Helm values reference

This page lists every value of the enterprise-ai chart (version 1.0.0, application 1.0.0, Kubernetes >=1.27.0-0) in deploy/helm/enterprise-ai/values.yaml. A list, an empty map and a resources block are one value each; litellm.config is the LiteLLM config.yaml rendered as is. Secrets never go in the values: they come from OpenBao through External Secrets or the OpenBao agent.

This page is generated by tools/docs/gen_platform_config.py from deploy/helm/enterprise-ai/values.yaml: do not edit it by hand.

214 values in 17 sections.

global

Global values. Shared by every component of the chart.

Path	Type	Default	Description
global.imageRegistry	string	harbor.example.internal/eai	Registry (Harbor) prefixed to every image whose useGlobalRegistry is not false. In an air-gapped install, the local Harbor mirror.
global.imagePullSecrets	list	[]	Pull secrets given to the Control Plane and worker pods.
global.environment	string	dev	Logical environment: dev, staging or prod.
global.trustDomain	string	enterprise-ai.internal	SPIFFE trust domain of the workload identities (spiffe://<domain>/ns/<namespace>/sa/<account>).
global.region	string	eu-west	Data residency region label. The templates of this chart version do not read it.
global.tenantLabel	string	platform	Value of the tenant label required by Kyverno on every workload.
global.owner	string	platform-team	Value of the owner label required by Kyverno on every workload.
global.secretsMode	string	external-secrets	Secret delivery: openbao-agent, external-secrets or none.
global.openbao.address	string	https://openbao.openbao.svc:8200	OpenBao address used by the agent injector.
global.openbao.kubernetesAuthPath	string	auth/kubernetes	Kubernetes auth method of OpenBao.
global.externalSecrets.secretStoreName	string	openbao	Secret store referenced by the ExternalSecret objects.
global.externalSecrets.secretStoreKind	string	ClusterSecretStore	Kind of that store (ClusterSecretStore or SecretStore).
global.networkPolicy	string	cilium	Network policy flavour: kubernetes, cilium or none.
global.monitoring.serviceMonitor	boolean	true	Creates the ServiceMonitor and PodMonitor objects of the Prometheus Operator.
global.monitoring.prometheusRules	boolean	true	Creates the PrometheusRule of the Control Plane alerts.
global.monitoring.metricsTokenSecret.name	string	empty	Secret holding the bearer token of GET /metrics, read by the ServiceMonitor. Empty: the Control Plane secret.
global.monitoring.metricsTokenSecret.key	string	EAI_METRICS_TOKEN	Key of the token in that secret.
global.monitoring.otlpEndpoint	string	https://otel-collector.observability.svc.cluster.local:4318	OTLP endpoint of the OpenTelemetry Collector.
global.namespaces.data	string	eai-data	Namespace of the data services, allowed by the network policies.
global.namespaces.security	string	eai-security	Namespace of the security services (Keycloak, OpenFGA, OPA).
global.namespaces.observability	string	observability	Namespace of the observability stack.
global.namespaces.gateway	string	apisix	Namespace of the APISIX gateway.
global.namespaces.ingress	string	ingress	Namespace of the ingress controller.

controlPlane

Control Plane API. Deployment of python -m eai.main, its ConfigMap, its ExternalSecret and its migration hook.

Path	Type	Default	Description
controlPlane.enabled	boolean	true	Deploys the Control Plane.
controlPlane.image.repository	string	control-plane	Image repository, under global.imageRegistry.
controlPlane.image.tag	string	1.0.0	Image tag.
controlPlane.image.pullPolicy	string	IfNotPresent	Kubernetes pull policy.
controlPlane.replicas	integer	2	Replicas when autoscaling is off.
controlPlane.port	integer	8080	Container port of the API.
controlPlane.resources	map	{"requests": {"cpu": "250m", "memory": "512Mi"}, "limits": {"cpu": "2", "memory": "2Gi"}}	CPU and memory requests and limits.
controlPlane.autoscaling.enabled	boolean	true	Creates a HorizontalPodAutoscaler.
controlPlane.autoscaling.minReplicas	integer	2	Fewest replicas.
controlPlane.autoscaling.maxReplicas	integer	10	Most replicas.
controlPlane.autoscaling.targetCPUUtilizationPercentage	integer	70	CPU use that triggers a scale out.
controlPlane.pdb.enabled	boolean	true	Creates a PodDisruptionBudget.
controlPlane.pdb.minAvailable	integer	1	Pods kept during a voluntary disruption.
controlPlane.migration.enabled	boolean	true	Runs python -m eai.migrate as a pre-install and pre-upgrade hook.
controlPlane.migration.backoffLimit	integer	2	Retries of the migration Job.
controlPlane.config.EAI_AUTH_DEV	string	0	Control Plane setting EAI_AUTH_DEV, see the configuration reference.
controlPlane.config.EAI_AUTH_SPIFFE	string	1	Control Plane setting EAI_AUTH_SPIFFE, see the configuration reference.
controlPlane.config.EAI_AUTO_MIGRATE	string	0	Control Plane setting EAI_AUTO_MIGRATE, see the configuration reference.
controlPlane.config.EAI_DEFAULT_LOCALE	string	en	Control Plane setting EAI_DEFAULT_LOCALE, see the configuration reference.
controlPlane.config.EAI_CORS_ORIGINS	string	["https://portal.example.internal"]	Control Plane setting EAI_CORS_ORIGINS, see the configuration reference.
controlPlane.config.EAI_OIDC_ISSUER	string	https://keycloak.example.internal/realms/enterprise-ai	Control Plane setting EAI_OIDC_ISSUER, see the configuration reference.
controlPlane.config.EAI_OIDC_AUDIENCE	string	control-plane	Control Plane setting EAI_OIDC_AUDIENCE, see the configuration reference.
controlPlane.config.EAI_LITELLM_URL	string	http://enterprise-ai-litellm:4000	Control Plane setting EAI_LITELLM_URL, see the configuration reference.
controlPlane.config.EAI_OPENFGA_URL	string	https://openfga.eai-security.svc.cluster.local:8080	Control Plane setting EAI_OPENFGA_URL, see the configuration reference.
controlPlane.config.EAI_OPA_URL	string	https://opa.eai-security.svc.cluster.local:8181	Control Plane setting EAI_OPA_URL, see the configuration reference.
controlPlane.config.EAI_OPENBAO_URL	string	https://openbao.openbao.svc:8200	Control Plane setting EAI_OPENBAO_URL, see the configuration reference.
controlPlane.config.EAI_OPENBAO_KV_MOUNT	string	kv	Control Plane setting EAI_OPENBAO_KV_MOUNT, see the configuration reference.
controlPlane.config.EAI_OPENBAO_TRANSIT_MOUNT	string	transit	Control Plane setting EAI_OPENBAO_TRANSIT_MOUNT, see the configuration reference.
controlPlane.config.EAI_QDRANT_URL	string	https://qdrant.eai-data.svc.cluster.local:6333	Qdrant address (vector database), read by the Qdrant adapter.
controlPlane.config.EAI_QDRANT_SHARD_NUMBER	string	3	Shards of a new Qdrant collection (3 nodes: 3 shards).
controlPlane.config.EAI_QDRANT_REPLICATION_FACTOR	string	2	Replicas of each shard (2: one node may be lost).
controlPlane.config.EAI_QDRANT_WRITE_CONSISTENCY_FACTOR	string	1	Replicas that must acknowledge a write.
controlPlane.config.EAI_NATS_URL	string	nats://nats.eai-data.svc:4222	NATS JetStream address (media jobs, audit events). Production: in the secret, tls:// with a per service user.
controlPlane.config.EAI_TEMPORAL_URL	string	https://temporal-frontend.eai-data.svc.cluster.local:7243	Temporal frontend address (durable execution).
controlPlane.config.EAI_LIVEKIT_URL	string	ws://livekit.eai-data.svc.cluster.local:80	LiveKit signalling address (Service port 80, container port 7880).
controlPlane.config.EAI_OPIK_URL	string	http://opik-backend.observability.svc:8080	Opik backend address (AI tracing and evaluation).
controlPlane.config.EAI_CLICKHOUSE_URL	string	https://clickhouse.observability.svc.cluster.local:8443	ClickHouse address of the analytics export.
controlPlane.config.EAI_S3_ENDPOINT	string	https://s3.example.internal	S3 compatible object storage of the media artifacts and of the WORM audit archive.
controlPlane.config.EAI_S3_BUCKET	string	eai-audit-worm	Bucket of the WORM audit archive (object lock).
controlPlane.config.EAI_S3_REGION	string	eu-west	Region of the object storage.
controlPlane.config.EAI_OTEL_ENABLED	string	1	Control Plane setting EAI_OTEL_ENABLED, see the configuration reference.
controlPlane.config.EAI_OTEL_EXPORTER_OTLP_ENDPOINT	string	https://otel-collector.observability.svc.cluster.local:4318	OTLP endpoint of the traces of the Control Plane.
controlPlane.secrets.path	string	control-plane	OpenBao KV v2 path, relative to kv/data/eai/<env>/, of the Control Plane secrets.
controlPlane.secrets.keys	list	["EAI_DATABASE_URL", "EAI_MASTER_KEY", "EAI_OPENBAO_TOKEN", "EAI_OPENFGA_STORE_ID", "EAI_OPENFGA_MODEL_ID", "EAI_LITELLM_MASTER_KEY", "EAI_S3_ACCESS_KEY", "EAI_S3_SECRET_KEY", "EAI_LIVEKIT_API_KEY", "EAI_LIVEKIT_API_SECRET"]	Keys pulled from that path into the Control Plane environment.
controlPlane.nodeSelector	map	{}	Node selector of the API pods.
controlPlane.tolerations	list	[]	Tolerations of the API pods.
controlPlane.affinity	map	{}	Affinity of the API pods.

portal

Portal. Next.js portal, its ConfigMap and its ingress-nginx Ingress.

Path	Type	Default	Description
portal.enabled	boolean	true	Deploys the portal.
portal.image.repository	string	portal	Image repository, under global.imageRegistry.
portal.image.tag	string	1.0.0	Image tag.
portal.image.pullPolicy	string	IfNotPresent	Kubernetes pull policy.
portal.replicas	integer	2	Replicas when autoscaling is off.
portal.port	integer	3000	Container port of the portal (PORT). Health probe: GET /api/health.
portal.resources	map	{"requests": {"cpu": "100m", "memory": "256Mi"}, "limits": {"cpu": "1", "memory": "1Gi"}}	CPU and memory requests and limits.
portal.autoscaling.enabled	boolean	true	Creates a HorizontalPodAutoscaler.
portal.autoscaling.minReplicas	integer	2	Fewest replicas.
portal.autoscaling.maxReplicas	integer	6	Most replicas.
portal.autoscaling.targetCPUUtilizationPercentage	integer	70	CPU use that triggers a scale out.
portal.pdb.enabled	boolean	true	Creates a PodDisruptionBudget.
portal.pdb.minAvailable	integer	1	Pods kept during a voluntary disruption.
portal.config.NEXT_PUBLIC_EAI_API_URL	string	https://api.example.internal	Public URL of the API as the browsers reach it.
portal.config.NEXT_PUBLIC_OIDC_ISSUER	string	https://keycloak.example.internal/realms/enterprise-ai	Keycloak realm the portal signs in with. The portal reads NEXT_PUBLIC_EAI_OIDC_ISSUER first, then this name.
portal.config.NEXT_PUBLIC_OIDC_CLIENT_ID	string	portal	OIDC public client of the portal (authorization code with PKCE). The portal reads NEXT_PUBLIC_EAI_OIDC_CLIENT_ID first, then this name.
portal.ingress.enabled	boolean	true	Creates the Ingress of the portal. TLS is mandatory, HTTP redirects to HTTPS.
portal.ingress.className	string	nginx	Ingress class.
portal.ingress.host	string	portal.example.internal	Public host name of the portal.
portal.ingress.tlsSecretName	string	portal-tls	Secret of the TLS certificate, issued by cert-manager.
portal.ingress.clusterIssuer	string	eai-internal-ca	cert-manager ClusterIssuer of the certificate.
portal.ingress.loginRateLimitPerMinute	integer	10	Brute force guard on /login, requests per minute per client IP.
portal.ingress.rateLimitPerMinute	integer	600	Requests per minute per client IP on the other paths.
portal.ingress.maxBodySize	string	10m	Largest request body (proxy-body-size).
portal.ingress.securityHeaders.Strict-Transport-Security	string	max-age=31536000; includeSubDomains; preload	Edge security header, added to the headers the portal sets itself.
portal.ingress.securityHeaders.X-Content-Type-Options	string	nosniff	Edge security header.
portal.ingress.securityHeaders.X-Frame-Options	string	DENY	Edge security header.
portal.ingress.securityHeaders.Referrer-Policy	string	strict-origin-when-cross-origin	Edge security header.
portal.ingress.securityHeaders.Permissions-Policy	string	camera=(), microphone=(self), geolocation=(), payment=(), usb=()	Edge security header (microphone allowed for the voice features).
portal.ingress.securityHeaders.Cross-Origin-Opener-Policy	string	same-origin	Edge security header.
portal.ingress.securityHeaders.Cross-Origin-Resource-Policy	string	same-origin	Edge security header.

litellm

LiteLLM gateway. LiteLLM proxy behind the model gateway of the Control Plane.

Path	Type	Default	Description
litellm.enabled	boolean	true	Deploys LiteLLM.
litellm.image.repository	string	litellm	Repository of the Navin LiteLLM image (deploy/docker/litellm.Dockerfile, litellm without the proprietary package litellm-enterprise and without enterprise/), prefixed by global.imageRegistry.
litellm.image.tag	string	1.106.5	LiteLLM release of the image, the same as the Manager catalogue and the compose stack (the Kyverno policy eai-verify-image-signatures checks the CI signature and resolves the digest).
litellm.replicas	integer	2	Replicas when autoscaling is off.
litellm.port	integer	4000	Container port.
litellm.resources	map	{"requests": {"cpu": "250m", "memory": "512Mi"}, "limits": {"cpu": "2", "memory": "2Gi"}}	CPU and memory requests and limits.
litellm.autoscaling.enabled	boolean	true	Creates a HorizontalPodAutoscaler.
litellm.autoscaling.minReplicas	integer	2	Fewest replicas.
litellm.autoscaling.maxReplicas	integer	10	Most replicas.
litellm.autoscaling.targetCPUUtilizationPercentage	integer	70	CPU use that triggers a scale out.
litellm.pdb.enabled	boolean	true	Creates a PodDisruptionBudget.
litellm.pdb.minAvailable	integer	1	Pods kept during a voluntary disruption.
litellm.secrets.path	string	litellm	OpenBao KV v2 path of the LiteLLM secrets.
litellm.secrets.keys	list	["LITELLM_MASTER_KEY", "DATABASE_URL", "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "MISTRAL_API_KEY"]	Keys pulled from that path (master key, database, provider keys).
litellm.config	map	map, keys model_list, router_settings, litellm_settings, general_settings	LiteLLM config.yaml. In production it is generated by GET /v1/litellm/config and synced by POST /v1/litellm/sync; keys are os.environ/ references only.

vllm

vLLM local inference. One Deployment per entry of vllm.models, on GPU nodes (accelerator: gpu, default) or CPU nodes (accelerator: cpu). Applications reach it only through LiteLLM.

Path	Type	Default	Description
vllm.enabled	boolean	false	Deploys vLLM.
vllm.image.repository	string	vllm/vllm-openai	CUDA image repository.
vllm.image.tag	string	v0.33.0	CUDA image tag.
vllm.image.useGlobalRegistry	boolean	false	false: absolute repository.
vllm.cpuImage.repository	string	vllm/vllm-openai-cpu	CPU image repository (accelerator: cpu).
vllm.cpuImage.tag	string	v0.33.0-x86_64	CPU image tag.
vllm.cpuImage.useGlobalRegistry	boolean	false	false: absolute repository.
vllm.port	integer	8000	Container port of the OpenAI compatible API.
vllm.antiAffinity	string	preferred	Replicas of one model on distinct nodes: required (HA, as many GPU nodes as replicas) or preferred.
vllm.startupFailureThreshold	integer	90	Failures of the startup probe before a restart (model loading time).
vllm.nodeSelector.nvidia.com/gpu.present	string	true	Node selector of the GPU models (label nvidia.com/gpu.present).
vllm.cpuNodeSelector	map	{}	Node selector of the CPU models.
vllm.tolerations	list	[{"key": "nvidia.com/gpu", "operator": "Exists", "effect": "NoSchedule"}]	Tolerations of the GPU nodes.
vllm.modelCache.storageClass	string	empty	Storage class of the model cache. Empty: the default class.
vllm.modelCache.size	string	200Gi	Size of the model cache volume.
vllm.keda.enabled	boolean	true	Creates a KEDA ScaledObject per model on vllm:num_requests_waiting.
vllm.keda.prometheusAddress	string	http://prometheus-operated.observability.svc:9090	Prometheus queried by KEDA.
vllm.keda.threshold	string	5	Queued requests per replica that trigger a scale out.
vllm.keda.pollingInterval	integer	15	Seconds between two KEDA checks.
vllm.keda.cooldownPeriod	integer	300	Seconds before scaling down.
vllm.models	list	[]	Models served: name, model, gpus, minReplicas, maxReplicas, args, resources, accelerator, cpuKvCacheSpaceGb.

ollama

Ollama. Complementary engine for light and quantized models: a StatefulSet whose replicas keep their own model store and pull the same preloadModels at start.

Path	Type	Default	Description
ollama.enabled	boolean	false	Deploys Ollama.
ollama.image.repository	string	ollama/ollama	Image repository.
ollama.image.tag	string	0.40.14	Image tag.
ollama.image.useGlobalRegistry	boolean	false	false: absolute repository.
ollama.port	integer	11434	Container port.
ollama.replicas	integer	1	Replicas of the StatefulSet.
ollama.accelerator	string	gpu	gpu or cpu.
ollama.gpus	integer	1	GPUs per replica with accelerator: gpu.
ollama.preloadModels	list	[]	Models pulled on every replica at start (OLLAMA_PRELOAD). Empty in an air gap where the store is restored from a validated volume.
ollama.registryCIDRs	list	[]	CIDRs of the internal model registry the preload pulls from (egress 443). Empty: no egress.
ollama.numParallel	integer	4	OLLAMA_NUM_PARALLEL.
ollama.maxLoadedModels	integer	2	OLLAMA_MAX_LOADED_MODELS.
ollama.maxQueue	integer	512	OLLAMA_MAX_QUEUE.
ollama.contextLength	integer	4096	OLLAMA_CONTEXT_LENGTH.
ollama.keepAlive	string	5m	OLLAMA_KEEP_ALIVE.
ollama.modelStore.storageClass	string	empty	Storage class of the model store. Empty: the default class.
ollama.modelStore.size	string	100Gi	Size of the model store of each replica.
ollama.resources	map	{"requests": {"cpu": "2", "memory": "8Gi"}, "limits": {"cpu": "8", "memory": "32Gi"}}	CPU and memory requests and limits.
ollama.nodeSelector.nvidia.com/gpu.present	string	true	Node selector with accelerator: gpu.
ollama.cpuNodeSelector	map	{}	Node selector with accelerator: cpu.
ollama.tolerations	list	[{"key": "nvidia.com/gpu", "operator": "Exists", "effect": "NoSchedule"}]	Tolerations of the GPU nodes.

worker

Background worker. python -m eai.worker with the image, ConfigMap and secrets of the API. A PostgreSQL advisory lock keeps one active replica.

Path	Type	Default	Description
worker.enabled	boolean	true	Deploys the worker.
worker.replicas	integer	1	Replicas (one is active, the others wait for the lock).
worker.metricsPort	integer	9464	EAI_WORKER_METRICS_PORT, scraped by the PodMonitor.
worker.resources	map	{"requests": {"cpu": "100m", "memory": "256Mi"}, "limits": {"cpu": "1", "memory": "1Gi"}}	CPU and memory requests and limits.
worker.nodeSelector	map	{}	Node selector.
worker.tolerations	list	[]	Tolerations.
worker.affinity	map	{}	Affinity.
worker.planes.enabled	boolean	false	Runs the audit, SOC and telemetry jobs in their own Deployments (--plane <name>, own lock and resources); the main worker runs --plane core.
worker.planes.audit.replicas	integer	1	Replicas of the audit plane.
worker.planes.audit.resources	map	{"requests": {"cpu": "100m", "memory": "256Mi"}, "limits": {"cpu": "1", "memory": "1Gi"}}	Resources of the audit plane.
worker.planes.soc.replicas	integer	1	Replicas of the SOC plane.
worker.planes.soc.resources	map	{"requests": {"cpu": "100m", "memory": "256Mi"}, "limits": {"cpu": "1", "memory": "1Gi"}}	Resources of the SOC plane.
worker.planes.telemetry.replicas	integer	1	Replicas of the telemetry plane.
worker.planes.telemetry.resources	map	{"requests": {"cpu": "100m", "memory": "256Mi"}, "limits": {"cpu": "1", "memory": "1Gi"}}	Resources of the telemetry plane.

workers

Media workers. GPU workers (STT, TTS, video) consuming NATS JetStream, scaled by KEDA on the consumer lag.

Path	Type	Default	Description
workers.enabled	boolean	false	Deploys the media workers.
workers.image.repository	string	worker	Image repository.
workers.image.tag	string	1.0.0	Image tag.
workers.nats.monitoringEndpoint	string	nats.eai-data.svc:8222	NATS monitoring endpoint read by KEDA.
workers.nats.stream	string	EAI_MULTIMODAL	JetStream stream (--stream).
workers.items	list	[]	Workers: name, kind (--kind), consumer, gpus, minReplicas, maxReplicas, lagThreshold.

sandbox

Sandbox. Sandboxed execution of the tools and of the code interpreter.

Path	Type	Default	Description
sandbox.enabled	boolean	true	Creates the sandbox resources.
sandbox.namespace	string	eai-sandbox	Namespace of the sandboxes.
sandbox.createNamespace	boolean	true	The chart creates the namespace (standalone install). GitOps: false, the platform bootstrap creates it with its Pod Security labels.
sandbox.runtimeClasses	list	[{"name": "gvisor", "handler": "runsc"}, {"name": "kata", "handler": "kata-qemu"}]	RuntimeClass objects created (gVisor runsc, Kata kata-qemu).

mcpRuntime

MCP Runtime. ToolHive Operator integration. On, the chart adds the ClusterRole and ClusterRoleBinding eai-mcp-runtime-controller and the EAI_MCP_RUNTIME_* variables of the Control Plane.

Path	Type	Default	Description
mcpRuntime.enabled	boolean	false	Turns the MCP Runtime on (EAI_MCP_RUNTIME_ENABLED).
mcpRuntime.issuer	string	empty	EAI_MCP_RUNTIME_ISSUER. Empty: http://<release>-control-plane.<namespace>.svc.<clusterDomain>:<port>/v1/mcp/runtime.
mcpRuntime.jwksUrl	string	empty	EAI_MCP_RUNTIME_JWKS_URL. Empty: the in-cluster GET /v1/mcp/runtime/jwks.
mcpRuntime.gatewayNamespace	string	empty	EAI_MCP_RUNTIME_GATEWAY_NAMESPACE. Empty: the release namespace.
mcpRuntime.internalHosts	list	[]	EAI_MCP_INTERNAL_HOSTS.
mcpRuntime.catalogStorageProfile	string	empty	EAI_MCP_CATALOG_STORAGE_PROFILE, required in production.
mcpRuntime.catalogKey	string	mcp-runtime/templates.yaml	EAI_MCP_CATALOG_KEY.
mcpRuntime.catalogRefreshSeconds	integer	300	EAI_MCP_CATALOG_REFRESH_SECONDS.
mcpRuntime.imageRegistries	list	["harbor.example.internal"]	EAI_MCP_RUNTIME_IMAGE_REGISTRIES.
mcpRuntime.wakeTimeoutSeconds	integer	90	EAI_MCP_RUNTIME_WAKE_TIMEOUT_SECONDS.
mcpRuntime.failureLimit	integer	3	EAI_MCP_RUNTIME_FAILURE_LIMIT.
mcpRuntime.failureWindowSeconds	integer	900	EAI_MCP_RUNTIME_FAILURE_WINDOW_SECONDS.
mcpRuntime.otelEndpoint	string	otel-collector.observability.svc.cluster.local:4318	OTLP/HTTP endpoint with TLS (host:port) of the MCPTelemetryConfig eai-mcp-telemetry.
mcpRuntime.otelSamplingRate	string	1.0	Trace sampling rate between 0 and 1.0.
mcpRuntime.otelCaFile	string	/etc/eai/ca/ca.crt	Internal CA file copied to every mcp-runtime namespace (required outside dev and test).
mcpRuntime.otelCaSecret	string	eai-internal-ca	Secret of the release namespace holding ca.crt of the internal CA, mounted at the folder of otelCaFile.

networkSecurity

Network hardening. Inputs of templates/control-plane/networkpolicy.yaml.

Path	Type	Default	Description
networkSecurity.clusterDomain	string	cluster.local	DNS domain of the cluster.
networkSecurity.metadataCIDRs	list	["169.254.169.254/32", "169.254.0.0/16", "fd00:ec2::254/128"]	Cloud metadata endpoints, denied for every workload (SSRF to instance credentials).
networkSecurity.kubeApiServerCIDRs	list	[]	Plain NetworkPolicy flavour only: API server endpoints reachable by the Control Plane.
networkSecurity.objectStorageFQDNs	list	s3.example.internal	FQDN of the S3 compatible object storage reached over HTTPS. Replace s3.example.internal by the object storage of the client.
networkSecurity.providerEgress.controlPlane	boolean	true	Allows the Control Plane to reach providerFQDNs.
networkSecurity.providerEgress.litellm	boolean	true	Allows LiteLLM to reach providerFQDNs.
networkSecurity.providerFQDNs	list	api.openai.com, api.anthropic.com, bedrock-runtime.eu-west-3.amazonaws.com, bedrock-runtime.eu-central-1.amazonaws.com, europe-west4-aiplatform.googleapis.com, europe-west1-aiplatform.googleapis.com, oauth2.googleapis.com, *.openai.azure.com, login.microsoftonline.com, api.mistral.ai, api.deepseek.com, api.groq.com, generativelanguage.googleapis.com, dashscope-intl.aliyuncs.com, api.z.ai, api.minimax.io, router.huggingface.co, api.githubcopilot.com, openrouter.ai, api.together.xyz, api.fireworks.ai, api.cohere.com	FQDN egress to the LLM providers (same list as deploy/cilium/egress-providers.yaml). Empty or both flags off in an air gap.

redis

Bundled Redis. Optional dependency (Bitnami chart 20.x), off: Argo CD installs Redis in production.

Path	Type	Default	Description
redis.enabled	boolean	false	Installs Redis with the chart (needs helm dependency build and network access).

qdrant

Bundled Qdrant. Optional dependency (chart 1.x), off: Argo CD installs Qdrant in production.

Path	Type	Default	Description
qdrant.enabled	boolean	false	Installs Qdrant with the chart.

nats

Bundled NATS. Optional dependency (chart 1.x), off: Argo CD installs NATS in production.

Path	Type	Default	Description
nats.enabled	boolean	false	Installs NATS with the chart.

openfga

Bundled OpenFGA. Optional dependency (chart 0.x), off: Argo CD installs OpenFGA in production.

Path	Type	Default	Description
openfga.enabled	boolean	false	Installs OpenFGA with the chart.

keycloakx

Bundled Keycloak. Optional dependency (codecentric keycloakx chart 7.x), off: Argo CD installs Keycloak in production.

Path	Type	Default	Description
keycloakx.enabled	boolean	false	Installs Keycloak with the chart.

ha

High availability scheduling. Helper eai.haPodSpec of _helpers.tpl. Off by default; values-ha.yaml turns it on.

Path	Type	Default	Description
ha.enabled	boolean	false	Adds topology spread, anti affinity and the grace period to the pods.
ha.terminationGracePeriodSeconds	integer	60	Seconds left to a pod to drain its requests after SIGTERM.
ha.hostnameSpread	string	DoNotSchedule	whenUnsatisfiable of the spread over hostnames (maxSkew: 1). The pod anti affinity on hostnames is required in any case.
ha.zoneSpread	string	ScheduleAnyway	whenUnsatisfiable of the spread over zones.

Profiles

The chart ships three profiles, given after values.yaml with -f. Each table lists every value the profile sets; a value it does not list keeps the default above. Production uses -f values-prod.yaml, then -f values-ha.yaml for the high availability profile or -f values-onprem-gpu.yaml for GPU nodes on premises.

values-prod.yaml

Production: prod environment, Cilium policies, External Secrets, 3 replicas with PodDisruptionBudget minAvailable: 2 and zone anti affinity, hardened Control Plane settings, data services over TLS.

Path	Value
global.environment	prod
global.networkPolicy	cilium
global.secretsMode	external-secrets
controlPlane.replicas	3
controlPlane.config.EAI_AUTH_DEV	0
controlPlane.config.EAI_AUTH_SPIFFE	1
controlPlane.config.EAI_ENVIRONMENT	prod
controlPlane.config.EAI_ALLOWED_HOSTS	api.example.internal
controlPlane.config.EAI_TRUSTED_PROXIES	10.42.0.0/16
controlPlane.config.EAI_DOCS_ENABLED	false
controlPlane.config.EAI_HSTS_ENABLED	true
controlPlane.config.EAI_MAX_BODY_BYTES	10485760
controlPlane.config.EAI_MAX_UPLOAD_BYTES	104857600
controlPlane.config.EAI_RATE_LIMIT_ENABLED	true
controlPlane.config.EAI_JWT_ALGORITHMS	RS256,PS256,ES256
controlPlane.config.EAI_EGRESS_PRIVATE_ALLOWLIST	enterprise-ai-vllm-llama-3-1-8b:8000,enterprise-ai-vllm-qwen2-5-72b:8000,enterprise-ai-vllm-bge-m3:8000,enterprise-ai-ollama:11434,enterprise-ai-litellm:4000
controlPlane.config.EAI_EGRESS_ALLOWED_PORTS	443
controlPlane.config.EAI_EGRESS_ALLOW_HTTP	false
controlPlane.config.EAI_PROMPT_INJECTION_DEFAULT_MODE	block
controlPlane.config.EAI_RAG_EMBEDDING_MODEL	bge-m3-vllm
controlPlane.config.EAI_MEMORY_EMBEDDING_MODEL	bge-m3-vllm
controlPlane.config.EAI_QDRANT_URL	https://qdrant.eai-data.svc.cluster.local:6333
controlPlane.config.EAI_QDRANT_SHARD_NUMBER	3
controlPlane.config.EAI_QDRANT_REPLICATION_FACTOR	2
controlPlane.config.EAI_QDRANT_WRITE_CONSISTENCY_FACTOR	1
controlPlane.config.EAI_CLICKHOUSE_URL	https://clickhouse.observability.svc.cluster.local:8443
controlPlane.config.EAI_CLICKHOUSE_USER	eai-writer
controlPlane.config.EAI_OPENBAO_URL	https://openbao.openbao.svc.cluster.local:8200
controlPlane.config.EAI_LITELLM_URL	http://enterprise-ai-litellm:4000
controlPlane.config.EAI_OPIK_URL	http://opik-backend.observability.svc:8080
controlPlane.secrets.path	control-plane
controlPlane.secrets.keys	["EAI_DATABASE_URL", "EAI_REDIS_URL", "EAI_NATS_URL", "EAI_QDRANT_API_KEY", "EAI_CLICKHOUSE_PASSWORD", "EAI_MASTER_KEY", "EAI_OPENBAO_TOKEN", "EAI_OPENFGA_STORE_ID", "EAI_OPENFGA_MODEL_ID", "EAI_LITELLM_MASTER_KEY", "EAI_S3_ACCESS_KEY", "EAI_S3_SECRET_KEY", "EAI_LIVEKIT_API_KEY", "EAI_LIVEKIT_API_SECRET"]
controlPlane.secretFormats.EAI_REDIS_URL	^rediss://
controlPlane.secretFormats.EAI_DATABASE_URL	sslmode=verify-full
controlPlane.secretFormats.EAI_NATS_URL	^tls://
controlPlane.autoscaling.minReplicas	3
controlPlane.autoscaling.maxReplicas	20
controlPlane.pdb.minAvailable	2
controlPlane.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution	[{"topologyKey": "topology.kubernetes.io/zone", "labelSelector": {"matchLabels": {"app.kubernetes.io/component": "control-plane"}}}]
portal.replicas	3
portal.autoscaling.minReplicas	3
portal.pdb.minAvailable	2
litellm.replicas	3
litellm.autoscaling.minReplicas	3
litellm.autoscaling.maxReplicas	30
litellm.pdb.minAvailable	2
sandbox.createNamespace	false

values-ha.yaml

High availability, on top of values-prod.yaml: 3 replicas, minAvailable: 2, spread over hostnames (required) and zones (preferred), 60 second graceful shutdown. A rendered manifest proves the configuration only; a validated failover needs a run on a real cluster.

Path	Value
ha.enabled	true
ha.terminationGracePeriodSeconds	60
ha.hostnameSpread	DoNotSchedule
ha.zoneSpread	ScheduleAnyway
controlPlane.replicas	3
controlPlane.autoscaling.enabled	true
controlPlane.autoscaling.minReplicas	3
controlPlane.autoscaling.maxReplicas	10
controlPlane.autoscaling.targetCPUUtilizationPercentage	70
controlPlane.pdb.enabled	true
controlPlane.pdb.minAvailable	2
portal.replicas	3
portal.autoscaling.enabled	true
portal.autoscaling.minReplicas	3
portal.autoscaling.maxReplicas	6
portal.autoscaling.targetCPUUtilizationPercentage	70
portal.pdb.enabled	true
portal.pdb.minAvailable	2
litellm.replicas	3
litellm.autoscaling.enabled	true
litellm.autoscaling.minReplicas	3
litellm.autoscaling.maxReplicas	10
litellm.autoscaling.targetCPUUtilizationPercentage	70
litellm.pdb.enabled	true
litellm.pdb.minAvailable	2

values-onprem-gpu.yaml

On premises with NVIDIA GPU nodes: internal Harbor registry, OpenBao agent, three vLLM models (chat, large chat and the bge-m3 embedding model), STT, TTS and video media workers, LiteLLM routed to the local models.

Path	Value
global.environment	prod
global.imageRegistry	harbor.onprem.internal/eai
global.secretsMode	openbao-agent
controlPlane.config.EAI_RAG_EMBEDDING_MODEL	bge-m3-vllm
controlPlane.config.EAI_MEMORY_EMBEDDING_MODEL	bge-m3-vllm
vllm.enabled	true
vllm.image.repository	harbor.onprem.internal/mirror/vllm/vllm-openai
vllm.modelCache.storageClass	local-nvme
vllm.modelCache.size	500Gi
vllm.models	list (3): llama-3-1-8b, qwen2-5-72b, bge-m3
workers.enabled	true
workers.items	list (3): stt, tts, video
litellm.config	map, keys model_list, router_settings, general_settings