Skip to main content

Helm Chart Values 2026.9.0

Version: 2026.9.0

Here is the reference for the customizable values for Helm installation. See Helm installation documentation for more information.

Values​

KeyDescription
global
(object)		Global configuration
Default: {"emptyDir":{"sizeLimit":""},"fipsEnabled":false,"image":{"imagePullPolicy":"IfNotPresent","registry":null},"imagePullSecrets":[],"imageRegistry":"","labels":{},"nodeSelector":{},"priorityClassName":"","tolerations":[]}
global.imageRegistry
(string)		Global Docker image registry
Default: ""
global.image.registry
(string)		Use the same value as global.imageRegistry here (for compatibility)
Default: nil
global.imagePullSecrets
(list)		Global Docker registry secret names as an array
Default: []
global.fipsEnabled
(bool)		Enable the use of FIPS compliant images
Default: false
global.priorityClassName
(string)		Default priority class for all components
Default: ""
global.labels
(object)		Common labels to add to all resources Format: name: value
Default: {}
global.tolerations
(list)		Common tolerations applied to all workloads Example for ARM/Graviton nodes: tolerations: - key: graviton operator: Exists
Default: []
global.emptyDir.sizeLimit
(string)		Default sizeLimit for every chart-managed emptyDir volume. Empty emits no sizeLimit (Kubernetes default: unbounded). Per-volume keys override this.
Default: ""
global.nodeSelector
(object)		Common nodeSelector for all components
Default: {}
hostname
(string)		Hostname for the GitGuardian application (without https://)
Default: "gitguardian.example.com"
extra_hostnames
(list)		Additional hostnames accepted by the routing layer. Only effective on /api/v1/receiver (the hook webapp skips Host validation); other paths still require the canonical hostname above.
Default: []
network.ipFamily
(string)		IP family mode for the deployment ("ipv4", "ipv6", "dualstack")
Default: "ipv4"
postgresql
(object)		PostgreSQL Database configuration
Default: Not set
postgresql.host
(string)		PostgreSQL Database host name
Default: ""
postgresql.port
(int)		PostgreSQL Database host port
Default: 5432
postgresql.username
(string)		PostgreSQL Database user name
Default: ""
postgresql.password
(string)		PostgreSQL Database user password Should preferably be set in existing secret (see: postgresql.existingSecret)
Default: ""
postgresql.tls.mode
(string)		PostgreSQL Database SSL mode Possible values: disable, allow, prefer, require, verify-ca, verify-full See: PostgreSQL SSL Mode Descriptions
Default: "allow"
postgresql.tls.crt
(string)		PostgreSQL Database Client certificate Should preferably be set in existing secret (see: postgresql.existingSecret)
Default: ""
postgresql.tls.key
(string)		PostgreSQL Database Client certificate private key Should preferably be set in existing secret (see: postgresql.existingSecret)
Default: ""
postgresql.tls.caCrt
(string)		PostgreSQL Database Custom Certificate Authority Should preferably be set in existing secret (see: postgresql.existingSecret)
Default: ""
postgresql.tls.existingSecretKeys.crt
(string)		Existing secret key where to store PostgreSQL Database Client certificate
Default: ""
postgresql.tls.existingSecretKeys.key
(string)		Existing secret key where to store PostgreSQL Database Client certificate private key
Default: ""
postgresql.tls.existingSecretKeys.caCrt
(string)		Existing secret key where to store PostgreSQL Database Custom Certificate Authority
Default: ""
postgresql.existingSecret
(string)		Secret used to store PostgreSQL password and Certificates (preferred method)
Default: ""
postgresql.existingSecretKeys
(object)		Keys used for PostgreSQL Database secrets when using an existing secret
postgresql.existingSecretKeys.password
(string)		Existing secret key where to store PostgreSQL Database user password
Default: ""
redis
(object)		Redis Database configuration You can either provide a full qualified URI or fill each parts in dedicated fields Redis is used as a broker and result backend for celery and as a Commit Cache
Default: Not set
redis.main.url
(string)		Full qualified URI of Redis Instance Should preferably be set in existing secret (see: redis.main.existingSecret) This values is not used if using Redis Sentinel
Default: ""
redis.main.user
(string)		Redis Instance user (if redis.main.url is not specified) / Redis Sentinel master name
Default: ""
redis.main.password
(string)		Redis Instance password (if redis.main.url is not specified) / Redis Sentinel master password Should preferably be set in existing secret (see: redis.main.existingSecret)
Default: ""
redis.main.host
(string)		Redis Instance host name (if redis.main.url is not specified) This values is not used if using Redis Sentinel
Default: ""
redis.main.port
(int)		Redis Instance host port (if redis.main.url is not specified)
Default: 6379
redis.main.sentinel
(object)		Redis Sentinel dedicated parameters (works along with redis.main.url)
Default: {"enabled":false,"masterServiceName":"","password":"","url":"","user":""}
redis.main.sentinel.enabled
(bool)		Redis Sentinel enabler
Default: false
redis.main.sentinel.url
(string)		Redis Sentinel instances list. Format: sentinel-1:26379,sentinel-2:26379 Should preferably be set in existing secret (see: redis.main.existingSecret)
Default: ""
redis.main.sentinel.user
(string)		Redis Sentinel master user
Default: ""
redis.main.sentinel.password
(string)		Redis Sentinel master password Should preferably be set in existing secret (see: redis.main.existingSecret)
Default: ""
redis.main.sentinel.masterServiceName
(string)		Redis Sentinel master service name
Default: ""
redis.main.tls
(object)		Redis Instance TLS configuration
Default: Not set
redis.main.tls.enabled
(bool)		Enable redis TLS (mandatory, whether using redis.main.url or redis.main.host)
Default: false
redis.main.tls.requireServerCert
(bool)		Enable redis server certificate check If true, you must provide a rediss:// URL Scheme for redis.main.url
Default: false
redis.main.tls.crt
(string)		Redis Instance Client certificate Should preferably be set in existing secret (see: redis.main.existingSecret)
Default: ""
redis.main.tls.key
(string)		Redis Instance Client certificate private key Should preferably be set in existing secret (see: redis.main.existingSecret)
Default: ""
redis.main.tls.caCrt
(string)		Redis Instance Custom Certificate Authority Should preferably be set in existing secret (see: redis.main.existingSecret)
Default: ""
redis.main.tls.existingSecretKeys.crt
(string)		Existing secret key where to store Redis Instance Client certificate
Default: ""
redis.main.tls.existingSecretKeys.key
(string)		Existing secret key where to store Redis Instance Client certificate private key
Default: ""
redis.main.tls.existingSecretKeys.caCrt
(string)		Existing secret key where to store Redis Instance Custom Certificate Authority
Default: ""
redis.main.existingSecret
(string)		Secret used to store Redis Instance URL or password and Certificates (preferred method)
Default: ""
redis.main.existingSecretKeys
(object)		Keys used for Redis secrets when using an existing secret
redis.main.existingSecretKeys.url
(string)		Redis url
Default: ""
redis.main.existingSecretKeys.password
(string)		Redis password (You can't use this parameter with Argo CD, use url parameter instead)
Default: ""
redis.main.existingSecretKeys.sentinelUrl
(string)		Redis Sentinel instances list
Default: ""
redis.main.existingSecretKeys.sentinelPassword
(string)		Redis Sentinel password
Default: ""
redis.commitCache.enabled
(bool)		Enable a separate Redis instance dedicated to the Commit Cache feature. Commit Cache feature allows to not scan already scanned commit by saving in Redis scan results. If not enabled, main Redis instance will be used for the Commit Cache
Default: false
redis.commitCache.url
(string)		Full qualified URI of Redis Instance Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
Default: ""
redis.commitCache.user
(string)		Redis Instance user name (if redis.commitCache.url is not specified)
Default: ""
redis.commitCache.password
(string)		Redis Instance user password (if redis.commitCache.url is not specified) Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
Default: ""
redis.commitCache.host
(string)		Redis Instance host name (if redis.commitCache.url is not specified)
Default: ""
redis.commitCache.port
(int)		Redis Instance host port (if redis.commitCache.url is not specified)
Default: 6379
redis.commitCache.tls
(object)		Redis Instance TLS configuration
Default: Not set
redis.commitCache.tls.enabled
(bool)		Enable redis TLS (mandatory, whether using redis.commitCache.url or redis.commitCache.host)
Default: false
redis.commitCache.tls.requireServerCert
(bool)		Enable redis server certificate check If true, you must provide a rediss:// URL Scheme for REDIS_URL
Default: false
redis.commitCache.tls.crt
(string)		Redis Instance Client certificate Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
Default: ""
redis.commitCache.tls.key
(string)		Redis Instance Client certificate private key Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
Default: ""
redis.commitCache.tls.caCrt
(string)		Redis Instance Custom Certificate Authority Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
Default: ""
redis.commitCache.tls.existingSecretKeys.crt
(string)		Existing secret key where to store Redis Instance Client certificate
Default: ""
redis.commitCache.tls.existingSecretKeys.key
(string)		Existing secret key where to store Redis Instance Client certificate private key
Default: ""
redis.commitCache.tls.existingSecretKeys.caCrt
(string)		Existing secret key where to store Redis Instance Custom Certificate Authority
Default: ""
redis.commitCache.existingSecret
(string)		Secret used to store Redis Instance URL or password and Certificates (preferred method)
Default: ""
redis.commitCache.existingSecretKeys
(object)		Keys used for Redis secrets when using an existing secret
redis.commitCache.existingSecretKeys.url
(string)		Redis url can be set directly, or it will be recomposed from host, user, ...
Default: ""
redis.commitCache.existingSecretKeys.password
(string)		Redis password (You can't use this parameter with Argo CD, use url parameter instead)
Default: ""
miscEncryption
(object)		Encryption keys configuration Django Secret Key, X509 certificate and key are auto-generated during installation if not set
Default: Auto-generated
miscEncryption.djangoSecretKey
(string)		Encryption key for sensitive database fields. Auto-generated at first install if empty (preferred method) IMPORTANT The key should be kept in a safe place at it is required to access all sensitive information in the database
Default: Auto-generated
miscEncryption.dbEncryptionKeys
(string)		DB encryption secrets (optional, only needed for djangoSecretKey key rotation)
Default: ""
miscEncryption.existingSecret
(string)		Secret used to store encryption secrets
Default: ""
miscEncryption.existingSecretKeys
(object)		Keys used for encryption secrets when using an existing secret
miscEncryption.existingSecretKeys.djangoSecretKey
(string)		Existing secret key where to store Django Secret Key Auto-generated at first install if empty (preferred method)
Default: ""
miscEncryption.existingSecretKeys.dbEncryptionKeys
(string)		Existing secret key where to store DB encryption keys (optional, only needed for djangoSecretKey key rotation)
Default: ""
miscEncryption.existingSecretKeys.x509Cert
(string)		Existing secret key where to store certificate for SAML/SSO auth Auto-generated at first install if empty (preferred method)
Default: ""
miscEncryption.existingSecretKeys.x509PrivateKey
(string)		Existing secret key where to store certificate private key for SAML/SSO auth Auto-generated at first install if empty (preferred method)
Default: ""
autoscaling
(object)		Autoscaling configuration
Default: {"keda":{"additionalPromqlLabelSelectors":"","prometheus":{}}}
autoscaling.keda.additionalPromqlLabelSelectors
(string)		Optional comma-terminated PromQL label selectors inserted at the start of every { in built-in KEDA Prometheus queries when your metrics need extra matchers (e.g. cluster="prod",). Leave empty to keep the default queries.
Default: ""
autoscaling.keda.prometheus
(object)		Prometheus scaler configguration
Default: {}
front
(object)		Frontend configuration The Frontend serves the Dashboard and acts as a proxy for other web deployments
front.nginx.replicas
(int)		Dashboard Frontend replicas count
Default: 1
front.nginx.nodeSelector
(object)		Node selection constraint for Frontend
Default: {}
front.nginx.tolerations
(list)		Schedule Frontend pods with matching taints
Default: []
front.nginx.priorityClassName
(string)		priorityClassName (overrides global)
Default: ""
front.nginx.podAntiAffinityPreset
(string)		Pod anti-affinity preset (hard or soft)
Default: "soft"
front.nginx.resources
(object)		Dashboard Frontend resources
Default: {"requests":{"cpu":"100m","memory":"200Mi"}}
front.service.type
(string)		Service type. Can be ClusterIP, NodePort or LoadBalancer
Default: "ClusterIP"
front.service.port
(int)		Dashboard Frontend Service port
Default: 80
front.service.annotations
(object)		Dashboard Frontend Service annotations
Default: {}
webappDefaults
(object)		Backend deployments configuration
webappDefaults.autoscaling.hpa.enabled
(bool)		Enable Horizontal Pod Autoscaler
Default: false
webappDefaults.autoscaling.keda.enabled
(bool)		Enable Keda Autoscaler
Default: false
webappDefaults.autoscaling.keda.triggers
(list)		Additional Keda triggers
Default: []
webappDefaults.autoscaling.minReplicas
(int)		Minimum number of workers created by autoscaler
Default: 1
webappDefaults.autoscaling.maxReplicas
(int)		Maximum number of workers created by autoscaler
Default: 10
webappDefaults.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"targetLatency":1000}
webappDefaults.podAntiAffinityPreset
(string)		Pod anti-affinity preset (hard or soft)
Default: "soft"
webappDefaults.nodeSelector
(object)		Node selection constraint
Default: {}
webappDefaults.tolerations
(list)		Schedule pods with matching taints
Default: []
webappDefaults.priorityClassName
(string)		priorityClassName (overrides global)
Default: ""
webapps.internal_api.name
(string)
Default: "internal-api"
webapps.internal_api.component
(string)
Default: "app"
webapps.internal_api.replicas
(int)		Internal API replicas count
Default: 1
webapps.internal_api.nginx.location
(string)
Default: "/api/v1/"
webapps.internal_api.gunicorn.port
(int)
Default: 5050
webapps.internal_api.gunicorn.workers
(int)
Default: 3
webapps.internal_api.resources.requests.cpu
(string)
Default: "100m"
webapps.internal_api.resources.requests.memory
(string)
Default: "500Mi"
webapps.internal_api.readinessProbe.enabled
(bool)
Default: true
webapps.internal_api.readinessProbe.initialDelaySeconds
(int)
Default: 15
webapps.internal_api.readinessProbe.periodSeconds
(int)
Default: 5
webapps.internal_api.readinessProbe.timeoutSeconds
(int)
Default: 3
webapps.internal_api.readinessProbe.successThreshold
(int)
Default: 1
webapps.internal_api.readinessProbe.failureThreshold
(int)
Default: 3
webapps.internal_api_long.name
(string)
Default: "internal-api-long"
webapps.internal_api_long.component
(string)
Default: "app"
webapps.internal_api_long.replicas
(int)		Internal API for long requests replicas count
Default: 1
webapps.internal_api_long.nginx.location
(string)
Default: `"~* "(?x)\n /api/v1/accounts/\d+/\n (\n report/\n
webapps.internal_api_long.nginx.keepalive_timeout
(string)
Default: "3600s"
webapps.internal_api_long.gunicorn.port
(int)
Default: 5050
webapps.internal_api_long.gunicorn.worker_class
(string)
Default: "gthread"
webapps.internal_api_long.gunicorn.workers
(int)
Default: 4
webapps.internal_api_long.gunicorn.timeout
(int)
Default: 300
webapps.internal_api_long.resources.requests.cpu
(string)
Default: "100m"
webapps.internal_api_long.resources.requests.memory
(string)
Default: "500Mi"
webapps.internal_api_long.readinessProbe.enabled
(bool)
Default: true
webapps.internal_api_long.readinessProbe.initialDelaySeconds
(int)
Default: 15
webapps.internal_api_long.readinessProbe.periodSeconds
(int)
Default: 10
webapps.internal_api_long.readinessProbe.timeoutSeconds
(int)
Default: 5
webapps.internal_api_long.readinessProbe.successThreshold
(int)
Default: 1
webapps.internal_api_long.readinessProbe.failureThreshold
(int)
Default: 3
webapps.public_api.name
(string)
Default: "public-api"
webapps.public_api.component
(string)
Default: "api"
webapps.public_api.replicas
(int)		Public API (used for ggshield scans) replicas count
Default: 1
webapps.public_api.nginx.location
(string)
Default: "/exposed"
webapps.public_api.nginx.locationDirectives[0]
(string)
Default: "client_max_body_size 25m;"
webapps.public_api.gunicorn.port
(int)
Default: 5051
webapps.public_api.gunicorn.workers
(int)
Default: 5
webapps.public_api.resources.requests.cpu
(string)
Default: "100m"
webapps.public_api.resources.requests.memory
(string)
Default: "500Mi"
webapps.public_api.readinessProbe.enabled
(bool)
Default: true
webapps.public_api.readinessProbe.initialDelaySeconds
(int)
Default: 15
webapps.public_api.readinessProbe.periodSeconds
(int)
Default: 10
webapps.public_api.readinessProbe.timeoutSeconds
(int)
Default: 5
webapps.public_api.readinessProbe.successThreshold
(int)
Default: 1
webapps.public_api.readinessProbe.failureThreshold
(int)
Default: 3
webapps.hook.name
(string)
Default: "hook"
webapps.hook.component
(string)
Default: "receiver"
webapps.hook.replicas
(int)		VCS Webhooks Receivers replicas count
Default: 1
webapps.hook.nginx.location
(string)
Default: "/api/v1/receiver"
webapps.hook.gunicorn.port
(int)
Default: 5050
webapps.hook.resources.requests.cpu
(string)
Default: "100m"
webapps.hook.resources.requests.memory
(string)
Default: "500Mi"
webapps.hook.readinessProbe.enabled
(bool)
Default: false
webapps.app_exporter.name
(string)
Default: "app-exporter"
webapps.app_exporter.replicas
(string)		Prometheus exporter replicas count Will be set to 1 if .Values.observability.exporter.statefulAppExporter.enabled is true
Default: 0
webapps.app_exporter.internal
(bool)
Default: true
webapps.app_exporter.gunicorn.port
(int)
Default: 9808
webapps.app_exporter.readinessProbe.enabled
(bool)
Default: true
webapps.app_exporter.readinessProbe.initialDelaySeconds
(int)
Default: 15
webapps.app_exporter.readinessProbe.periodSeconds
(int)
Default: 10
webapps.app_exporter.readinessProbe.timeoutSeconds
(int)
Default: 5
webapps.app_exporter.readinessProbe.successThreshold
(int)
Default: 1
webapps.app_exporter.readinessProbe.failureThreshold
(int)
Default: 3
celeryWorkerDefaults
(object)		Default configuration applied to all celery workers Workers can override any of these values in their own configuration. NOTE: Do NOT set terminationGracePeriodSeconds here - it has a dedicated fallback mechanism.
Default: {"autoscaling":{"hpa":{"enabled":false},"keda":{"enabled":false,"idleReplicaCount":0,"triggers":[]},"maxReplicas":10,"minReplicas":1},"ephemeralStorage":{"annotations":{},"enabled":false,"labels":{},"size":"1Gi","storageClass":""},"livenessProbe":{"enabled":true,"failureThreshold":3,"initialDelaySeconds":30,"periodSeconds":30,"successThreshold":1,"timeoutSeconds":10},"metricsPort":9808,"nodeSelector":{},"podAntiAffinityPreset":"soft","priorityClassName":"","startupProbe":{"enabled":true,"failureThreshold":30,"heartbeatThreshold":120,"initialDelaySeconds":10,"periodSeconds":10,"timeoutSeconds":5},"tolerations":[]}
celeryWorkers
(object)		Asynchronous Workers deployments configuration
celeryWorkers.worker.queues
(string)		Queues consumed by default workers
Default: "celery,check_run,realtime,realtime_retry,honeytoken,reports,core_default,sources_default,incidents_default,individual_validity_check"
celeryWorkers.worker.replicas
(int)		Default workers (incl. realtime scans) replicas count
Default: 2
celeryWorkers.worker.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"celery":10,"check_run":10,"core_default":10,"honeytoken":10,"incidents_default":10,"individual_validity_check":10,"realtime":10,"realtime_retry":10,"reports":10,"sources_default":10}
celeryWorkers.check-runs.queues
(string)		Queues consumed by Check Run workers
Default: "check_run"
celeryWorkers.check-runs.replicas
(int)		Check Run workers replicas count
Default: 0
celeryWorkers.check-runs.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"check_run":10}
celeryWorkers.email.queues
(string)		Queues consumed by Messaging workers
Default: "email,notifier"
celeryWorkers.email.replicas
(int)		Messaging workers replicas count
Default: 2
celeryWorkers.email.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"email":10,"notifier":10}
celeryWorkers.public-monitoring.queues
(string)		Queues consumed by Public Monitoring workers
Default: "public_monitoring,public_monitoring_historical_scan,public_monitoring_realtime_scan"
celeryWorkers.public-monitoring.replicas
(int)		Worker count when enabled (gated to 0 unless the license field below is true)
Default: 1
celeryWorkers.scanners.queues
(string)		Queues consumed by Historical Scan workers
Default: "basic_repo_scan,premium_repo_scan,manual_repo_scan,code_fixing"
celeryWorkers.scanners.replicas
(int)		Historical Scan workers replicas count
Default: 2
celeryWorkers.scanners.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"basic_repo_scan":10,"code_fixing":10,"manual_repo_scan":10,"premium_repo_scan":10}
celeryWorkers.check-run-scanners.queues
(string)		Queues consumed by scan-based check-run workers
Default: "check_run_scan"
celeryWorkers.check-run-scanners.replicas
(int)		Scan-based check-run workers replicas count (0 = fall back to scanners)
Default: 0
celeryWorkers.check-run-scanners.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"check_run_scan":10}
celeryWorkers.premium-scanners-retry.queues
(string)		Queues consumed by the VCS scan retry workers
Default: "premium_repo_scan_retry"
celeryWorkers.premium-scanners-retry.replicas
(int)		VCS scan retry workers replicas count (0 disables the dedicated worker)
Default: 0
celeryWorkers.premium-scanners-retry.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"premium_repo_scan_retry":1}
celeryWorkers.long.queues
(string)		Queues consumed by Long Tasks workers
Default: "background_validity_check,update_sources_state,nhi_ingestion,endpoints,hmsl,core_long,sources_long,incidents_long,ml_backpopulate,core_aspm,team_sync"
celeryWorkers.long.replicas
(int)		Long Tasks workers replicas count
Default: 2
celeryWorkers.long.autoscaling.metrics
(object)		HPA metrics threshold
Default: {"background_validity_check":10,"core_aspm":10,"core_long":10,"endpoints":10,"hmsl":10,"incidents_long":10,"ml_backpopulate":10,"nhi_ingestion":10,"sources_long":10,"team_sync":10,"update_sources_state":10}
celeryWorkers.automatic-severities.queues
(string)		Queues consumed by automatic severities workers
Default: "automatic_severities"
celeryWorkers.automatic-severities.replicas
(int)		Automatic severities workers replicas count
Default: 1
celeryWorkers.automatic-severities.autoscaling.maxReplicas
(int)		Autoscaling metrics threshold
Default: 3
celeryWorkers.incidents-disk.queues
(string)		Queues consumed by the locations recompute workers
Default: "incidents_disk"
celeryWorkers.incidents-disk.replicas
(int)		Locations recompute workers replicas count (0 = fall back to scanners)
Default: 0
celeryWorkers.incidents-disk.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"incidents_disk":10}
celeryWorkers.scanners-ods.queues
(string)		Queues consumed by non-VCS Historical Scan workers
Default: "ods_scan"
celeryWorkers.scanners-ods.replicas
(int)		Non-VCS Historical Scan workers replicas count
Default: 0
celeryWorkers.scanners-ods.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"ods_scan":10}
celeryWorkers.scanners-ods-highdisk.queues
(string)		Queues consumed by non-VCS Historical Scan workers
Default: "ods_scan_highdisk"
celeryWorkers.scanners-ods-highdisk.replicas
(int)		Non-VCS Historical Scan workers replicas count
Default: 0
celeryWorkers.scanners-ods-highdisk.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"ods_scan_highdisk":10}
celeryWorkers.realtime-ods.queues
(string)		Queues consumed by default workers
Default: "realtime_ods,realtime_retry_ods"
celeryWorkers.realtime-ods.replicas
(int)		Default workers (incl. realtime scans) replicas count
Default: 0
celeryWorkers.realtime-ods.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"realtime_ods":10,"realtime_retry_ods":10}
celeryWorkers.long-ods.queues
(string)		Queues consumed by none-VCS Long Tasks workers
Default: "long_ods"
celeryWorkers.long-ods.replicas
(int)		Non-VCS Long Tasks workers replicas count
Default: 0
celeryWorkers.long-ods.autoscaling.maxReplicas
(int)		Maximum number of workers created by autoscaler
Default: 15
celeryWorkers.long-ods.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"long_ods":10}
celeryWorkers.long-ods-io.replicas
(int)		Number of replica for Non-VCS workers specialized in IO operations
Default: 0
celeryWorkers.long-ods-io.autoscaling.maxReplicas
(int)		Maximum number of workers created by autoscaler
Default: 1
celeryWorkers.long-ods-io.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"long_ods_io":10}
celeryWorkers.container-registries.replicas
(int)		Number of replica for Container Registries scans
Default: 0
celeryWorkers.container-registries.autoscaling.maxReplicas
(int)		Maximum number of workers created by autoscaler
Default: 1
celeryWorkers.container-registries.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"container_registries":10}
celeryWorkers.scanners-slack.replicas
(int)		Number of replica for Slack scans
Default: 0
celeryWorkers.scanners-slack.autoscaling.maxReplicas
(int)		Maximum number of workers created by autoscaler
Default: 4
celeryWorkers.scanners-slack.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"slack_scan":6}
celeryWorkers.business-contribution.replicas
(int)		Number of replica for Business Contrib Worker
Default: 0
celeryWorkers.business-contribution.autoscaling.maxReplicas
(int)		Maximum number of workers created by autoscaler
Default: 5
celeryWorkers.business-contribution.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"business_contribution":10}
celeryWorkers.business-contribution.prefetchMultiplier
(int)		Prefetch multiplier for Business Contrib Worker
Default: 100
celeryWorkers.ml-api-priority.replicas
(int)		Number of replica for ML API priority worker
Default: 1
celeryWorkers.ml-api-priority.autoscaling.metrics
(object)		Autoscaling metrics threshold
Default: {"ml_api_priority":10}
celeryWorkers.ml-api-priority.autoscaling.maxReplicas
(int)		Maximum number of workers created by autoscaler
Default: 1
beat
(object)		Asynchronous tasks scheduler
beat.priorityClassName
(string)		priorityClassName (overrides global)
Default: ""
beat.resources
(object)		Asynchronous tasks scheduler resources
Default: {"requests":{"cpu":"10m","memory":"200Mi"}}
secretEngine
(object)		ML Secret Engine
Default: {"autoscaling":{"hpa":{"enabled":false},"keda":{"enabled":false,"triggers":[]},"maxReplicas":1,"metrics":{"bentoml_service_request_in_progress":10},"minReplicas":1},"emptyDir":{"bentomlProm":{"sizeLimit":""},"bentomlTmp":{"sizeLimit":""},"modelDir":{"sizeLimit":""}},"labels":{},"nodeSelector":{},"pdb":{"enabled":false,"minAvailable":"50%"},"priorityClassName":"","replicas":1,"tolerations":[]}
secretEngine.replicas
(int)		Number of replicas
Default: 1
secretEngine.nodeSelector
(object)		Node selection constraint for secret-engine
Default: {}
secretEngine.tolerations
(list)		Schedule secret-engine pods with matching taints
Default: []
secretEngine.priorityClassName
(string)		priorityClassName (overrides global)
Default: ""
secretEngine.labels
(object)		Additional labels
Default: {}
secretEngine.pdb.enabled
(bool)		Activate PodDisruptionBudget on secret engine Note: podDisruptionBudget.enabled must be true
Default: false
secretEngine.pdb.minAvailable
(string)		Minimum percentage of available replicas
Default: "50%"
secretEngine.autoscaling.hpa.enabled
(bool)		Enable HPA on secret engine
Default: false
secretEngine.autoscaling.keda.enabled
(bool)		Enable Keda Autoscaler
Default: false
secretEngine.autoscaling.keda.triggers
(list)		Additional Keda triggers
Default: []
secretEngine.autoscaling.minReplicas
(int)		Minimum number of workers created by autoscaler
Default: 1
secretEngine.autoscaling.maxReplicas
(int)		Maximum number of workers created by autoscaler
Default: 1
secretEngine.autoscaling.metrics
(object)		Metrics
Default: {"bentoml_service_request_in_progress":10}
secretEngine.emptyDir.modelDir.sizeLimit
(string)		sizeLimit for the model-dir emptyDir holding the ML model bundle, by far the largest of the three (>650Mi as of 1.11.0). Size it accordingly if your platform caps emptyDir volumes. Empty falls back to global.emptyDir.sizeLimit.
Default: ""
secretEngine.emptyDir.bentomlTmp.sizeLimit
(string)		sizeLimit for the bentoml-tmp emptyDir. Empty falls back to global.emptyDir.sizeLimit.
Default: ""
secretEngine.emptyDir.bentomlProm.sizeLimit
(string)		sizeLimit for the bentoml-prom emptyDir. Empty falls back to global.emptyDir.sizeLimit.
Default: ""
inAppAnalytics
(object)		InApp Analytics
Default: {"annotations":{},"enabled":true,"ephemeralStorage":{"annotations":{},"enabled":false,"labels":{},"size":"20Gi","storageClass":""},"labels":{},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"postgresql":{"analyticsSchema":"","applicationSchema":"","useSeparateAnalyticsSchema":null},"priorityClassName":"","tolerations":[]}
inAppAnalytics.enabled
(bool)		Enable InApp Analytics
Default: true
inAppAnalytics.postgresql
(object)		PostgreSQL schema layout used by the analytics pipeline. Each setting is passed to the job only when set; leaving them unset keeps the historical layout (GitGuardian tables in public, intermediate objects in their own analytics schema).
Default: {"analyticsSchema":"","applicationSchema":"","useSeparateAnalyticsSchema":null}
inAppAnalytics.postgresql.applicationSchema
(string)		Schema holding the GitGuardian tables, where the pipeline writes the product-facing analytics objects. Must match the default schema of the database user.
Default: ""
inAppAnalytics.postgresql.useSeparateAnalyticsSchema
(bool)		Give the pipeline's intermediate objects a schema of their own. Set to false to keep them in applicationSchema, so that the job never issues a CREATE SCHEMA.
Default: nil
inAppAnalytics.postgresql.analyticsSchema
(string)		Name of the schema holding the intermediate objects. A pre-created schema is accepted, as long as the database user has USAGE, CREATE on it.
Default: ""
inAppAnalytics.nodeSelector
(object)		Node selection constraint
Default: {}
inAppAnalytics.tolerations
(list)		Schedule with matching taints
Default: []
inAppAnalytics.priorityClassName
(string)		priorityClassName (overrides global)
Default: ""
inAppAnalytics.annotations
(object)		Additional annotations
Default: {}
inAppAnalytics.labels
(object)		Additional labels
Default: {}
inAppAnalytics.podLabels
(object)		Additional pod labels
Default: {}
inAppAnalytics.podAnnotations
(object)		Additional pod annotations
Default: {}
inAppAnalytics.ephemeralStorage.enabled
(bool)		Enable ephemeral storage
Default: false
inAppAnalytics.ephemeralStorage.annotations
(object)		Additional annotations
Default: {}
inAppAnalytics.ephemeralStorage.labels
(object)		Additional labels
Default: {}
inAppAnalytics.ephemeralStorage.storageClass
(string)		Storage class
Default: ""
inAppAnalytics.ephemeralStorage.size
(string)		Size
Default: "20Gi"
apacheTika
(object)		Apache Tika
Default: {"autoscaling":{"hpa":{"enabled":false},"keda":{"enabled":false,"triggers":[]},"maxReplicas":10,"minReplicas":1,"targetCPUUtilizationPercentage":60,"targetMemoryUtilizationPercentage":60},"labels":{},"nodeSelector":{},"pdb":{"enabled":false,"minAvailable":"50%"},"priorityClassName":"","replicas":0,"tolerations":[]}
apacheTika.replicas
(int)		Number of replicas
Default: 0
apacheTika.nodeSelector
(object)		Node selection constraint for apache-tika
Default: {}
apacheTika.tolerations
(list)		Schedule secret-engine pods with matching taints
Default: []
apacheTika.priorityClassName
(string)		priorityClassName (overrides global)
Default: ""
apacheTika.labels
(object)		Additional labels
Default: {}
apacheTika.pdb.enabled
(bool)		Activate PodDisruptionBudget on apache-tika Note: podDisruptionBudget.enabled must be true
Default: false
apacheTika.pdb.minAvailable
(string)		Minimum percentage of available replicas
Default: "50%"
apacheTika.autoscaling.hpa.enabled
(bool)		Enable HPA on apache-tika
Default: false
apacheTika.autoscaling.keda.enabled
(bool)		Enable Keda Autoscaler
Default: false
apacheTika.autoscaling.keda.triggers
(list)		Additional Keda triggers
Default: []
apacheTika.autoscaling.targetCPUUtilizationPercentage
(int)		Autoscaling CPU threshold
Default: 60
apacheTika.autoscaling.targetMemoryUtilizationPercentage
(int)		Autoscaling Memory threshold
Default: 60
apacheTika.autoscaling.minReplicas
(int)		Minimum number of workers created by autoscaler
Default: 1
apacheTika.autoscaling.maxReplicas
(int)		Maximum number of workers created by autoscaler
Default: 10
onPrem.adminUser
(object)		GitGuardian Admin User A temporary password has to be set in secret "gim-secrets" under ADMIN_PASSWORD key. You'll be asked to change this password on your connection
Default: {"email":"admin@example.com","existingSecret":"","existingSecretKeys":{"password":""},"firstname":"Admin"}
onPrem.replicatedRbac.mode
(string)		Controls the RBAC mode for the Replicated SDK. - full: default, grants all permissions required by the SDK (get/list/watch on core resources, create/update secrets) - minimal: read-only permissions scoped to specific resource names. Some SDK features (e.g. status informers, custom metrics reporting) may not work. Reserved for environments with strict RBAC policies that prohibit runtime secret creation and broad resource access. - disabled: no Role or RoleBinding created for the SDK. The ServiceAccount is still created.
Default: "full"
mcpServer
(object)		MCP Server (opt-in: requires enabled: true)
Default: {"annotations":{},"autoscaling":{"hpa":{"enabled":false},"keda":{"enabled":false,"triggers":[]},"maxReplicas":10,"metrics":{"targetLatency":1000},"minReplicas":1},"enabled":false,"extraEnv":[],"gunicorn":{"maxRequests":1000,"port":8000,"timeout":120,"workers":1},"image":{"imagePullPolicy":"IfNotPresent","name":"gitguardian/mcp-server","registry":"proxy.replicated.com/proxy/gitguardian/ghcr.io","tag":"0.7.0"},"ingress":{"enabled":true},"labels":{},"livenessProbe":{"enabled":true,"failureThreshold":3,"initialDelaySeconds":30,"periodSeconds":10,"timeoutSeconds":5},"mcpOAuthProxyEnabled":true,"nodeSelector":{},"oauth":{"extraRedirectUris":[]},"podAnnotations":{},"podAntiAffinityPreset":"soft","podLabels":{},"priorityClassName":"","readinessProbe":{"enabled":true,"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":5,"successThreshold":1,"timeoutSeconds":3},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"1500Mi"},"requests":{"cpu":"250m","memory":"1Gi"}},"sentry":{"dsn":"","enabled":false,"profilesSampleRate":"0.1","tracesSampleRate":"0.1"},"service":{"annotations":{},"port":8000,"type":"ClusterIP"},"tolerations":[]}
mcpServer.enabled
(bool)		Toggle deployment of the MCP server
Default: false
mcpServer.replicas
(int)		Number of replicas (only effective when enabled is true)
Default: 1
mcpServer.labels
(object)		Additional labels for the MCP server Deployment
Default: {}
mcpServer.annotations
(object)		Additional annotations for the MCP server Deployment
Default: {}
mcpServer.podLabels
(object)		Additional pod labels
Default: {}
mcpServer.podAnnotations
(object)		Additional pod annotations
Default: {}
mcpServer.podAntiAffinityPreset
(string)		Pod anti-affinity preset (hard or soft)
Default: "soft"
mcpServer.mcpOAuthProxyEnabled
(bool)		Enable the MCP OAuth proxy behaviour (MCP_OAUTH_PROXY_ENABLED env var in gg-mcp)
Default: true
mcpServer.oauth.extraRedirectUris
(list)		Extra OAuth callback URLs for your own MCP gateway (absolute https://, host you control)
Default: []
mcpServer.nodeSelector
(object)		Node selection constraint
Default: {}
mcpServer.tolerations
(list)		Schedule MCP server pods with matching taints
Default: []
mcpServer.priorityClassName
(string)		priorityClassName (overrides global)
Default: ""
mcpServer.extraEnv
(list)		Additional environment variables
Default: []
replicated.replicaCount
(int)		Number of Replicated SDK replicas
Default: 2
replicated.highAvailability.podAntiAffinityPreset
(string)		antiAffinity for Replicated SDK, applies only if replicaCount > 1
Default: "soft"
replicated.highAvailability.podDisruptionBudget.enabled
(bool)		Enable podDisruptionBudget for Replicated SDK
Default: true
replicated.highAvailability.podDisruptionBudget.minAvailable
(int)		podDisruptionBudget minAvailable for Replicated SDK
Default: 1
replicated.image.registry
(string)		Replicated SDK image registry
Default: "proxy.replicated.com/proxy/gitguardian/docker.io"
replicated.image.repository
(string)		Replicated SDK image repository
Default: "replicated/replicated-sdk"
replicated.image.tag
(string)		Replicated SDK image tag
Default: "1.19.10"
replicated.imagePullSecrets
(list)		Image pullsecrets
Default: [{"name":"gim-replicated-registry"}]
replicated.extraEnv
(list)		Replicated SDK env vars update this to use an existing Secret for proxy urls. gim-proxy only exists when proxy.httpProxyUrl or proxy.httpsProxyUrl is set inline, so the references stay optional and the SDK starts without a proxy.
Default: [{"name":"HTTP_PROXY","valueFrom":{"secretKeyRef":{"key":"http_proxy","name":"gim-proxy","optional":true}}},{"name":"HTTPS_PROXY","valueFrom":{"secretKeyRef":{"key":"https_proxy","name":"gim-proxy","optional":true}}},{"name":"NO_PROXY","valueFrom":{"configMapKeyRef":{"key":"NO_PROXY","name":"gim-config"}}}]
replicated.isAirgap
(bool)		Disable Replicated outbound connections
Default: false
replicated.privateCASecret
(object)		Specify secret containing Custom Certificate Authority certificate. See GitGuardian doc
Default: nil
replicated.supportBundle.enabled
(bool)		Enable/Disable Support Bundle related file generation entirely
Default: true
replicated.supportBundle.rbac.createPodRole
(bool)		Add pod create/get/delete permissions to the GIM ServiceAccount role, allowing the application to spawn support-bundle pods. Set to false to prevent in-cluster support bundle generation entirely.
Default: true
replicated.supportBundle.rbac.serviceAccount.create
(bool)
Default: true
replicated.supportBundle.rbac.serviceAccount.existingServiceAccountName
(string)		Use an existing ServiceAccount instead of creating one If set, this takes precedence over create: true
Default: ""
replicated.supportBundle.rbac.role.create
(bool)		Create role (optional) for Support Bundle generation
Default: true
replicated.supportBundle.rbac.clusterRole.create
(bool)		Create ClusterRole (optional) for Support Bundle generation
Default: true
replicated.supportBundle.admissionPolicy.enabled
(bool)		Create a ValidatingAdmissionPolicy to restrict support bundle pod creation. Only effective when rbac.enabled
Default: true
replicated.supportBundle.credentials.existingSecret
(string)		Use an existing Secret instead of creating one. The secret must contain the keys: 'license-id' and 'upload-domain'. If set, the chart will not create the 'support-bundle-credentials' secret.
Default: ""
replicated.supportBundle.logs.maxLines
(int)		Set the max number of lines in the support bundle logs
Default: 10000
replicated.supportBundle.nodeSelector
(object)		Node selector for the support bundle pod. Falls back to global.nodeSelector.
Default: {}
replicated.supportBundle.tolerations
(list)		Tolerations for the support bundle pod, to schedule it on tainted nodes. Concatenated with global.tolerations.
Default: []
replicated.supportBundle.affinity
(object)		Affinity rules for the support bundle pod
Default: {}
replicated.supportBundle.podAnnotations
(object)		Annotations for the support bundle pod. The pod has no controller, so an eviction loses the bundle: set the annotation that your node autoscaler or descheduler honors to prevent voluntary eviction (for example karpenter.sh/do-not-disrupt: "true").
Default: {}
replicated.supportBundle.resources
(object)		Resource requests/limits for the support bundle pod containers
Default: {"initContainer":{"limits":{"cpu":"500m","memory":"4Gi"},"requests":{"cpu":"100m","memory":"1Gi"}},"mainContainer":{"limits":{"cpu":"100m","memory":"64Mi"},"requests":{"cpu":"10m","memory":"32Mi"}}}
replicated.supportBundle.resources.initContainer.requests.cpu
(string)		CPU request for the bundle generation init container
Default: "100m"
replicated.supportBundle.resources.initContainer.requests.memory
(string)		Memory request for the bundle generation init container
Default: "1Gi"
replicated.supportBundle.resources.initContainer.limits.cpu
(string)		CPU limit for the bundle generation init container
Default: "500m"
replicated.supportBundle.resources.initContainer.limits.memory
(string)		Memory limit for the bundle generation init container
Default: "4Gi"
replicated.supportBundle.resources.mainContainer.requests.cpu
(string)		CPU request for the HTTP server container
Default: "10m"
replicated.supportBundle.resources.mainContainer.requests.memory
(string)		Memory request for the HTTP server container
Default: "32Mi"
replicated.supportBundle.resources.mainContainer.limits.cpu
(string)		CPU limit for the HTTP server container
Default: "100m"
replicated.supportBundle.resources.mainContainer.limits.memory
(string)		Memory limit for the HTTP server container
Default: "64Mi"
ggscout.enabled
(bool)		Enable ggscout
Default: false
ggscout.inventory.config.gitguardian.endpoint
(string)		GitGuardian API endpoint (optional; if not specified, the current self-hosted GitGuardian instance URL will be used)
Default: "http://public-api:5051/exposed/v1"
ggscout.inventory.config.gitguardian.api_token
(string)		GitGuardian API token for ggscout, please refer to ggscout Helm configuration
Default: ""
ggscout.inventory.config.sources
(object)		For ggscout inventory sources configuration details, please refer to ggscout Helm chart examples
Default: {}
ggscout.caBundle.certs
(string)		Specify CA certificates to inject (PEM format)
Default: ""
ggscout.caBundle.existingSecret
(string)		Specify the secret containing the CA certificate to inject
Default: ""
ggscout.caBundle.existingSecretKey
(string)		Specify secret key under the CA certificate is stored
Default: "ca.crt"
GGBridge.enabled
(bool)		Enable GitGuardian Bridge, to scan sources reachable only from an isolated network. Read the dedicated documentation.
Default: false
GGBridge.basePublicDomain
(string)		Public domain shared by every bridge server: the domain of the ggbridge server releases, so that a bridge is reachable at <subdomain>.<basePublicDomain>
Default: ""
GGBridge.baseInternalDomain
(string)		Cluster DNS suffix of the namespace running the ggbridge server releases, for example ggbridge.svc.cluster.local. All the server releases must be installed in that single namespace
Default: ""
GGBridge.bridges
(list)		One entry per isolated network. subdomain must match the subdomain value of the ggbridge server release, and it names the proxy Service GitGuardian connects to, it must be unique. domains are the hostnames routed through that bridge.
Default: []
tls
(object)		HTTPS TLS configuration You can manage the certificate manually or use Cert-Manager
tls.certManager.enabled
(bool)		Use Cert-Manager instead of a manual certificate
Default: false
tls.certManager.certificatesSecret
(string)		Name of the created cert-manager Certificate object
Default: "gitguardian-certificate"
tls.certManager.certificatesNamespace
(string)		Namespace where certificate will be created
Default: .Release.Namespace
tls.certManager.issuer.group
(string)		Cert-Manager Issuer Group
Default: "cert-manager.io"
tls.certManager.issuer.kind
(string)		Cert-Manager Issuer Class
Default: "ClusterIssuer"
tls.certManager.issuer.name
(string)		Cert-Manager Issuer Name
Default: "gitguardian"
tls.customCa
(object)		Custom Certificate Authority certificate for integrations (VCS, notifiers, webhooks, ...)
tls.customCa.caCrt
(string)		Certificates full chain in the PEM format Should preferably be set in existing secret (see: tls.customCa.existingSecret)
Default: ""
tls.customCa.existingSecret
(string)		Existing secret containing certificates full chain in the PEM format
Default: ""
tls.customCa.existingSecretKeys.caCrt
(string)		Key name of the certificate authority entry
Default: ""
tls.customCa.image
(object)		Custom CA (used for init-containers only) image configuration
Default: {"name":"gitguardian/wolfi/bash","pullSecrets":[],"registry":"proxy.replicated.com/proxy/gitguardian/ghcr.io","tag":"5.3"}
tls.customCa.image.registry
(string)		Registry source to fetch the image Empty = from dockerhub
Default: "proxy.replicated.com/proxy/gitguardian/ghcr.io"
tls.customCa.image.name
(string)		Image name
Default: "gitguardian/wolfi/bash"
tls.customCa.image.tag
(string)		Image tag
Default: "5.3"
tls.customCa.image.pullSecrets
(list)		Image pullsecrets
Default: []
tls.customCa.resources
(object)		Resource requests and limits for the init-custom-ca init container
Default: {"limits":{"memory":"128Mi"},"requests":{"cpu":"50m","memory":"64Mi"}}
tls.clientAuth
(object)		Client (end user) authentication
tls.clientAuth.enabled
(bool)		Enable client authentication. This is required for Common Access Card
Default: false
tls.clientAuth.mode
(string)		Set client authentication mode (one of enforce, audit). audit mode must be used for initial setup.
Default: "enforce"
tls.clientAuth.userRegex
(string)		Regex to extract the unique user identifier from the certificate DN. You must use a capture group using parenthesis to catch the user ID. Default regex will match 117 here: CN=hubert.bonisseur.delabath.117,O=DGSE,C=FR
Default: "(?:.+,)?CN=[^.]+\\.[^.]+\\.[^.]+\\.(\\d+)(?:,.+)?"
tls.clientAuth.crt
(string)		NGINX Server certificate (PEM) Should preferably be set in existing secret (see: tls.clientAuth.existingSecret)
Default: ""
tls.clientAuth.key
(string)		NGINX Server key (PEM) Should preferably be set in existing secret (see: tls.clientAuth.existingSecret)
Default: ""
tls.clientAuth.caCrt
(string)		NGINX Authority that validates user certificates (PEM) Should preferably be set in existing secret (see: tls.clientAuth.existingSecret)
Default: ""
tls.clientAuth.crl
(object)		Nginx CRL usage for clientAuth
Default: {"cron":"0 0 * * *","persistence":{"accessModes":["ReadWriteMany"],"annotations":{},"labels":{},"size":"1Gi","storageClass":""},"url":""}
tls.clientAuth.crl.url
(string)		Nginx CRL URL. Use a CRL instead of OCSP to check revokations status. Keep empty to use OCSP.
Default: ""
tls.clientAuth.crl.cron
(string)		Nginx CRL refresh cron expression. This example means daily at 00:00
Default: "0 0 * * *"
tls.clientAuth.crl.persistence.storageClass
(string)		storageClass to use for the CRL PVC
Default: ""
tls.clientAuth.crl.persistence.accessModes
(list)		accessModes to use for the CRL PVC. Use only ReadWriteMany (HA) if available.
Default: ["ReadWriteMany"]
tls.clientAuth.crl.persistence.size
(string)		PVC size
Default: "1Gi"
tls.clientAuth.crl.persistence.labels
(object)		PVC Labels
Default: {}
tls.clientAuth.crl.persistence.annotations
(object)		PVC Annotations
Default: {}
tls.clientAuth.existingSecret
(string)		Existing secret name
Default: ""
networkPolicy.enabled
(bool)		Enable network policies for GIM namespace isolation. When enabled, ingress from outside the GIM namespace is denied by default, and only explicitly allowed namespaces can reach GIM pods. Start with mode=dryrun to verify your config, then switch to mode=enforce.
Default: false
networkPolicy.mode
(string)		Network policy mode dryrun: all policies are deployed but a temporary allow-all prevents any blocking — verify your config first enforce: the allow-all is removed and policies actively block unauthorized ingress
Default: "dryrun"
networkPolicy.allowedNamespaces
(list)		List of namespace names allowed to reach GIM pods Include your ingress controller namespace, monitoring, and any other namespace that needs access. Example: ["ingress-nginx", "monitoring"]
Default: []
networkPolicy.extraPolicies
(list)		Extra NetworkPolicy resources to create alongside the default ones Each entry is rendered as a full NetworkPolicy spec — full flexibility for custom rules.
Default: []
securityContext
(object)		Specify Pod Security Context.
Default: {"enabled":true,"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532}
containerSecurityContext
(object)		Specify Container Security Context. Note: Enabled if securityContext.enabled is true.
Default: {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"seccompProfile":{"type":"RuntimeDefault"}}
podDisruptionBudget.enabled
(bool)		Deploy PodDisruptionBudget globally. Note: Some Deployments have their own enabler (like apacheTika or secretEngine)
Default: true
ingress.enabled
(bool)		Enable ingress resource
Default: false
ingress.routingApi
(string)		Routing API used to expose the application: - "ingress" -> Kubernetes Ingress v1 / IngressRoute / VirtualService / HTTPProxy / Route (templates/exposure/) - "gateway-api" -> Gateway API HTTPRoute + Gateway (templates/exposure-gateway-api/)
Default: "ingress"
ingress.controller
(string)		Data plane / ingress controller in use in the cluster. Supported: ingress-nginx / traefik / contour / aws_alb / openshift (Openshift Route) / istio. Drives which exposure/* template is picked (when routingApi=ingress) AND which Prometheus metric is used for HPA/KEDA latency-based autoscaling. With routingApi=gateway-api, only istio / contour / traefik are supported. "other" = any controller without a built-in integration (Kong, Cilium, …): generic routing, no built-in autoscaling query (use keda.triggers).
Default: "ingress-nginx"
ingress.path
(string)		The routing path to the GitGuardian instance. You may need to set this to '/*' in order to use this with ALB ingress controllers.
Default: "/"
ingress.pathType
(string)		Ingress Path type (only used when routingApi=ingress and experimental.ingressRoutes=false)
Default: "Prefix"
ingress.ingressClassName
(string)		IngressClass that will be used to implement the Ingress (only used when routingApi=ingress)
Default: ""
ingress.gatewayApi
(object)		Gateway API configuration (only used when routingApi=gateway-api)
Default: {"gateway":{"create":false,"httpListenerPort":80,"httpsListenerPort":443,"name":"gitguardian","namespace":""},"gatewayClassName":""}
ingress.gatewayApi.gatewayClassName
(string)		GatewayClass name
Default: ""
ingress.gatewayApi.gateway.create
(bool)		Create the Gateway resource or use an existing one
Default: false
ingress.gatewayApi.gateway.name
(string)		Name of the Gateway (created or existing)
Default: "gitguardian"
ingress.gatewayApi.gateway.namespace
(string)		Namespace of the Gateway (empty = same as release namespace)
Default: ""
ingress.gatewayApi.gateway.httpListenerPort
(int)		HTTP listener port (only used when create=true)
Default: 80
ingress.gatewayApi.gateway.httpsListenerPort
(int)		HTTPS listener port (only used when create=true)
Default: 443
ingress.annotations
(object)		Additional annotations for the Ingress resource.
Default: {}
ingress.labels
(object)		Additional labels for the Ingress resource.
Default: {}
ingress.istio.revision
(string)		Istio revision, if any
Default: ""
ingress.istio.gateway.enabled
(bool)		Enable Istio gateway handling
Default: false
ingress.istio.gateway.name
(string)		Istio Gateway name
Default: "{{.Release.Name}}-{{.Release.Namespace}}"
ingress.istio.gateway.namespace
(string)		Istio Gateway namespace
Default: "istio-system"
ingress.istio.gateway.selector
(string)		Istio Gateway selector
Default: "ingressgateway"
ingress.tls.enabled
(bool)		Enable TLS configuration for the hostname defined at ingress.hostname parameter
Default: false
ingress.tls.existingSecret
(string)		Existing secret containing TLS certificates
Default: ""
ingress.tls.crt
(string)		TLS certificate in PEM format Should preferably be set in existing secret (see: ingress.tls.existingSecret)
Default: ""
ingress.tls.key
(string)		TLS private key Should preferably be set in existing secret (see: ingress.tls.existingSecret)
Default: ""
observability.exporters
(object)		Prometheus exporters configuration
observability.exporters.webAppExporter.enabled
(bool)		Enable GitGuardian Applicative metrics on Webapp pods and Celery Workers
Default: false
observability.exporters.statefulAppExporter.enabled
(bool)		Enable Stateful metrics on Applicative Exporter See: GitGuardian documentation
Default: false
observability.exporters.statefulAppExporter.resources
(object)		Applicative Exporter resources
Default: {"requests":{"cpu":"100m","memory":"500Mi"}}
observability.serviceMonitors.enabled
(bool)		Enable ServiceMonitors for Prometheus Operator Note: this requires to install Prometheus Operator (not included in this chart) See: Prometheus documentation
Default: false
rbac
(object)		GitGuardian pods will use a limited role if enabled
Default: {"enabled":true}
rbac.enabled
(bool)		Creates a Role and bind it to GitGuardian ServiceAccount (see serviceAccount.name). See GitGuardian doc
Default: true
serviceAccount
(object)		GitGuardian Pods are using this ServiceAccount
Default: {"annotations":{},"autoMount":true,"create":true,"labels":{},"name":"gim"}
serviceAccount.create
(bool)		create the serviceAccount
Default: true
serviceAccount.name
(string)		name of the serviceAccount (if serviceAccount.create is false, it must exists prior to chart deployment)
Default: "gim"
migration.nodeSelector
(object)
Default: {}
migration.tolerations
(list)
Default: []
migration.labels
(object)
Default: {}
migration.podLabels
(object)
Default: {}
migration.podAnnotations
(object)
Default: {}
migration.preDeploy.resources
(object)		Pre Deployment Job resources
Default: {"limits":{"memory":"10Gi"},"requests":{"cpu":"500m","memory":"3Gi"}}
migration.postDeploy.resources
(object)		Post Deployment Job resources
Default: {"limits":{"memory":"2Gi"},"requests":{"cpu":"500m","memory":"1Gi"}}
migration.upgradePathCheck.resources
(object)		upgradePathCheck Job resources
Default: {"limits":{"memory":"1Gi"},"requests":{"cpu":"200m","memory":"500Mi"}}
migration.serviceAccount
(object)		GitGuardian migration pods are using this ServiceAccount
Default: {"annotations":{},"autoMount":true,"create":true,"labels":{},"name":"gim-migration"}
migration.serviceAccount.create
(bool)		create the migration serviceAccount
Default: true
migration.serviceAccount.name
(string)		name of the serviceAccount (if migration.serviceAccount.create is false, it must exists prior to chart deployment)
Default: "gim-migration"
hookMethod
(string)		Hook Method (helm/argocd/none)
Default: "helm"
proxy
(object)		HTTP(s) proxy configuration You can configure a proxy server for outgoing traffic from the application
Default: Not set
proxy.httpProxyUrl
(string)		Url of the proxy server to be used for HTTP requests
Default: ""
proxy.httpsProxyUrl
(string)		Url of the proxy server to be used for HTTPS requests
Default: ""
proxy.noProxyHostNames
(list)		List of host names through which the traffic should not go via the proxy
Default: []
proxy.existingSecret
(string)		Secret used to store proxy urls (preferred method)
Default: ""
proxy.existingSecretKeys.httpProxyUrl
(string)		Existing secret key where to store proxy http url
Default: ""
proxy.existingSecretKeys.httpsProxyUrl
(string)		Existing secret key where to store proxy https url
Default: ""
logCollector.enabled
(bool)		Enable logCollector
Default: true
logCollector.emptyDir.sizeLimit
(string)		sizeLimit for the logs emptyDir shared by every log collector sidecar. Empty falls back to global.emptyDir.sizeLimit.
Default: ""
logCollector.collectMigrationLogs
(bool)		Also collect logs from the pre-deploy and post-deploy hook Jobs. The collector is injected as a native sidecar (initContainer with restartPolicy: Always), which requires Kubernetes >= 1.29 so the hook Job can still complete. Leave disabled on older clusters.
Default: true
logCollector.image.registry
(string)		Fluent-bit image registry
Default: "proxy.replicated.com/proxy/gitguardian/ghcr.io"
logCollector.image.name
(string)		Fluent-bit image repository
Default: "gitguardian/wolfi/fluent-bit"
logCollector.image.tag
(string)		Fluent-bit image tag
Default: "4.2.4"
logCollector.image.pullSecrets
(list)		Fluent-bit image pull secrets
Default: []
logCollector.env
(list)		- Environment variables to be passed to logCollector
Default: []
logCollector.envFrom
(list)		- Environment variables to be passed to logCollector from configMaps or Secrets
Default: []
logCollector.pipelines
(object)		- Specify additional logCollector pipelines
Default: {}
logCollector.networkPolicy
(DEPRECATED)		Use networkPolicy.enabled instead. Will be removed in a future release.
Default: {"enabled":false}
logCollector.resources.requests.cpu
(string)		Specify CPU request
Default: "10m"
logCollector.resources.requests.memory
(string)		Specify Memory request
Default: "32Mi"
logCollector.supportBundle.since
(string)		lookback window for retrieving logs
Default: "24h"
logCollector.supportBundle.limit
(int)		Limit on number of logs to retrieve for each component (0 means disabled)
Default: 0
logCollector.supportBundle.logLevel
(string)		Log levels for support-bundle Loki queries: info (all levels) or error (error
loki-minio.image.registry
(string)		MinIO image registry
Default: "proxy.replicated.com/proxy/gitguardian/ghcr.io"
loki-minio.image.repository
(string)		MinIO image repository
Default: "gitguardian/wolfi/minio"
loki-minio.image.tag
(string)		MinIO image tag
Default: "0.20260717"
loki-minio.image.digest
(string)		MinIO image digest
Default: ""
loki-minio.image.imagePullPolicy
(string)		MinIO image pull policy
Default: "IfNotPresent"
loki-minio.image.pullSecrets
(list)		MinIO image pull secrets
Default: [{"name":"gim-replicated-registry"}]
loki-minio.persistence.storageClass
(string)		Storage class for MinIO
Default: ""
loki-minio.persistence.size
(string)		MinIO persistent storage size
Default: "20Gi"
loki-minio.podSecurityContext.fsGroup
(int)		Enable pod Security Context for MinIO
Default: 65532
loki-minio.containerSecurityContext.runAsUser
(int)		Enable container Security Context for MinIO
Default: 65532
loki-minio.containerSecurityContext.runAsGroup
(int)
Default: 65532
loki-minio.containerSecurityContext.seccompProfile.type
(string)
Default: "RuntimeDefault"
loki-minio.resources.requests.cpu
(string)		Specify CPU request for MinIO
Default: "100m"
loki-minio.resources.requests.memory
(string)		Specify Memory request for MinIO
Default: "512Mi"
loki.serviceAccount.create
(bool)		Specifies whether a ServiceAccount should be created
Default: true
loki.rbac.sccEnabled
(bool)		For OpenShift set sccEnabled to 'true' to use the SecurityContextConstraints.
Default: false
loki.imagePullSecrets
(list)		Loki image pull secrets
Default: [{"name":"gim-replicated-registry"}]
loki.loki.image.registry
(string)		Loki image registry
Default: "proxy.replicated.com/proxy/gitguardian/ghcr.io"
loki.loki.image.repository
(string)		Loki image repository
Default: "gitguardian/wolfi/loki"
loki.loki.image.tag
(string)		Loki image tag
Default: "3.7.7"
loki.loki.image.digest
(string)		Loki image digest
Default: ""
loki.loki.image.pullPolicy
(string)		Loki image pull policy
Default: "IfNotPresent"
loki.loki.compactor.retention_delete_delay
(string)		Delay after which chunks will be fully deleted during retention.
Default: "2h"
loki.loki.podSecurityContext.fsGroup
(int)
Default: 65532
loki.loki.podSecurityContext.runAsGroup
(int)
Default: 65532
loki.loki.podSecurityContext.runAsNonRoot
(bool)
Default: true
loki.loki.podSecurityContext.runAsUser
(int)
Default: 65532
loki.loki.containerSecurityContext.runAsNonRoot
(bool)
Default: true
loki.loki.containerSecurityContext.privileged
(bool)
Default: false
loki.loki.containerSecurityContext.readOnlyRootFilesystem
(bool)
Default: true
loki.loki.containerSecurityContext.allowPrivilegeEscalation
(bool)
Default: false
loki.loki.containerSecurityContext.capabilities.drop[0]
(string)
Default: "ALL"
loki.loki.containerSecurityContext.seccompProfile.type
(string)
Default: "RuntimeDefault"
loki.singleBinary.replicas
(int)		Number of replicas
Default: 1
loki.singleBinary.extraEnv[0].name
(string)
Default: "LOKI_ADDR"
loki.singleBinary.extraEnv[0].value
(string)
Default: "http://localhost:3100"
loki.singleBinary.persistence.size
(string)		Size of persistent disk
Default: "10Gi"
loki.singleBinary.persistence.storageClass
(string)		Storage class to be used
Default: ""
loki.singleBinary.resources.requests.cpu
(string)		Specify CPU request for Loki
Default: "100m"
loki.singleBinary.resources.requests.memory
(string)		Specify Memory request for Loki
Default: "256Mi"
clickhouse.enabled
(bool)
Default: false
clickhouse.serverConfig
(object)		Settings that vary with a customer's infrastructure sizing, unlike the GG-chosen guardrails defaults
Default: {"cacheMaxSize":"","extraVars":{},"maxBytesRatioBeforeExternalGroupBy":0.4,"maxBytesRatioBeforeExternalSort":0.4,"maxConcurrentQueries":32,"maxExecutionTime":55,"maxServerMemoryUsageToRamRatio":0.9,"metadataDiskKeepFreeSpaceBytes":1073741824,"nonReplicatedDeduplicationWindow":1000,"partsToDelayInsert":1000,"partsToThrowInsert":3000}
clickhouse.serverConfig.cacheMaxSize
(string)		Filesystem cache disk max size (object_cache.xml). "" auto-derives it from clickhouse.cache.size minus a 2Gi safety margin (recommended); set explicitly only to override that derivation. Unused (no need to set it, whatever clickhouse.cache.enabled is) when clickhouse.objectStorage.provider=local
Default: ""
clickhouse.serverConfig.metadataDiskKeepFreeSpaceBytes
(int)		Free space to reserve on the metadata disk (01-metadata-guardrails.xml), 1GiB by default: refuse writes below this threshold so it never fills to 100%
Default: 1073741824
clickhouse.serverConfig.extraVars
(object)		Extra env vars injected as-is into the clickhouse-server-config-defaults ConfigMap, for guardrails.xml/guardrails-users.xml from_env references you add yourself
Default: {}
clickhouse.objectStorage
(object)		ClickHouse object storage backend, auto-generates configdFiles."00-object-storage.xml" instead of hand-writing it. clickhouse.backup.config is configured separately below (deliberately independent, see its own comment)
Default: {"azblob":{"containerName":"","credentialless":false,"existingSecret":"","storageAccountUrl":""},"gcs":{"bucket":"","endpoint":"https://storage.googleapis.com","existingSecret":"","prefix":""},"provider":"","s3":{"bucket":"","credentialless":false,"endpoint":"","existingSecret":"","forcePathStyle":false,"prefix":"","region":""}}
clickhouse.objectStorage.provider
(string)		"" disables generation (hand-write configdFiles."00-object-storage.xml" and backup.config yourself, as before), "local" runs on the metadata PVC only, no object storage at all
Default: ""
clickhouse.objectStorage.s3.endpoint
(string)		Required when provider=s3, e.g. https://mybucket.s3.<region>.amazonaws.com (a bucket-less regional endpoint if forcePathStyle=true, e.g. MinIO)
Default: ""
clickhouse.objectStorage.s3.bucket
(string)		Required when provider=s3
Default: ""
clickhouse.objectStorage.s3.prefix
(string)		Optional S3 key prefix within the bucket, e.g. to share it with another consumer, no leading/trailing slash needed
Default: ""
clickhouse.objectStorage.s3.region
(string)		Required, AWS S3 SigV4 signing needs it even when the endpoint doesn't encode it (e.g. MinIO)
Default: ""
clickhouse.objectStorage.s3.forcePathStyle
(bool)		false = virtual-hosted style, endpoint must already embed the bucket as a subdomain (AWS default). Set true for MinIO/most S3-compatible stores, with a bucket-less endpoint
Default: false
clickhouse.objectStorage.s3.credentialless
(bool)		true = IRSA (AWS), no static credentials. Requires the pod's ServiceAccount annotated via serviceAccount.annotations
Default: false
clickhouse.objectStorage.s3.existingSecret
(string)		Secret with keys: access-key-id, secret-access-key. Required unless credentialless=true
Default: ""
clickhouse.objectStorage.gcs.endpoint
(string)		GCS has no native ClickHouse disk type, accessed via its S3-compatible HMAC interface
Default: "https://storage.googleapis.com"
clickhouse.objectStorage.gcs.bucket
(string)		Required when provider=gcs
Default: ""
clickhouse.objectStorage.gcs.prefix
(string)		Optional key prefix within the bucket, e.g. to share it with another consumer, no leading/trailing slash needed
Default: ""
clickhouse.objectStorage.gcs.existingSecret
(string)		HMAC keys, Secret with keys: access-key-id, secret-access-key
Default: ""
clickhouse.objectStorage.azblob.storageAccountUrl
(string)		Required when provider=azblob, e.g. https://myaccount.blob.core.windows.net
Default: ""
clickhouse.objectStorage.azblob.containerName
(string)		Required when provider=azblob
Default: ""
clickhouse.objectStorage.azblob.credentialless
(bool)		true = Entra Workload ID (AKS), no static credentials. Requires the pod's ServiceAccount annotated (serviceAccount.annotations) and podLabels set for the mutating webhook
Default: false
clickhouse.objectStorage.azblob.existingSecret
(string)		Secret with keys: account-name, account-key. Required unless credentialless=true
Default: ""
clickhouse.backup.enabled
(bool)		Runs the clickhouse-backup sidecar. Set to false to fully manage it yourself via clickhouse.sidecars instead
Default: true
clickhouse.backup.metrics
(object)		Ship a ServiceMonitor for the backup sidecar's Prometheus metrics (requires Prometheus Operator CRDs)
Default: {"enabled":false}
clickhouse.backup.objectStorage
(object)		Backup destination, same structure as clickhouse.objectStorage but deliberately independent values (a backup must never target the bucket it protects; the chart fails the render when both sides name the same bucket/container on the same store). Auto-generates the provider env vars (S3_, GCS_, AZBLOB_*) in the clickhouse-backup-config ConfigMap and the credential env from existingSecret. Setting a provider also stops mounting the legacy clickhouse-backup-secret (a stale one would silently override the generated destination); put extra sensitive settings in backup.sidecar.extraEnvVarsSecret instead
Default: {"azblob":{"containerName":"","credentialless":false,"existingSecret":"","prefix":"","storageAccountName":""},"gcs":{"bucket":"","credentialless":false,"existingSecret":"","prefix":""},"provider":"","s3":{"bucket":"","credentialless":false,"endpoint":"","existingSecret":"","forcePathStyle":false,"prefix":"","region":""}}
clickhouse.backup.objectStorage.provider
(string)		"" disables generation (hand-write provider settings via backup.config.extraVars and credentials via the clickhouse-backup-secret Secret, as before), or one of "s3", "gcs", "azblob"
Default: ""
clickhouse.backup.objectStorage.s3.endpoint
(string)		Optional bucket-less endpoint for S3-compatible stores (e.g. MinIO, http://minio:9000). Leave "" on AWS: clickhouse-backup derives the endpoint from region
Default: ""
clickhouse.backup.objectStorage.s3.bucket
(string)		Required when provider=s3. Use a DIFFERENT bucket than clickhouse.objectStorage.s3.bucket
Default: ""
clickhouse.backup.objectStorage.s3.prefix
(string)		Optional key prefix within the bucket; backup manifests land under <prefix>/metadata and object-disk blob copies under <prefix>/objects
Default: ""
clickhouse.backup.objectStorage.s3.region
(string)		Required when provider=s3
Default: ""
clickhouse.backup.objectStorage.s3.forcePathStyle
(bool)		Required true whenever endpoint is set (the chart fails the render otherwise): custom endpoints almost never serve virtual-hosted bucket subdomains
Default: false
clickhouse.backup.objectStorage.s3.credentialless
(bool)		true = IRSA (AWS), no static credentials, via the AWS SDK default chain: the ServiceAccount token (serviceAccount.annotations) is mounted into every container of the pod, this sidecar included
Default: false
clickhouse.backup.objectStorage.s3.existingSecret
(string)		Secret with keys: access-key-id, secret-access-key (same shape as clickhouse.objectStorage.s3.existingSecret, but a different secret for a different bucket). Required unless credentialless=true
Default: ""
clickhouse.backup.objectStorage.gcs.bucket
(string)		Required when provider=gcs. Use a DIFFERENT bucket than clickhouse.objectStorage.gcs.bucket
Default: ""
clickhouse.backup.objectStorage.gcs.prefix
(string)		Optional key prefix within the bucket; backup manifests land under <prefix>/metadata and object-disk blob copies under <prefix>/objects
Default: ""
clickhouse.backup.objectStorage.gcs.credentialless
(bool)		true = GKE Workload Identity (Application Default Credentials), no static key. Unlike clickhouse.objectStorage.gcs (S3-HMAC only), the backup sidecar speaks native GCS via the Google SDK
Default: false
clickhouse.backup.objectStorage.gcs.existingSecret
(string)		Secret with key: credentials-json (a GCP service-account JSON key; never put it in a ConfigMap/values file). Required unless credentialless=true
Default: ""
clickhouse.backup.objectStorage.azblob.storageAccountName
(string)		Required when provider=azblob, the storage account NAME (clickhouse-backup takes the name, not the URL clickhouse.objectStorage.azblob uses)
Default: ""
clickhouse.backup.objectStorage.azblob.containerName
(string)		Required when provider=azblob. Use a DIFFERENT container than clickhouse.objectStorage.azblob (ideally a different storage account)
Default: ""
clickhouse.backup.objectStorage.azblob.prefix
(string)		Optional key prefix within the container; backup manifests land under <prefix>/metadata and object-disk blob copies under <prefix>/objects
Default: ""
clickhouse.backup.objectStorage.azblob.credentialless
(bool)		true = Entra Workload ID (AKS), no static credentials: the AKS mutating webhook injects the federated token into every container of the pod, this sidecar included
Default: false
clickhouse.backup.objectStorage.azblob.existingSecret
(string)		Secret with key: account-key (a secret shaped like clickhouse.objectStorage.azblob's, with an extra account-name key, works as-is: only account-key is read). Required unless credentialless=true
Default: ""
clickhouse.backup.config
(object)		clickhouse-backup sidecar's settings, deliberately independent from clickhouse.objectStorage (a backup must never default to the same bucket as the data it protects)
Default: {"allowEmptyBackups":true,"backupsToKeepRemote":7,"downloadConcurrency":2,"extraVars":{},"logLevel":"info","rebaseBeforeRemoveOldRemote":true,"rebaseConcurrency":2,"remoteStorage":"s3","s3Concurrency":2,"uploadConcurrency":2,"watchSchedules":"name=ch-bkp,full=0 2 * * 0,increment=0 2 * * *,full_type=rebase,delete_previous_cycle=false"}
clickhouse.backup.config.remoteStorage
(string)		Only used when backup.objectStorage.provider is "" (otherwise derived from the provider)
Default: "s3"
clickhouse.backup.config.watchSchedules
(string)		Full backup Sunday 2am (server-side rebase after the first, no re-upload), daily increment at 2am, mutually exclusive with WATCH_INTERVAL/FULL_INTERVAL, see clickhouse-backup#1354
Default: "name=ch-bkp,full=0 2 * * 0,increment=0 2 * * *,full_type=rebase,delete_previous_cycle=false"
clickhouse.backup.config.rebaseBeforeRemoveOldRemote
(bool)		Without this, backupsToKeepRemote isn't a hard cap, old chains stay if a newer increment depends on them
Default: true
clickhouse.backup.config.allowEmptyBackups
(bool)		Without this, a first install crash-loops the sidecar, no tables yet is treated as a fatal error
Default: true
clickhouse.backup.config.uploadConcurrency
(int)		Pins concurrency instead of clickhouse-backup's own auto-calc, which is NumCPU()-based and not cgroup-aware
Default: 2
clickhouse.backup.config.extraVars
(object)		Escape hatch for any NON-SENSITIVE clickhouse-backup setting (github.com/Altinity/clickhouse-backup) the chart doesn't model, e.g. S3_STORAGE_CLASS. Renders into a ConfigMap: credential keys (S3_ACCESS_KEY, GCS_CREDENTIALS_JSON, AZBLOB_ACCOUNT_KEY, ...) are refused, they belong in a Secret. Provider basics (bucket, region, paths) are better set via backup.objectStorage above; a key it owns fails the render here. Use a DIFFERENT bucket/account than clickhouse.objectStorage
Default: {}
clickhouse.backup.sidecar.image.registry
(string)
Default: "proxy.replicated.com/proxy/gitguardian/513715405986.dkr.ecr.us-west-2.amazonaws.com"
clickhouse.backup.sidecar.image.repository
(string)
Default: "cgr.dev/gitguardian.com/clickhouse-backup"
clickhouse.backup.sidecar.image.tag
(string)
Default: "2.8.1"
clickhouse.backup.sidecar.resources.requests.cpu
(string)
Default: "100m"
clickhouse.backup.sidecar.resources.requests.memory
(string)
Default: "128Mi"
clickhouse.backup.sidecar.resources.limits.cpu
(string)
Default: "1"
clickhouse.backup.sidecar.resources.limits.memory
(string)
Default: "1Gi"
clickhouse.backup.sidecar.containerSecurityContext.enabled
(bool)
Default: true
clickhouse.backup.sidecar.extraEnvVars
(list)		Additive env vars for the backup sidecar, to add one without redeclaring the hardcoded ones (CLICKHOUSE_PASSWORD, API_USERNAME, ...)
Default: []
clickhouse.backup.sidecar.extraVolumeMounts
(list)		Extra volumeMounts for the backup sidecar, e.g. to mount a volume declared via clickhouse.extraVolumes
Default: []
clickhouse.commonAnnotations
(object)
Default: {}
clickhouse.image.registry
(string)
Default: "proxy.replicated.com/proxy/gitguardian/513715405986.dkr.ecr.us-west-2.amazonaws.com"
clickhouse.image.repository
(string)
Default: "cgr.dev/gitguardian.com/clickhouse-iamguarded"
clickhouse.image.tag
(string)
Default: "26.4"
clickhouse.image.pullSecrets[0].name
(string)
Default: "gim-replicated-registry"
clickhouse.configdFiles
(object)		Add your own config.d XML files here, or reuse a chart-generated key (guardrails.xml, object-cache.xml, 09-log-tables.xml, 00-object-storage.xml) to override it entirely
Default: {}
clickhouse.usersdFiles
(object)		Add your own users.d XML files here, or reuse the chart-generated key (guardrails-users.xml) to override it entirely
Default: {}
clickhouse.initdbScripts."00-create-gim-db.sql"
(string)
Default: "CREATE DATABASE IF NOT EXISTS gim;\n"
clickhouse.resources
(object)		Recommended: keep requests equal to limits to prevent over-commitment on the node. See the ClickHouse sizing guide: https://docs.gitguardian.com/self-hosting/management/infrastructure-management/clickhouse/sizing
Default: {"limits":{"cpu":4,"memory":"16Gi"},"requests":{"cpu":4,"memory":"16Gi"}}
clickhouse.podSecurityContext.enabled
(bool)
Default: true
clickhouse.podSecurityContext.runAsUser
(int)
Default: 1001
clickhouse.podSecurityContext.runAsGroup
(int)
Default: 1001
clickhouse.podSecurityContext.runAsNonRoot
(bool)
Default: true
clickhouse.podSecurityContext.seccompProfile.type
(string)
Default: "RuntimeDefault"
clickhouse.containerSecurityContext.enabled
(bool)
Default: true
clickhouse.podLabels
(object)
Default: {}
clickhouse.podAnnotations
(object)
Default: {}
clickhouse.nodeSelector
(object)		Recommended for production: pin ClickHouse to a dedicated, on-demand node pool. See: https://docs.gitguardian.com/self-hosting/management/infrastructure-management/clickhouse/sizing
Default: {}
clickhouse.tolerations
(list)		Must match a taint on the dedicated node pool selected via nodeSelector above
Default: []
clickhouse.priorityClassName
(string)		Recommended for production: protects ClickHouse from preemption/eviction under node pressure; the PriorityClass must already exist in-cluster
Default: ""
clickhouse.extraEnvVars
(list)
Default: []
clickhouse.extraVolumeMounts
(list)		Use this for extra volumes beyond persistence/cache, e.g. a customer-managed cache PVC when clickhouse.cache.enabled=false
Default: []
clickhouse.extraVolumeClaimTemplates
(list)		Use this for extra PVC templates beyond persistence/cache, e.g. a customer-managed cache PVC when clickhouse.cache.enabled=false
Default: []
clickhouse.cache.enabled
(bool)		Filesystem cache PVC for the object_cache disk, set to false to fully manage yourself
Default: true
clickhouse.cache.storageClass
(string)		Recommended for production: use an SSD/NVMe-backed class, same as clickhouse.persistence.storageClass. See: https://docs.gitguardian.com/self-hosting/management/infrastructure-management/clickhouse/sizing
Default: ""
clickhouse.cache.accessModes[0]
(string)
Default: "ReadWriteOnce"
clickhouse.cache.size
(string)
Default: "50Gi"
clickhouse.sidecars
(list)		Extra sidecars, or the clickhouse-backup one entirely when clickhouse.backup.enabled=false
Default: []
clickhouse.persistence.enabled
(bool)
Default: true
clickhouse.persistence.storageClass
(string)		Recommended for production: use an SSD/NVMe-backed class. See: https://docs.gitguardian.com/self-hosting/management/infrastructure-management/clickhouse/sizing
Default: ""
clickhouse.persistence.accessModes[0]
(string)
Default: "ReadWriteOnce"
clickhouse.persistence.size
(string)
Default: "20Gi"
clickhouse.serviceAccount.create
(bool)
Default: true
clickhouse.serviceAccount.name
(string)
Default: "clickhouse"
clickhouse.serviceAccount.annotations
(object)
Default: {}
clickhouse.metrics
(object)		Ship a ServiceMonitor for ClickHouse's own Prometheus metrics (requires Prometheus Operator CRDs, requires metrics.enabled)
Default: {"enabled":false,"serviceMonitor":{"enabled":false}}
experimental
(object)		Experimental features
Default: Not set
experimental.tini
(bool)		Enable tini to terminate zombie processes on workers
Default: true
experimental.ingressRoutes
(bool)		Use Ingress routes instead of legacy nginx ⚠️ WARNING: This feature is deprecated and should not be used.
Default: false
Last updated on

Something we didn’t cover?

See our Roadmap
Subscribe on GitHub
Submit a request
API status