Helm Values Reference¶

Full reference for values.yaml. Pass overrides via --set key=value or a values.yaml file.

helm upgrade --install kubemanta oci://registry.kubemanta.com/kubemanta/charts/stable/kubemanta \
  --version CHART_VERSION \
  -n kubemanta-system --create-namespace \
  -f my-values.yaml

Which version?

Replace CHART_VERSION with the release you are installing. The newest is at the top of the Changelog, or read it from the registry once you are logged in:

helm show chart oci://registry.kubemanta.com/kubemanta/charts/stable/kubemanta | grep '^version:'

Always pin it. An unpinned install resolves to whatever stable points at today, which is not necessarily the release you tested against.

Global¶

Value	Default	Description
`global.hostname`	`""`	Public hostname for the UI. When set, triggers Ingress creation + CORS auto-config.
`global.tls`	`true`	Enable HTTPS on the Ingress.
`global.tlsProvider`	`""`	TLS mode: `gcp-managed` · `acm` · `cert-manager` · `manual`. Auto-detected from `ingressClassName` when empty.
`global.tlsSecret`	`""`	Name of an existing TLS Secret (manual mode).
`global.certManagerIssuer`	`letsencrypt-prod`	cert-manager ClusterIssuer name.
`global.installCertManager`	`false`	Install cert-manager (v1.21.2) as a subchart + create a Let's Encrypt ClusterIssuer automatically. Requires `certManagerIssuerEmail`. cert-manager 1.21 is tested on Kubernetes 1.33–1.36; on an older cluster install cert-manager yourself and leave this off. See cert-manager subchart.
`global.certManagerIssuerEmail`	`""`	Email for Let's Encrypt ACME registration (required when `installCertManager=true`).
`global.ingressClassName`	`""`	Ingress class: `gce` · `alb` · `nginx`, or any installed class. Auto-detected TLS mode: `gce`→Google-managed, `gce-internal`→manual (supply `global.tlsSecret`), `alb`→ACM; every other class, nginx and traefik included, takes the cert-manager path.
`global.staticIpName`	`""`	GCP only: name of a reserved global static IP to pin the GCE load balancer.
`global.acmCertificateArn`	`""`	AWS only: ACM certificate ARN for ALB TLS termination.
`global.pullToken`	`""`	Legacy; leave empty. Ignored when `license.key` is set — the licence key is the registry credential for `registry.kubemanta.com`.

License¶

Value	Default	Description
`license.key`	`""`	Per-cluster license key. Stored in a Secret; auto-creates the registry pull secret for `registry.kubemanta.com`.
`license.accountId`	`cf6c7851-...`	Pre-set licensing account ID — do not change.
`license.apiUrl`	`https://api.keygen.sh`	License service URL (override only for a self-hosted licence service).
`license.reportNodeCount`	`true`	Send this cluster's node count — numbers only (current, monthly average and peak), never node names or workload data — with the licence heartbeat. It is never used for a charge or a limit. Set `false` to keep the count in the cluster: it is still shown in Admin → License, and nothing else changes. Set it here rather than with `kubectl set env`, so the choice survives upgrades and GitOps reconciles. `false`, `"false"`, `"0"`, `"no"` and `"off"` all mean off.

RBAC¶

Value	Default	Description
`rbac.allowWrites`	`false`	Grant the agent write verbs: pod restart/delete, deployment scale, namespace create, pod exec — and, with `security.scanning.enabled` (the default), `create`/`delete` on Jobs. Read-only without this. Secret writes never reach KubeManta's own namespace. The browser terminal's ServiceAccount gets the same workload writes, but never in KubeManta's own namespace (see `terminal.clusterCredentials.enabled`).
`rbac.clusterWide`	`true`	`true`: one ClusterRole covers every namespace. `false`: only genuinely cluster-scoped reads stay in the ClusterRole and everything namespaced is granted per namespace over `rbac.tenantNamespaces` (then required). Use `false` on a shared or regulated cluster — it makes the API server, not only KubeManta, enforce the namespace allowlist, including for `kubectl` in the browser terminal. Namespace create is unavailable, and a namespace added later needs a `helm upgrade` to receive its Role.
`rbac.tenantNamespaces`	`[]`	The namespaces granted read when `rbac.clusterWide=false` (required then; ignored otherwise). Not the top-level `tenantNamespaces`, which grants nothing in RBAC.
`rbac.readSecrets`	`true`	Grant the agent `get/list` on Secrets. On by default, matching what an operator with a plain kubeconfig can already read. Secret values are still protected where it matters — every AI/MCP tool result crosses the redaction boundary, and per-tool grants can deny object-reading tools outright. Scope it with `rbac.secretsNamespaces`, or set `false` to withhold it. DELETE is never granted. This is the agent's grant: the browser terminal does not inherit it (see `terminal.clusterCredentials.enabled`).
`rbac.secretsNamespaces`	`[]`	With `rbac.readSecrets=true`, limit Secret read to these namespaces (a Role in each) instead of every namespace. It does not decide what `kubectl` in the browser terminal reads; that is `terminal.secretsNamespaces`. Deprecated, for one more release: the terminal also still reads Secrets in the namespaces listed here, and the install notes name the ones to copy into `terminal.secretsNamespaces`.

Security¶

Value	Default	Description
`security.adminPassword`	`""`	Admin password, seeded at install (the agent sets it on first startup — there is no first-login setup, which is blocked from a public URL by design). Empty = auto-generate a stable one; retrieve it with `kubectl get secret <release>-admin -n <ns> -o jsonpath='{.data.password}' \\| base64 -d`. The seed never overwrites an already-set password (a later recovery or Admin change survives upgrades). Min 8 chars.
~~`security.apiKey`~~	—	Removed. Programmatic access and the MCP server now use per-user API keys, created by each user from the account menu → API keys. There is no shared secret to configure. See Security model.
`security.appArmorProfile`	`runtime/default`	AppArmor profile applied to every container. Relax knob for policy-enforced clusters: set `unconfined` to emit no AppArmor profile (e.g. if a terminal user's tooling needs syscalls the default profile blocks), or `localhost/<name>` to pin a custom loaded profile.
`security.cookieSecure`	`auto`	Session-cookie `Secure` attribute. `auto` computes it from the exposure (true when serving HTTPS via Ingress, false for port-forward / HTTP-only). Set an explicit `true`/`false` to override — required (`true`) when you serve HTTPS through your own edge with no hostname set.
`security.aiRateLimitPerMin`	`10`	Per-session AI request rate limit.
`security.discoveryRateLimitPerMin`	`300`	K8s API discovery rate limit.
`security.requireApproval`	`false`	Force approval for all AI write operations (overrides agent mode).
`security.viewerPassword`	`""`	Optional viewer password → read-only "viewer" role (bcrypt hash or plaintext). Empty = single-admin mode.
`security.encryptionAtRest`	`true`	Encrypt cloud/Helm/integration/SSO credentials in SQLite with AES-256-GCM. A random key is generated on first install and preserved across upgrades (`helm.sh/resource-policy: keep`).
`security.encryptionKey`	`""`	BYO encryption key (raw 16/24/32 bytes or base64). Empty = auto-generated.
`security.blockImds`	`true`	NetworkPolicy that blocks access to the cloud Instance Metadata Service (169.254.169.254) from all pods in `kubemanta-system`. Not rendered when `security.airgap.enabled=true`: the air-gap egress policy already blocks the metadata address, and this policy's allow-everything-else rule would cancel it.
`security.cilium.apiServerPolicy`	`auto`	Cilium only. Cilium cannot match the Kubernetes API server with a plain NetworkPolicy, so when any of the chart's egress policies is rendered (`security.blockImds`, air-gap mode, or the Expert Mode egress allowlist) the chart also renders a CiliumNetworkPolicy, `<release>-apiserver`, that allows the API server on `security.cilium.apiServerPorts` and nothing else. `auto` renders it when the cluster serves the CiliumNetworkPolicy API. Set `true` when you render with `helm template` or a GitOps tool that cannot see the cluster's APIs, or `false` to manage that policy yourself. Without it the agent cannot reach the API server on Cilium and never becomes ready.
`security.cilium.apiServerPorts`	`[443, 6443]`	The ports the API server listens on: 443 for the `kubernetes` Service, 6443 for kubeadm, k3s and RKE2 endpoints. Add your control plane's port if it is different.
`security.trustedProxyCidrs`	`""`	Comma-separated CIDRs of proxies/LBs allowed to set `X-Forwarded-For`. Empty = trust nothing (always use the socket peer). Required in service-only mode.
`security.sessionIdleTimeout`	`28800`	Sliding session idle-timeout in seconds (every authenticated request extends it). `0` disables the idle check and makes sessions non-expiring (sign-in then issues a token with no expiry); otherwise the absolute session lifetime, `security.sessionTtl`, is the hard ceiling. Runtime-editable in Admin → Access Control.
`security.sessionTtl`	`604800`	Absolute session lifetime in seconds (7 days), however active the session is. Not applied when `sessionIdleTimeout` is `0`.

Hardened by default (OPA Gatekeeper / restricted clusters)

Every container ships non-root with a read-only root filesystem, dropped capabilities, RuntimeDefault seccomp, an AppArmor profile, projected ServiceAccount tokens, and CPU + memory limits — no profile flag to flip. Every pod meets the Kubernetes restricted Pod Security profile; label the namespace to have the API server enforce it. On a policy-enforced cluster you must allowlist the KubeManta images (registry.kubemanta.com/kubemanta/*, the python:3.12-alpine preflight image, and aquasec/trivy:* for self-scan). security.appArmorProfile and terminal.readOnlyRootFilesystem are the two relax knobs. See Restricted / policy-enforced clusters.

Container scanning¶

Value	Default	Description
`security.scanning.enabled`	`true`	Read-only: grants the reader role `get/list` on CRDs (to detect trivy-operator) + `get/list/watch` on trivy-operator report CRDs, and lets an admin trigger a scan. On by default so the Security tab works out of the box — reading reports and detecting the operator never writes to your cluster. Set `false` to turn scanning off entirely: the reader role isn't broadened and `POST /security/scan` is refused with a 403. Running the built-in self-scan is a separate Pro feature that also requires `expertMode.enabled=true`.
`security.scanning.mode`	`auto`	Scan-source seed: `auto` · `operator` (BYO, hard-disables self-scan) · `self`. Overridden at runtime by the admin `scanner_source` setting.
`security.scanning.retentionDays`	`90`	How long scan history is kept — `scan_runs`, `vuln_findings` and `posture_findings`, pruned by age on the insert path.
`security.scanning.selfScan.image`	`aquasec/trivy:0.74.0`	Trivy image for the self-scan Job.
`security.scanning.selfScan.cache.enabled`	`true`	Reuse a PVC for Trivy's CVE database between scans. Off, every scan downloads the database again (about 100 MB).
`security.scanning.selfScan.cache.size`	`2Gi`	Size of that cache PVC.
`security.scanning.selfScan.maxConcurrentScans`	`1`	How many built-in scans may run at the same time across the whole install. At `1`, a second scan (another admin's, another namespace's, or a scheduled one) is refused with the details of the scan already running, and a scheduled scan waits its turn instead of being skipped. Each scan pulls every image of its namespace and the CVE database, so raise it only on a cluster sized for several at once. Always `1` while `cache.enabled` is on (the default), because the cache volume can be mounted by one scan pod at a time: to run scans in parallel, also set `cache.enabled=false`.
`security.scanning.selfScan.resources`	`250m`/`1Gi` req, `1`/`8Gi` limit	Self-scan Job resources.

selfScan.waitSecs was removed

POST /security/scan no longer waits for the scan. It launches the Job and returns {"status": "running", "job_name": ...} immediately; results are collected in the background and by GET /security/scan/{id}. Setting selfScan.waitSecs has no effect and can be dropped from your values.

Self-scan additionally requires expertMode.enabled=true (the Job is created via expert-exec). See Container Scanning.

Metrics¶

Value	Default	Description
`metrics.kubeletScrape.enabled`	`true`	Pod network bandwidth, scraped from each kubelet's built-in cadvisor. metrics-server exposes no network metrics at all, so cadvisor — already running inside every kubelet, nothing to deploy — is the only in-cluster source. On by default, because the grant it needs is narrow: the agent dials each kubelet directly and the kubelet authorizes that against `nodes/metrics`, which covers the metrics endpoints and nothing else. CPU/memory always come from metrics-server and are unaffected either way; only bandwidth stops when it's off. Exposed to the agent as `METRICS_KUBELET_SCRAPE`.
`metrics.kubeletScrape.viaProxy`	`false`	Fallback for clusters that firewall port 10250 from pods: routes the scrape through the API server instead. This is the only setting that puts `nodes/proxy` in the ClusterRole.

nodes/metrics is the kubelet's metrics endpoints and nothing else — no exec, no logs, no arbitrary proxying — which is why the scrape is on by default. nodes/proxy is the broad verb that reaches every kubelet handler, and it is granted only by metrics.kubeletScrape.viaProxy=true. Prefer your own Prometheus instead? Set metrics.kubeletScrape.enabled=false and point the metrics source at prometheus (PUT /metrics/source) — Admin → Observability → Generate scrape config emits the RBAC + prometheus.yml your Prometheus needs. See Metrics.

Agent¶

Value	Default	Description
`agent.prometheusUrl`	`""`	Prometheus API URL (e.g. `http://prometheus-server.monitoring.svc:9090`). Enables the `query_metrics` PromQL tool. Seed only — a Prometheus source saved in Admin → Observability takes precedence at runtime.
`agent.alertInvestigation`	`false`	Seed for Admin → AI → Alert diagnosis (Pro): a read-only AI diagnosis follows each alert on the same integrations as the alert. Once an admin saves that screen, the saved setting wins.
`agent.alertMinSeverity`	`critical`	Minimum severity that gets an AI diagnosis: `critical` · `high` · `medium` · `low`. Seed only, like `agent.alertInvestigation`.
`agent.agentApiKey`	`""`	Anthropic API key for autonomous alert investigations. Stored in a Secret.
`agent.anthropicApiKey`	`""`	Server-side default Anthropic key for the agent's AI loop (stored in a Secret). Never exposed to PTY terminal sessions — the terminal is BYO-LLM (`ANTHROPIC_API_KEY` is stripped from the PTY env; Claude Code authenticates via its own `claude` OAuth login).
`agent.blastRadiusLimit`	`5`	Max write operations per agent session. Sessions that hit this limit block further write tools.
`agent.circuitBreakerThreshold`	`3`	Number of consecutive write-tool failures before the circuit breaker trips.
`agent.circuitBreakerResetSecs`	`300`	Seconds before the circuit breaker auto-resets.

Expert Mode¶

Value	Default	Description
`expertMode.enabled`	`false`	Provision the separate `kubemanta-expert-exec` pod holding the `cluster-admin` token (used for Helm and agent write ops; the browser terminal never uses it). Default off — the agent pod never mounts this token.
`expertMode.execSecret`	`""`	Agent ↔ expert-exec shared token. Empty = generated once and kept across `helm upgrade`. Set it for `helm template`-based GitOps (Argo CD).
`expertMode.image` / `expertMode.tag`	`""`	Override image/tag for the expert-exec pod (defaults to `image.repository`/`tag`).
`expertMode.digest`	`""`	Pin the expert-exec image by digest (`sha256:<64 hex>`); replaces the tag. Empty = inherit `image.digest`, so pinning the agent pins this pod too.
`expertMode.resources`	`1`/`256Mi` limit, `100m`/`128Mi` req	expert-exec pod resources.
`expertMode.networkPolicy.egress.enabled`	`false`	Limit where the expert-exec pod can connect to: the Kubernetes API server, cluster DNS, HTTPS to chart repositories and registries outside your network, and whatever you list in `extraCIDRs`. Pod and Service addresses, private (RFC1918 / CGNAT) ranges and cloud metadata are refused. Off by default: the pod then accepts connections only from the agent, but can itself connect anywhere the rest of KubeManta can. Needs a CNI that enforces egress NetworkPolicy.
`expertMode.networkPolicy.egress.extraCIDRs`	`[]`	Further destinations: an internal chart repository or registry, and your HTTP proxy if `security.proxy` is set (Helm then connects to the proxy, not the repository). A plain CIDR allows every port; `{cidr: 10.0.8.20/32, ports: [3128]}` limits it. Missing either breaks Helm installs and upgrades.
`expertMode.networkPolicy.egress.apiServer.cidrs`	`[]`	The API server's endpoint IPs and the `kubernetes` Service ClusterIP, as CIDRs. Empty = looked up at install/upgrade. Set it when you render with `helm template` or a GitOps tool (the render fails and says so otherwise), and on a managed control plane whose endpoint IPs can change (EKS), set the control-plane subnet.
`expertMode.networkPolicy.egress.internet.enabled`	`true`	HTTPS (port 443) to destinations outside the cluster and your internal network, for public chart repositories and OCI registries. Set `false` when every chart comes from `extraCIDRs`. Never rendered in air-gap mode.

The egress allowlist is opt-in because each destination it does not know about breaks Helm operations. Every expertMode.networkPolicy.egress.* value, including the DNS selector and the extra ranges it refuses, is documented in the chart's values.yaml.

Terminal¶

Value	Default	Description
`terminal.image` / `terminal.tag`	`""`	Override image/tag for the terminal sidecar (defaults to agent image).
`terminal.digest`	`""`	Pin the terminal sidecar by digest (`sha256:<64 hex>`); replaces the tag. Empty = inherit `image.digest`, so pinning the agent pins the sidecar too.
`terminal.clusterCredentials.enabled`	`true`	Give the browser terminal's shell a cluster credential, so `kubectl`, `helm` and `k9s` work there with no setup. The shell runs as its own ServiceAccount, `<release>-terminal`, never KubeManta's: KubeManta's read permissions, and write verbs with `rbac.allowWrites`, but no Secrets in KubeManta's own namespace at any setting, and Secrets elsewhere only in namespaces listed in `terminal.secretsNamespaces`. On a default install `kubectl get secret` in the shell is refused, while the product's own Secret views keep working. With `rbac.allowWrites`, the shell can change nothing in KubeManta's own namespace: its Role there is read-only with `rbac.clusterWide=false`, and on a cluster-wide install the chart adds a ValidatingAdmissionPolicy, `<release>-terminal-guard` (Kubernetes 1.30+), that refuses its every change there, `kubectl exec` included. On a cluster without that API the shell's cluster-wide writes are withheld; GitOps tools that render with `helm template` must pass the cluster's API versions (or `--api-versions admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy`). KubeManta issues the account a one-hour token and renews it. Set `false` when Kubernetes RBAC has to be the boundary for terminal users: no token reaches the terminal container, the account and its roles are not created, no kubeconfig is written, and the in-cluster environment variables are removed. An unrecognised value reads as off.
`terminal.secretsNamespaces`	`[]`	Namespaces where `kubectl get secret` works in the browser terminal (get, list, watch; never writes). Independent of `rbac.secretsNamespaces`: it never narrows what KubeManta itself reads. The install fails if the list names KubeManta's own namespace, or a namespace where KubeManta may not read Secrets (`rbac.readSecrets=false`, or outside `rbac.secretsNamespaces` / scoped `rbac.tenantNamespaces`), because KubeManta issues the shell's credential. Ignored when `terminal.clusterCredentials.enabled=false`.
`terminal.readOnlyRootFilesystem`	`true`	Read-only root filesystem on the terminal sidecar (hardened). Relax knob for the one container where users run arbitrary commands: set `false` if a user's tooling insists on writing outside `$HOME` and `/tmp` (both stay writable regardless). Every other container's root filesystem is read-only unconditionally.
`terminal.idleTimeoutSecs`	`0`	Terminate a terminal session with no PTY I/O for this many seconds and reclaim its slot/RAM. `0` (the default) never reaps an idle terminal, because watching `k9s` or tailing logs produces no input — so an input-based timeout kills the session being watched most attentively. Set a positive number to enable the reaper.
`terminal.resources.limits.cpu`	`2`	CPU limit for the terminal sidecar.
`terminal.resources.limits.memory`	`8Gi`	Memory limit for the terminal sidecar — the container limit is what actually bounds a terminal's memory. Sized so an SRE can run memory-hungry tooling without thinking about it.

Nothing configures how KubeManta authenticates to the terminal. The agent generates the key that signs each terminal session in memory when it starts, and gives the terminal only the public half; no Secret, file or environment variable holds it. Restarting the agent rotates it.

Upgrading from 1.3.1 or earlier

terminal.proxySecret, terminal.signingKey and terminal.signingPubkey are no longer read, and km-terminal-keygen is retired. If your values still set them, the install notes say so: remove them, then delete the Secret earlier releases created, which Helm keeps and nothing uses any more: kubectl -n kubemanta-system delete secret kubemanta-terminal (<release>-terminal). Upgrade the chart and the agent image together: a newer chart with an older agent image leaves kubectl in the terminal without a credential, and a newer agent image under an older chart reports the terminal as not configured.

Enterprise SSO¶

Value	Default	Description
`sso.publicUrl`	`""`	Optional seed for the SSO wizard's `external_base_url` (ACS/EntityID base). Only pre-fills the wizard; the admin-entered config is authoritative. See Enterprise SSO.

Persistence¶

Value	Default	Description
`persistence.enabled`	`true`	Create a PVC for agent data (SQLite DB, terminal home, Helm cache).
`persistence.size`	`1Gi`	PVC size.
`persistence.storageClass`	`""`	StorageClass name. Empty = cluster default.
`persistence.mountPath`	`/data/kubemanta`	Mount path inside the agent container.

A+ SQLite → S3 replication (Litestream)¶

Optional continuous replication of the SQLite DB to object storage, so the pod survives node/PVC loss. Default off — a default install is unchanged. See Disaster Recovery.

Value	Default	Description
`persistence.replication.enabled`	`false`	Enable Litestream WAL replication. With `persistence.enabled=false` the DB dir becomes an emptyDir, a restore init-container rebuilds the DB on boot, and a sidecar ships the WAL continuously.
`persistence.replication.bucket`	`""`	Required when enabled. Target bucket.
`persistence.replication.path`	`kubemanta-db`	Key prefix within the bucket.
`persistence.replication.region`	`us-east-1`	Bucket region.
`persistence.replication.endpoint`	`""`	Set for MinIO / other S3-compatible stores.
`persistence.replication.forcePathStyle`	`false`	Set `true` for MinIO / path-style endpoints.
`persistence.replication.credentialsSecret`	`""`	Secret with `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`. Empty = use IRSA / workload identity.
`persistence.replication.image`	`litestream/litestream:0.3.13`	Litestream image.

Warning

Run an attended kill-pod failover test against your real object store once, before you depend on this. Never host the bucket in the cluster you are observing.

Alerting¶

Value	Default	Description
`alerting.webhookUrl`	`""`	Webhook URL for alert delivery.
`alerting.slackWebhookUrl`	`""`	Slack incoming webhook URL.
`alerting.pagerdutyRoutingKey`	`""`	PagerDuty Events API v2 routing key.
`alerting.watchIntervalSecs`	`60`	Alert rule evaluation interval.
`alerting.dedupeWindowSecs`	`300`	Cooldown window per rule+resource to suppress repeated firings.

Audit¶

Value	Default	Description
`audit.webhookUrl`	`""`	Forward every audited request to an HTTP collector (SIEM / Splunk). Disabled when empty.
`audit.webhookToken`	`""`	Optional Bearer token for the audit webhook. Stored in the agent Secret.
`audit.worm.enabled`	`false`	Tamper-evident off-box WORM export: write every audit row as one object into an Object-Lock S3 bucket (closes the trim-newest-rows gap the in-DB hash-chain can't). See Activity & Audit.
`audit.worm.bucket`	`""`	Target bucket (Object Lock + default retention required).
`audit.worm.prefix`	`audit`	Key prefix.
`audit.worm.region`	`us-east-1`	Bucket region.
`audit.worm.endpoint`	`""`	Set for MinIO / S3-compatible; empty = real AWS S3.
`audit.worm.credentialsSecret`	`""`	Secret holding S3 credentials. Empty = IRSA / workload identity.

The in-pod audit_log is always hash-chained regardless of this block — verify it with GET /audit/verify-chain.

Cloud provider¶

Value	Default	Description
`aws.region`	`""`	AWS region override (auto-discovered from `topology.kubernetes.io/region` node label when empty).
`gcp.region`	`""`	GCP region override (auto-discovered).
`azure.location`	`""`	Azure location override (auto-discovered).

Namespace control¶

Value	Default	Description
`tenantNamespaces`	`[]`	The namespaces KubeManta works in: its starting namespace allowlist (an admin can change it later in the product). Empty = auto-discover all non-system namespaces. This is an application-layer list, not an RBAC boundary: with `rbac.clusterWide=true` (the default) the ServiceAccount can still read every namespace, and `kubectl` in the browser terminal is not bound by it. For a boundary the API server enforces, use `rbac.clusterWide=false` with `rbac.tenantNamespaces`. It grants no write permission; restart, scale and delete need `rbac.allowWrites=true`. (Up to 1.3.1 it also granted pod delete and deployment patch in each listed namespace without `rbac.allowWrites`; it is read-only now.)
`blocklist`	see values.yaml	Namespaces always hidden. Includes `kube-system`, `kube-public`, `kubemanta-system`, `istio-system`, `cert-manager`, `argo`, `argocd`, and others.

Image and resources¶

Value	Default	Description
`replicaCount`	`1`	Agent replicas. Must be `1`: the agent owns a ReadWriteOnce volume and an embedded database, and the install fails for any higher value. The UI scales separately (`ui.replicaCount`).
`image.repository`	`registry.kubemanta.com/kubemanta/kubemanta-agent`	Agent image.
`image.tag`	`""`	Agent image tag. Empty means "use the chart's `appVersion`" — so the version you run is the version the chart you installed was built for. Set this (or better, `image.digest`) to pin explicitly.
`image.pullPolicy`	`Always`	Image pull policy.
`resources.requests.cpu`	`250m`	Agent CPU request (for scheduling).
`resources.requests.memory`	`1Gi`	Agent memory request.
`resources.limits.cpu`	`2`	Agent CPU limit: generous, so the container satisfies "limits required" admission policies without throttling normal work.
`resources.limits.memory`	`2Gi`	Agent memory limit, deliberately above the 1Gi request so a burst of large security-findings reads on an image-heavy cluster fits. Raise it (e.g. `4Gi`) for a very large or CVE-heavy estate. Use `priorityClassName` for eviction protection.
`ui.image.repository`	`registry.kubemanta.com/kubemanta/kubemanta-ui`	UI image.
`ui.image.tag`	`""`	UI image tag. Empty means "use the chart's `appVersion`", as with `image.tag` above.
`ui.resources.limits.cpu`	`1`	UI CPU limit.
`ui.resources.limits.memory`	`256Mi`	UI memory limit.

Sizing

The defaults (1Gi request, 2Gi limit) suit most clusters. All-cluster list calls are paginated, so memory does not scale with cluster size; for a very large or CVE-heavy estate raise resources.limits.memory (e.g. 4Gi).

Scheduling & availability¶

Value	Default	Description
`priorityClassName`	`""`	Makes the agent harder to evict under node pressure. For production set an existing high-priority class (e.g. `system-cluster-critical`). Pair with Guaranteed/reserved memory.
`updateStrategy`	`{}`	Empty = auto: `Recreate` while the agent holds a ReadWriteOnce PVC (a rolling update would deadlock on Multi-Attach), `RollingUpdate` once persistence is off. Override only if your storage is ReadWriteMany.
`podDisruptionBudget.enabled`	`false`	Off by default: with the agent's single replica a PDB cannot provide availability, and `maxUnavailable: 0` will block node drains. Enable it only to deliberately make the replica un-evictable by the autoscaler.
`podDisruptionBudget.maxUnavailable`	`0`	Used when the PDB is enabled.
`podDisruptionBudget.minAvailable`	`""`	Set (e.g. `1`) to use `minAvailable` instead of `maxUnavailable`.

Diagnostics¶

Value	Default	Description
`diagnostics.loopDebug`	`true`	Event-loop diagnostics in the agent. With it on, the agent's `event loop stalled … blocked by:` warning names the step that held the loop (see Troubleshooting). Costs a few percent of CPU. Set `false` to turn it off from your values file, so the choice survives upgrades and GitOps reconciles; the warning then says the blocker is unknown and why. `false`, `"false"`, `"0"`, `"no"` and `"off"` all mean off.

cert-manager subchart¶

Active only with global.installCertManager=true (off by default). Values under cert-manager: are passed straight to the upstream cert-manager chart, v1.21.2.

Value	Default	Description
`cert-manager.crds.enabled`	`true`	Install cert-manager's CRDs with the subchart.
`cert-manager.crds.keep`	`true`	Keep the CRDs, and so your Certificates, when the release is uninstalled.

Upgrading an install that enabled the subchart

Up to 1.3.1 the subchart was cert-manager v1.15.0. cert-manager recommends upgrading one minor version at a time, and since v1.18 a Certificate without privateKey.rotationPolicy gets a new private key on every renewal. If you set cert-manager.installCRDs yourself, replace it with cert-manager.crds.enabled=true: the two are refused together. If you never enabled the subchart, nothing changes.

In an air-gapped install the subchart's images are mirrored with everything else — see Air-gapped install.

Exposure¶

Value	Default	Description
`ingress.enabled`	`true`	`false` = service-only mode: render only the agent + UI Services (no Ingress/BackendConfig/ManagedCertificate) so you can front KubeManta with your own edge/LB/Gateway/WAF. See Access Control.
`tlsSidecar.enabled`	`false`	Terminate HTTPS inside the UI pod, for a LoadBalancer/NodePort UI Service with no ingress controller. An alternative to `ingress.enabled` — the install fails if both are on. The UI Service then serves 443 only. Needs a `kubernetes.io/tls` Secret. See Exposure → Mode 8. Not yet verified against a live cloud load balancer.
`tlsSidecar.secretName`	`""`	TLS Secret to serve. Empty = `global.tlsSecret`, else the name the chart Ingress uses (`kubemanta-tls` for a release named `kubemanta`).
`tlsSidecar.httpRedirect`	`false`	Also expose port 80 and answer it with a 308 redirect to `https://`.
`tlsSidecar.servicePort`	`443`	HTTPS port on the UI Service.
`tlsSidecar.maxconn`	`1024`	Connections the proxy holds at once (each open terminal is one).
`tlsSidecar.image`	pinned haproxy version@digest	Point at your mirror in an air-gapped install; keep the digest.
`ui.service.externalTrafficPolicy`	`""`	`Local` preserves the real client IP for NodePort/LoadBalancer (the default `Cluster` rewrites the source to a node address). Required for real client IPs with `tlsSidecar`.
`service.type`	`ClusterIP`	Agent Service type: `ClusterIP` · `NodePort` · `LoadBalancer`.
`service.port`	`8080`	Agent Service port.
`service.annotations`	`{}`	Pass-through annotations (e.g. internal-LB).
`ui.service.type`	`ClusterIP`	UI Service type.
`ui.service.nodePort`	`""`	Pin the NodePort (30000–32767) when `type=NodePort`.
`ui.service.annotations`	`{}`	Pass-through annotations for the UI Service.

Service-only mode requires security.trustedProxyCidrs

When you front KubeManta yourself, you must set security.trustedProxyCidrs to your edge's egress CIDR(s) — otherwise every request is attributed to the proxy IP, breaking audit attribution and applying your allowlist/denylist to the edge rather than to the real client. The terminal WebSocket path /api/agent/terminal/ws must reach the agent Service directly; all other traffic goes to the UI Service. With tlsSidecar.enabled, the proxy that sees the client runs inside the UI pod, so set trustedProxyCidrs to your pod CIDR.