Helm Chart Values 2026.9.0
Here is the reference for the customizable values for Helm installation. See Helm installation documentation for more information.
global
Global configuration
Default
global:
emptyDir:
sizeLimit: ""
fipsEnabled: false
image:
imagePullPolicy: IfNotPresent
registry: null
imagePullSecrets: []
imageRegistry: ""
labels: {}
nodeSelector: {}
priorityClassName: ""
tolerations: []
Use the same value as global.imageRegistry here (for compatibility)
nilCommon tolerations applied to all workloads Example for ARM/Graviton nodes: tolerations: - key: graviton operator: Exists
[]Default sizeLimit for every chart-managed emptyDir volume. Empty emits no sizeLimit (Kubernetes default: unbounded). Per-volume keys override this.
""hostname
hostnamestringHostname for the GitGuardian application (without https://)
"gitguardian.example.com"extra_hostnames
extra_hostnameslistAdditional hostnames accepted by the routing layer. Only effective on /api/v1/receiver (the hook webapp skips Host validation); other paths still require the canonical hostname above.
[]network
IP family mode for the deployment ("ipv4", "ipv6", "dualstack")
"ipv4"postgresql
PostgreSQL Database configuration
PostgreSQL Database user password Should preferably be set in existing secret (see: postgresql.existingSecret)
""PostgreSQL Database SSL mode Possible values: disable, allow, prefer, require, verify-ca, verify-full See: PostgreSQL SSL Mode Descriptions
"allow"PostgreSQL Database Client certificate Should preferably be set in existing secret (see: postgresql.existingSecret)
""PostgreSQL Database Client certificate private key Should preferably be set in existing secret (see: postgresql.existingSecret)
""PostgreSQL Database Custom Certificate Authority Should preferably be set in existing secret (see: postgresql.existingSecret)
""Existing secret key where to store PostgreSQL Database Client certificate
""Existing secret key where to store PostgreSQL Database Client certificate private key
""Existing secret key where to store PostgreSQL Database Custom Certificate Authority
""Secret used to store PostgreSQL password and Certificates (preferred method)
""Keys used for PostgreSQL Database secrets when using an existing secret
Existing secret key where to store PostgreSQL Database user password
""redis
Redis Database configuration You can either provide a full qualified URI or fill each parts in dedicated fields Redis is used as a broker and result backend for celery and as a Commit Cache
Full qualified URI of Redis Instance Should preferably be set in existing secret (see: redis.main.existingSecret) This values is not used if using Redis Sentinel
""Redis Instance user (if redis.main.url is not specified) / Redis Sentinel master name
""Redis Instance password (if redis.main.url is not specified) / Redis Sentinel master password Should preferably be set in existing secret (see: redis.main.existingSecret)
""Redis Instance host name (if redis.main.url is not specified) This values is not used if using Redis Sentinel
""Redis Sentinel dedicated parameters (works along with redis.main.url)
Default
redis:
main:
sentinel:
enabled: false
masterServiceName: ""
password: ""
url: ""
user: ""
Redis Sentinel instances list. Format: sentinel-1:26379,sentinel-2:26379 Should preferably be set in existing secret (see: redis.main.existingSecret)
""Redis Sentinel master password Should preferably be set in existing secret (see: redis.main.existingSecret)
""Enable redis TLS (mandatory, whether using redis.main.url or redis.main.host)
falseEnable redis server certificate check If true, you must provide a rediss:// URL Scheme for redis.main.url
falseRedis Instance Client certificate Should preferably be set in existing secret (see: redis.main.existingSecret)
""Redis Instance Client certificate private key Should preferably be set in existing secret (see: redis.main.existingSecret)
""Redis Instance Custom Certificate Authority Should preferably be set in existing secret (see: redis.main.existingSecret)
""Existing secret key where to store Redis Instance Client certificate
""Existing secret key where to store Redis Instance Client certificate private key
""Existing secret key where to store Redis Instance Custom Certificate Authority
""Secret used to store Redis Instance URL or password and Certificates (preferred method)
""Keys used for Redis secrets when using an existing secret
Redis password (You can't use this parameter with Argo CD, use url parameter instead)
""Enable a separate Redis instance dedicated to the Commit Cache feature. Commit Cache feature allows to not scan already scanned commit by saving in Redis scan results. If not enabled, main Redis instance will be used for the Commit Cache
falseFull qualified URI of Redis Instance Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
""Redis Instance user name (if redis.commitCache.url is not specified)
""Redis Instance user password (if redis.commitCache.url is not specified) Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
""Redis Instance host name (if redis.commitCache.url is not specified)
""Redis Instance host port (if redis.commitCache.url is not specified)
6379Enable redis TLS (mandatory, whether using redis.commitCache.url or redis.commitCache.host)
falseEnable redis server certificate check If true, you must provide a rediss:// URL Scheme for REDIS_URL
falseRedis Instance Client certificate Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
""Redis Instance Client certificate private key Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
""Redis Instance Custom Certificate Authority Should preferably be set in existing secret (see: redis.commitCache.existingSecret)
""Existing secret key where to store Redis Instance Client certificate
""Existing secret key where to store Redis Instance Client certificate private key
""Existing secret key where to store Redis Instance Custom Certificate Authority
""Secret used to store Redis Instance URL or password and Certificates (preferred method)
""Keys used for Redis secrets when using an existing secret
Redis url can be set directly, or it will be recomposed from host, user, ...
""Redis password (You can't use this parameter with Argo CD, use url parameter instead)
""miscEncryption
Encryption keys configuration Django Secret Key, X509 certificate and key are auto-generated during installation if not set
Encryption key for sensitive database fields. Auto-generated at first install if empty (preferred method) IMPORTANT The key should be kept in a safe place at it is required to access all sensitive information in the database
DB encryption secrets (optional, only needed for djangoSecretKey key rotation)
""Keys used for encryption secrets when using an existing secret
Existing secret key where to store Django Secret Key Auto-generated at first install if empty (preferred method)
""Existing secret key where to store DB encryption keys (optional, only needed for djangoSecretKey key rotation)
""Existing secret key where to store certificate for SAML/SSO auth Auto-generated at first install if empty (preferred method)
""Existing secret key where to store certificate private key for SAML/SSO auth Auto-generated at first install if empty (preferred method)
""autoscaling
Autoscaling configuration
Default
autoscaling:
keda:
additionalPromqlLabelSelectors: ""
prometheus: {}
Optional comma-terminated PromQL label selectors inserted at the start of every { in built-in KEDA Prometheus queries when your metrics need extra matchers (e.g. cluster="prod",). Leave empty to keep the default queries.
""front
Frontend configuration The Frontend serves the Dashboard and acts as a proxy for other web deployments
Dashboard Frontend resources
Default
front:
nginx:
resources:
requests:
cpu: "100m"
memory: "200Mi"
Service type. Can be ClusterIP, NodePort or LoadBalancer
"ClusterIP"webappDefaults
Backend deployments configuration
Maximum number of workers created by autoscaler
10Autoscaling metrics threshold
Default
webappDefaults:
autoscaling:
metrics:
targetLatency: 1000
webapps
"internal-api""app""/api/v1/"50503"100m""500Mi"true155313"internal-api-long""app""3600s"5050"gthread"4300"100m""500Mi"true1510513"public-api""api""/exposed""client_max_body_size 25m;"50515"100m""500Mi"true1510513"hook""receiver""/api/v1/receiver"5050"100m""500Mi"false"app-exporter"Prometheus exporter replicas count Will be set to 1 if .Values.observability.exporter.statefulAppExporter.enabled is true
true9808true1510513celeryWorkerDefaults
celeryWorkerDefaultsobjectDefault configuration applied to all celery workers Workers can override any of these values in their own configuration. NOTE: Do NOT set terminationGracePeriodSeconds here - it has a dedicated fallback mechanism.
Default
celeryWorkerDefaults:
autoscaling:
hpa:
enabled: false
keda:
enabled: false
idleReplicaCount: 0
triggers: []
maxReplicas: 10
minReplicas: 1
ephemeralStorage:
annotations: {}
enabled: false
labels: {}
size: "1Gi"
storageClass: ""
livenessProbe:
enabled: true
failureThreshold: 3
initialDelaySeconds: 30
periodSeconds: 30
successThreshold: 1
timeoutSeconds: 10
metricsPort: 9808
nodeSelector: {}
podAntiAffinityPreset: soft
priorityClassName: ""
startupProbe:
enabled: true
failureThreshold: 30
heartbeatThreshold: 120
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
tolerations: []
celeryWorkers
Asynchronous Workers deployments configuration
Queues consumed by default workers
"celery,check_run,realtime,realtime_retry,honeytoken,reports,core_default,sources_default,incidents_default,individual_validity_check"Autoscaling metrics threshold
Default
celeryWorkers:
worker:
autoscaling:
metrics:
celery: 10
check_run: 10
core_default: 10
honeytoken: 10
incidents_default: 10
individual_validity_check: 10
realtime: 10
realtime_retry: 10
reports: 10
sources_default: 10
Autoscaling metrics threshold
Default
celeryWorkers:
check-runs:
autoscaling:
metrics:
check_run: 10
Autoscaling metrics threshold
Default
celeryWorkers:
email:
autoscaling:
metrics:
email: 10
notifier: 10
Queues consumed by Public Monitoring workers
"public_monitoring,public_monitoring_historical_scan,public_monitoring_realtime_scan"Worker count when enabled (gated to 0 unless the license field below is true)
1Queues consumed by Historical Scan workers
"basic_repo_scan,premium_repo_scan,manual_repo_scan,code_fixing"Autoscaling metrics threshold
Default
celeryWorkers:
scanners:
autoscaling:
metrics:
basic_repo_scan: 10
code_fixing: 10
manual_repo_scan: 10
premium_repo_scan: 10
Queues consumed by scan-based check-run workers
"check_run_scan"Scan-based check-run workers replicas count (0 = fall back to scanners)
0Autoscaling metrics threshold
Default
celeryWorkers:
check-run-scanners:
autoscaling:
metrics:
check_run_scan: 10
Queues consumed by Long Tasks workers
"background_validity_check,update_sources_state,nhi_ingestion,endpoints,hmsl,core_long,sources_long,incidents_long,ml_backpopulate,core_aspm,team_sync"HPA metrics threshold
Default
celeryWorkers:
long:
autoscaling:
metrics:
background_validity_check: 10
core_aspm: 10
core_long: 10
endpoints: 10
hmsl: 10
incidents_long: 10
ml_backpopulate: 10
nhi_ingestion: 10
sources_long: 10
team_sync: 10
update_sources_state: 10
Queues consumed by automatic severities workers
"automatic_severities"Automatic severities workers replicas count
1Autoscaling metrics threshold
3Queues consumed by the locations recompute workers
"incidents_disk"Locations recompute workers replicas count (0 = fall back to scanners)
0Autoscaling metrics threshold
Default
celeryWorkers:
incidents-disk:
autoscaling:
metrics:
incidents_disk: 10
Queues consumed by non-VCS Historical Scan workers
"ods_scan"Autoscaling metrics threshold
Default
celeryWorkers:
scanners-ods:
autoscaling:
metrics:
ods_scan: 10
Queues consumed by non-VCS Historical Scan workers
"ods_scan_highdisk"Non-VCS Historical Scan workers replicas count
0Autoscaling metrics threshold
Default
celeryWorkers:
scanners-ods-highdisk:
autoscaling:
metrics:
ods_scan_highdisk: 10
Queues consumed by default workers
"realtime_ods,realtime_retry_ods"Default workers (incl. realtime scans) replicas count
0Autoscaling metrics threshold
Default
celeryWorkers:
realtime-ods:
autoscaling:
metrics:
realtime_ods: 10
realtime_retry_ods: 10
Queues consumed by none-VCS Long Tasks workers
"long_ods"Maximum number of workers created by autoscaler
15Autoscaling metrics threshold
Default
celeryWorkers:
long-ods:
autoscaling:
metrics:
long_ods: 10
Number of replica for Non-VCS workers specialized in IO operations
0Maximum number of workers created by autoscaler
1Autoscaling metrics threshold
Default
celeryWorkers:
long-ods-io:
autoscaling:
metrics:
long_ods_io: 10
Number of replica for Container Registries scans
0Maximum number of workers created by autoscaler
1Autoscaling metrics threshold
Default
celeryWorkers:
container-registries:
autoscaling:
metrics:
container_registries: 10
Maximum number of workers created by autoscaler
4Autoscaling metrics threshold
Default
celeryWorkers:
scanners-slack:
autoscaling:
metrics:
slack_scan: 6
Number of replica for Business Contrib Worker
0Maximum number of workers created by autoscaler
5Autoscaling metrics threshold
Default
celeryWorkers:
business-contribution:
autoscaling:
metrics:
business_contribution: 10
Prefetch multiplier for Business Contrib Worker
100Autoscaling metrics threshold
Default
celeryWorkers:
ml-api-priority:
autoscaling:
metrics:
ml_api_priority: 10
Maximum number of workers created by autoscaler
1beat
Asynchronous tasks scheduler
Asynchronous tasks scheduler resources
Default
beat:
resources:
requests:
cpu: "10m"
memory: "200Mi"
secretEngine
ML Secret Engine
Default
secretEngine:
autoscaling:
hpa:
enabled: false
keda:
enabled: false
triggers: []
maxReplicas: 1
metrics:
bentoml_service_request_in_progress: 10
minReplicas: 1
emptyDir:
bentomlProm:
sizeLimit: ""
bentomlTmp:
sizeLimit: ""
modelDir:
sizeLimit: ""
labels: {}
nodeSelector: {}
pdb:
enabled: false
minAvailable: "50%"
priorityClassName: ""
replicas: 1
tolerations: []
Activate PodDisruptionBudget on secret engine Note: podDisruptionBudget.enabled must be true
falseMetrics
Default
secretEngine:
autoscaling:
metrics:
bentoml_service_request_in_progress: 10
sizeLimit for the model-dir emptyDir holding the ML model bundle, by far the largest of the three (>650Mi as of 1.11.0). Size it accordingly if your platform caps emptyDir volumes. Empty falls back to global.emptyDir.sizeLimit.
""sizeLimit for the bentoml-tmp emptyDir. Empty falls back to global.emptyDir.sizeLimit.
""sizeLimit for the bentoml-prom emptyDir. Empty falls back to global.emptyDir.sizeLimit.
""inAppAnalytics
InApp Analytics
Default
inAppAnalytics:
annotations: {}
enabled: true
ephemeralStorage:
annotations: {}
enabled: false
labels: {}
size: "20Gi"
storageClass: ""
labels: {}
nodeSelector: {}
podAnnotations: {}
podLabels: {}
postgresql:
analyticsSchema: ""
applicationSchema: ""
useSeparateAnalyticsSchema: null
priorityClassName: ""
tolerations: []
PostgreSQL schema layout used by the analytics pipeline. Each setting is passed to the job only when set; leaving them unset keeps the historical layout (GitGuardian tables in public, intermediate objects in their own analytics schema).
Default
inAppAnalytics:
postgresql:
analyticsSchema: ""
applicationSchema: ""
useSeparateAnalyticsSchema: null
Schema holding the GitGuardian tables, where the pipeline writes the product-facing analytics objects. Must match the default schema of the database user.
""Give the pipeline's intermediate objects a schema of their own. Set to false to keep them in applicationSchema, so that the job never issues a CREATE SCHEMA.
nilName of the schema holding the intermediate objects. A pre-created schema is accepted, as long as the database user has USAGE, CREATE on it.
""apacheTika
Apache Tika
Default
apacheTika:
autoscaling:
hpa:
enabled: false
keda:
enabled: false
triggers: []
maxReplicas: 10
minReplicas: 1
targetCPUUtilizationPercentage: 60
targetMemoryUtilizationPercentage: 60
labels: {}
nodeSelector: {}
pdb:
enabled: false
minAvailable: "50%"
priorityClassName: ""
replicas: 0
tolerations: []
Activate PodDisruptionBudget on apache-tika Note: podDisruptionBudget.enabled must be true
falseonPrem
GitGuardian Admin User A temporary password has to be set in secret "gim-secrets" under ADMIN_PASSWORD key. You'll be asked to change this password on your connection
Default
onPrem:
adminUser:
email: admin@example.com
existingSecret: ""
existingSecretKeys:
password: ""
firstname: Admin
Controls the RBAC mode for the Replicated SDK. - full: default, grants all permissions required by the SDK (get/list/watch on core resources, create/update secrets) - minimal: read-only permissions scoped to specific resource names. Some SDK features (e.g. status informers, custom metrics reporting) may not work. Reserved for environments with strict RBAC policies that prohibit runtime secret creation and broad resource access. - disabled: no Role or RoleBinding created for the SDK. The ServiceAccount is still created.
"full"mcpServer
MCP Server (opt-in: requires enabled: true)
Default
mcpServer:
annotations: {}
autoscaling:
hpa:
enabled: false
keda:
enabled: false
triggers: []
maxReplicas: 10
metrics:
targetLatency: 1000
minReplicas: 1
enabled: false
extraEnv: []
gunicorn:
maxRequests: 1000
port: 8000
timeout: 120
workers: 1
image:
imagePullPolicy: IfNotPresent
name: gitguardian/mcp-server
registry: proxy.replicated.com/proxy/gitguardian/ghcr.io
tag: "0.7.0"
ingress:
enabled: true
labels: {}
livenessProbe:
enabled: true
failureThreshold: 3
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 5
mcpOAuthProxyEnabled: true
nodeSelector: {}
oauth:
extraRedirectUris: []
podAnnotations: {}
podAntiAffinityPreset: soft
podLabels: {}
priorityClassName: ""
readinessProbe:
enabled: true
failureThreshold: 3
initialDelaySeconds: 10
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 3
replicas: 1
resources:
limits:
cpu: "1000m"
memory: "1500Mi"
requests:
cpu: "250m"
memory: "1Gi"
sentry:
dsn: ""
enabled: false
profilesSampleRate: "0.1"
tracesSampleRate: "0.1"
service:
annotations: {}
port: 8000
type: ClusterIP
tolerations: []
Enable the MCP OAuth proxy behaviour (MCP_OAUTH_PROXY_ENABLED env var in gg-mcp)
trueExtra OAuth callback URLs for your own MCP gateway (absolute https://, host you control)
[]replicated
antiAffinity for Replicated SDK, applies only if replicaCount > 1
"soft"Enable podDisruptionBudget for Replicated SDK
truepodDisruptionBudget minAvailable for Replicated SDK
1Replicated SDK image registry
"proxy.replicated.com/proxy/gitguardian/docker.io"Replicated SDK image repository
"replicated/replicated-sdk"Image pullsecrets
Default
replicated:
imagePullSecrets:
- name: gim-replicated-registry
Replicated SDK env vars update this to use an existing Secret for proxy urls. gim-proxy only exists when proxy.httpProxyUrl or proxy.httpsProxyUrl is set inline, so the references stay optional and the SDK starts without a proxy.
Default
replicated:
extraEnv:
- name: HTTP_PROXY
valueFrom:
secretKeyRef:
key: http_proxy
name: gim-proxy
optional: true
- name: HTTPS_PROXY
valueFrom:
secretKeyRef:
key: https_proxy
name: gim-proxy
optional: true
- name: NO_PROXY
valueFrom:
configMapKeyRef:
key: NO_PROXY
name: gim-config
Specify secret containing Custom Certificate Authority certificate. See GitGuardian doc
nilEnable/Disable Support Bundle related file generation entirely
trueAdd pod create/get/delete permissions to the GIM ServiceAccount role, allowing the application to spawn support-bundle pods. Set to false to prevent in-cluster support bundle generation entirely.
truetrueUse an existing ServiceAccount instead of creating one If set, this takes precedence over create: true
""Create role (optional) for Support Bundle generation
trueCreate ClusterRole (optional) for Support Bundle generation
trueCreate a ValidatingAdmissionPolicy to restrict support bundle pod creation. Only effective when rbac.enabled
trueUse an existing Secret instead of creating one. The secret must contain the keys: 'license-id' and 'upload-domain'. If set, the chart will not create the 'support-bundle-credentials' secret.
""Set the max number of lines in the support bundle logs
10000Node selector for the support bundle pod. Falls back to global.nodeSelector.
{}Tolerations for the support bundle pod, to schedule it on tainted nodes. Concatenated with global.tolerations.
[]Annotations for the support bundle pod. The pod has no controller, so an eviction loses the bundle: set the annotation that your node autoscaler or descheduler honors to prevent voluntary eviction (for example karpenter.sh/do-not-disrupt: "true").
{}Resource requests/limits for the support bundle pod containers
Default
replicated:
supportBundle:
resources:
initContainer:
limits:
cpu: "500m"
memory: "4Gi"
requests:
cpu: "100m"
memory: "1Gi"
mainContainer:
limits:
cpu: "100m"
memory: "64Mi"
requests:
cpu: "10m"
memory: "32Mi"
CPU request for the bundle generation init container
"100m"Memory request for the bundle generation init container
"1Gi"CPU limit for the bundle generation init container
"500m"Memory limit for the bundle generation init container
"4Gi"CPU request for the HTTP server container
"10m"Memory request for the HTTP server container
"32Mi"CPU limit for the HTTP server container
"100m"Memory limit for the HTTP server container
"64Mi"ggscout
GitGuardian API endpoint (optional; if not specified, the current self-hosted GitGuardian instance URL will be used)
"http://public-api:5051/exposed/v1"GitGuardian API token for ggscout, please refer to ggscout Helm configuration
""For ggscout inventory sources configuration details, please refer to ggscout Helm chart examples
{}Specify the secret containing the CA certificate to inject
""Specify secret key under the CA certificate is stored
"ca.crt"GGBridge
Enable GitGuardian Bridge, to scan sources reachable only from an isolated network. Read the dedicated documentation.
falsePublic domain shared by every bridge server: the domain of the ggbridge server releases, so that a bridge is reachable at <subdomain>.<basePublicDomain>
""Cluster DNS suffix of the namespace running the ggbridge server releases, for example ggbridge.svc.cluster.local. All the server releases must be installed in that single namespace
""One entry per isolated network. subdomain must match the subdomain value of the ggbridge server release, and it names the proxy Service GitGuardian connects to, it must be unique. domains are the hostnames routed through that bridge.
[]tls
HTTPS TLS configuration You can manage the certificate manually or use Cert-Manager
Name of the created cert-manager Certificate object
"gitguardian-certificate"Namespace where certificate will be created
.Release.NamespaceCustom Certificate Authority certificate for integrations (VCS, notifiers, webhooks, ...)
Certificates full chain in the PEM format Should preferably be set in existing secret (see: tls.customCa.existingSecret)
""Existing secret containing certificates full chain in the PEM format
""Custom CA (used for init-containers only) image configuration
Default
tls:
customCa:
image:
name: gitguardian/wolfi/bash
pullSecrets: []
registry: proxy.replicated.com/proxy/gitguardian/ghcr.io
tag: "5.3"
Registry source to fetch the image Empty = from dockerhub
"proxy.replicated.com/proxy/gitguardian/ghcr.io"Resource requests and limits for the init-custom-ca init container
Default
tls:
customCa:
resources:
limits:
memory: "128Mi"
requests:
cpu: "50m"
memory: "64Mi"
Client (end user) authentication
Enable client authentication. This is required for Common Access Card
falseSet client authentication mode (one of enforce, audit). audit mode must be used for initial setup.
"enforce"Regex to extract the unique user identifier from the certificate DN. You must use a capture group using parenthesis to catch the user ID. Default regex will match 117 here: CN=hubert.bonisseur.delabath.117,O=DGSE,C=FR
"(?:.+,)?CN=[^.]+\\.[^.]+\\.[^.]+\\.(\\d+)(?:,.+)?"NGINX Server certificate (PEM) Should preferably be set in existing secret (see: tls.clientAuth.existingSecret)
""NGINX Server key (PEM) Should preferably be set in existing secret (see: tls.clientAuth.existingSecret)
""NGINX Authority that validates user certificates (PEM) Should preferably be set in existing secret (see: tls.clientAuth.existingSecret)
""Nginx CRL usage for clientAuth
Default
tls:
clientAuth:
crl:
cron: "0 0 * * *"
persistence:
accessModes:
- ReadWriteMany
annotations: {}
labels: {}
size: "1Gi"
storageClass: ""
url: ""
Nginx CRL URL. Use a CRL instead of OCSP to check revokations status. Keep empty to use OCSP.
""Nginx CRL refresh cron expression. This example means daily at 00:00
"0 0 * * *"accessModes to use for the CRL PVC. Use only ReadWriteMany (HA) if available.
Default
tls:
clientAuth:
crl:
persistence:
accessModes:
- ReadWriteMany
networkPolicy
Enable network policies for GIM namespace isolation. When enabled, ingress from outside the GIM namespace is denied by default, and only explicitly allowed namespaces can reach GIM pods. Start with mode=dryrun to verify your config, then switch to mode=enforce.
falseNetwork policy mode dryrun: all policies are deployed but a temporary allow-all prevents any blocking — verify your config first enforce: the allow-all is removed and policies actively block unauthorized ingress
"dryrun"List of namespace names allowed to reach GIM pods Include your ingress controller namespace, monitoring, and any other namespace that needs access. Example: ["ingress-nginx", "monitoring"]
[]Extra NetworkPolicy resources to create alongside the default ones Each entry is rendered as a full NetworkPolicy spec — full flexibility for custom rules.
[]securityContext
securityContextobjectSpecify Pod Security Context.
Default
securityContext:
enabled: true
fsGroup: 65532
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
containerSecurityContext
containerSecurityContextobjectSpecify Container Security Context. Note: Enabled if securityContext.enabled is true.
Default
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
seccompProfile:
type: RuntimeDefault
podDisruptionBudget
Deploy PodDisruptionBudget globally. Note: Some Deployments have their own enabler (like apacheTika or secretEngine)
trueingress
Routing API used to expose the application: - "ingress" -> Kubernetes Ingress v1 / IngressRoute / VirtualService / HTTPProxy / Route (templates/exposure/) - "gateway-api" -> Gateway API HTTPRoute + Gateway (templates/exposure-gateway-api/)
"ingress"Data plane / ingress controller in use in the cluster. Supported: ingress-nginx / traefik / contour / aws_alb / openshift (Openshift Route) / istio. Drives which exposure/* template is picked (when routingApi=ingress) AND which Prometheus metric is used for HPA/KEDA latency-based autoscaling. With routingApi=gateway-api, only istio / contour / traefik are supported. "other" = any controller without a built-in integration (Kong, Cilium, …): generic routing, no built-in autoscaling query (use keda.triggers).
"ingress-nginx"The routing path to the GitGuardian instance. You may need to set this to '/*' in order to use this with ALB ingress controllers.
"/"Ingress Path type (only used when routingApi=ingress and experimental.ingressRoutes=false)
"Prefix"IngressClass that will be used to implement the Ingress (only used when routingApi=ingress)
""Gateway API configuration (only used when routingApi=gateway-api)
Default
ingress:
gatewayApi:
gateway:
create: false
httpListenerPort: 80
httpsListenerPort: 443
name: gitguardian
namespace: ""
gatewayClassName: ""
Create the Gateway resource or use an existing one
falseName of the Gateway (created or existing)
"gitguardian"Namespace of the Gateway (empty = same as release namespace)
""HTTP listener port (only used when create=true)
80HTTPS listener port (only used when create=true)
443Istio Gateway name
"{{.Release.Name}}-{{.Release.Namespace}}"Enable TLS configuration for the hostname defined at ingress.hostname parameter
falseTLS certificate in PEM format Should preferably be set in existing secret (see: ingress.tls.existingSecret)
""TLS private key Should preferably be set in existing secret (see: ingress.tls.existingSecret)
""observability
Prometheus exporters configuration
Enable GitGuardian Applicative metrics on Webapp pods and Celery Workers
falseEnable Stateful metrics on Applicative Exporter See: GitGuardian documentation
falseApplicative Exporter resources
Default
observability:
exporters:
statefulAppExporter:
resources:
requests:
cpu: "100m"
memory: "500Mi"
Enable ServiceMonitors for Prometheus Operator Note: this requires to install Prometheus Operator (not included in this chart) See: Prometheus documentation
falserbac
GitGuardian pods will use a limited role if enabled
Default
rbac:
enabled: true
Creates a Role and bind it to GitGuardian ServiceAccount (see serviceAccount.name). See GitGuardian doc
trueserviceAccount
GitGuardian Pods are using this ServiceAccount
Default
serviceAccount:
annotations: {}
autoMount: true
create: true
labels: {}
name: gim
name of the serviceAccount (if serviceAccount.create is false, it must exists prior to chart deployment)
"gim"migration
{}[]{}{}{}Pre Deployment Job resources
Default
migration:
preDeploy:
resources:
limits:
memory: "10Gi"
requests:
cpu: "500m"
memory: "3Gi"
Post Deployment Job resources
Default
migration:
postDeploy:
resources:
limits:
memory: "2Gi"
requests:
cpu: "500m"
memory: "1Gi"
upgradePathCheck Job resources
Default
migration:
upgradePathCheck:
resources:
limits:
memory: "1Gi"
requests:
cpu: "200m"
memory: "500Mi"
GitGuardian migration pods are using this ServiceAccount
Default
migration:
serviceAccount:
annotations: {}
autoMount: true
create: true
labels: {}
name: gim-migration
name of the serviceAccount (if migration.serviceAccount.create is false, it must exists prior to chart deployment)
"gim-migration"hookMethod
hookMethodstringHook Method (helm/argocd/none)
"helm"proxy
HTTP(s) proxy configuration You can configure a proxy server for outgoing traffic from the application
List of host names through which the traffic should not go via the proxy
[]Existing secret key where to store proxy http url
""Existing secret key where to store proxy https url
""logCollector
sizeLimit for the logs emptyDir shared by every log collector sidecar. Empty falls back to global.emptyDir.sizeLimit.
""Also collect logs from the pre-deploy and post-deploy hook Jobs. The collector is injected as a native sidecar (initContainer with restartPolicy: Always), which requires Kubernetes >= 1.29 so the hook Job can still complete. Leave disabled on older clusters.
trueFluent-bit image registry
"proxy.replicated.com/proxy/gitguardian/ghcr.io"- Environment variables to be passed to logCollector from configMaps or Secrets
[]Use networkPolicy.enabled instead. Will be removed in a future release.
Default
logCollector:
networkPolicy:
enabled: false
Limit on number of logs to retrieve for each component (0 means disabled)
0Log levels for support-bundle Loki queries: info (all levels) or error (error
loki-minio
MinIO image registry
"proxy.replicated.com/proxy/gitguardian/ghcr.io"MinIO image pull secrets
Default
loki-minio:
image:
pullSecrets:
- name: gim-replicated-registry
Enable container Security Context for MinIO
6553265532"RuntimeDefault"loki
For OpenShift set sccEnabled to 'true' to use the SecurityContextConstraints.
falseLoki image pull secrets
Default
loki:
imagePullSecrets:
- name: gim-replicated-registry
Loki image registry
"proxy.replicated.com/proxy/gitguardian/ghcr.io"Delay after which chunks will be fully deleted during retention.
"2h"6553265532true65532truefalsetruefalse"ALL""RuntimeDefault""LOKI_ADDR""http://localhost:3100"clickhouse
falseSettings that vary with a customer's infrastructure sizing, unlike the GG-chosen guardrails defaults
Default
clickhouse:
serverConfig:
cacheMaxSize: ""
extraVars: {}
maxBytesRatioBeforeExternalGroupBy: 0.4
maxBytesRatioBeforeExternalSort: 0.4
maxConcurrentQueries: 32
maxExecutionTime: 55
maxServerMemoryUsageToRamRatio: 0.9
metadataDiskKeepFreeSpaceBytes: 1073741824
nonReplicatedDeduplicationWindow: 1000
partsToDelayInsert: 1000
partsToThrowInsert: 3000
Filesystem cache disk max size (object_cache.xml). "" auto-derives it from clickhouse.cache.size minus a 2Gi safety margin (recommended); set explicitly only to override that derivation. Unused (no need to set it, whatever clickhouse.cache.enabled is) when clickhouse.objectStorage.provider=local
""Free space to reserve on the metadata disk (01-metadata-guardrails.xml), 1GiB by default: refuse writes below this threshold so it never fills to 100%
1073741824Extra env vars injected as-is into the clickhouse-server-config-defaults ConfigMap, for guardrails.xml/guardrails-users.xml from_env references you add yourself
{}ClickHouse object storage backend, auto-generates configdFiles."00-object-storage.xml" instead of hand-writing it. clickhouse.backup.config is configured separately below (deliberately independent, see its own comment)
Default
clickhouse:
objectStorage:
azblob:
containerName: ""
credentialless: false
existingSecret: ""
storageAccountUrl: ""
gcs:
bucket: ""
endpoint: "https://storage.googleapis.com"
existingSecret: ""
prefix: ""
provider: ""
s3:
bucket: ""
credentialless: false
endpoint: ""
existingSecret: ""
forcePathStyle: false
prefix: ""
region: ""
"" disables generation (hand-write configdFiles."00-object-storage.xml" and backup.config yourself, as before), "local" runs on the metadata PVC only, no object storage at all
""Required when provider=s3, e.g. https://mybucket.s3.<region>.amazonaws.com (a bucket-less regional endpoint if forcePathStyle=true, e.g. MinIO)
""Optional S3 key prefix within the bucket, e.g. to share it with another consumer, no leading/trailing slash needed
""Required, AWS S3 SigV4 signing needs it even when the endpoint doesn't encode it (e.g. MinIO)
""false = virtual-hosted style, endpoint must already embed the bucket as a subdomain (AWS default). Set true for MinIO/most S3-compatible stores, with a bucket-less endpoint
falsetrue = IRSA (AWS), no static credentials. Requires the pod's ServiceAccount annotated via serviceAccount.annotations
falseSecret with keys: access-key-id, secret-access-key. Required unless credentialless=true
""GCS has no native ClickHouse disk type, accessed via its S3-compatible HMAC interface
"https://storage.googleapis.com"Optional key prefix within the bucket, e.g. to share it with another consumer, no leading/trailing slash needed
""HMAC keys, Secret with keys: access-key-id, secret-access-key
""Required when provider=azblob, e.g. https://myaccount.blob.core.windows.net
""true = Entra Workload ID (AKS), no static credentials. Requires the pod's ServiceAccount annotated (serviceAccount.annotations) and podLabels set for the mutating webhook
falseSecret with keys: account-name, account-key. Required unless credentialless=true
""Runs the clickhouse-backup sidecar. Set to false to fully manage it yourself via clickhouse.sidecars instead
trueShip a ServiceMonitor for the backup sidecar's Prometheus metrics (requires Prometheus Operator CRDs)
Default
clickhouse:
backup:
metrics:
enabled: false
Backup destination, same structure as clickhouse.objectStorage but deliberately independent values (a backup must never target the bucket it protects; the chart fails the render when both sides name the same bucket/container on the same store). Auto-generates the provider env vars (S3_, GCS_, AZBLOB_*) in the clickhouse-backup-config ConfigMap and the credential env from existingSecret. Setting a provider also stops mounting the legacy clickhouse-backup-secret (a stale one would silently override the generated destination); put extra sensitive settings in backup.sidecar.extraEnvVarsSecret instead
Default
clickhouse:
backup:
objectStorage:
azblob:
containerName: ""
credentialless: false
existingSecret: ""
prefix: ""
storageAccountName: ""
gcs:
bucket: ""
credentialless: false
existingSecret: ""
prefix: ""
provider: ""
s3:
bucket: ""
credentialless: false
endpoint: ""
existingSecret: ""
forcePathStyle: false
prefix: ""
region: ""
"" disables generation (hand-write provider settings via backup.config.extraVars and credentials via the clickhouse-backup-secret Secret, as before), or one of "s3", "gcs", "azblob"
""Optional bucket-less endpoint for S3-compatible stores (e.g. MinIO, http://minio:9000). Leave "" on AWS: clickhouse-backup derives the endpoint from region
""Required when provider=s3. Use a DIFFERENT bucket than clickhouse.objectStorage.s3.bucket
""Optional key prefix within the bucket; backup manifests land under <prefix>/metadata and object-disk blob copies under <prefix>/objects
""Required true whenever endpoint is set (the chart fails the render otherwise): custom endpoints almost never serve virtual-hosted bucket subdomains
falsetrue = IRSA (AWS), no static credentials, via the AWS SDK default chain: the ServiceAccount token (serviceAccount.annotations) is mounted into every container of the pod, this sidecar included
falseSecret with keys: access-key-id, secret-access-key (same shape as clickhouse.objectStorage.s3.existingSecret, but a different secret for a different bucket). Required unless credentialless=true
""Required when provider=gcs. Use a DIFFERENT bucket than clickhouse.objectStorage.gcs.bucket
""Optional key prefix within the bucket; backup manifests land under <prefix>/metadata and object-disk blob copies under <prefix>/objects
""true = GKE Workload Identity (Application Default Credentials), no static key. Unlike clickhouse.objectStorage.gcs (S3-HMAC only), the backup sidecar speaks native GCS via the Google SDK
falseSecret with key: credentials-json (a GCP service-account JSON key; never put it in a ConfigMap/values file). Required unless credentialless=true
""Required when provider=azblob, the storage account NAME (clickhouse-backup takes the name, not the URL clickhouse.objectStorage.azblob uses)
""Required when provider=azblob. Use a DIFFERENT container than clickhouse.objectStorage.azblob (ideally a different storage account)
""Optional key prefix within the container; backup manifests land under <prefix>/metadata and object-disk blob copies under <prefix>/objects
""true = Entra Workload ID (AKS), no static credentials: the AKS mutating webhook injects the federated token into every container of the pod, this sidecar included
falseSecret with key: account-key (a secret shaped like clickhouse.objectStorage.azblob's, with an extra account-name key, works as-is: only account-key is read). Required unless credentialless=true
""clickhouse-backup sidecar's settings, deliberately independent from clickhouse.objectStorage (a backup must never default to the same bucket as the data it protects)
Default
clickhouse:
backup:
config:
allowEmptyBackups: true
backupsToKeepRemote: 7
downloadConcurrency: 2
extraVars: {}
logLevel: info
rebaseBeforeRemoveOldRemote: true
rebaseConcurrency: 2
remoteStorage: s3
s3Concurrency: 2
uploadConcurrency: 2
watchSchedules: "name=ch-bkp,full=0 2 * * 0,increment=0 2 * * *,full_type=rebase,delete_previous_cycle=false"
Only used when backup.objectStorage.provider is "" (otherwise derived from the provider)
"s3"Full backup Sunday 2am (server-side rebase after the first, no re-upload), daily increment at 2am, mutually exclusive with WATCH_INTERVAL/FULL_INTERVAL, see clickhouse-backup#1354
"name=ch-bkp,full=0 2 * * 0,increment=0 2 * * *,full_type=rebase,delete_previous_cycle=false"Without this, backupsToKeepRemote isn't a hard cap, old chains stay if a newer increment depends on them
trueWithout this, a first install crash-loops the sidecar, no tables yet is treated as a fatal error
truePins concurrency instead of clickhouse-backup's own auto-calc, which is NumCPU()-based and not cgroup-aware
2Escape hatch for any NON-SENSITIVE clickhouse-backup setting (github.com/Altinity/clickhouse-backup) the chart doesn't model, e.g. S3_STORAGE_CLASS. Renders into a ConfigMap: credential keys (S3_ACCESS_KEY, GCS_CREDENTIALS_JSON, AZBLOB_ACCOUNT_KEY, ...) are refused, they belong in a Secret. Provider basics (bucket, region, paths) are better set via backup.objectStorage above; a key it owns fails the render here. Use a DIFFERENT bucket/account than clickhouse.objectStorage
{}"proxy.replicated.com/proxy/gitguardian/513715405986.dkr.ecr.us-west-2.amazonaws.com""cgr.dev/gitguardian.com/clickhouse-backup""2.8.1""100m""128Mi""1""1Gi"trueAdditive env vars for the backup sidecar, to add one without redeclaring the hardcoded ones (CLICKHOUSE_PASSWORD, API_USERNAME, ...)
[]Extra volumeMounts for the backup sidecar, e.g. to mount a volume declared via clickhouse.extraVolumes
[]{}"proxy.replicated.com/proxy/gitguardian/513715405986.dkr.ecr.us-west-2.amazonaws.com""cgr.dev/gitguardian.com/clickhouse-iamguarded""26.4""gim-replicated-registry"Add your own config.d XML files here, or reuse a chart-generated key (guardrails.xml, object-cache.xml, 09-log-tables.xml, 00-object-storage.xml) to override it entirely
{}Add your own users.d XML files here, or reuse the chart-generated key (guardrails-users.xml) to override it entirely
{}Default
"CREATE DATABASE IF NOT EXISTS gim;\n"
Recommended: keep requests equal to limits to prevent over-commitment on the node. See the ClickHouse sizing guide: https://docs.gitguardian.com/self-hosting/management/infrastructure-management/clickhouse/sizing
Default
clickhouse:
resources:
limits:
cpu: 4
memory: "16Gi"
requests:
cpu: 4
memory: "16Gi"
true10011001true"RuntimeDefault"true{}{}Recommended for production: pin ClickHouse to a dedicated, on-demand node pool. See: https://docs.gitguardian.com/self-hosting/management/infrastructure-management/clickhouse/sizing
{}Must match a taint on the dedicated node pool selected via nodeSelector above
[]Recommended for production: protects ClickHouse from preemption/eviction under node pressure; the PriorityClass must already exist in-cluster
""[]Use this for extra volumes beyond persistence/cache, e.g. a customer-managed cache PVC when clickhouse.cache.enabled=false
[]Use this for extra PVC templates beyond persistence/cache, e.g. a customer-managed cache PVC when clickhouse.cache.enabled=false
[]Filesystem cache PVC for the object_cache disk, set to false to fully manage yourself
trueRecommended for production: use an SSD/NVMe-backed class, same as clickhouse.persistence.storageClass. See: https://docs.gitguardian.com/self-hosting/management/infrastructure-management/clickhouse/sizing
"""ReadWriteOnce""50Gi"Extra sidecars, or the clickhouse-backup one entirely when clickhouse.backup.enabled=false
[]trueRecommended for production: use an SSD/NVMe-backed class. See: https://docs.gitguardian.com/self-hosting/management/infrastructure-management/clickhouse/sizing
"""ReadWriteOnce""20Gi"true"clickhouse"{}Ship a ServiceMonitor for ClickHouse's own Prometheus metrics (requires Prometheus Operator CRDs, requires metrics.enabled)
Default
clickhouse:
metrics:
enabled: false
serviceMonitor:
enabled: false
experimental
Experimental features
Use Ingress routes instead of legacy nginx ⚠️ WARNING: This feature is deprecated and should not be used.
false
