kagent values¶
Every value of chart kagent 0.5.1, read from values.yaml and values.schema.json. A map is listed with its keys; a map without a description of its own is listed by its keys only. Every value has a default: the chart installs with none given.
| Value | Type | Default | Description |
|---|---|---|---|
route.host |
string | "" |
empty: OpenShift assigns a host under the default application domain |
route.labels |
object | {} |
extra labels on the Route only, for example to pick a router shard |
route.timeout |
string | 3600s |
agent answers stream; the router must not cut long requests |
route.annotations |
object | used when a host is set; certificate issued by cert-manager | |
route.annotations.cert-manager.io/issuer-kind |
string | ClusterIssuer |
|
route.annotations.cert-manager.io/issuer-name |
string | letsencrypt |
|
login.provider |
string | openshift |
openshift: OpenShift oauth-proxy, one shared kagent user (controller auth mode unsecure). oidc: upstream oauth2-proxy against an OIDC provider, a kagent user per person (set upstream.oauth2-proxy and upstream.controller.auth.mode trusted-proxy) One of: openshift, oidc. |
login.allowedGroups |
array | [] |
OpenShift groups admitted, strictly. Empty: everyone who may edit the project |
login.oidc.clientId |
string | "" |
client id at the OIDC provider, written into the Secret kagent-oidc |
login.oidc.keycloakClient |
object | the login client as an EDP KeycloakClient in the release namespace, with the client secret of the Secret kagent-oidc; needs the EDP Keycloak operator and a realm the namespace may use (a tenant's clientId starts with <tenant>-) | |
login.oidc.keycloakClient.create |
boolean | false |
|
login.oidc.keycloakClient.realmRef.kind |
string | ClusterKeycloakRealm |
|
login.oidc.keycloakClient.realmRef.name |
string | public |
|
login.oidc.keycloakClient.defaultClientScopes |
array | ["basic", "email", "profile", "roles", "web-origins"] |
|
login.loginClusterRole |
string | "" |
ClusterRole holding the verb login on services/proxy that allowedGroups are bound to. Empty: the chart's own Role, which only an installer holding that verb (a cluster admin) can create |
login.image |
string | image-registry.openshift-image-registry.svc:5000/openshift/oauth-proxy:v4.4 |
OpenShift oauth-proxy in front of the UI; the cluster keeps this tag current |
login.port |
integer | 4180 |
|
login.resources.requests.cpu |
string | 10m |
|
login.resources.requests.memory |
string | 32Mi |
|
login.resources.limits.cpu |
string | 200m |
|
login.resources.limits.memory |
string | 128Mi |
|
secrets.type |
string | kubernetes |
kubernetes: the chart keeps the OpenShift login cookie key in a Secret it generates once. externalSecret: with login.provider oidc, an ExternalSecret writes the Secret kagent-oidc (client-id, client-secret, cookie-secret) that upstream.oauth2-proxy.config.existingSecret names One of: kubernetes, externalSecret. |
secrets.cookieSecret |
string | "" |
login cookie key. Empty: generated once and kept on upgrade |
secrets.externalSecret.storeKind |
string | ClusterSecretStore |
One of: ClusterSecretStore, SecretStore. |
secrets.externalSecret.storeName |
string | "" |
|
secrets.externalSecret.refreshInterval |
string | 1h |
|
secrets.externalSecret.items |
object | remote keys whose property login.password holds the value | |
secrets.externalSecret.items.oidcClientSecret |
string | "" |
|
secrets.externalSecret.items.oidcCookieSecret |
string | "" |
|
database.cnpg |
object | CloudNativePG Cluster kagent-postgres in the release namespace; the controller reads its URL from the Secret kagent-postgres-app (upstream.database.postgres.urlFile and upstream.controller.volumes below). Needs the CloudNativePG operator. false: set upstream.database.postgres (bundled.enabled, url or urlFile) and upstream.controller.volumes and volumeMounts to [] | |
database.cnpg.enabled |
boolean | true |
|
database.cnpg.instances |
integer | 1 |
|
database.cnpg.storage.size |
string | 1Gi |
|
database.cnpg.storage.storageClass |
string | "" |
empty: the cluster's default StorageClass |
database.cnpg.imageName |
string | "" |
empty: the operator's default PostgreSQL image |
database.cnpg.resources |
object | {} |
|
database.cnpg.operatorNamespaceSelector |
object | namespaces of the CloudNativePG operator, which reads the instance status | |
database.cnpg.operatorNamespaceSelector.matchLabels.kubernetes.io/metadata.name |
string | openshift-operators |
|
examples |
object | The upstream example agents: set upstream.<agent>.enabled per agent (Helm cannot switch subcharts from here). This adds their tool server, RemoteMCPServer kagent-tool-server, bound to clusterRole in the release namespace only; never cluster-wide | |
examples.enabled |
boolean | false |
|
examples.tools.image |
string | ghcr.io/kagent-dev/kagent/tools:0.1.3 |
|
examples.tools.clusterRole |
string | view |
|
examples.tools.args |
array | ["--read-only", "--tools", "k8s,helm,utils"] |
|
examples.tools.resources.requests.cpu |
string | 10m |
|
examples.tools.resources.requests.memory |
string | 64Mi |
|
examples.tools.resources.limits.cpu |
string | 500m |
|
examples.tools.resources.limits.memory |
string | 256Mi |
|
remoteMCPServers |
array | [] |
RemoteMCPServers of the release namespace, for the tenant's own MCP servers. Each: name, description, url, protocol (STREAMABLE_HTTP or SSE), timeout, allowedNamespaces (default {from: Same}; {from: Selector, selector: ...} shares it with other namespaces) and headers: name, optional prefix ("Bearer "), and the value from vaultItem (a remote key of secrets.externalSecret.storeName, property vaultProperty, default login.password) or existingSecret {name, key} |
networkPolicy.enabled |
boolean | true |
|
networkPolicy.agentNamespaceSelector |
object | {} |
namespaces whose agent pods reach the controller API (sessions, A2A). Empty: the release namespace only |
networkPolicy.agentPodSelector |
object | {} |
pods within those namespaces. The controller does not verify the token a caller sends (trusted-proxy), so these namespaces are the tenant boundary for ServiceAccounts: select the tenant's namespaces only. Empty: every pod there |
upstream |
object | Overrides of the upstream kagent chart (alias upstream). Set rbac.namespaces to the release namespace (Argo CD: parameter upstream.rbac.namespaces[0]=$ARGOCD_APP_NAMESPACE): empty renders cluster-wide RBAC, which this chart refuses | |
upstream.fullnameOverride |
string | kagent |
|
upstream.nameOverride |
string | kagent |
|
upstream.rbac.namespaces |
array | [] |
|
upstream.controller.auth |
object | the login proxy has authenticated the browser; the controller takes no JWT | |
upstream.controller.auth.mode |
string | unsecure |
|
upstream.controller.volumes |
array | [{"name": "postgres-app", "secret": {"secretName": "kagent-postgres-app", "it... |
|
upstream.controller.volumeMounts |
array | [{"name": "postgres-app", "mountPath": "/etc/kagent/postgres", "readOnly": tr... |
|
upstream.ui.service.type |
string | ClusterIP |
|
upstream.ui.route |
object | the login Route of this chart is the only way in | |
upstream.ui.route.enabled |
boolean | false |
|
upstream.database.postgres.urlFile |
string | /etc/kagent/postgres/uri |
the Secret of the CloudNativePG Cluster (database.cnpg) |
upstream.database.postgres.bundled.enabled |
boolean | false |
|
upstream.database.postgres.bundled.podSecurityContext |
object | OpenShift assigns the UID of the project | |
upstream.database.postgres.bundled.podSecurityContext.fsGroup |
string | null |
|
upstream.database.postgres.bundled.podSecurityContext.runAsUser |
string | null |
|
upstream.database.postgres.bundled.podSecurityContext.runAsGroup |
string | null |
|
upstream.database.postgres.bundled.podSecurityContext.runAsNonRoot |
boolean | true |
|
upstream.database.postgres.bundled.podSecurityContext.seccompProfile.type |
string | RuntimeDefault |
|
upstream.oauth2-proxy |
object | login.provider oidc; OpenShift assigns the UID of the project. An Application sets enabled, extraEnv (OIDC_ISSUER_URL, OIDC_REDIRECT_URL, UPSTREAM_URL) and extraArgs.allowed-group: the tenant's realm roles, comma separated, which the client scope puts in the claim groups | |
upstream.oauth2-proxy.securityContext.runAsUser |
string | null |
|
upstream.oauth2-proxy.securityContext.runAsGroup |
string | null |
|
upstream.oauth2-proxy.config.existingSecret |
string | kagent-oidc |
|
upstream.oauth2-proxy.extraArgs.scope |
string | openid profile email |
Keycloak has no scope groups; a default client scope carries the claim |
upstream.oauth2-proxy.extraArgs.skip-jwt-bearer-tokens |
boolean | true |
a bearer caller passes the same allowed-group check as a browser session |
upstream.oauth2-proxy.extraArgs.skip-auth-regex |
string | ^/(login$|_next/static/|_next/image|login-bg\.(jpg|png|webp)$|logo-[a-z0-9-]+... |
the login page and static assets only; upstream also skips api/agentharnesses/*/gateway (substrate, not deployed) with any suffix |
upstream.kmcp |
object | cluster-wide parts come from the platform kagent-operator | |
upstream.kmcp.enabled |
boolean | false |
|
upstream.kagent-tools.enabled |
boolean | false |
|
upstream.grafana-mcp.enabled |
boolean | false |
|
upstream.k8s-agent.enabled |
boolean | false |
|
upstream.kgateway-agent.enabled |
boolean | false |
|
upstream.istio-agent.enabled |
boolean | false |
|
upstream.promql-agent.enabled |
boolean | false |
|
upstream.observability-agent.enabled |
boolean | false |
|
upstream.argo-rollouts-agent.enabled |
boolean | false |
|
upstream.helm-agent.enabled |
boolean | false |
|
upstream.cilium-policy-agent.enabled |
boolean | false |
|
upstream.cilium-manager-agent.enabled |
boolean | false |
|
upstream.cilium-debug-agent.enabled |
boolean | false |