Values reference
The complete key-by-key reference is generated from each chart's schema in CI, so it cannot drift. It is linked at the bottom of each section.
This page covers the keys you actually set, which is a much shorter list, and states which of them are required.
No chart schema exists yet, so the generated reference is not published. Until it is, treat this
page as the source and read the chart's own values.yaml for anything not listed.
How values are layered
Three files, applied in order, last one wins.
chart values.yaml the chart's own defaults, registry deliberately blank
values-onprem.yaml shipped in the bundle, points everything at a registry
your overrides what you set
Always pass -f values-onprem.yaml. The default values.yaml leaves the registry blank on
purpose, so installing without it cannot resolve images.
Put your overrides in a file rather than in --set arguments, because helm upgrade uses only what
you pass it. Anything set with --set last time and omitted this time reverts to the chart default.
helm get values g0s -n gen0sec # what the running release actually has
gen0sec-infra
Top-level keys: postgres-operator, strimzi-kafka-operator, synapse-operator, synapse,
rustfs, dragonfly.
| Key | Default | Set it when |
|---|---|---|
rustfs.storageclass.name | "", meaning the cluster default | You want a specific StorageClass |
rustfs.storageclass.dataStorageSize | 50Gi | Sizing the object store. Four drives per replica |
rustfs.storageclass.logStorageSize | 10Gi | Rarely |
rustfs.replicaCount | 3 | Fewer nodes. Erasure coding assumes they spread |
rustfs.clusterDomain | cluster.local | Your cluster uses a custom DNS domain |
dragonfly.extraArgs | [] | Adding --force_epoll when io_uring is blocked |
dragonfly.maxMemory | Chart default | Keep it comfortably under the memory limit, or the kubelet kills the pod before it can evict |
See Sizing storage for your retention.
gen0sec-data
Top-level keys: postgres, kafka, kafka2pg.
| Key | Default | Set it when |
|---|---|---|
postgres.numberOfInstances | 3 | Never below 3 in production |
postgres.volume.size | 50Gi | Sizing the database. This is the system of record, so it is the one to grow first |
postgres.volume.storageClass | "" | You want a specific StorageClass. Fast block storage |
postgres.resources | 1 vCPU / 2 GiB requested, 8 vCPU / 12 GiB limit | Tuning. The limit sets the per-node minimum |
kafka.replicas | 3 | Fewer nodes. Drop the replication factors together, or brokers refuse writes |
kafka.storage.size | 50Gi | Sizing the message log and the ingest buffer |
kafka.storage.class | "" | You want a specific StorageClass |
min.insync.replicas must stay below replicas. Reducing brokers without reducing the factors gives
you a cluster that schedules and then refuses every write.
gen0sec-platform
Top-level keys: global, migration, downloadProxy, services.
global
| Key | Default | Notes |
|---|---|---|
global.registry.host | registry.gen0sec.com | Rewritten by the bundler on the offline path |
global.registry.namespace | gen0sec | Every image lives under this |
global.imageTag | Empty | Required. Set it to the release version |
global.imagePullSecrets | gen0sec-registry | Must exist in both namespaces |
global.commonEnv.S3_ENDPOINT | The object store service URL | Must match the object store Service, which has a -svc suffix |
global.commonEnv.ARXIGNIS_DATA_URL | The same URL plus /platform-data | The bucket name must match the bucket you created |
global.commonEnv.REDIS_URL | The cache service URL | No credential in it, deliberately |
global.podSecurityContext | Non-root, uid 65532 | Do not weaken. See Hardening |
global.securityContext | Read-only root, no capabilities | Do not weaken |
global.ingress.className | synapse | The ingress controller the infra chart installs |
downloadProxy
| Key | Default | Notes |
|---|---|---|
downloadProxy.enabled | true | Turning it off is not supported |
downloadProxy.apiKeySecret.name | "" | Required. Empty is a silently broken deployment |
Full detail on Data relay. This is the single most consequential key in the chart.
services
Twenty-one entries. Each one accepts the same shape, and you rarely need to touch any of it.
| Key pattern | Notes |
|---|---|
services.<name>.enabled | threat-api is not shipped at this release |
services.<name>.replicaCount | 2 or 3 in production, 1 in the quickstart overlay |
services.<name>.resources | Requests and limits. See Sizing |
services.<name>.env | Per-service environment, including PORT |
services.<name>.ingress | Off by default. Set by the entrypoint overlay |
services.<name>.volumes, .volumeMounts | Do not remove these. They exist because the read-only root filesystem needs a writable path where each service expects one |
services.ui.enabled | true. The dashboard |
services.ui.entraId.enabled | false. Entra ID is in development and not supported at this release. See Sign-in and identity |
Several services default to writing into a path relative to their working directory, which fails on a read-only root filesystem. Each one has an explicit writable volume mounted where it writes. Those mounts are load-bearing, not leftovers.
Checking what a change will do
Always render before you apply.
helm template g0s $B/charts/gen0sec-platform-*.tgz -n gen0sec \
-f $B/values/gen0sec-platform-values-onprem.yaml \
-f my-overrides.yaml \
| less
To diff against what is running:
helm get manifest g0s -n gen0sec > running.yaml
helm template g0s ... > proposed.yaml
diff running.yaml proposed.yaml
Named starting points
Two tested configurations rather than a blank page: Reference configurations.