Values reference

This page is the reference

It covers the keys you actually set, which is a much shorter list than every key a chart accepts, and states which of them are required. For anything not listed here, read the chart's own values.yaml in the bundle.

There is no generated key-by-key reference. The charts carry no JSON schema yet, so nothing can be generated from one; when that changes this page will link to it.

How values are layered

Three files, applied in order, last one wins.

chart values.yaml            the chart's own defaults, registry deliberately blank
  values-onprem.yaml         shipped in the bundle, points everything at a registry
    your overrides           what you set

Always pass -f values-onprem.yaml. The default values.yaml leaves the registry blank on purpose, so installing without it cannot resolve images.

Put your overrides in a file rather than in --set arguments, because helm upgrade uses only what you pass it. Anything set with --set last time and omitted this time reverts to the chart default.

helm get values g0s -n gen0sec        # what the running release actually has

gen0sec-infra

Top-level keys: postgres-operator, strimzi-kafka-operator, synapse-operator, synapse, rustfs, dragonfly.

Key	Default	Set it when
rustfs.storageclass.name	"", meaning the cluster default	You want a specific StorageClass
rustfs.storageclass.dataStorageSize	50Gi	Sizing the object store. Four drives per replica
rustfs.storageclass.logStorageSize	10Gi	Rarely
rustfs.replicaCount	3	Fewer nodes. Erasure coding assumes they spread
rustfs.clusterDomain	cluster.local	Your cluster uses a custom DNS domain
dragonfly.extraArgs	[]	Adding --force_epoll when io_uring is blocked
dragonfly.maxMemory	Chart default	Keep it comfortably under the memory limit, or the kubelet kills the pod before it can evict

See Sizing storage for your retention.

gen0sec-data

Top-level keys: postgres, kafka, kafka2pg.

Key	Default	Set it when
postgres.numberOfInstances	3	Never below 3 in production
postgres.volume.size	50Gi	Sizing the database. This is the system of record, so it is the one to grow first
postgres.volume.storageClass	""	You want a specific StorageClass. Fast block storage
postgres.resources	1 vCPU / 2 GiB requested, 8 vCPU / 12 GiB limit	Tuning. The limit sets the per-node minimum
kafka.replicas	3	Fewer nodes. Drop the replication factors together, or brokers refuse writes
kafka.storage.size	50Gi	Sizing the message log and the ingest buffer
kafka.storage.class	""	You want a specific StorageClass

Kafka replicas and replication factor move together

min.insync.replicas must stay below replicas. Reducing brokers without reducing the factors gives you a cluster that schedules and then refuses every write.

gen0sec-platform

Top-level keys: global, migration, downloadProxy, services.

global

Key	Default	Notes
global.registry.host	registry.gen0sec.com	Rewritten by the bundler on the offline path
global.registry.namespace	gen0sec	Every image lives under this
global.imageTag	Empty	Required. Set it to the release version
global.imagePullSecrets	gen0sec-registry	Must exist in both namespaces
global.commonEnv.S3_ENDPOINT	The object store service URL	Must match the object store Service, which has a -svc suffix
global.commonEnv.ARXIGNIS_DATA_URL	The same URL plus /platform-data	The bucket name must match the bucket you created
global.commonEnv.REDIS_URL	The cache service URL	No credential in it, deliberately
global.podSecurityContext	Non-root, uid 65532	Do not weaken. See Hardening
global.securityContext	Read-only root, no capabilities	Do not weaken
global.ingress.className	synapse	The ingress controller the infra chart installs

Publishing

Set by the single-entrypoint overlay, not by values-onprem.yaml, which leaves every ingress disabled. Both are top level, and both are aliased into every rule the overlay writes — which is why they are listed here rather than under services.

Key	Default	Notes
entrypointHost	gen0sec.internal	Required to publish anything. The one address that serves the dashboard and every agent-facing API. A rule with an empty host renders, and the controller then skips it with no event and no log line. It must also be the address people actually type: the dashboard derives its sign-in URL from it
externalScheme	Unset	Set to https only when TLS terminates upstream of the Ingress — a cloud load balancer, a CDN, a tunnel. With no tls: block to read, the chart otherwise infers http while the browser is on https, and every sign-in is rejected with Invalid origin. Leave it unset when TLS terminates at the Ingress

downloadProxy

Key	Default	Notes
downloadProxy.enabled	true	Turning it off is not supported
downloadProxy.apiKeySecret.name	""	Required. Empty is a silently broken deployment

Full detail on Data relay. This is the single most consequential key in the chart.

services

Twenty-one entries. Each one accepts the same shape, and you rarely need to touch any of it.

Key pattern	Notes
services.<name>.enabled	threat-api is not shipped at this release
services.<name>.replicaCount	2 or 3 in production, 1 in the quickstart overlay
services.<name>.resources	Requests and limits. See Sizing
services.<name>.env	Per-service environment, including PORT
services.<name>.ingress	Off by default. Set by the entrypoint overlay
services.<name>.volumes, .volumeMounts	Do not remove these. They exist because the read-only root filesystem needs a writable path where each service expects one
services.ui.enabled	true. The dashboard
services.ui.entraId.enabled	false. Entra ID is in development and not supported at this release. See Sign-in and identity

Removing a service's volume mount breaks that service

Several services default to writing into a path relative to their working directory, which fails on a read-only root filesystem. Each one has an explicit writable volume mounted where it writes. Those mounts are load-bearing, not leftovers.

Checking what a change will do

Always render before you apply.

helm template g0s $B/charts/gen0sec-platform-*.tgz -n gen0sec \
  -f $B/values/gen0sec-platform-values-onprem.yaml \
  -f my-overrides.yaml \
  | less

To diff against what is running:

helm get manifest g0s -n gen0sec > running.yaml
helm template g0s ... > proposed.yaml
diff running.yaml proposed.yaml

Named starting points

Two tested configurations rather than a blank page: Reference configurations.