Application settings in `sitesConfig`¶

sitesConfig sets the application configuration written to the sites-config ConfigMap. Chart values are in Chart values; identity, notification, and analytics service settings are in External service settings; the content mirror is in Migration settings.

Application settings in `sitesConfig`¶

The chart writes sitesConfig to the sites-config ConfigMap. The tables in this section describe every setting in the application configuration schema. Defaults in these tables are application defaults, not necessarily examples in the chart values. An omitted field uses its listed default.

The chart sets namespace from the Helm release namespace. It sets site.version from images.tag and all of routing from the top-level chart routing values. Do not set those fields under sitesConfig. The chart also refuses to render a sitesConfig key that is not a setting in the tables below; see Chart values. The application defaults to TLS certificate verification. When sitesConfig.dev is true, the application disables verification for Site API, Splunk, and OpenSearch connections.

Use YAML lists in values files. Environment variables use the setting names with uppercase section and field names, separated with underscores, for example SESSION_SECRET_KEY or INTEGRATIONS_ANALYTICS. CSV list decoding applies only to fields that support it. ldap.search_base and directory.default_users need JSON when set through environment variables. Integration environment variable values are JSON objects. Use YAML values for normal Helm configuration.

Root settings¶

Setting	Default	Explanation
`debug`	`false`	Enables global debug output. Keep this off in production because logs can contain more operational detail.
`dev`	`false`	Enables global development behaviour, including unredacted logs. It disables TLS checks for Site API, Splunk, and OpenSearch connections. Do not enable it in production.
`namespace`	Required; set by chart	Namespace where the platform runs. The chart provides this value; do not override it under `sitesConfig`.
`trusted_ips`	`[]`	IP addresses or CIDR ranges allowed to access protected health and metrics endpoints. Add only monitoring and operator networks that need this access.
`trusted_domains`	`[]`	Browser domains trusted for CORS and Content Security Policy (CSP) frame ancestors. Use lowercase DNS names without scheme, port, path, or wildcard. Each entry also trusts all subdomains. An empty list does not add any domain trust.

`hub`¶

Setting	Default	Explanation
`hub.version`	`develop`	Hub application version label. The chart image tag selects the deployed Hub image; normally keep this field at its default.
`hub.administrator_users`	`[]`	User names with platform administrator privileges. Keep this list limited to the operators who need full platform control.
`hub.administrator_groups`	`[]`	Identity-provider groups with platform administrator privileges. Prefer a managed admin group over a long user list.
`hub.staff_groups`	`[]`	Groups with platform staff privileges. Staff can use administrative features that are not available to ordinary site users.
`hub.staff_users`	`[]`	User names with platform staff privileges.
`hub.master_token`	Empty; use `HUB_MASTER_TOKEN` Secret	Administrator token for Hub access. Do not store the token in a values file. Supply the `HUB_MASTER_TOKEN` key in `sites-secrets`. When empty, the Hub API rejects every bearer master token and the Hub logs a warning at startup; generate one from the Hub settings page (Platform administration token).
`hub.pagination_max_items`	`15`	Maximum number of items shown on each paginated Hub page. Increase it only if users need larger pages and the Hub can support the added response size.
`hub.threading_max_workers`	`5`	Maximum worker threads for Hub background tasks. Set with available CPU and expected task load in mind.
`hub.health_timeout_seconds`	`5.0`	Maximum time in seconds for a health check. A slower check is reported as timed out.
`hub.health_timeout_status`	`WARN`	Status used when a health check times out: `OK`, `WARN`, or `ERROR`. `ERROR` marks overall health as unhealthy; `WARN` reports the delay without failing overall health.
`hub.labels`	See label settings below	Text labels for Hub titles, menus, pages, and actions.

`hub.labels`¶

Setting	Default	Explanation
`hub.labels.title`	`Sites Hub`	Platform title shown in the Hub.
`hub.labels.list_my`	`My Sites`	Label for the menu item that lists the user's sites.
`hub.labels.list_all`	`All Sites`	Label for the menu item that lists all sites.
`hub.labels.administration`	`Administration`	Label for the administration menu item.
`hub.labels.about`	`About`	Label for the About menu item.
`hub.labels.create`	`Create Site`	Label for the site creation menu item.
`hub.labels.view`	`Site View`	Label for site view pages.
`hub.labels.details`	`Site Details`	Label for site details pages.
`hub.labels.sharing`	`Site Sharing`	Label for site sharing pages.
`hub.labels.settings`	`Site Settings`	Label for site settings pages.
`hub.labels.upgrade_all`	`Upgrade All Sites`	Label for the action that upgrades all sites.
`hub.labels.force_upgrade_all`	`Force Upgrade All Sites`	Label for the action that updates all site resources even when application versions are unchanged.
`hub.labels.restart_all`	`Restart All Sites`	Label for the action that restarts all sites.

`branding`¶

Setting	Default	Explanation
`branding.organisation_name`	`Example Organisation`	Organisation name shown in page titles and text. It must not be empty, contain control characters or braces, or exceed 100 characters.
`branding.logo`	Packaged Sites logo	Inline SVG markup or a `data:image/svg+xml;base64,` URL. Empty uses the packaged logo. SVG is checked and must not include scripts, entities, doctypes, event attributes, or external references. Maximum decoded size is 256 KiB. Use `--set-file` to load a file.
`branding.favicon`	Packaged Sites favicon	Inline SVG markup or a base64 SVG data URL. The same validation rules and size limit as `branding.logo` apply. Empty uses the packaged favicon.
`branding.documentation_url`	`https://example.org/docs`	HTTP(S) or root-relative link to user documentation. Empty hides the link.
`branding.support_url`	`https://example.org/support`	HTTP(S) or root-relative link to user support. Empty hides the link.
`branding.privacy_url`	`https://example.org/privacy`	HTTP(S) or root-relative link to the privacy notice. Empty hides the link.
`branding.terms_url`	`https://example.org/terms`	HTTP(S) or root-relative link to terms of use. Empty hides the link.
`branding.policy_url`	Empty	HTTP(S) or root-relative link to web governance policy. Empty hides the link.

All branding URLs reject credentials, whitespace, control characters, and protocols other than HTTP or HTTPS. Branding is shared by the Hub and site interfaces. Existing sites use updated branding after they are updated.

`site`¶

These are platform-wide defaults and limits for Site resources. Some values apply to newly created sites; they do not necessarily change existing Site resources.

Setting	Default	Explanation
`site.version`	Set from `images.tag`	Version of the Site applications. The chart sets it; use a tested, lockstep image release instead of overriding it.
`site.replicas`	`1`	Default number of replicas for each site. More than one replica needs compatible storage and session handling. In Gateway mode, configure session affinity.
`site.default_view_groups`	`[]`	Groups that get default view access to new sites. With the empty default, a new private site gets no default viewer group. Set this to the correct least-privilege group for your organisation.
`site.default_view_users`	`[]`	Users that get default view access to new sites.
`site.token_default_duration`	`90` days	Initial HTTP Access Token duration offered by the web interface. It does not set a maximum lifetime.
`site.signed_url_default_duration`	`7` days	Initial Signed URL duration offered by the web interface.
`site.session_url_default_duration`	`7` days	Initial Session URL duration offered by the web interface.
`site.storage_max_quota`	`500` GB	Maximum storage quota that can be assigned to one site. The chart's namespace quota is separate.
`site.verify_tls`	`true`	Checks TLS certificates on Site API requests. The application sets it to `false` when `dev` is true. Keep this enabled outside isolated local development.
`site.allow_public_custom_application`	`false`	Allows a custom application image on a `public` site. When `false`, a custom application image is only allowed on a `private` site. A new image, or a change from private to public, is rejected. The next change to an existing public site with an image makes the site private. If the site has no access users or groups, it gets `site.default_view_users` and `site.default_view_groups`.
`site.custom_application_allowed_registries`	`[]`	Registries allowed for custom application images. This list is the only control over where custom application images come from; `kubernetes.private_registry` does not restrict them. Each entry is a host or a host/path prefix, for example `registry.example.org/team`. An image must start with an entry followed by `/`. An empty list allows any registry. The image must name its registry in any case: a short Docker Hub name such as `redis:7` is rejected even with an empty list, because it leaves the registry implicit; write `docker.io/library/redis:7`. The check applies only to new or changed images. Use a comma-separated list in environment variables.

`operator`¶

Setting	Default	Explanation
`operator.retries`	`5`	Number of retries for Operator tasks such as creating Kubernetes resources.
`operator.worker_limit`	`5`	Maximum number of concurrent Operator workers. Increase only with measured reconciliation load and available cluster capacity.
`operator.dependency_log_level`	`INFO`	Log level of the Kopf library in the Operator. With `debug: true`, the Operator writes Sites debug messages but Kopf stays at `INFO`, and the HTTP client libraries (`urllib3`, `kubernetes`) stay at `WARNING`. Set `DEBUG` only to troubleshoot Kopf: it writes full resource payloads and all HTTP requests. Valid values: `DEBUG`, `INFO`, `WARNING`, `ERROR`.

`jobs`¶

Setting	Default	Explanation
`jobs.retention_expired_trigger_before_days`	`31` days	How many days before a site's retention date the platform starts sending expiry notifications.
`jobs.retention_expired_archive_after_days`	`183` days	How many days after the retention date the retention job archives a site. Archiving disables the site but keeps its data.
`jobs.retention_expired_delete_after_days`	`365` days	How many days after the retention date the retention job deletes a site. This must be greater than the archive delay.
`jobs.quota_trigger_percentage`	`85`	Storage-use percentage that triggers a quota notification. Valid values are from 1 through 100.
`jobs.backup_keep_files`	`60` days	Age after which the backup job removes backup files from its data volume. This backup contains Site definitions, not website content.
`jobs.backup_notifications_email`	`null`	Email address for backup notifications. Set it only when email sending is configured.
`jobs.notification_default_assignee`	`null`	User or assignee for notifications that require platform administrator action. Required when notifications are enabled for providers that need an assignee.
`jobs.retention_broadcast_channels`	`[]`	Extra notification providers that receive retention archive/delete broadcasts. Each value must be a configured notification provider.
`jobs.http_access_token_expiration_warning_seconds`	`604800` seconds	Window before expiry, in seconds, within which the token history marks an HTTP Access Token as `expiring`. The Hub token panel also shows this value as the number of days expired entries remain in the history; the site actually prunes expired entries daily, after a fixed seven-day grace period. No notification is sent.

`cache`¶

Setting	Default	Explanation
`cache.redis_host`	`redis`	Redis service hostname used by the application. Change it when Redis is external or has a different Service name.
`cache.redis_port`	`6379`	Redis service port.
`cache.redis_password`	`null`; use `CACHE_REDIS_PASSWORD` Secret	Redis password. When `CACHE_REDIS_PASSWORD` is set in `sites-secrets`, the chart Redis server also requires it (Redis password). Do not put the password in a values file.
`cache.redis_db`	`0`	Redis database number. Use a separate database only if your Redis deployment supports and reserves it.
`cache.timeout_cold`	`604800` seconds (7 days)	Expiry for cold cache data.
`cache.timeout_warm`	`259200` seconds (3 days)	Expiry for warm cache data.
`cache.timeout_warmish`	`86400` seconds (1 day)	Expiry for warmish cache data.
`cache.timeout_super_warm`	`900` seconds (15 minutes)	Expiry for super-warm cache data.
`cache.timeout_hot`	`300` seconds (5 minutes)	Expiry for hot cache data and the retry interval after a failed metadata refresh.

`kubernetes`¶

These settings apply to Site workloads and their Kubernetes resources. The chart's own platform data persistent volume claim (PVC) has separate values under storage.data.

Setting	Default	Explanation
`kubernetes.kube_config`	`null`	Path to a kubeconfig file. `null` uses in-cluster credentials, which is the normal chart deployment.
`kubernetes.private_registry`	`eccr.ecmwf.int`	Registry host for the platform Site images. It does not limit custom application images. Use `site.custom_application_allowed_registries` for that.
`kubernetes.private_registry_image_pull_secrets_name`	`null`	Name of a pull Secret that every Site pod gets. `null` adds no pull Secret. Standard images in the public registry project do not need registry credentials. If you use an internal repository that requires authentication, set this to the matching Secret name and make sure that Secret is available in each Site namespace. The chart does not use `serviceAccount.imagePullSecretName` for Site pods.
`kubernetes.private_registry_project`	`sites-oss`	Registry project/path for Site images. Use the project that contains the Site application images.
`kubernetes.custom_application_image_pull_secrets_name`	`null`	Name of an extra pull Secret. Site pods get it only when the site has a custom application image. `null` adds no extra pull Secret. Set it explicitly to pull custom images from a private registry; it can be the same Secret as `serviceAccount.imagePullSecretName`. Give it access only to the repositories of custom images, and also set `site.custom_application_allowed_registries`. Make sure that Secret is available in each Site namespace.
`kubernetes.image_pull_policy`	`IfNotPresent`	Image pull policy for Site Pods: `Always`, `IfNotPresent`, or `Never`. Choose a policy that matches tag immutability and node image caching.
`kubernetes.storage_class_name`	`null`	StorageClass for Site PVCs. `null` uses the cluster default.
`kubernetes.storage_access_mode`	`ReadWriteMany`	Access mode requested for Site PVCs, such as `ReadWriteMany` or `ReadWriteOnce`. It must be supported by the selected storage class and fit the replica count.
`kubernetes.storage_expansion_supported`	`false`	Set true only if the storage provider and StorageClass support PVC expansion.
`kubernetes.termination_grace_period_seconds`	`null` (application uses 120 seconds)	Pod shutdown grace period. The default gives uploads and downloads time to finish. Set a number only when the cluster or workload needs a different duration.

`routing`¶

The chart builds this section from its top-level routing values. Do not configure sitesConfig.routing directly. The application model includes these generated settings:

Generated setting	Chart value	Explanation
`routing.mode`	`routing.mode`	Routing implementation for Hub and sites: `ingress` or `gateway`.
`routing.host`	`routing.host`	Public DNS name for the websites (and for the Hub when `routing.hub_host` is empty). It must be a valid lowercase DNS name. Required in Gateway mode and when `routing.hub_host` is set.
`routing.hub_host`	`routing.hubHost`	Separate public DNS name for the Hub. It must differ from `routing.host`. Set it for every production installation. Empty keeps the Hub on `routing.host`, where a website script can use the Hub session.
`routing.scheme`	`routing.scheme`	Public URL scheme: `http` or `https`. Keep it aligned with the external endpoint.
`routing.hsts`	`routing.hsts`	Enables Strict-Transport-Security behaviour. Keep enabled when the public service uses HTTPS.
`routing.ingress.class_name`	`routing.ingress.className`	Ingress class used for site routes.
`routing.ingress.route_annotations`	`routing.ingress.routeAnnotations`	Extra annotations applied to site Ingress resources.
`routing.gateway.name`	`routing.gateway.name`	Gateway name to which site HTTPRoutes attach.
`routing.gateway.namespace`	`routing.gateway.namespace`	Gateway namespace. Empty means the platform namespace.
`routing.gateway.listener_name`	`routing.gateway.listenerName`	Gateway listener name for routes. Empty permits all matching listeners.
`routing.gateway.route_annotations`	`routing.gateway.routeAnnotations`	Extra annotations applied to site HTTPRoutes.
`routing.gateway.policy_provider`	`routing.gateway.policyProvider`	Controller-specific policy provider. `none` uses standard Gateway API resources only.
`routing.gateway.policies`	`routing.gateway.policies`	Required controller policy features, for example `session_affinity`. The provider must support every listed feature.

Other routing values that control Kubernetes resources, such as TLS Secret, Gateway creation, listener definitions, class names, and policy role-based access control (RBAC), are chart values documented in the routing and networking guide.

Application settings in sitesConfig¶