Helm Values Reference¶

Choose your relay

The shipped chart address defaults to beacon.cloudtaser.io:443, with system-root TLS trust enabled; the CLI P2P relay address has the same default. Leaving the address unset selects the demo relay. Set your own relay address, TLS trust and tenant enrollment explicitly: the hosted fleet is demo only, with no customer or pilot enrollment. See Beacon Installation.

cloudtaser provides two Helm charts: the operator chart for standalone operator installation, and the unified cloudtaser chart that bundles the operator, wrapper configuration, and S3 proxy defaults into a single release.

The Helm charts control how cloudtaser is deployed into your Kubernetes cluster. Key decisions include the number of operator replicas (for high availability), webhook listener availability, and resource allocation for each component. All configuration is declarative and version-controlled through standard Helm values files.

Operator Chart¶

Chart: cloudtaser Repository: https://charts.cloudtaser.io

Image registry paths

The europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/ image paths shown below are the default values from the Helm chart. You do not need to configure a separate registry -- these images are public and pulled automatically.

Installation¶

helm repo add cloudtaser https://charts.cloudtaser.io
helm repo update

helm install cloudtaser cloudtaser/cloudtaser \
  --namespace cloudtaser-system \
  --create-namespace \
  --values values.yaml

Values¶

`replicaCount`¶


Type	`int`
Default	`2`

Number of operator pod replicas. Use at least 2 for high availability in production. The operator uses leader election, so only one replica is active at a time.

replicaCount: 2

`image`¶

Field	Type	Default
`image.repository`	`string`	`europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-operator`
`image.tag`	`string`	Chart `appVersion`
`image.pullPolicy`	`string`	`IfNotPresent`

The operator container image.

image:
  repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-operator
  tag: "v0.6.9"
  pullPolicy: IfNotPresent

`initImage`¶

Field	Type	Default
`initImage.repository`	`string`	`europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper`
`initImage.tag`	`string`	Chart `appVersion`

The wrapper binary image used by the init container during wrapper injection. The init container copies the wrapper binary into a shared emptyDir volume.

initImage:
  repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper
  tag: "v0.1.6"

`resources`¶


Type	`corev1.ResourceRequirements`

Resource requests and limits for the operator pods.

resources:
  requests:
    cpu: "50m"
    memory: "128Mi"
  limits:
    cpu: "500m"
    memory: "256Mi"

`webhook`¶

Value	Type	Default (inferred from schema)	Description
`operator.webhook.port`	`integer`	`9443`	Webhook listener port.
`operator.webhook.timeoutSeconds`	`integer`	`10`	Admission request timeout in seconds. Range: 1–30.

The webhook template hardcodes Fail. Failure policy is not an effective configurable setting. The schema still accepts compatibility inputs for failure policy and its upgrade guard; schema acceptance does not change the rendered policy. While the operator runs, admission tamper reconciliation restores the expected policy after a live edit. Restore webhook availability instead of relying on a fail-open patch.

`secretBackend`¶


Type	`string`
Default (inferred from chart)	`inmemory`

The default keeps operational credentials in operator memory and uses the Port/beacon introduction path. RAM state is lost on restart. Select vault explicitly for legacy direct mode: the operator authenticates to OpenBao and persists its operational credentials there. The deprecated kubernetes name is an alias for inmemory, not Kubernetes Secret storage.

secretBackend: inmemory

See Zero Kubernetes Secrets Architecture for the backend boundaries and restart limits.

`vault`¶

Field	Type	Default	Description
`vault.address`	`string`	`""`	OpenBao address for operator secret storage and workload injection
`vault.authPath`	`string`	`kubernetes`	OpenBao Kubernetes auth method mount path
`vault.role`	`string`	`cloudtaser-operator`	OpenBao role for operator authentication
`vault.secretPrefix`	`string`	`secret/cloudtaser/system`	OpenBao path prefix for operator secrets
`vault.tlsSkipVerify`	`bool`	`false`	Skip TLS verification for OpenBao (development only)
`vault.caCert`	`string`	`""`	PEM-encoded CA certificate for OpenBao TLS verification

vault:
  address: "https://vault.eu.example.com"
  authPath: kubernetes
  role: cloudtaser-operator
  secretPrefix: secret/cloudtaser/system
  tlsSkipVerify: false
  caCert: ""

These values are used when secretBackend: vault. The vault.address is also used as the default OpenBao address for workload secret injection (overridable per-workload via annotations). Run cloudtaser-cli source install + cloudtaser-cli source configure to create the required OpenBao policy and Kubernetes auth role before deploying the operator with OpenBao backend.

`serviceAccount`¶

Field	Type	Default	Description
`serviceAccount.create`	`bool`	`true`	Create a service account for the operator
`serviceAccount.name`	`string`	`""`	Override the service account name (defaults to release name)
`serviceAccount.annotations`	`map`	`{}`	Annotations to add to the service account

serviceAccount:
  create: true
  name: ""
  annotations:
    iam.gke.io/gcp-service-account: cloudtaser@myproject.iam.gserviceaccount.com

`nodeSelector`¶


Type	`map[string]string`
Default	`{}`

nodeSelector:
  kubernetes.io/arch: amd64

`tolerations`¶


Type	`[]corev1.Toleration`
Default	`[]`

tolerations:
  - key: "node-role.kubernetes.io/control-plane"
    operator: "Exists"
    effect: "NoSchedule"

`affinity`¶


Type	`corev1.Affinity`
Default	`{}`

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                  - cloudtaser-operator
          topologyKey: kubernetes.io/hostname

Default Values Summary¶

Value	Default
`replicaCount`	`2`
`image.repository`	`europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-operator`
`image.tag`	Chart appVersion
`image.pullPolicy`	`IfNotPresent`
`initImage.repository`	`europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper`
`initImage.tag`	Chart appVersion
`secretBackend`	`inmemory`
`vault.address`	`""`
`vault.authPath`	`kubernetes`
`vault.role`	`cloudtaser-operator`
`vault.secretPrefix`	`secret/cloudtaser/system`
`vault.tlsSkipVerify`	`false`
`vault.caCert`	`""`
`resources.requests.cpu`	`50m`
`resources.requests.memory`	`128Mi`
`resources.limits.cpu`	`500m`
`resources.limits.memory`	`256Mi`
`webhook.port`	`9443`
`webhook.timeoutSeconds`	`10`
`serviceAccount.create`	`true`
`nodeSelector`	`{}`
`tolerations`	`[]`
`affinity`	`{}`

Unified cloudtaser Chart¶

Chart: cloudtaser Repository: https://charts.cloudtaser.io

The unified chart bundles the operator, wrapper defaults, and S3 proxy configuration into a single Helm release. It uses subcharts and exposes grouped values under operator.*, wrapper.*, and s3proxy.* prefixes. The current chart (1.0.359) bundles operator v0.13.209; the latest standalone operator release (v0.13.209) is a separate version track.

Installation¶

helm repo add cloudtaser https://charts.cloudtaser.io
helm repo update

helm install cloudtaser cloudtaser/cloudtaser \
  --namespace cloudtaser-system \
  --create-namespace \
  --values values.yaml

`operator.*`¶

All values from the operator chart are available under the operator prefix.

operator:
  replicaCount: 2
  image:
    repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-operator
    tag: "v0.13.209"
  secretBackend: vault
  vault:
    address: "https://vault.eu.example.com"
    authPath: kubernetes
    role: cloudtaser-operator
  webhook:
    failurePolicy: Fail
    timeoutSeconds: 10
  resources:
    requests:
      cpu: "50m"
      memory: "128Mi"
    limits:
      cpu: "500m"
      memory: "256Mi"

`wrapper.*`¶

Default configuration for the wrapper init container injected into workloads. These values serve as cluster-wide defaults and can be overridden per-workload via CloudTaserConfig CRs or annotations.

Value	Type	Default	Description
`wrapper.image.repository`	`string`	`europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper`	Wrapper container image
`wrapper.image.tag`	`string`	`v0.2.207`	Wrapper image tag
`wrapper.image.digest`	`string`	(set by helm-update pipeline)	Immutable sha256 digest (hex, no `sha256:` prefix). When set, the operator injects the wrapper as `repo@sha256:<digest>`
`wrapper.initImage.repository`	`string`	`europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper-init`	Separate init container image
`wrapper.initImage.tag`	`string`	`""`	Init container image tag. When empty, falls back to `wrapper.image`
`wrapper.initImage.digest`	`string`	(set by helm-update pipeline)	Immutable sha256 digest for the init container image
`wrapper.initImagePullPolicy`	`string`	`IfNotPresent`	ImagePullPolicy for the webhook-injected wrapper init container. One of `Always`, `IfNotPresent`, `Never`
`wrapper.healthPort`	`integer`	`8199`	HTTPS health/status listener port for injected wrapper pods. The eBPF DaemonSet uses the same value for its self-traffic exemption
`wrapper.metrics.enabled`	`boolean`	`false`	Enable the opt-in metrics endpoint for wrapper sidecars
`wrapper.metrics.addr`	`string`	`127.0.0.1:9090`	Metrics listen address (loopback-only default)

wrapper:
  image:
    repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper
    tag: "v0.2.207"
  initImage:
    repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper-init
    tag: "v0.2.207"
  initImagePullPolicy: IfNotPresent
  healthPort: 8199
  metrics:
    enabled: false
    addr: "127.0.0.1:9090"

`s3proxy.*`¶

Configuration for the S3 encryption proxy sidecar.

Value	Type	Default	Description
`s3proxy.enabled`	`boolean`	`false`	Enable S3 proxy sidecar injection
`s3proxy.image.repository`	`string`	`europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-s3-proxy`	S3 proxy image
`s3proxy.image.tag`	`string`	`v0.2.61`	S3 proxy image tag
`s3proxy.image.digest`	`string`	(set by helm-update pipeline)	Immutable sha256 digest for digest-pinned pulls
`s3proxy.imagePullPolicy`	`string`	`IfNotPresent`	ImagePullPolicy for the S3 proxy sidecar. One of `Always`, `IfNotPresent`, `Never`
`s3proxy.vault.skipVerify`	`boolean`	`false`	Skip TLS certificate verification for the vault connection in injected S3 proxy sidecars. Requires `allowInsecure: true`
`s3proxy.vault.allowInsecure`	`boolean`	`false`	Explicit acknowledgement of insecure vault connection

s3proxy:
  enabled: true
  image:
    repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-s3-proxy
    tag: "v0.2.61"
  imagePullPolicy: IfNotPresent

Full Example (Unified Chart)¶

values.yaml

operator:
  replicaCount: 2
  image:
    repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-operator
    tag: "v0.13.209"
  secretBackend: vault
  vault:
    address: "https://vault.eu.example.com"
    authPath: kubernetes
    role: cloudtaser-operator
    secretPrefix: secret/cloudtaser/system
  webhook:
    failurePolicy: Fail
    timeoutSeconds: 10
  resources:
    requests:
      cpu: "100m"
      memory: "256Mi"
    limits:
      cpu: "1000m"
      memory: "512Mi"
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 100
          podAffinityTerm:
            labelSelector:
              matchExpressions:
                - key: app.kubernetes.io/name
                  operator: In
                  values:
                    - cloudtaser-operator
            topologyKey: kubernetes.io/hostname

wrapper:
  image:
    repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper
    tag: "v0.2.207"
  initImage:
    repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper-init
    tag: "v0.2.207"
  initImagePullPolicy: IfNotPresent
  healthPort: 8199
  metrics:
    enabled: false

s3proxy:
  enabled: true
  image:
    repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-s3-proxy
    tag: "v0.2.61"
  imagePullPolicy: IfNotPresent

Upgrading¶

helm repo update

helm upgrade cloudtaser cloudtaser/cloudtaser \
  --namespace cloudtaser-system \
  --values values.yaml

Wrapper image updates

Upgrading the Helm chart updates the operator and the default wrapper image tag. Existing pods will continue using their current wrapper version until they are restarted. To roll out the new wrapper version across all workloads, perform a rolling restart of your Deployments after the Helm upgrade.

Published documentation cohort¶

Documentation version input	Published selection
`beacon_version`	`v0.6.23`
`cli_version`	`v0.19.176`
`dbproxy_version`	`v0.1.55`
`ebpf_version`	`v0.13.164`
`helm_version`	`1.0.359`
`openbao_chart_version`	`0.2.17`
`operator_bundled_version`	`v0.13.209`
`operator_latest_version`	`v0.13.209`
`port_version`	`v0.4.133`
`s3proxy_version`	`v0.2.61`
`wrapper_version`	`v0.2.207`

Chart-bundled image versions come from the published chart. CLI and relay/store chart selections have independent release ownership; this table records the matched published inputs and does not qualify a newer component combination.

Helm Values Reference¶

Operator Chart¶

Installation¶

Values¶

replicaCount¶

image¶

initImage¶

resources¶

webhook¶

secretBackend¶

vault¶

serviceAccount¶

nodeSelector¶

tolerations¶

affinity¶

Default Values Summary¶

Unified cloudtaser Chart¶

Installation¶

operator.*¶

wrapper.*¶

s3proxy.*¶

Full Example (Unified Chart)¶

Upgrading¶

Published documentation cohort¶

`replicaCount`¶

`image`¶

`initImage`¶

`resources`¶

`webhook`¶

`secretBackend`¶

`vault`¶

`serviceAccount`¶

`nodeSelector`¶

`tolerations`¶

`affinity`¶

`operator.*`¶

`wrapper.*`¶

`s3proxy.*`¶