Helm Values Reference¶
Reference for the published cloudtaser and cloudtaser-openbao charts maintained in cloudtaser-helm. Both use the matched documentation cohort.
For the operator-specific and unified chart overview, see Helm Values. For the OpenBao store chart, see OpenBao Helm Values.
cloudtaser Chart (cloudtaser-helm)¶
Chart: cloudtaser
Source: cloudtaser-helm/charts/cloudtaser/values.yaml
This is the primary chart for deploying cloudtaser into a Kubernetes cluster. It includes the operator, wrapper image configuration, eBPF daemonset, S3 proxy defaults, DB proxy defaults, NetworkPolicy, and PodDisruptionBudget.
Image tag defaults
The current published chart (1.0.359) bundles operator v0.13.209. The latest standalone operator release is v0.13.209 and is not automatically the chart default. Use helm show values cloudtaser/cloudtaser (after helm repo add cloudtaser https://charts.cloudtaser.io) to verify the published defaults.
Global¶
| Value | Type | Default | Description |
|---|---|---|---|
namespace |
string |
cloudtaser-system |
Namespace for all cloudtaser components |
imagePullSecrets |
list |
[] |
Image pull secrets for private registries |
operator.*¶
Operator deployment configuration.
| Value | Type | Default | Description |
|---|---|---|---|
operator.ha |
bool |
false |
Enable HA mode (multiple replicas with leader election) |
operator.replicaCount |
int |
1 |
Number of operator pod replicas. Use 2+ for HA |
operator.leaderElect |
bool |
false |
Enable leader election. Required when replicaCount > 1 |
operator.image.repository |
string |
europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-operator |
Operator container image repository |
operator.image.tag |
string |
v0.13.209 |
Operator image tag bundled by chart 1.0.359 |
operator.image.pullPolicy |
string |
IfNotPresent |
Image pull policy |
operator.resources.requests.cpu |
string |
50m |
CPU request for operator pods |
operator.resources.requests.memory |
string |
64Mi |
Memory request for operator pods |
operator.resources.limits.cpu |
string |
200m |
CPU limit for operator pods |
operator.resources.limits.memory |
string |
128Mi |
Memory limit for operator pods |
operator.secretstore.address |
string |
"" |
Default secret store address (OpenBao/HashiCorp Vault) for token renewal. Pods override this via annotations. Legacy alias: operator.vault.address. |
| Value | Type | Default (inferred from schema) | Description |
|---|---|---|---|
operator.webhook.port |
integer |
9443 |
Webhook listener port. |
operator.webhook.timeoutSeconds |
integer |
10 |
Admission request timeout in seconds. Range: 1–30. |
The webhook template hardcodes Fail. Failure policy is not an effective configurable setting. The schema still accepts compatibility inputs for failure policy and its upgrade guard; schema acceptance does not change the rendered policy. While the operator runs, admission tamper reconciliation restores the expected policy after a live edit. Restore webhook availability instead of relying on a fail-open patch.
wrapper.*¶
Wrapper image used by the init container during wrapper injection.
| Value | Type | Default | Description |
|---|---|---|---|
wrapper.image.repository |
string |
europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper |
Wrapper binary image |
wrapper.image.tag |
string |
v0.2.207 |
Wrapper image tag |
s3proxy.*¶
S3 encryption proxy sidecar image configuration.
| Value | Type | Default | Description |
|---|---|---|---|
s3proxy.image.repository |
string |
europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-s3-proxy |
S3 proxy image |
s3proxy.image.tag |
string |
v0.2.61 |
S3 proxy image tag |
ebpf.*¶
eBPF runtime enforcement daemonset.
| Value | Type | Default | Description |
|---|---|---|---|
ebpf.enabled |
bool |
true |
Deploy the eBPF enforcement daemonset |
ebpf.image.repository |
string |
europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-ebpf |
eBPF agent image |
ebpf.image.tag |
string |
v0.13.164 |
eBPF agent image tag |
ebpf.image.pullPolicy |
string |
IfNotPresent |
Image pull policy |
ebpf.enforceMode |
bool |
true |
Enable enforcement (block syscalls). When false, the agent only logs events |
ebpf.logAll |
bool |
false |
Log all monitored syscalls, not just security violations. Generates high event volume |
ebpf.reactiveKill |
bool |
true |
SIGKILL processes that leak secrets after detection. An additional layer on every kernel, not a substitute for synchronous blocking: the default chart does not count reactive kill as enforcement and reports HTTP 503 while a required vector has no synchronous deny path. See Kernel Compatibility. |
ebpf.priorityClassName |
string |
"" |
Priority class for eBPF pods. Set to system-node-critical for production (requires GKE quota) |
ebpf.resources.requests.cpu |
string |
100m |
CPU request for eBPF agent pods |
ebpf.resources.requests.memory |
string |
128Mi |
Memory request for eBPF agent pods |
ebpf.resources.limits.cpu |
string |
500m |
CPU limit for eBPF agent pods |
ebpf.resources.limits.memory |
string |
512Mi |
Memory limit for eBPF agent pods |
Reactive kill
Reactive kill terminates the offending process after the syscall returns, so it does not prevent disclosure. Kernels without CONFIG_BPF_KPROBE_OVERRIDE (for example RHEL 8, Debian 12/13 and Amazon Linux 2 default) have no synchronous kprobe path, and with the default chart the agent is not ready there. See Kernel Compatibility for the full per-distro matrix.
networkPolicy.*¶
Chart-managed NetworkPolicies, including direct store egress.
| Value | Type | Default | Description |
|---|---|---|---|
networkPolicy.enabled |
bool |
true |
Create chart-managed NetworkPolicies restricting ingress and egress, including direct store egress when configured |
networkPolicy.vaultCIDR |
string |
"" |
Store CIDR for chart-managed egress policies. When both this value and networkPolicy.secretstoreCIDR are empty, the store egress rule is omitted by default (fail closed). Unrestricted destination egress on the store port requires the explicit networkPolicy.allowOpenVaultEgress=true opt-in; it is not the empty-CIDR default. |
networkPolicy.vaultPort |
int |
8200 |
OpenBao server port for egress rules |
On helm upgrade, the pre-upgrade guard fails the release when a direct store address is set, the effective store CIDR is empty, and networkPolicy.allowOpenVaultEgress=false, unless upgradeGuard.allowSkew=true. That override bypasses the guard; it does not add the missing egress rule. Configure the required CIDR before upgrading.
These chart values do not configure the operator-generated protected workload policies. For direct mode with a Service DNS store address, add the selector-based workload egress policy allowing protected Pods to reach the store Pods on TCP 8200.
pdb.*¶
PodDisruptionBudget configuration.
| Value | Type | Default | Description |
|---|---|---|---|
pdb.enabled |
bool |
false |
Create a PodDisruptionBudget for the operator |
pdb.operator.minAvailable |
int |
1 |
Minimum number of operator pods that must be available during disruptions |
Full Default Values¶
namespace: cloudtaser-system
imagePullSecrets: []
operator:
ha: false
replicaCount: 1
leaderElect: false
image:
repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-operator
tag: "v0.13.209"
pullPolicy: IfNotPresent
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 200m
memory: 128Mi
vaultAddress: ""
webhook:
port: 9443
failurePolicy: Fail
timeoutSeconds: 10
wrapper:
image:
repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-wrapper
tag: "v0.2.207"
s3proxy:
image:
repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-s3-proxy
tag: "v0.2.61"
ebpf:
enabled: true
image:
repository: europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-ebpf
tag: "v0.13.164"
pullPolicy: IfNotPresent
enforceMode: true
logAll: false
reactiveKill: true
priorityClassName: ""
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
networkPolicy:
enabled: true
vaultCIDR: ""
vaultPort: 8200
pdb:
enabled: false
operator:
minAvailable: 1
OpenBao Chart¶
The published cloudtaser/cloudtaser-openbao chart 0.2.17
is maintained in cloudtaser-helm. It deploys the store and is separate from
Port. The OpenBao Helm values reference describes its
installation scope, administrator custody and TLS lifecycle.
The principal defaults below are generated from the published chart values.
tls.mode=openbao-pki is the production default. The CLI sets
bootstrap.enabled=false for source install bao, leaving initialization,
unsealing and provisioning to the administrator. The direct Helm default is
bootstrap.enabled=true; its post-install Job runs the bootstrap lifecycle
and requires administrator custody of the unseal shares. Neither route
qualifies Kubernetes Port.
Use the host-Port procedure for the measured
outbound-only EU-store connection.
| Value | Default from the published chart |
|---|---|
bootstrap.auth.path |
"kubernetes" |
bootstrap.enabled |
true |
bootstrap.image.digest |
"630c733aa0f24cf42ba06b6c493102384a5e1b97693e4c414dbf37ea974d5fc9" |
bootstrap.image.pullPolicy |
"IfNotPresent" |
bootstrap.image.repository |
"europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-bootstrap" |
bootstrap.image.tag |
"v0.4.133" |
bootstrap.kv.path |
"secret" |
bootstrap.policy.kvReadPaths |
["secret/data/*", "secret/metadata/*"] |
bootstrap.policy.name |
"cloudtaser" |
bootstrap.role.boundServiceAccountNames |
"cloudtaser-wrapper" |
bootstrap.role.boundServiceAccountNamespaces |
"default" |
bootstrap.role.name |
"cloudtaser" |
bootstrap.role.ttl |
"1h" |
bootstrap.shamir.shares |
5 |
bootstrap.shamir.threshold |
3 |
bootstrap.unsealMode |
"shamir-manual" |
namespace |
"" |
openbao.injector.enabled |
false |
openbao.server.auditStorage.enabled |
true |
openbao.server.auditStorage.size |
"10Gi" |
openbao.server.dataStorage.enabled |
true |
openbao.server.dataStorage.size |
"10Gi" |
openbao.server.ha.enabled |
true |
openbao.server.ha.raft.enabled |
true |
openbao.server.ha.replicas |
3 |
openbao.server.resources.limits.cpu |
"1" |
openbao.server.resources.limits.memory |
"512Mi" |
openbao.server.resources.requests.cpu |
"250m" |
openbao.server.resources.requests.memory |
"256Mi" |
tls.certManager.enabled |
false |
tls.enabled |
true |
tls.mode |
"openbao-pki" |
tls.openbaoPki.leafTTL |
"24h" |
tls.openbaoPki.renewBefore |
"8h" |
tls.openbaoPki.trustBundleConfigMap |
"openbao-tls-trust-bundle" |
Common Configuration Patterns¶
Production HA with enforcement¶
operator:
ha: true
replicaCount: 3
leaderElect: true
vaultAddress: "https://vault.eu.example.com"
webhook:
failurePolicy: Fail
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 256Mi
ebpf:
enabled: true
enforceMode: true
reactiveKill: true
priorityClassName: "system-node-critical"
resources:
requests:
cpu: 200m
memory: 256Mi
limits:
cpu: 1000m
memory: 1Gi
networkPolicy:
enabled: true
vaultCIDR: "10.128.0.0/16"
vaultPort: 8200
pdb:
enabled: true
operator:
minAvailable: 1
Development / testing¶
Use a qualified node configuration and the same strict admission policy for development. Restore webhook reachability when admission fails; development does not make a fail-open policy effective. See webhook recovery.