Hyvop

Get 40% offSee the offer

0.9.0 betaDocumentation of the Community Edition, copied on .
On this page

Configuration reference#

<!-- Generated by scripts/config-reference.cjs from hyvop/values.schema.json and hyvop/values.yaml. Do not edit by hand: run `node scripts/config-reference.cjs`. -->

Every value the chart reads. A key that is not in this list, or a value of the wrong type, is refused by helm lint, template, install and upgrade, with the path in the message.

Give values with --set key=value, or in a file with -f my-values.yaml. The schema lets any key through under core.env, but the chart reads only the ones listed in the core table; another key there has no effect. Every key under the env of an ingestor (ingestors.<cloud>.env) is passed to that ingestor as an environment variable, listed or not.

"Default" is the value in hyvop/values.yaml. "not set" means the file gives none: the chart then does what the description says, or, where there is no description, nothing. A few settings (secrets, the address of the install) are made or worked out by the chart when left empty; the description says so.

global#

Value Type Default Meaning
global.edition string: one of community, enterprise community Edition: community or enterprise (license required for enterprise)
global.storageClass string "" Storage class for the data volumes of PostgreSQL and ClickHouse. Empty: the cluster's default class.
global.imageRegistry string "" When set, every image is pulled from this registry instead of the one in its reference. For a mirror or an air-gapped install.
global.imagePullSecrets array [] Names of the pull secrets every pod uses, for a private registry. They must exist in the namespace.
global.imagePullPolicy string: one of Always, IfNotPresent, Never IfNotPresent Pull policy for every container. Use Never only with images loaded into the node by hand (kind, minikube).

license#

Value Type Default Meaning
license.key string "" Enterprise license key - contact sales@hyvop.com

core#

Value Type Default Meaning
core.enabled boolean true
core.serviceAccount.annotations object not set
core.image string or object ghcr.io/hyvop-inc/hyvop-core An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.
core.existingSecret string "" A Secret of your own holding jwt-secret-key, jwt-previous-secret-keys, setup-code and ai-key (see README, Secrets).
core.ingestorExistingSecret string "" A Secret of your own holding shared-secret, the secret core proves itself to the ingestors with.
core.mcpDeployer.enabled boolean false Core creates MCP servers itself at run time, and is given a Role on Secrets, Services, ConfigMaps and Deployments of the namespace for it. Off as shipped: the chart deploys the GitHub server.
core.setupCode string "" The first person to open a new install creates its administrator account. Give a code here (a long random value: openssl rand -hex 24) and that screen asks for it, so that only whoever installed Hyvop can claim it. Empty: no code is asked. It is not used once an account exists.
core.approvals.requests string: one of "", send, show-only, by-edition by-edition send: the people whose turn it is are mailed, reminded and escalated, in every edition. show-only: nothing is mailed, reminded or escalated; the plan shows who would be asked, and answers on the screen still count. by-edition (the default of the chart): send when the licence allows remediation beyond preview, which is Enterprise, show only otherwise, which is Community. Empty, absent or misspelt: core's default, which is by-edition.
core.approvals.order string: one of "", chain, any "" chain: approvers answer one stage after the other, in the order the plan's chain gives; an answer out of turn is refused (HTTP 409). any: every required approver may answer at once. Empty: core's default (chain).
core.approvals.stepTimeout string or integer, pattern ^$|^[0-9]+(ms|s|m|h|d)?$ "" How long a step may wait for its person before it is escalated once, for example 5d; 0 never escalates. Empty: core's default (5d).
core.approvals.escalationEmail string "" Who is told when a step is escalated and the chain names nobody further. Empty: the organisation's administrators.
core.approvals.chainCheckMs integer or string (0..), pattern ^[0-9]*$ "" How often core looks for overdue steps, in milliseconds. Empty: core's default (900000).
core.mail.host string "" The relay's host name. Empty: no relay, no e-mail. The relay can also be set in the settings screen.
core.mail.port integer (1..65535) 587 The relay's port (587 with STARTTLS, 465, 25).
core.mail.username string "" The account at the relay. Empty: none.
core.mail.password string "" The account's password, kept in the Secret as mail-password. With core.existingSecret, put mail-password there yourself and leave this empty.
core.mail.from string "" The sender address. Most relays refuse an address they do not host: set it.
core.mail.smtpAuth boolean or string: one of true, false, "" "" Whether to sign in at the relay. Empty: core's own default (true).
core.mail.starttls boolean or string: one of true, false, "" "" Whether to upgrade the connection with STARTTLS. Empty: core's own default (true).
core.mail.approvals.onPlan boolean or string: one of true, false, "" "" Mail the approvers when a plan is made (core's default: true).
core.mail.approvals.linkValidity string, pattern ^$|^[0-9]+(ms|s|m|h|d)$ "" How long a mailed link works, for example 7d (core's default: 7d).
core.mail.approvals.reminderInterval string or integer, pattern ^$|^[0-9]+(ms|s|m|h|d)?$ "" How often an approver who has not answered is reminded, for example 3d; 0 sends no reminder (core's default: 3d).
core.mail.approvals.maxReminders integer or string (0..), pattern ^[0-9]*$ "" How many reminders at most (core's default: 2).
core.service.port integer (1..65535) 8081
core.jobrunr.enabled boolean false The job dashboard; off by default (it has no login of its own).
core.jobrunr.port integer (1..65535) 8082
core.env.AUTH_MODE string: one of DEFAULT, OIDC DEFAULT DEFAULT: passwords kept by Hyvop. OIDC: an identity provider that speaks OpenID Connect.
core.env.OIDC_ISSUER_URI string, pattern ^$|^https?:// "" The provider's issuer, whose discovery document core reads.
core.env.OIDC_CLIENT_ID string "" The client registered for Hyvop there, a confidential one, with the redirect address <the address of Hyvop>/api/auth/oidc/callback/oidc. The secret is kept in the Secret hyvop-core-secrets (oidc-client-secret); with core.existingSecret, put it there yourself.
core.env.OIDC_CLIENT_SECRET string ""
core.env.OIDC_ROLE_CLAIM string groups The claim of the ID token that says what a person is, and the values that make an administrator and a user, comma-separated. A dotted name reads inside an object (Keycloak: realm_access.roles). Both lists empty: the claim is not read, the first person to sign in is the administrator, the others get OIDC_DEFAULT_ROLE and an administrator changes roles in Hyvop.
core.env.OIDC_ADMIN_VALUES string ""
core.env.OIDC_USER_VALUES string ""
core.env.OIDC_DEFAULT_ROLE string: one of VIEWER, USER, ADMIN VIEWER
core.env.INTERNAL_PROXIES string "" Which addresses core takes for Hyvop's own web servers (the ingress, the UI's) when it works out the address a request came from: a regular expression. Empty: every private address. See "The address recorded with an approval" in the README before relying on that address.
core.env.FRONTEND_URL string ""
core.env.JWT_SECRET_KEY string "" The secret sessions are signed with. Leave empty: the chart makes a random one on the first install and keeps it across upgrades. To set your own, use a private string of 32 characters or more (openssl rand -base64 48). core refuses a value that has been published.
core.env.JWT_PREVIOUS_SECRET_KEYS string "" When you replace JWT_SECRET_KEY, put the old value here (comma-separated if several) until the sessions signed with it have expired, so that nobody is signed out by the change.
core.env.HYVOP_DATA_KEY string, pattern ^$|^.{32,}$ "" The key the secrets the database holds are encrypted under: 32 characters or more, or empty for one the chart makes and keeps.
core.env.HYVOP_PREVIOUS_DATA_KEYS string "" Data keys that were current before, comma-separated, until core has rewritten everything under the current one.
core.env.INGESTOR_SHARED_SECRET string "" What core sends to an ingestor to prove it is core. Leave empty: the chart makes a random secret on the first install and keeps it across upgrades.
core.env.OPENAI_API_KEY string "" The key of the model provider named in AI_PROVIDER below. The chart ships no key: give yours here, with --set, in a values file of your own, or as ai-key in a Secret of your own (core.existingSecret).
core.env.AI_PROVIDER string: one of "", openai, openai-compatible "" AI features are off until a provider is chosen: "openai" (the OpenAI API) or "openai-compatible" (Azure OpenAI, OpenRouter, Ollama, vLLM...: give OPENAI_BASE_URL and AI_OPENAI_MODEL too).
core.env.OPENAI_BASE_URL string "" The endpoint, with its version path: core adds only /chat/completions to it. Left empty, "openai" uses https://api.openai.com/v1; "openai-compatible" needs it (OpenRouter: https://openrouter.ai/api/v1, Ollama: http://ollama:11434/v1).
core.env.AI_OPENAI_MODEL string "" The model id: left empty, "openai" uses gpt-4o-mini; "openai-compatible" needs it.
core.env.AI_TIMEOUT string or integer, pattern ^$|^[0-9]+(ms|s|m|h)?$ "" How long one model call may take, for example 120s; 0 is no limit. Empty: core's default (120s). A call that takes longer answers HTTP 504.
core.env.AI_MAX_OUTPUT_TOKENS integer or string (0..), pattern ^[0-9]*$ "" The longest answer asked of the model, in tokens, for a call that sets no limit; 0 is none. Empty: core's default (4096).
core.env.AI_BUDGET_TOKENS_PER_MONTH integer or string (0..), pattern ^[0-9]*$ "" Tokens an organisation may use per month; past it, AI calls are refused (HTTP 429). 0 is no limit. An organisation's own budget, set by an administrator in the screen, wins. Empty: core's default (0).
core.env.AI_BUDGET_TOKENS_PER_RUN integer or string (0..), pattern ^[0-9]*$ "" Tokens one run (a knowledge-graph build, an investigation) may use; it stops there and says why. 0 is no limit. Empty: core's default (0).
core.env.AI_PRICING_INPUT_USD_PER_MILLION number or string, pattern ^[0-9.]*$ "" What the model costs per million input tokens, in US dollars, for the estimated cost on the usage page. 0 shows the cost as 0. Empty: core's default (0).
core.env.AI_PRICING_OUTPUT_USD_PER_MILLION number or string, pattern ^[0-9.]*$ "" What the model costs per million output tokens, in US dollars. Empty: core's default (0).
core.env.OWNERSHIP_AUTO_VALIDATION string: one of "", off, two-sources "" off: no resource is validated without a person's answer. two-sources: the validation agent accepts an owner that two independent sources name. Empty: core's default (off).
core.env.OWNERSHIP_RECERTIFY_AFTER_DAYS integer or string (0..), pattern ^[0-9]*$ "" After this many days an owner's confirmation is asked for again. Empty: core's default (180).
core.env.INVESTIGATOR_SUMMARY_JUDGE boolean or string: one of true, false, "" "" Whether a small model checks that the Investigator's sentence is supported by what the code read. Empty: core's default (true).
core.env.DATALAKE_MIGRATION_LOCK_WAIT string or integer, pattern ^$|^[0-9]+(ms|s|m|h)?$ "" How long a core pod waits for another to finish the data-lake migrations before it gives up, for example 10m. Empty: core's default (5m).
core.env.MCP_READY_TIMEOUT_SECONDS integer or string (0..), pattern ^[0-9]*$ "" How long core waits for the GitHub MCP server to answer before a knowledge-graph build fails, in seconds. Empty: core's default (180).
core.env.PIPELINE_BATCH_SIZE integer or string (0..), pattern ^[0-9]*$ "" Events an ownership stage takes per pass. Empty: core's default (20).
core.env.PIPELINE_CONCURRENCY integer or string (0..), pattern ^[0-9]*$ "" Events of a stage worked at once. Empty: core's default (4).
core.env.PIPELINE_RECLAIM_IDLE_MS integer or string (0..), pattern ^[0-9]*$ "" How long an event left unacknowledged waits before it is claimed again, in milliseconds. Empty: core's default (30000).
core.env.INVESTIGATOR_BEAT_SECONDS integer or string (0..), pattern ^[0-9]*$ "" How long one Investigator beat keeps taking batches off the queues, in seconds. Empty: core's default (25).
core.env.INVESTIGATOR_MODEL_FOR_DECLARED_TEAMS boolean or string: one of true, false, "" "" Whether a workload that declares only a team (a team tag or a manifest, no person) is still investigated by the model, which is asked for a person. Each such workload costs one investigation, two model calls. false: a declared team ends the investigation, no model call, and the resource gets no suggestion. Empty: core's default (true).
core.env.INVESTIGATOR_MAX_CONCURRENT_INVESTIGATIONS integer or string (0..), pattern ^[0-9]*$ "" How many resources the Investigator investigates at once. Empty: core's default (3).
core.env.AI_ORGANISATION_MODEL_MAX_RETRIES integer or string (0..), pattern ^[0-9]*$ "" Retries the client makes on a call to the model an organisation brought from the settings screen. The install model of AI_PROVIDER stays the default for any organisation that brought none. Empty: core's default (1).
core.env.REMEDIATION_AGENT_MODEL boolean or string: one of true, false, "" "" Whether the remediation agent asks a model for a draft of the plan when one is configured. The rules in code decide either way; false writes plans by the rules alone. Empty: core's default (true).
core.env.KNOWLEDGE_ESTIMATE_SECONDS_PER_CALL number or string, pattern ^[0-9.]*$ "" The seconds one model call is estimated to take, for the time shown before a knowledge-graph build starts. Only an estimate. Empty: core's default (1.0).
core.env.OWNERSHIP_ACTIVITY_LOG_ENABLED boolean or string: one of true, false, "" "" Whether the ownership activity log is written. Empty: core's default (true).
core.env.OWNERSHIP_ACTIVITY_LOG_KEEP_DAYS integer or string (0..), pattern ^[0-9]*$ "" How many days a row of the ownership activity log is kept. Empty: core's default (90).
core.env.OWNERSHIP_ACTIVITY_LOG_WRITE_EVERY_MS integer or string (0..), pattern ^[0-9]*$ "" How often the buffered rows of the ownership activity log are written, in milliseconds. Empty: core's default (1000).
core.env.OWNERSHIP_ACTIVITY_LOG_PRUNE_CRON string "" When rows older than the keep period are deleted: a Spring cron of six fields. Empty: core's default (0 40 3 * * *, every day at 03:40).
core.env.REMEDIATION_AGENT_ENABLED boolean or string: one of true, false, "" "" Whether the remediation agent writes plans at all. Empty: core's default (true).
core.env.CORS_ALLOWED_ORIGINS string, pattern ^[^*]*$ not set Origins other than the install's own address that may call the API with the session cookie: exact, comma-separated. A wildcard is refused.
core.env.AUTH_COOKIE_SAME_SITE string: one of Strict, Lax, None not set
core.env.DETECTOR_CATALOGUE_URL string https://registry.hyvop.com/api/v1/detectors Where core reads the registry's list. An install installs and runs the catalogue shipped with its release. When this list holds a higher version of a detector the organisation has installed, an administrator is offered the update and can apply it; nothing is applied on its own, and a published rule is applied only if it passes the same checks as a shipped one.
core.env.DETECTOR_CATALOGUE_REMOTE boolean true Set to false on installs that must make no outbound calls: no update is offered and the shipped copy is used as it is. Nothing is lost: every official detector is in the shipped copy.
core.env.HYVOP_MCP_CA_CERT_CONTENT string ""
core.env.OUTBOUND_ALLOWED_HOSTS string "" The address of a Git server is typed by a person (GitHub Enterprise, a self-hosted GitLab). Core calls it only if it is a public HTTPS address: anything inside the cluster or on a private network is refused. Name here, comma-separated, the internal hosts it may call: "gitlab.corp.example,*.git.corp.example".
core.env.REMEDIATION_ACCOUNT_ENVIRONMENTS string "" Which environment each cloud account is, for the approval a remediation plan needs: "111122223333=production,444455556666=development". Read when a resource has no environment tag. An account that is not listed is treated as production: a person approves every change to it.
core.env.AI_PERSONAL_DATA string stand-ins What the model is told of people. "stand-ins": a person goes out as person-3 and is put back in the answer, and two spellings of one person are matched by rules, without the model. "as-is": names, addresses and handles are sent as the integrations give them. Core refuses any other word.
core.env.JOBS_INGESTION_INVENTORY_CRON string not set When core collects a connected AWS account (Spring cron expressions, with seconds): inventory every 4 hours, metrics every 2 hours, billing nightly at 02:00. A connected account is also collected at once. Example: 0 0 0/4 * * *.
core.env.JOBS_INGESTION_METRICS_CRON string not set Example: 0 0 0/2 * * *.
core.env.JOBS_INGESTION_BILLING_CRON string not set Example: 0 0 2 * * *.

ingestors#

Value Type Default Meaning
ingestors.aws.enabled boolean true
ingestors.aws.image string or object ghcr.io/hyvop-inc/hyvop-ingestor-aws An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.
ingestors.aws.port integer (1..65535) 5000
ingestors.aws.serviceAccount.annotations object not set
ingestors.aws.extraCidrs array [] Private endpoints of the cloud this ingestor may reach on 443, as CIDRs (a VPC endpoint, a private link). Allowed whatever networkPolicy.egress.ingestors.internet says.
ingestors.aws.workloadIdentity.enabled boolean not set
ingestors.aws.workloadIdentity.audience string not set The full name of the customer's workload identity provider: //iam.googleapis.com/projects/NUMBER/locations/global/workloadIdentityPools/POOL/providers/PROVIDER. Required when enabled.
ingestors.aws.workloadIdentity.tokenExpirationSeconds integer (600..86400) not set How long a token lives; the kubelet renews it (default 3600).
ingestors.aws.tls boolean not set Whether the ingestor listens with TLS, with the certificate of the install (the default). false only for an image that does not yet.
ingestors.azure.enabled boolean false
ingestors.azure.image string or object ghcr.io/hyvop-inc/hyvop-ingestor-azure An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.
ingestors.azure.port integer (1..65535) 5001
ingestors.azure.serviceAccount.annotations object not set
ingestors.azure.extraCidrs array [] Private endpoints of the cloud this ingestor may reach on 443, as CIDRs (a VPC endpoint, a private link). Allowed whatever networkPolicy.egress.ingestors.internet says.
ingestors.azure.workloadIdentity.enabled boolean not set
ingestors.azure.workloadIdentity.audience string not set The full name of the customer's workload identity provider: //iam.googleapis.com/projects/NUMBER/locations/global/workloadIdentityPools/POOL/providers/PROVIDER. Required when enabled.
ingestors.azure.workloadIdentity.tokenExpirationSeconds integer (600..86400) not set How long a token lives; the kubelet renews it (default 3600).
ingestors.azure.tls boolean not set Whether the ingestor listens with TLS, with the certificate of the install (the default). false only for an image that does not yet.
ingestors.gcp.enabled boolean false
ingestors.gcp.image string or object ghcr.io/hyvop-inc/hyvop-ingestor-gcp An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.
ingestors.gcp.port integer (1..65535) 5002
ingestors.gcp.serviceAccount.annotations object not set
ingestors.gcp.extraCidrs array [] Private endpoints of the cloud this ingestor may reach on 443, as CIDRs (a VPC endpoint, a private link). Allowed whatever networkPolicy.egress.ingestors.internet says.
ingestors.gcp.workloadIdentity.enabled boolean false
ingestors.gcp.workloadIdentity.audience string "" The full name of the customer's workload identity provider: //iam.googleapis.com/projects/NUMBER/locations/global/workloadIdentityPools/POOL/providers/PROVIDER. Required when enabled.
ingestors.gcp.workloadIdentity.tokenExpirationSeconds integer (600..86400) 3600 How long a token lives; the kubelet renews it (default 3600).
ingestors.gcp.tls boolean not set Whether the ingestor listens with TLS, with the certificate of the install (the default). false only for an image that does not yet.
ingestors.aws.env.INGESTION_ENABLED boolean false Off: core schedules the collections (see core.env.JOBS_INGESTION_*_CRON). The ingestor's own loop collects from a configuration it serves itself (a sample account) with worker credentials of its own: not this set-up.
ingestors.aws.env.AWS_DATA_SOURCE string live live reads AWS (the ingestor's default). dummy is demo mode: sample data for the demo account 000000000000 only (connect it in Hyvop to see it; "remove demo data" deletes it), any other account refused.
ingestors.azure.env.INGESTION_ENABLED boolean false
ingestors.azure.env.AZURE_DATA_SOURCE string live
ingestors.gcp.env.INGESTION_ENABLED boolean false
ingestors.gcp.env.GCP_DATA_SOURCE string live

ui#

Value Type Default Meaning
ui.enabled boolean true
ui.image string or object ghcr.io/hyvop-inc/hyvop-ui An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.
ui.imagePullPolicy string: one of Always, IfNotPresent, Never IfNotPresent
ui.replicas integer (0..) 1
ui.service.port integer (1..65535) 8080
ui.env.API_BASE_URL string ""
ui.resources.requests.cpu string, pattern ^[0-9]+(\.[0-9]+)?(m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$ 50m A Kubernetes quantity, such as 500m, 1Gi or 2.
ui.resources.requests.memory string, pattern ^[0-9]+(\.[0-9]+)?(m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$ 64Mi A Kubernetes quantity, such as 500m, 1Gi or 2.
ui.resources.limits.cpu string, pattern ^[0-9]+(\.[0-9]+)?(m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$ 500m A Kubernetes quantity, such as 500m, 1Gi or 2.
ui.resources.limits.memory string, pattern ^[0-9]+(\.[0-9]+)?(m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$ 256Mi A Kubernetes quantity, such as 500m, 1Gi or 2.

networkPolicy#

Value Type Default Meaning
networkPolicy.enabled boolean true
networkPolicy.ingressControllerNamespace string "" The namespace of the ingress controller, admitted to core when the Ingress routes to it. Empty: the rule names the port only.
networkPolicy.egress.enabled boolean true
networkPolicy.egress.core.internet boolean not set Core may reach the internet on 443. Unset: yes when a model provider or a remote detector catalogue is configured, no otherwise.
networkPolicy.egress.ingestors.internet boolean true The ingestors may reach the cloud's APIs on 443 (default true).
networkPolicy.egress.extraCidrs array [] Further addresses core may reach, as CIDRs.
networkPolicy.egress.mailCidrs array not set The addresses of the mail relay named in core.mail.host, as CIDRs: core may reach them on the relay's port, and on no other. A host name cannot be followed by a network policy.
networkPolicy.egress.core string {} Core may reach the internet on 443. Left out: yes when a model provider or a remote detector catalogue is configured, no otherwise. Set true for a mail relay or a code host outside the cluster.

ingress#

Value Type Default Meaning
ingress.enabled boolean true
ingress.className string nginx
ingress.annotations object not set
ingress.hosts array [{"host":"hyvop.test","paths":[{"path":"/api","pathType":"Prefix","serviceName":"hyvop-core","servicePort":80},{"path":"/","pathType":"Prefix","serviceName":"hyvop-ui","servicePort":80}]}]
ingress.tls array []
ingress.https boolean false HTTPS only at the ingress. Off by default (HTTP); also on when ingress.tls or ingress.certManager is given. true with neither makes a self-signed certificate.
ingress.certManager.clusterIssuer string "" The ClusterIssuer, or the Issuer of this namespace, that issues the certificate (into the Secret hyvop-tls). One of the two.
ingress.certManager.issuer string ""

internalTls#

Value Type Default Meaning
internalTls.existingSecret string "" A Secret of your own with ca.crt, tls.crt and tls.key for the ingestors, in place of the authority and certificate the chart makes.

postgres#

Value Type Default Meaning
postgres.enabled boolean true
postgres.image string or object postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873 An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.
postgres.existingSecret string "" A Secret of your own holding the password of postgres.db.user (key: password).
postgres.persistence.enabled boolean true
postgres.persistence.size string, pattern ^[0-9]+(\.[0-9]+)?(m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$ 1Gi A Kubernetes quantity, such as 500m, 1Gi or 2.
postgres.persistence.storageClass string ""
postgres.db.core string "" Core's database. Empty: hyvop on a new install; slackmcp, the older name, on the upgrade of an install made before the rename.
postgres.db.user string user
postgres.db.password string ""
postgres.external.enabled boolean false

valkey#

Value Type Default Meaning
valkey.enabled boolean true
valkey.image string or object valkey/valkey:8.0-alpine@sha256:fd348c9b6999ef15719a1d6b43b810ee1bf2068ded2d7ab6f6dd15943841f28b An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.

clickhouse#

Value Type Default Meaning
clickhouse.enabled boolean true
clickhouse.image string or object clickhouse/clickhouse-server:24.8@sha256:1ffa82edee000a42c09313bd9f1293d94c570aee74babc1b3ca9983a35fa597b An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.
clickhouse.existingSecret string "" A Secret of your own holding the password of clickhouse.user (key: password).
clickhouse.accountsExistingSecret string "" A Secret of your own holding reader-password and ingest-password.
clickhouse.persistence.enabled boolean true
clickhouse.persistence.size string, pattern ^[0-9]+(\.[0-9]+)?(m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$ 2Gi A Kubernetes quantity, such as 500m, 1Gi or 2.
clickhouse.persistence.storageClass string ""
clickhouse.user string user
clickhouse.password string ""
clickhouse.db string datalake
clickhouse.reader.password string ""
clickhouse.ingest.password string ""
clickhouse.external.enabled boolean false

keycloak#

Value Type Default Meaning
keycloak.enabled boolean false Off by default: single sign-on is an Enterprise feature. Switch it on to try sign-in with the bundled development server (it runs start-dev, with no database).
keycloak.image string or object quay.io/keycloak/keycloak:26.0@sha256:09a381c715ab0b111835b70f2905955274843a219c6f27efb348e4d9f4086858 An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.
keycloak.existingSecret string "" A Secret of your own holding admin-password.
keycloak.adminUser string admin
keycloak.adminPassword string ""

githubMcp#

Value Type Default Meaning
githubMcp.enabled boolean true The GitHub MCP server core reads repositories, teams and users through. It holds no token: core sends one with each request.
githubMcp.image string or object ghcr.io/github/github-mcp-server:v1.14.0@sha256:7aaeeec9ae4fe9a736d100c1ff0798f3c219b5009e05f5d3945fcacb13cc196b An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.
githubMcp.host string "" The GitHub host, for GitHub Enterprise Server, for example https://github.example.com. Set on the server as GITHUB_HOST and told to core, which refuses an organisation on another host. One server serves one host. Empty: github.com.
githubMcp.toolsets array ["context","repos","users","orgs","pull_requests"] The groups of tools the server offers. It is always started read-only.

clickhouseMcp#

Value Type Default Meaning
clickhouseMcp.enabled boolean false Off unless asked for: nothing in Hyvop calls this server, and it takes no login of its own, so whoever reaches its port reads the data lake as the read-only account.
clickhouseMcp.image string or object mcp/clickhouse:latest@sha256:51bcd33e17adede7cf6de666a50e9b1275d53fbe0f4ad0cfd7bd35678a5b8c3f An image reference: repository with a tag or a digest, or neither for one of Hyvop's own (the chart then uses appVersion); or a map with repository, tag and optionally pullPolicy.

Keys every component accepts#

Each component also accepts the keys below, which values.yaml does not set; the chart then applies its own requests, limits and security contexts (the chart README lists them). They are left out of the tables above to keep them short.

Key Type Meaning
<component>.imagePullPolicy Always, IfNotPresent or Never Pull policy of that component; falls back to global.imagePullPolicy.
<component>.resources object with requests and limits, each with cpu and memory (Kubernetes quantities) Replaces the component's requests and limits.
<component>.podSecurityContext object Replaces the chart's pod security context for that component, whole.
<component>.containerSecurityContext object Replaces the chart's container security context for that component, whole.

<component> is each of core, ui, postgres, valkey, clickhouse, keycloak, githubMcp, clickhouseMcp, and ingestors.<cloud> for the ingestors.