opencode-agent values

Every value of chart opencode-agent 0.6.0, read from values.yaml and values.schema.json. A map is listed with its keys; a map without a description of its own is listed by its keys only. Every value has a default: the chart installs with none given.

Value	Type	Default	Description
team	string	""	Team of the tenant the app serves: the chart puts every object into <tenant>-<team>, a namespace the team already has. Empty: the release namespace
tenant	string	""	Tenant the app belongs to; required with team
person.name	string	""	short lowercase name; objects are named <name>-agent. Empty: the release name
person.email	string	""	Git identity; also the UI owner when oauth.ownerEmail is empty
person.role	string	""	one line appended to the agent instructions, for example "I am sales"
route.host	string	""	empty: OpenShift assigns a host under the default application domain
route.labels	object	{}	extra labels on the Route only, for example to pick a router shard
route.timeout	string	3600s	the UI streams over SSE; the router must not cut idle streams
route.annotations	object		used when a host is set; certificate issued by cert-manager
route.annotations.cert-manager.io/issuer-kind	string	ClusterIssuer
route.annotations.cert-manager.io/issuer-name	string	letsencrypt
oauth.ownerEmail	string	""	OpenShift user name (an email) of the only person admitted to the UI. Empty: person.email; both empty: everyone who may edit the project
oauth.allowedGroups	array	[]	OpenShift groups admitted, strictly (with an owner: the owner must be in one)
oauth.loginClusterRole	string	""	ClusterRole holding the verb login on services/proxy that allowedGroups are bound to. Empty: the chart's own Role, which only an installer holding that verb (a cluster admin) can create
secrets.type	string	kubernetes	kubernetes: Secrets from the values below. externalSecret: from a secret store One of: kubernetes, externalSecret.
secrets.cookieSecret	string	""	empty: generated once and kept on upgrade. A value that is not 16, 24 or 32 characters long is hashed to 32
secrets.serverPassword	string	""	password between the UI proxy, the A2A adapter and OpenCode. Empty: generated once
secrets.a2aToken	string	""	bearer token the A2A adapter accepts. Empty: generated once
secrets.gitToken	string	""	access token for git.url, sent to the host of git.url only
secrets.externalSecret.storeKind	string	ClusterSecretStore	One of: ClusterSecretStore, SecretStore.
secrets.externalSecret.storeName	string	""
secrets.externalSecret.refreshInterval	string	1h
secrets.externalSecret.items	object		one vault item per secret; the value is read from the item's password. Empty name: <name>-agent-<secret>
secrets.externalSecret.items.cookieSecret	string	""
secrets.externalSecret.items.serverPassword	string	""
secrets.externalSecret.items.a2aToken	string	""
secrets.externalSecret.items.gitToken	string	""
git.url	string	""	repository cloned into /workspace on first start; empty: no clone. The token is secrets.gitToken
git.branch	string	main	branch of the first clone
gateway.upstream	string	""	model and A2A gateway the token proxy forwards to, for example https://api.example.com
gateway.audience	string	""	audience of the agent's ServiceAccount token. Empty: the host of upstream
a2a.gatewayNamespace	string	""	namespace of the gateway's HTTPRoutes that publish A2A. Empty: none
a2a.allowedHosts	array	[]	inbound Host header allowlist (A2A_ALLOWED_HOSTS); empty disables the check
a2a.publicUrl	string	""	Agent Card base URL. Empty: the in-cluster Service URL
a2a.peers	array	[]	agents this agent may call with the a2a_call tool: a name, or {name: <agent>, namespace: <namespace>}; the namespace defaults to the release namespace. Each is reached at <gateway.upstream origin>/a2a/<namespace>/<name>/ through the token proxy. Empty: no A2A tools
a2a.version	string	2.0.0+hoolia.2	opencode-a2a release with the OpenCode 2.x API (OPENCODE_API_VERSION=v2)
a2a.package	string	opencode-a2a @ https://github.com/hoolia/opencode-a2a/archive/refs/tags/v2.0....	pip requirement the adapter image installs; a source archive needs no git
a2a.tenantAuth	object		Callers of the agent's tenant reach it with their own bearer JWT, next to the static credentials: a ServiceAccount token from a namespace <tenant> or <tenant>-, or an OIDC token whose groups claim holds <tenant> or <tenant>-. kagent forwards its caller's token. Needs the adapter version above or later
a2a.tenantAuth.enabled	boolean	true
a2a.tenantAuth.tenant	string	""	empty: the release namespace up to its first "-"
a2a.tenantAuth.kubernetesIssuer	string	https://kubernetes.default.svc	the cluster's ServiceAccount token issuer; empty: none
a2a.tenantAuth.oidcIssuers	array	[]	OIDC issuers, for example https://login.example/realms/<realm>
a2a.baseImage	string	registry.access.redhat.com/ubi10/python-312-minimal	the A2A task store needs SQLite 3.35 or later (RETURNING); UBI 9 ships 3.34
a2a.image	string	""	prebuilt adapter image; required when builds.enabled is false
a2a.resources	object		adapter container requests and limits
a2a.resources.requests.cpu	string	50m
a2a.resources.requests.memory	string	192Mi
a2a.resources.limits.memory	string	512Mi
opencode.version	string	2.1.1	OpenCode release; 2.x migrates the session store in place, see backup-db.sh
opencode.baseImage	string	ghcr.io/anomalyco/opencode	OpenCode image the build starts from
opencode.image	string	""	prebuilt image with the toolset and /tools/kubernetes-mcp-server, used when builds.enabled is false. Empty: baseImage:version
opencode.plugins	array	[]	npm plugins OpenCode installs on start, for example a model provider plugin
opencode.npmScopes	object	{}	"@scope": <registry URL> for those installs, written to ~/.npmrc
opencode.env	object	{}	extra environment for the opencode container (name: value)
opencode.disabledProviders	array	["opencode"]	providers off by default; opencode is opencode.ai's public inference, outside your gateway. A user turns one back on with an allow policy in ~/.config/opencode/opencode.json
opencode.config	object	{}	merged over the generated opencode.json
opencode.resources	object		opencode container requests and limits; an agent at work peaks near 10 cores
opencode.resources.requests.cpu	string	500m
opencode.resources.requests.memory	string	2Gi
opencode.resources.limits.cpu	string	8
opencode.resources.limits.memory	string	16Gi
tools.goImage	string	docker.io/library/golang:1.26-alpine	Go image that builds the odf CLI, which has no binary release, from source
tools.odfRepository	string	https://github.com/red-hat-storage/odf-cli	Git repository of the odf CLI; the newest commit of its default branch is built
kubernetesMcpServer.image	string	quay.io/containers/kubernetes_mcp_server:v0.0.67	image the kubernetes-mcp-server binary is copied from
builds.enabled	boolean	true	build the opencode (with the toolset) and opencode-a2a images in the project
builds.registry	string	image-registry.openshift-image-registry.svc:5000	registry of the cluster, where the builds push and the pod pulls
builds.nodeSelector	object	{}	node labels for the build pods; a build writes several Gi of layers to the node
builds.resources	object		build pod requests and limits; compiling the odf CLI needs several Gi
builds.resources.requests.cpu	string	100m
builds.resources.requests.memory	string	256Mi
builds.resources.limits.memory	string	6Gi
oauthProxy.image	string	image-registry.openshift-image-registry.svc:5000/openshift/oauth-proxy:v4.4	OpenShift oauth-proxy in front of the UI; the cluster keeps this tag current
oauthProxy.port	integer	4180	UI port of the pod
oauthProxy.resources	object		login proxy requests and limits
oauthProxy.resources.requests.cpu	string	10m
oauthProxy.resources.requests.memory	string	32Mi
oauthProxy.resources.limits.memory	string	256Mi
uiProxy.port	integer	4097	loopback port oauth-proxy sends the UI to; runs on tokenProxy.image
uiProxy.resources	object		UI proxy requests and limits
uiProxy.resources.requests.cpu	string	10m
uiProxy.resources.requests.memory	string	32Mi
uiProxy.resources.limits.memory	string	256Mi
tokenProxy.image	string	registry.access.redhat.com/ubi9/python-312-minimal	image that runs the token proxy script
tokenProxy.port	integer	8099	loopback port OpenCode sends model and A2A calls to
tokenProxy.agentToken	object		calls under paths carry the agent's own OpenID Connect token instead of the ServiceAccount token: a client_credentials grant at tokenUrl, authenticated with a ServiceAccount token for audience (federated client authentication). Empty: off
tokenProxy.agentToken.tokenUrl	string	""
tokenProxy.agentToken.audience	string	""	usually the realm's issuer URL
tokenProxy.agentToken.paths	array	["/mcp"]
tokenProxy.resources	object		token proxy requests and limits
tokenProxy.resources.requests.cpu	string	10m
tokenProxy.resources.requests.memory	string	32Mi
tokenProxy.resources.limits.memory	string	256Mi
nodeSelector	object	{}	node labels and affinity of the agent pod; the OpenCode image is several Gi
affinity	object	{}
agentLabels	object	{}	labels on the kagent Agent, for example the one a platform uses to register the ServiceAccount kagent creates for it as an OpenID Connect client
serviceAccount.name	string	""	empty: <name>-agent, created by kagent; another name is created by the chart
serviceAccount.labels	object	{}	labels on a ServiceAccount the chart creates, for example the one a platform uses to register it as an OpenID Connect client
storage.size	string	20Gi	work tree, OpenCode home and session store
storage.accessMode	string	ReadWriteMany	the only accepted mode: a rolling update starts the new pod before the old one stops One of: ReadWriteMany.
storage.className	string	""	empty: the default storage class
networkPolicy.enabled	boolean	true	admit the UI from the router and A2A from the listed namespaces only
networkPolicy.a2aNamespaces	array	[]	more namespaces that may call A2A on 8080; a2a.gatewayNamespace always may