platform-values-onprem.yaml \
-f my-overrides.yaml \
| less
To diff against what is running:
helm get manifest g0s -n gen0sec > running.yaml
helm template g0s ... > proposed.yaml
diff running.yaml proposed.yaml
Named starting points
Two tested configurations rather than a blank page: Reference configurations.