---
title: "Helm objects and values"
description: "Look up the chart objects and supported values."
canonical_url: "https://docs.oz0.ai/fleet/kubernetes/values"
---
# Helm objects and values

> Look up the chart objects and supported values.

For: cluster operators.

Look up the chart objects and supported values.

## What the chart runs

<table>
<thead>
  <tr>
    <th>
      Object
    </th>
    
    <th>
      What it does
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      StatefulSet <code>
        &lt;release>-server
      </code>
    </td>
    
    <td>
      The servers. A StatefulSet so each keeps its name across restarts (the <code>
        servers
      </code>
      
       table, its leases, its logs), and upgrades roll one at a time. Each has a volume of its own for its data directory (<code>
        --data-dir
      </code>
      
      , <code>
        server.persistence
      </code>
      
      ): the metering writes the database refused, kept until it takes them, and the erasure ledger, which a replaced pod (a rollout, an eviction, a drain) must not lose. <code>
        --advertise
      </code>
      
       is the pod's IP.
    </td>
  </tr>
  
  <tr>
    <td>
      Job <code>
        &lt;release>-init
      </code>
    </td>
    
    <td>
      <code>
        server init
      </code>
      
       as a <code>
        pre-install,pre-upgrade
      </code>
      
       hook.
    </td>
  </tr>
  
  <tr>
    <td>
      Service <code>
        &lt;release>-edge
      </code>
    </td>
    
    <td>
      Ports 7233 (Temporal for nodes) and 7443 (join, renewals, control stream).
    </td>
  </tr>
  
  <tr>
    <td>
      Service <code>
        &lt;release>-management
      </code>
    </td>
    
    <td>
      Port 8443: the admin API and the console.
    </td>
  </tr>
  
  <tr>
    <td>
      Service <code>
        &lt;release>-servers
      </code>
    </td>
    
    <td>
      Headless: stable names for the servers.
    </td>
  </tr>
  
  <tr>
    <td>
      Probes
    </td>
    
    <td>
      Startup and liveness <code>
        GET /healthz
      </code>
      
      , readiness <code>
        GET /readyz
      </code>
      
      , over HTTPS on 7443. A <a href="https://docs.oz0.ai/fleet/high-availability#when-a-server-loses-postgresql-fencing">
        fenced edge
      </a>
      
       answers 503, so the Services stop sending it nodes while its peers serve.
    </td>
  </tr>
  
  <tr>
    <td>
      PodDisruptionBudget
    </td>
    
    <td>
      At most one server down for a node drain (<code>
        server.pdb
      </code>
      
      ).
    </td>
  </tr>
  
  <tr>
    <td>
      NetworkPolicy
    </td>
    
    <td>
      Servers reach each other on every port. The edge's ports are open to the chart's nodes and to <code>
        networkPolicy.edgeFrom
      </code>
      
       (by default anyone, for nodes outside the cluster). Management's port admits only the servers and <code>
        networkPolicy.managementFrom
      </code>
      
      , never nodes. Nodes reach only the edge, DNS and, unless <code>
        nodes.networkPolicy.allowPublicEgress
      </code>
      
       is off, public addresses for their plugins; private ranges stay closed.
    </td>
  </tr>
  
  <tr>
    <td>
      CronJob <code>
        &lt;release>-backup
      </code>
    </td>
    
    <td>
      Optional: <code>
        server backup
      </code>
      
       on a schedule into a volume (<a href="https://docs.oz0.ai/fleet/backups#back-up">
        Back up
      </a>
      
      ).
    </td>
  </tr>
  
  <tr>
    <td>
      StatefulSet <code>
        &lt;release>-node
      </code>
    </td>
    
    <td>
      Optional: nodes in the cluster.
    </td>
  </tr>
</tbody>
</table>

Kubernetes `port-forward` reaches management without a NetworkPolicy rule. An Ingress controller needs one: add its namespace to `networkPolicy.managementFrom`.

## Values

The full list with comments is the chart's `values.yaml`. The groups:

<table>
<thead>
  <tr>
    <th>
      Values
    </th>
    
    <th>
      What they set
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        image.server
      </code>
      
      , <code>
        image.node
      </code>
    </td>
    
    <td>
      Repository, tag (default: the chart's appVersion) or digest, pull policy. <code>
        imagePullSecrets
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        cluster
      </code>
    </td>
    
    <td>
      What the first install creates: <code>
        name
      </code>
      
      , <code>
        historyShards
      </code>
      
       (never changes), <code>
        tenant
      </code>
      
      , <code>
        operator
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        database
      </code>
    </td>
    
    <td>
      <code>
        existingSecret
      </code>
      
       and <code>
        urlKey
      </code>
      
      : the PostgreSQL URL. Required.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        masterKey
      </code>
    </td>
    
    <td>
      <code>
        existingSecret
      </code>
      
       and <code>
        key
      </code>
      
      : the master key file. Required.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        masterKey.command
      </code>
      
      , <code>
        caSigner.command
      </code>
    </td>
    
    <td>
      A <a href="https://docs.oz0.ai/admin/key-commands">
        key command
      </a>
      
       that unwraps the master key, and the <a href="https://docs.oz0.ai/fleet/cluster#the-cluster-cas-key-in-an-hsm-or-a-kms">
        CA signing command
      </a>
      
      , passed to init and every server. Bring the executables with <code>
        server.extraVolumes
      </code>
      
      , <code>
        server.extraVolumeMounts
      </code>
      
       or <code>
        server.extraInitContainers
      </code>
      
      ; they run without a shell, with a minimal environment: name the variables they need in <code>
        OZ0_KEY_COMMAND_ENV
      </code>
      
       through <code>
        server.extraEnv
      </code>
      
      , such as <code>
        AWS_*,VAULT_ADDR,VAULT_TOKEN
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        erasureLedger
      </code>
    </td>
    
    <td>
      <a href="#erasure-ledger-storage">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        init
      </code>
    </td>
    
    <td>
      <code>
        enabled
      </code>
      
       (off: run <code>
        server init --master-key-file
      </code>
      
       yourself before the first install), <code>
        adminPassword.existingSecret
      </code>
      
       (required while <code>
        enabled
      </code>
      
       is on), <code>
        backoffLimit
      </code>
      
      , <code>
        activeDeadlineSeconds
      </code>
      
      , <code>
        resources
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        server
      </code>
    </td>
    
    <td>
      <code>
        replicas
      </code>
      
       (2 or more), <code>
        logLevel
      </code>
      
      , <code>
        sans
      </code>
      
      , <code>
        publicURL
      </code>
      
       and <code>
        oidcConfig.existingSecret
      </code>
      
       (<a href="https://docs.oz0.ai/admin/sign-in">
        Sign-in
      </a>
      
      ), <code>
        routineOutputAllowNets
      </code>
      
      , <code>
        llm.anthropicURL
      </code>
      
       and <code>
        llm.openaiURL
      </code>
      
      , <code>
        persistence
      </code>
      
       (on by default: <code>
        size
      </code>
      
      , <code>
        storageClass
      </code>
      
      ; off, the data directory is an emptyDir, and a pod that is replaced loses the metering writes waiting there), <code>
        extraArgs
      </code>
      
      , <code>
        extraEnv
      </code>
      
      , <code>
        extraVolumes
      </code>
      
      , <code>
        extraVolumeMounts
      </code>
      
      , <code>
        extraInitContainers
      </code>
      
      , <code>
        resources
      </code>
      
      , scheduling (<code>
        nodeSelector
      </code>
      
      , <code>
        tolerations
      </code>
      
      , <code>
        affinity
      </code>
      
      , <code>
        topologySpreadConstraints
      </code>
      
      , <code>
        priorityClassName
      </code>
      
      ), security contexts, the three probes' timings, <code>
        pdb
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        service.edge
      </code>
      
      , <code>
        service.management
      </code>
    </td>
    
    <td>
      Service <code>
        type
      </code>
      
      , <code>
        annotations
      </code>
      
      ; for the edge also <code>
        loadBalancerSourceRanges
      </code>
      
      , <code>
        externalTrafficPolicy
      </code>
      
       and <code>
        nodePorts
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        ingress
      </code>
    </td>
    
    <td>
      <a href="#ingress-configuration">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        metrics
      </code>
    </td>
    
    <td>
      <code>
        enabled
      </code>
      
      , <code>
        port
      </code>
      
       (9464): Prometheus metrics over plain HTTP, and a headless Service for them; <code>
        serviceMonitor
      </code>
      
       for the Prometheus Operator.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        otlp
      </code>
    </td>
    
    <td>
      <code>
        endpoint
      </code>
      
      , plain <code>
        headers
      </code>
      
      , and <code>
        secretHeaders
      </code>
      
       whose values come from Secrets.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        networkPolicy
      </code>
    </td>
    
    <td>
      <code>
        enabled
      </code>
      
      , <code>
        edgeFrom
      </code>
      
      , <code>
        managementFrom
      </code>
      
      , <code>
        metricsFrom
      </code>
      
      : lists of NetworkPolicy peers.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        backup
      </code>
    </td>
    
    <td>
      <code>
        enabled
      </code>
      
      , <code>
        schedule
      </code>
      
      , <code>
        keep
      </code>
      
       (archives to keep), <code>
        persistence
      </code>
      
       (<code>
        existingClaim
      </code>
      
      , or <code>
        size
      </code>
      
       and <code>
        storageClass
      </code>
      
       for one the chart makes once and keeps when it is uninstalled).
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        nodes
      </code>
    </td>
    
    <td>
      <code>
        enabled
      </code>
      
      , <code>
        replicas
      </code>
      
      , <code>
        joinToken.existingSecret
      </code>
      
       or <code>
        caHash
      </code>
      
      , <code>
        server
      </code>
      
       (default: the edge Service), <code>
        sandbox
      </code>
      
      , <code>
        sandboxTier1
      </code>
      
       (<a href="https://docs.oz0.ai/fleet/kubernetes#sandbox-tier-1-in-node-pods">
        Sandbox tier 1 in node pods
      </a>
      
      ), <code>
        runtimeClassName
      </code>
      
      , <code>
        stopGraceSeconds
      </code>
      
      , <code>
        persistence
      </code>
      
      , <code>
        resources
      </code>
      
      , scheduling, <code>
        networkPolicy.allowPublicEgress
      </code>
      
      , <code>
        privateRanges
      </code>
      
       and <code>
        extraEgress
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        temporal
      </code>
    </td>
    
    <td>
      The backend, connection, encryption, UI and codec settings. See <a href="#temporal-chart-settings">
        Temporal chart settings
      </a>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        roles
      </code>
    </td>
    
    <td>
      <a href="#separate-roles-configuration">
        Details
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        payloadStore
      </code>
    </td>
    
    <td>
      <code>
        url
      </code>
      
       (<code>
        s3://bucket/prefix?...
      </code>
      
      ) keeps payloads and plugin artifacts in an S3-compatible bucket instead of PostgreSQL, on every server that runs the edge role; <code>
        credentials.existingSecret
      </code>
      
       and <code>
        credentials.key
      </code>
      
       name a Secret with an AWS shared credentials file for it. See <a href="https://docs.oz0.ai/fleet/payload-storage">
        Payload storage
      </a>
      
      .
    </td>
  </tr>
</tbody>
</table>

### Temporal chart settings

`backend`: `embedded` (Temporal's services in every server, on your PostgreSQL), `external` or `cloud`, with `address`, `tls`, `apiKey`, `cloudAccount`, `createNamespaces`, `encryptPayloads` (`true` by default: payloads are encrypted with each tenant's key; `false` turns it off, which `oz0 doctor` warns about), `uiURL` and `codec` for the latter two (`codec.audience`, `codec.accountClaim` and `codec.maxTokenAge` bind the Temporal Cloud UI's tokens to this server).

The chart refuses what the server would: `cloud` without `cloudAccount`, an API key to an `external` Temporal without `tls.enabled`, and a `codec.jwksURL` of your own without `codec.jwtIssuer`. See [Temporal](https://docs.oz0.ai/concepts/temporal).

### Erasure ledger storage

Where management records every erasure for a restore to apply again ([backups and erasure](https://docs.oz0.ai/govern/personal-data/retention#backups)). By default each server gets a volume of its own for it (`persistence`: `size`, `storageClass`), mounted at `/var/lib/orchestrator-zero/erasure-ledger`, apart from the database and its backups. `existingClaim` names a ReadWriteMany claim instead, with one file per pod; `roles.separate` needs it, since management's Deployment has no volume per pod. `enabled: false` keeps no ledger (`--erasure-ledger=off`). A ledger on a pod's own storage would be lost at every rollout, and erasures would then be refused, so the chart refuses to render one.

### Ingress configuration

An Ingress for the console on port 8443. Management speaks only HTTPS, so set your controller's backend protocol (for ingress-nginx: `nginx.ingress.kubernetes.io/backend-protocol: HTTPS`). The CLI uses client certificates, which pass only through TLS passthrough; use a port-forward otherwise. The Ingress hosts are added to the servers' certificates.

Set `ingress.trustedProxies` to the addresses the controller's own pods connect from: management then counts failed sign-ins per browser, by the client the controller names in `X-Forwarded-For`, instead of counting every browser as the controller's one address ([sign-in](https://docs.oz0.ai/admin/sign-in/passwords#passwords)).

Name the controller alone, never the cluster's whole pod network: a pod inside a trusted network chooses the address it is counted as, and unless `roles.separate` is on, the edge's API, which nodes and other pods reach, trusts the same list. Pin the controller where nothing else runs (a node pool of its own, whose pod range you name, or host networking and those machines' addresses), or run the roles separately. The install notes remind you while it is empty.

### Separate roles configuration

`separate: true` runs management as a Deployment and edges as a StatefulSet with a volume each. With the embedded backend, Temporal's services run as a separate StatefulSet. `roles.manager`, `roles.edge` and `roles.temporal` set their replicas and resources.

The edges also need these settings:

<table>
<thead>
  <tr>
    <th>
      Setting
    </th>
    
    <th>
      Purpose
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        managementURL
      </code>
    </td>
    
    <td>
      Management's internal API address.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        payloadDatabase
      </code>
    </td>
    
    <td>
      A Secret with the edges' own PostgreSQL URL for payloads and plugin artifacts. Required unless <code>
        payloadStore.url
      </code>
      
       is set; a separate edge will not start without one of them.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        secretsKey
      </code>
    </td>
    
    <td>
      Required key for sealing tenant secrets, created with <code>
        oz0 server secrets-key create
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        persistence
      </code>
    </td>
    
    <td>
      The edge's persistent volume configuration.
    </td>
  </tr>
</tbody>
</table>

With `separate: true`, the database user needs `CREATEROLE`, and `pg_hba.conf` must let `oz0_edge_<database>` log in with a password from the management pods ([database requirements](https://docs.oz0.ai/fleet/separate-roles/database-rights#what-the-database-must-allow)). The init Job checks both from its own pod with `server init --roles-apart` and fails with what to change.


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.