Helm chart
This page lists every value in the kslate Helm chart and what it does.
Chart kslate, version 0.9.0, app version 0.9.0. kslate — a shared record for agent fleets, with a gateway that checks every write
The chart needs Kubernetes >=1.27.0-0. It lives at
deploy/helm/kslate in the repository. For how to install it and what to
set on a first run, see the Install page.
Values
| Key | Type | Default | Description |
|---|---|---|---|
| example | object | {"createNamespace":false,"enabled":false,"namespace":"kagent"} | The design’s example incidents SharedContext, applied as a ready-to-use class. A live policy granting sa:kagent/* write access; off by default. |
| example.createNamespace | bool | false | Create the example namespace. Off because a Namespace is shared infrastructure. |
| example.enabled | bool | false | Apply the example class. |
| example.namespace | string | "kagent" | Namespace for the example class and the ServiceAccounts its roles name. |
| external | object | {"dsn":"","existingSecret":"","existingSecretKey":""} | An external Postgres, used when postgres.enabled is false. |
| external.dsn | string | "" | Full postgres:// DSN, rendered into the chart’s own Secret. Use sslmode=require or stronger. |
| external.existingSecret | string | "" | Name of a Secret you manage holding the DSN; nothing about the credential is then in Helm values. |
| external.existingSecretKey | string | "" | Key in existingSecret holding the DSN (default dsn). |
| gateway | object | {"apikeysSecret":"","apikeysSecretKey":"apikeys.yaml","grpcPort":0,"identity":"k8s-sa","listenPort":8080,"metricsPort":9100,"podDisruptionBudget":{"enabled":true,"minAvailable":1},"replicas":2,"resources":{"limits":{"cpu":"1","memory":"512Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}} | The stateless API gateway (HTTP/JSON + MCP, optional gRPC). |
| gateway.apikeysSecret | string | "" | Existing Secret holding the --apikeys file. Required when identity includes apikey; the key must be apikeys.yaml unless apikeysSecretKey says otherwise. |
| gateway.apikeysSecretKey | string | "apikeys.yaml" | Key within apikeysSecret. |
| gateway.grpcPort | int | 0 | gRPC port. 0 disables the gRPC transport. |
| gateway.identity | string | "k8s-sa" | Identity providers, comma-separated and tried in order: apikey |
| gateway.listenPort | int | 8080 | Port for HTTP/JSON and MCP (/mcp). |
| gateway.metricsPort | int | 9100 | Prometheus metrics port, on its own Service (kslate-gateway-metrics). Labels name classes, fields and roles. |
| gateway.podDisruptionBudget | object | {"enabled":true,"minAvailable":1} | PodDisruptionBudget for the gateway, created when replicas is above 1 so a node drain never takes every gateway at once. |
| gateway.podDisruptionBudget.enabled | bool | true | Create the PodDisruptionBudget. |
| gateway.podDisruptionBudget.minAvailable | int | 1 | Gateways that must stay up during a voluntary disruption. |
| gateway.replicas | int | 2 | Gateway replicas. All share one Postgres. |
| gateway.resources | object | {"limits":{"cpu":"1","memory":"512Mi"},"requests":{"cpu":"100m","memory":"128Mi"}} | Resource requests and limits. |
| image | object | {"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"kslate","tag":""} | Container image for the gateway, worker/controller and CLI. No images are published; build and load your own (README). |
| image.pullPolicy | string | "IfNotPresent" | Image pull policy. |
| image.pullSecrets | list | [] | Names of existing image pull Secrets, applied to every pod of the chart. |
| image.repository | string | "kslate" | Image repository. kslate alone resolves to docker.io/library/kslate, which does not exist; set your registry or load the image into kind. |
| image.tag | string | "" | Image tag. Empty means the chart appVersion; the kind harness sets dev. |
| networkPolicy | object | {"enabled":false,"from":[]} | NetworkPolicy restricting who may scrape the two metrics Services, and who may reach the bundled Postgres. |
| networkPolicy.enabled | bool | false | Create the NetworkPolicy. Needs a CNI that enforces it. |
| networkPolicy.from | list | [] | NetworkPolicyPeer list allowed to scrape, e.g. a namespaceSelector for your monitoring namespace. |
| postgres | object | {"allowDefaultPassword":false,"database":"kslate","enabled":true,"image":"postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea","password":"kslate-dev-only","resources":{"limits":{"cpu":"1","memory":"1Gi"},"requests":{"cpu":"100m","memory":"256Mi"}},"user":"kslate"} | Bundled Postgres: one unreplicated pod on an emptyDir, for development only. |
| postgres.allowDefaultPassword | bool | false | Permit the default password. Throwaway clusters only. |
| postgres.database | string | "kslate" | Database name. |
| postgres.enabled | bool | true | Deploy the bundled Postgres. Set false and configure external for anything beyond development. |
| postgres.image | string | "postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea" | Postgres image, pinned by digest. |
| postgres.password | string | "kslate-dev-only" | Database password. The chart refuses to render with this default unless allowDefaultPassword is true. |
| postgres.resources | object | {"limits":{"cpu":"1","memory":"1Gi"},"requests":{"cpu":"100m","memory":"256Mi"}} | Resource requests and limits. |
| postgres.user | string | "kslate" | Database user. |
| serviceMonitor | object | {"enabled":false,"interval":"","labels":{}} | Prometheus Operator ServiceMonitor for both metrics Services. |
| serviceMonitor.enabled | bool | false | Create the ServiceMonitor. |
| serviceMonitor.interval | string | "" | Scrape interval. Empty uses the Prometheus default. |
| serviceMonitor.labels | object | {} | Labels on the ServiceMonitor objects. Most Prometheus Operator installs select on one (for example release: kube-prometheus-stack); without it the monitors are silently ignored. |
| tls | object | {"enabled":false,"secretName":""} | TLS for the API listener (HTTP/JSON, MCP, and gRPC when enabled). Off by default; otherwise run behind a mesh or TLS-terminating ingress. |
| tls.enabled | bool | false | Serve TLS from the gateway itself. |
| tls.secretName | string | "" | A kubernetes.io/tls Secret holding tls.crt and tls.key. |
| watchNamespace | string | "" | Namespace the controller and the gateway watch for SharedContext objects. Empty is cluster-wide. Set it where more than one team creates classes: class names are a flat namespace and a duplicate is refused. |
| worker | object | {"healthPort":8081,"interval":"60s","metricsPort":9090,"resources":{"limits":{"cpu":"500m","memory":"256Mi"},"requests":{"cpu":"50m","memory":"64Mi"}}} | The worker-and-controller pod: TTL sweep, lease-lapse marking, SharedContext reconciliation (one replica). |
| worker.healthPort | int | 8081 | Worker health port: /readyz (schema present, SharedContext watch healthy) and /healthz, for the probes. Not restricted by the NetworkPolicy. |
| worker.interval | string | "60s" | Sweep interval. |
| worker.metricsPort | int | 9090 | Worker metrics port (kslate-worker-metrics). |
| worker.resources | object | {"limits":{"cpu":"500m","memory":"256Mi"},"requests":{"cpu":"50m","memory":"64Mi"}} | Resource requests and limits. |
What the chart installs
| Object | Notes |
|---|---|
CRD sharedcontexts.kslate.dev | Installed from crds/ before the templates. Helm does not change it on upgrade. |
Deployment kslate-gateway | gateway.replicas replicas. The readiness probe is GET /readyz on the API port, which checks that the database schema is present. |
Deployment kslate-worker | One replica. It deletes expired records, flags expired leases, runs the SharedContext controller and mirrors class roles into RBAC. |
Deployment + Service kslate-postgres | Only when postgres.enabled is true. Uses strategy: Recreate and an emptyDir. For development only. |
| Secret (Postgres DSN) | Built from postgres.* or external.dsn. Not created when you set external.existingSecret. |
Service kslate-gateway | Port 80 to the API port. Serves HTTP/JSON and MCP at /mcp, and gRPC when gateway.grpcPort is set. |
Services kslate-gateway-metrics, kslate-worker-metrics | Metrics, on a separate port from the API. |
ServiceAccount kslate-cli | Only when example.enabled is true. For running the kslate CLI inside the cluster; it is the operator role in the example class, which is the only thing that names it. |
| ClusterRole / ClusterRoleBinding | Lets the controller watch SharedContext objects and create the per-class RBAC. |
| ServiceMonitor, NetworkPolicy, example SharedContext | Each is created only when you enable it. |