Helm values

Configuration values for the agentregistry Helm chart.

Every value the agentregistry Helm chart accepts, with its type and default. Override them with --set key=value on the install command, or by passing a values file with -f.

Key	Type	Default	Description
affinity	object	`{}`	Affinity rules for pod assignment (overrides preset if set)
args	list	`[]`	Override default container args (evaluated as a template)
automountServiceAccountToken	bool	`true`	Mount the service account token in the pod
command	list	`[]`	Override default container command (evaluated as a template)
commonAnnotations	object	`{}`	Annotations to add to all deployed resources
commonLabels	object	`{}`	Labels to add to all deployed resources
config.agentRegistryMcpPort	string	`"31313"`	Agent Registry MCP server port
config.enableRegistryValidation	string	`"false"`	Enable input validation on the registry API
config.serverAddress	string	`":8080"`	Listen address for the HTTP server
containerSecurityContext.allowPrivilegeEscalation	bool	`false`	Allow privilege escalation
containerSecurityContext.capabilities.drop	list	`["ALL"]`	Linux capabilities to drop
containerSecurityContext.enabled	bool	`true`	Enable container-level security context
containerSecurityContext.readOnlyRootFilesystem	bool	`true`	Mount root filesystem as read-only
containerSecurityContext.runAsGroup	int	`1001`	Group ID to run the container as
containerSecurityContext.runAsNonRoot	bool	`true`	Prevent running as root
containerSecurityContext.runAsUser	int	`1001`	User ID to run the container as
containerSecurityContext.seccompProfile.type	string	`"RuntimeDefault"`	Seccomp profile type
database.postgres.bundled	object	`{"image":{"name":"postgres","pullPolicy":"IfNotPresent","registry":"docker.io","repository":"library","tag":"18"},"resources":{"limits":{"cpu":"1","memory":"1Gi"},"requests":{"cpu":"250m","memory":"256Mi"}},"storage":"5Gi","storageClass":""}`	Bundled PostgreSQL — dev/eval only. Only consumed when `type: bundled`.
database.postgres.bundled.image.name	string	`"postgres"`	Bundled PostgreSQL image name
database.postgres.bundled.image.pullPolicy	string	`"IfNotPresent"`	Bundled PostgreSQL image pull policy
database.postgres.bundled.image.registry	string	`"docker.io"`	Bundled PostgreSQL image registry
database.postgres.bundled.image.repository	string	`"library"`	Bundled PostgreSQL image repository (org/namespace)
database.postgres.bundled.image.tag	string	`"18"`	Bundled PostgreSQL image tag
database.postgres.bundled.resources	object	`{"limits":{"cpu":"1","memory":"1Gi"},"requests":{"cpu":"250m","memory":"256Mi"}}`	Resource requests/limits for the bundled PostgreSQL container
database.postgres.bundled.storage	string	`"5Gi"`	PersistentVolumeClaim size for the bundled PostgreSQL data directory
database.postgres.bundled.storageClass	string	`""`	StorageClass for the bundled PostgreSQL PersistentVolumeClaim. Leave empty ("") to use the cluster default StorageClass.
database.postgres.external	object	`{"secretRef":{"key":"AGENT_REGISTRY_DATABASE_URL","name":""},"url":""}`	External (BYO) PostgreSQL configuration. Only consumed when `type: external`.
database.postgres.external.secretRef	object	`{"key":"AGENT_REGISTRY_DATABASE_URL","name":""}`	Source the connection string from an existing Secret instead of inlining it. Use this when credentials are managed by an external secret store (e.g. AWS Secrets Manager via External Secrets Operator) and synced into the cluster as a Secret. The chart does not create or manage this Secret. Mutually exclusive with `external.url`. On credential rotation, Kubernetes does NOT auto-restart the pod — pair with a controller such as stakater/Reloader if you need automatic restarts on Secret content changes.
database.postgres.external.secretRef.key	string	`"AGENT_REGISTRY_DATABASE_URL"`	Key within the Secret that holds the connection string.
database.postgres.external.secretRef.name	string	`""`	Name of an existing Secret in the release namespace. Leave empty to disable.
database.postgres.external.url	string	`""`	Inline connection string. Mutually exclusive with `external.secretRef.name`.
database.postgres.type	string	`"bundled"`	Backend type: “bundled” (deploy the chart’s in-cluster dev/eval Postgres pod) or “external” (connect to a Postgres you bring yourself; configure under `external` below).
dnsConfig	object	`{}`	DNS configuration for the pod
dnsPolicy	string	`""`	DNS policy for the pod
extraEnvVars	list	`[]`	Array of extra environment variables for the Agent Registry container. Additive only — cannot override env vars the chart already renders. For credentialed fields use the dedicated knobs (e.g. `database.postgres.external.secretRef`).
fullnameOverride	string	`""`	Override the full name of the chart
global.imagePullSecrets	list	`[]`	Global Docker registry secret names
global.imageRegistry	string	`""`	Global container image registry override
hostAliases	list	`[]`	Add custom entries to /etc/hosts
image.digest	string	`""`	Agent Registry image digest (overrides tag if set)
image.name	string	`"server"`	Agent Registry image name
image.pullPolicy	string	`"IfNotPresent"`	Agent Registry image pull policy
image.pullSecrets	list	`[]`	Agent Registry image pull secrets
image.registry	string	`"ghcr.io"`	Agent Registry image registry
image.repository	string	`"agentregistry-dev/agentregistry"`	Agent Registry image repository (org/path, excluding the image name)
image.tag	string	`""`	Agent Registry image tag (immutable tags recommended). Leave empty to use .Chart.AppVersion.
lifecycleHooks	object	`{}`	Lifecycle hooks for the Agent Registry container
livenessProbe.enabled	bool	`true`	Enable liveness probe
livenessProbe.failureThreshold	int	`6`	Failure threshold for liveness check
livenessProbe.initialDelaySeconds	int	`30`	Initial delay before liveness check
livenessProbe.periodSeconds	int	`10`	Period between liveness checks
livenessProbe.successThreshold	int	`1`	Success threshold for liveness check
livenessProbe.timeoutSeconds	int	`5`	Timeout for the liveness check
nameOverride	string	`""`	Override the name of the chart
nodeAffinityPreset.key	string	`""`	Node label key for affinity
nodeAffinityPreset.type	string	`""`	Node affinity preset type (soft or hard)
nodeAffinityPreset.values	list	`[]`	Node label values for affinity
nodeSelector	object	`{}`	Node labels for pod assignment
podAffinityPreset	string	`""`	Pod affinity preset (soft or hard)
podAnnotations	object	`{}`	Extra annotations for Agent Registry pods
podAntiAffinityPreset	string	`"soft"`	Pod anti-affinity preset (soft or hard)
podLabels	object	`{}`	Extra labels for Agent Registry pods
podSecurityContext.enabled	bool	`true`	Enable pod-level security context
podSecurityContext.fsGroup	int	`1001`	Group ID for the pod filesystem
podSecurityContext.fsGroupChangePolicy	string	`"Always"`	Policy for changing fsGroup ownership
priorityClassName	string	`""`	Priority class name for the Agent Registry pods
rbac.enabled	bool	`true`	Enable RBAC resource creation
rbac.watchedNamespaces	list	`[]`	Namespaces Agent Registry is permitted to manage resources in. Empty list grants cluster-wide access via ClusterRole (default). Set to one or more namespaces to create a Role in each and restrict access accordingly. Note: read access to the cluster scoped APIs is always granted via ClusterRole regardless of this setting.
readinessProbe.enabled	bool	`true`	Enable readiness probe
readinessProbe.failureThreshold	int	`3`	Failure threshold for readiness check
readinessProbe.initialDelaySeconds	int	`10`	Initial delay before readiness check
readinessProbe.periodSeconds	int	`5`	Period between readiness checks
readinessProbe.successThreshold	int	`1`	Success threshold for readiness check
readinessProbe.timeoutSeconds	int	`3`	Timeout for the readiness check
replicaCount	int	`1`	Number of Agent Registry replicas
resources	object	`{"limits":{"cpu":"1","memory":"1Gi"},"requests":{"cpu":"250m","memory":"256Mi"}}`	Resource requests and limits for the Agent Registry container
revisionHistoryLimit	int	`10`	Number of old ReplicaSets to retain
schedulerName	string	`""`	Name of the scheduler to use
secretStore	object	`{"encryptionKeySecretRef":{"key":"SECRET_STORE_ENCRYPTION_KEY","name":""},"type":"Kubernetes"}`	Backend used to persist Secret resource payloads.
secretStore.encryptionKeySecretRef	object	`{"key":"SECRET_STORE_ENCRYPTION_KEY","name":""}`	Existing Secret containing the hex-encoded 32-byte AES-256 key for Database.
secretStore.encryptionKeySecretRef.key	string	`"SECRET_STORE_ENCRYPTION_KEY"`	Key containing the encryption key.
secretStore.encryptionKeySecretRef.name	string	`""`	Name of the Secret in the install namespace.
secretStore.type	string	`"Kubernetes"`	“Kubernetes” stores core/v1.Secrets; “Database” encrypts payloads in Postgres.
service.annotations	object	`{}`	Service annotations
service.clusterIP	string	`""`	Specific cluster IP (set to None for headless)
service.externalTrafficPolicy	string	`"Cluster"`	External traffic policy
service.loadBalancerIP	string	`""`	LoadBalancer IP
service.loadBalancerSourceRanges	list	`[]`	LoadBalancer allowed source ranges
service.nodePorts.http	string	`""`	NodePort for HTTP (when type is NodePort)
service.nodePorts.mcp	string	`""`	NodePort for MCP (when type is NodePort)
service.ports.http	int	`12121`	HTTP port
service.ports.mcp	int	`31313`	MCP HTTP port
service.sessionAffinity	string	`"None"`	Session affinity (None or ClientIP)
service.sessionAffinityConfig	object	`{}`	Session affinity configuration
service.targetPorts.http	int	`8080`	HTTP container target port
service.targetPorts.mcp	int	`31313`	MCP container target port
service.type	string	`"ClusterIP"`	Kubernetes Service type
serviceAccount.annotations	object	`{}`	ServiceAccount annotations
serviceAccount.automountServiceAccountToken	bool	`true`	Mount API token in the ServiceAccount
serviceAccount.create	bool	`true`	Create a dedicated ServiceAccount
serviceAccount.name	string	`""`	Override the auto-generated ServiceAccount name
startupProbe.enabled	bool	`true`	Enable startup probe
startupProbe.failureThreshold	int	`30`	Failure threshold for startup check (controls max startup time)
startupProbe.initialDelaySeconds	int	`5`	Initial delay before startup check
startupProbe.periodSeconds	int	`5`	Period between startup checks
startupProbe.successThreshold	int	`1`	Success threshold for startup check
startupProbe.timeoutSeconds	int	`3`	Timeout for the startup check
terminationGracePeriodSeconds	string	`""`	Seconds the pod needs to terminate gracefully
tolerations	list	`[]`	Tolerations for pod assignment
topologySpreadConstraints	list	`[]`	Topology spread constraints for pod assignment

CLI Security Vulnerabilities