Chart values¶

Chart values control the Kubernetes resources: Deployments, storage, routing, role-based access control (RBAC), jobs, and monitoring. Application settings are in sitesConfig; see Application settings.

Chart value groups¶

This table lists every top-level group in the chart values. Read the complete values for the approved chart release with helm show values.

Group	Purpose and choices
`nameOverride`	Sets the `app.kubernetes.io/part-of` label. Empty uses the chart name.
`serviceAccount`	Optionally attaches an existing image pull Secret when an image repository requires authentication. The chart always creates the `sites`, `sites-hub`, and `sites-jobs` ServiceAccounts and their RBAC.
`images`	Sets registry, tag, and pull policy for Hub, Core, and Operator; Redis has its own registry, repository, tag, and policy.
`priorityClasses`	Creates cluster-wide PriorityClass objects. Use unique names and coordinate values and preemption policy with cluster administrators. Platform pods always use the `high-priority` class.
`sitesConfig`	Application settings. This is expanded below. The chart supplies `namespace`, `site.version`, and `routing`; do not set `sitesConfig.routing`.
`siteTemplates`	Site creation templates provided by the deployment. Each key is a template name and each value is a mapping or a string with the template file content. The chart renders them into the read-only `sites-templates` ConfigMap that the Hub mounts; see Site creation templates.
`redisConfig`	Redis configuration file text. Tune only with a resource and workload review.
`hub`	Hub and initializer commands, replicas, environment variables, and resource requests and limits.
`operator`	Operator image pull policy and resource requests and limits. The chart always runs one Operator replica.
`redis`	Sets resources for the in-chart Redis Deployment and Service, which the chart always creates.
`storage.data`	Creates the platform data persistent volume claim (PVC), its access modes, StorageClass, capacity, and labels. It is separate from per-site content PVCs.
`cron`	Schedules and pod options for analytics, backup, quota, and retention jobs. Each schedule uses standard five-field cron syntax.
`routing`	Selects `ingress` or `gateway`, sets the public host and scheme, TLS and HTTP Strict Transport Security (HSTS), and mode-specific controller options.
`networkPolicy`	Creates the Redis and site traffic policies when `enabled` is `true`, and identifies ingress, Gateway, monitoring, and metrics namespaces.
`quota`	Creates a namespace ResourceQuota for total CPU and memory.
`serviceMonitor`	Creates Prometheus Operator ServiceMonitors for Hub and site metrics.
`secrets`	Controls chart-managed OpenID Connect (OIDC) and application Secrets. Prefer external Secret management; see secrets and integrations.

Chart value options¶

This map lists the configurable child fields. Read the values for the approved chart release with helm show values to check exact types and defaults.

Values path	Options
`serviceAccount`	`imagePullSecretName`
`images`	`registry`, `pullPolicy`, `tag`, `hub.repository`, `core.repository`, `operator.repository`, `redis.registry`, `redis.repository`, `redis.tag`, `redis.pullPolicy`
`priorityClasses`	`classes[]`: `name`, `value`, `preemptionPolicy`, `globalDefault`, `description`
`redisConfig`	Redis configuration directives as a text block
`hub`	`replicas`, `imagePullPolicy`, `command`, `args`, `extraEnv[]`, `resources`, `hpa.enabled`, `hpa.minReplicas`, `hpa.maxReplicas`, `hpa.memoryUtilization`, `initializer.command`, `initializer.args`, `initializer.resources`
`operator`	`imagePullPolicy`, `resources`
`redis`	`resources`
`storage.data`	`name`, `nameLabel`, `accessModes[]`, `storageClassName`, `size`
`cron.<job>`	For `analytics`, `backup`, `quota`, and `retention`: `schedule`, `suspend`, `hostNetwork`, `mountsData`
`routing`	`mode`, `host`, `scheme`, `hsts`, `tls.enabled`, `tls.secretName`, `ingress.className`, `ingress.hubAnnotations`, `ingress.routeAnnotations`, and the `gateway.*` settings described in routing and networking
`networkPolicy`	`enabled`, `gatewayNamespace`, `ingressNamespace`, `monitoringNamespace`, `metricsGatewayNamespace`, `egressCIDRs`
`quota`	`enabled`, `cpu`, `memory`
`serviceMonitor`	`enabled`, `namespaceSelector`, `labels`, `site.enabled`, `site.interval`, `site.labels`, `hub.enabled`, `hub.interval`, `hub.labels`. The `labels` maps add extra labels to the ServiceMonitor resources, for example to match a Prometheus or Thanos selector. `site.labels` and `hub.labels` override `labels`.
`secrets.oidcSecrets`	`create`, `name`, `data`
`secrets.sitesSecrets`	`create`, `name`, `data`

nameOverride is a top-level string. sitesConfig contains application settings described in Application settings. Configure image pull access with serviceAccount.imagePullSecretName.

Value behaviour details¶

These fields have behaviour that a values list alone does not show.

Unknown values keys stop the install¶

The chart refuses to render a key that nothing reads. A top-level key must appear in values.yaml, and a key under sitesConfig must be one of the application settings listed in Application settings and in files/sites-config-keys.yaml of the chart. A mistyped or invented key — for example site.custom_application_allow_any_registry, which has never existed — fails the install or upgrade with unknown Helm value: <path> instead of being ignored and having no effect.

Subtrees that hold deployment data, not chart settings, accept any child key: siteTemplates, the ServiceMonitor labels maps, the ingress and Gateway annotation maps, and the data maps under secrets. The same applies to sitesConfig.opensearch.query_fields and sitesConfig.splunk.query_fields, which hold search field names.

The chart does not check the Helm global key. A parent chart sends this key to all of its subcharts, and the parent chart owns its content.

PriorityClass defaults¶

The chart ships three classes. Platform pods (Hub, Operator, Redis, and the CronJobs) always use high-priority; medium-priority and low-priority are the classes a site resource tier can select (see domain model). The classes are cluster-scoped objects: a second Sites installation in the same cluster reuses them, so the names and values must be coordinated with cluster administrators before you change them.

Class	`value`	`preemptionPolicy`
`high-priority`	`10000000`	`PreemptLowerPriority`
`medium-priority`	`100000`	`PreemptLowerPriority`
`low-priority`	`1000`	`Never`

Hub concurrency (Gunicorn)¶

The Hub container runs Gunicorn with the gthread worker class. The worker, thread, timeout, and request-budget settings come from environment variables with these defaults:

Variable	Default	Effect
`GUNICORN_WORKERS`	4	Worker processes
`GUNICORN_THREADS`	10	Threads per worker
`GUNICORN_TIMEOUT`	120 seconds	Request timeout
`GUNICORN_MAX_REQUESTS`	1024	Requests per worker before recycling (jitter 100)
`GUNICORN_PORT`	8080	Listen port

Set these through hub.extraEnv when you need more concurrency than the defaults give. Prefer scaling the Deployment (replicas or the Horizontal Pod Autoscaler (HPA)) over adding workers per Pod, so the CPU and memory limits keep their meaning. The Gunicorn access log is disabled; the application writes its own request audit lines (see observability). The server internals are documented in Hub API — application assembly.

Hub HPA behaviour¶

When hub.hpa.enabled is true, both scaling directions use a 300-second stabilization window and allow a 100 percent change per 60 seconds. The target is hpa.memoryUtilization percent of the requested memory. Only the memory request, the min and max replica bounds, and the utilization target are configurable; the behavior block is fixed.

Rollout and probe timings¶

These values are fixed in the chart templates, not values:

Hub and Redis Deployments keep revisionHistoryLimit: 1 ReplicaSet.
The Hub Deployment rolls with maxSurge: 1 and maxUnavailable: 0: one new Pod starts before an old one stops.
Hub container liveness: TCP probe, start delay 30 seconds, timeout 5, period 30, failure threshold 5.
Redis readiness: redis-cli ping, start delay 10 seconds; liveness: TCP probe, start delay 40 seconds; timeout 5, period 30, failure threshold 5.

Pod security contexts¶

These settings are fixed in the chart templates, not values. They apply to the Hub (and its initializer), the Operator, Redis, and the CronJobs:

The pod runs as a non-root user with the RuntimeDefault seccomp profile. The Hub, the Operator, and the CronJobs run as UID and GID 65534. Redis runs as UID and GID 999, the redis user of the official image. If you set images.redis to a different image, make sure that it can run as UID 999.
Every container has a read-only root filesystem, drops all Linux capabilities, and does not allow privilege escalation.
The Hub, the Operator, and the CronJobs mount an emptyDir at /tmp for temporary files. Redis writes only to its /data emptyDir.
The chart sets no fsGroup. The platform data PVC must be writable by UID 65534, as in earlier releases.

Platform data PVC label¶

storage.data.nameLabel sets the app.kubernetes.io/name label on the platform data PVC; empty uses sites-hub-storage. It is metadata: the chart always binds the volume by name (storage.data.name), not by this label. External tools that find the volume by label can match the configured value.

CronJob history¶

The four platform CronJobs keep successfulJobsHistoryLimit: 1 and failedJobsHistoryLimit: 1: one finished job of each kind stays visible for triage. Job defaults and schedules are in quotas, backups, and retention.