Kubernetes
Values
Every value of the Helm chart with its default, and the keys of its credentials Secret.
Values
| Value | Default | Sets |
|---|---|---|
image.repository, image.tag | ghcr.io/relicbuild/relic, v<appVersion> | The Relic image. |
image.pullPolicy, imagePullSecrets | IfNotPresent, [] | Pull policy and private registry Secrets. |
existingCredentialsSecret | (none) | Your own Secret with the keys below. Empty: the chart creates one from credentials.*. |
credentials.* | (none) | One value per key below. encryptionKey and adminPassword are required. |
database.engine | postgresql | postgresql or sqlite. sqlite runs a single node and needs cluster.enabled and cloudnative-pg.enabled off. |
objectStorage.type | s3 | s3, azure, gcs or filesystem. filesystem runs a single node. All but s3 need seaweedfs.enabled off. |
data.size, data.storageClass | 20Gi, cluster default | A single node's data volume, kept on uninstall. A single node runs one pod with relic server start --worker, no worker Deployment, autoscaler or disruption budget, and refuses server.replicas other than 1. |
objectStorage.endpoint | SeaweedFS's S3 gateway | RELIC_OBJECT_STORAGE_ENDPOINT. Required with seaweedfs.enabled off, except for gcs, s3 with defaultCredentials (empty means Amazon S3), and azure with a connection string. For Amazon S3 with a key pair, use the regional endpoint. |
objectStorage.region | us-east-1 | RELIC_OBJECT_STORAGE_REGION. |
objectStorage.checksum | when_supported | RELIC_OBJECT_STORAGE_CHECKSUM. |
objectStorage.artifactsBucket, objectStorage.temporaryBucket | artifacts, temporary | The two buckets. The names must differ. |
objectStorage.defaultCredentials | false | true authenticates with the platform's identity (IRSA or EKS Pod Identity, Azure workload or managed identity, GKE workload identity) instead of keys. Annotate the service account. |
objectStorage.serverSideEncryption, objectStorage.sseKmsKeyId | (none) | RELIC_OBJECT_STORAGE_SSE (AES256 or aws:kms) and its KMS key. |
objectStorage.storageClass | (none) | RELIC_OBJECT_STORAGE_STORAGE_CLASS. |
cloudnative-pg.enabled, cloudnative-pg.* | on | The CloudNativePG operator and its chart's values. |
cluster.enabled, cluster.* | on | PostgreSQL: the cnpg/cluster chart's values. |
seaweedfs.enabled, seaweedfs.* | on | The seaweedfs chart's values. Keep seaweedfs.s3.createBuckets in step with the bucket names. |
server.replicas, server.autoscaling.* | 2, off | Server pods. A PodDisruptionBudget (server.podDisruptionBudget.*) keeps one running during a drain; the chart omits it when it would block the drain. |
server.temporaryVolumeSize | 10Gi | The /tmp emptyDir, for release bundles and archive browsing. |
worker.replicas, worker.temporaryVolumeSize | 1, 20Gi | The worker. More than one replica needs worker.vulnerabilityDatabase.persistence off. |
worker.vulnerabilityDatabase.* | persisted, 5Gi | Relic Scan's vulnerability database. Without persistence, it is downloaded again after every restart. |
tls.enabled | on | HTTPS (The server's certificate). Off serves plain HTTP. |
tls.existingSecret | (none) | A kubernetes.io/tls Secret mounted at /etc/relic/tls. Without it, each pod generates its own certificate authority. |
tls.hostnames | [] | Extra names for the generated certificate, besides the Service's names and ingress hosts. |
tls.minVersion | "1.2" | "1.2" or "1.3". |
ingress.* | off | Hosts, class, annotations and TLS. Adds the ingress-nginx HTTPS backend annotation while tls.enabled is on. |
service.type, service.port, service.nodePort | ClusterIP, 443 (80 without TLS) | How the server is exposed. |
trustedProxies | the private ranges | RELIC_TRUSTED_PROXIES. |
ldap.caCertificate | (none) | A PEM CA certificate for LDAP servers (LDAP). |
networkPolicy.enabled, networkPolicy.allowServerAccessFrom | on, (anyone) | Who may reach the server (Network policy). |
serviceAccount.create, serviceAccount.name, serviceAccount.annotations | on, <release>-relic, (none) | The pods' service account; its token is not mounted. Annotations bind a cloud identity, such as eks.amazonaws.com/role-arn. |
podLabels | (none) | Labels for the server and worker pods. |
podSecurityContext, securityContext | non-root 65532, read-only root filesystem | See Hardening. |
metrics.enabled | on | /metrics on port 8091, a <release>-relic-metrics Service and a scrape rule. metrics.allowScrapesFrom narrows the rule. |
metrics.serviceMonitor.*, metrics.prometheusRule.* | on | A ServiceMonitor and alert rules, when the Prometheus Operator's API exists. |
metrics.repositoryNameLabel, metrics.profiling | off | RELIC_METRICS_REPOSITORY_LABEL, RELIC_PROFILING_ENABLED. |
tracing.otlpEndpoint, tracing.sampler, tracing.samplerArg | (none), parentbased_traceidratio, 0.1 | OTLP traces. Defaults to the bundled Alloy with monitoringStack.enabled. |
logging.level, logging.format, logging.otlp | info, json, off | RELIC_LOG_LEVEL, RELIC_LOG_FORMAT, OTLP logs. |
grafana.dashboards.* | off | Dashboards as ConfigMaps for a Grafana sidecar. Always on with monitoringStack.enabled. |
monitoringStack.enabled | off | The monitoring stack. |
extraEnv | [] | Any variable from the configuration reference, on server and worker. |
*.nodeSelector, *.tolerations, *.affinity, *.resources | Per component. The server's memory limit sets how many uploads run at once (Memory and concurrent uploads). |
For example, to let remote repositories proxy an internal registry:
extraEnv:
- name: RELIC_UPSTREAM_ALLOW_PRIVATE_ADDRESSES
value: "true"
Secret keys
| Key | Variable | Used when |
|---|---|---|
databaseURL | RELIC_DATABASE_URL | cluster.enabled is off and database.engine is postgresql. |
objectStorageAccessKey, objectStorageSecretKey | RELIC_OBJECT_STORAGE_ACCESS_KEY, RELIC_OBJECT_STORAGE_SECRET_KEY | seaweedfs.enabled is off, the type is s3, and defaultCredentials is off. |
objectStorageAzureConnectionString | RELIC_OBJECT_STORAGE_AZURE_CONNECTION_STRING | The type is azure and defaultCredentials is off. |
adminPassword | RELIC_ADMIN_PASSWORD | Always required. Creates admin on the first start. |
encryptionKey | RELIC_ENCRYPTION_KEY | Always required (openssl rand -base64 32). Keep a copy apart from the backups. |
The chart does not generate adminPassword or encryptionKey, because a
generated value would change on every helm template or Argo CD sync. Its
Secret is kept on uninstall.