Helm values

The tables below list every configurable value in the Hub Helm charts, generated from the charts themselves.

Hub installs through the umbrella hub chart, which pulls in the hub-core and hub-connector subcharts. When configuring through the umbrella, set a subchart value under its key, like hub-core.api.replicaCount or hub-connector.connector.replicaCount. The hub-webui component is distributed as a separate OCI chart and is not covered here.

hub chart

Umbrella chart that deploys the full Hub stack — Hub Core, Hub Connector, Hub Inference, and Hub WebUI.

Key	Type	Default	Description
global.apiServiceName	string	"hub-core"	Name of the hub-core Service. Changing this one value rewires the connector and webui to the API automatically.
global.apiServicePort	int	8080	Port the hub-core Service listens on.
global.authServiceName	string	"hub-auth"	Name of the hub-auth Service. hub-core's HTTPRoute and the connector send token-exchange and OIDC front-door traffic here.
global.demo	object	(see fields below)	Install an opinionated, self-contained demo of the hub stack on the current Kubernetes cluster. When enabled, the chart also bundles PostgreSQL, Keycloak, and the Envoy Gateway controller, wires hub-core and hub-connector to them, and auto-registers the cluster as a default ControlPlane. The result is a complete stack that a prospect can browse without any external prerequisites. Demo only - fixed credentials, ephemeral storage, self-signed TLS. Not suitable for production. For production, leave demo.enabled false and supply your own PostgreSQL connection, identity providers, and ControlPlanes via hub-core.bootstrap.files. See the user documentation for more details.
global.demo.envoy	object	{"nodePorts":{"https":30443,"postgres":30432},"serviceType":"NodePort"}	Bundled Envoy Gateway data plane. NodePorts must match the host port mappings on the KIND cluster.
global.demo.keycloak.image	object	(see fields below)	Image used for the bundled demo Keycloak.
global.demo.keycloak.resources	object	{"limits":{"cpu":"1000m","memory":"1Gi"},"requests":{"cpu":"100m","memory":"512Mi"}}	Resource requests and limits for the Keycloak container.
global.demo.postgres.image	object	(see fields below)	Image used for the bundled demo PostgreSQL.
global.demo.postgres.resources	object	{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"50m","memory":"128Mi"}}	Resource requests and limits for the Postgres container.
global.demo.postgres.tcpRoute	object	{"enabled":true}	Requires gateway.listeners.postgres.enabled.
global.gateway	object	(see fields below)	Kubernetes Gateway API integration. Subchart HTTPRoutes gate on enabled. Forcefully enabled by demo mode.
global.gateway.domain	string	""	Apex domain. <subdomain>.<domain> composes per-service hostnames. When demo.enabled, this defaults to 127.0.0.1.nip.io.
global.gateway.gatewayClassName	string	""	Required when create=true. Identifies the GatewayClass that the cluster's Gateway controller has registered (e.g. "envoy", "istio", "cilium").
global.gateway.listeners.https.tls.certificateRefs	list	[]	Leave empty to offload TLS to the upstream (e.g. ACM on a cloud load balancer). Set refs to decrypt TLS inside the cluster.
global.gateway.namespace	string	""	Default = release namespace.
global.gateway.natsRoute	object	{"connectionIdleTimeout":"5m","enabled":false,"envoyTrafficPolicies":true,"path":"/_nats","serviceName":"nats","servicePort":8080}	NATS, the transport connectors reach Hub over. Connectors speak to NATS over a websocket on the API hostname. Requires the NATS server to have websockets enabled (the NATS chart's config.websocket.enabled) and a gateway that proxies websocket upgrades.
global.gateway.natsRoute.connectionIdleTimeout	string	"5m"	Idle timeout for a NATS connection. Must exceed the connector's NATS ping interval (10s) or idle connections are dropped.
global.gateway.natsRoute.envoyTrafficPolicies	bool	true	Emit an Envoy Gateway BackendTrafficPolicy lifting the route's request timeout. A NATS connection is held open indefinitely, so without this the gateway drops it at the default timeout. Requires Envoy Gateway; on any other implementation turn this off and raise the timeouts there.
global.gateway.natsRoute.path	string	"/_nats"	Path prefix on the API hostname that upgrades to a NATS websocket.
global.gateway.natsRoute.serviceName	string	"nats"	Name of the NATS Service in the release namespace.
global.gateway.natsRoute.servicePort	int	8080	Websocket port on that Service, which the NATS chart publishes as config.websocket.port.
global.gateway.parentRef	object	{"name":"hub-gateway","namespace":"","sectionName":""}	Used when create=false. Charts target this parentRef.
global.gateway.subdomains	object	{"api":"api","auth":"auth","db":"db","ui":"ui"}	Subdomain prefixes per service. Each subchart can override these locally via its own httpRoute.subdomain.
global.hubCoreExternalUrl	string	""	Externally reachable base URL for hub-core. Used by hub-webui to redirect the browser through the OIDC login flow, and by hub-core to construct OIDC callback URIs. Precedence: explicit value > hub-core.api.externalURL > gateway-derived (<scheme>://<gateway.subdomains.api>.<gateway.domain> when gateway integration is on). Empty for production installs without a gateway.
global.inference	object	{"enabled":false}	Upbound Inference. One switch: it installs the hub-inference subchart and turns on the Inference gate that makes hub-core publish the product as entitled. Setting hub-core.api.featureFlags.gates.Inference overrides the gate half, for an install that wants only one of the two.
global.spaces	object	{"enabled":false}	Spaces integration. When enabled, the connector registers as a space instead of a control plane, and (in demo mode) hub-core bootstraps a Space for it to register against.
global.tokenExchangePort	int	8444	Port the hub-auth Service listens on.
hub-auth	object	{"enabled":false}	Standalone auth authority (OIDC front-door, JWKS, token exchange). hub-core verifies hub JWTs against its JWKS, so an install that enables hub-core must enable and configure hub-auth (issuerURL, database, signing key). Off by default so a bare render stays valid; demo and production installs turn it on.
hub-connector.connector.fullnameOverride	string	"hub-connector"
hub-core	object	(see fields below)	PostgreSQL connection must be provided at install time. Either set connectionString or host + auth credentials.
hub-inference.api.fullnameOverride	string	"hub-inference"
hub-inference.postgresql	object	{"auth":{"password":{"existingSecretRef":{"key":"password","name":""},"value":""}},"connectionString":"","database":"postgres","host":"","port":5432,"sslmode":"disable","user":"postgres"}	hub-inference answers authorization from the same database hub-core does, and reads nothing else from it. Keep this in step with hub-core.postgresql above: each chart reads its own values and neither can see the other's.
hub-webui.fullnameOverride	string	"hub-webui"	Name for the hub-webui resources, the Service included. Without it the umbrella release prefixes the Service to "hub-hub-webui".

hub-core chart

REST/Kubernetes-style API that stores and serves resources.

Key	Type	Default	Description
aggregator	object	{"affinity":{},"backendPortName":"http","backendScheme":"http","containerPort":8080,"debug":false,"enabled":true,"extraEnv":[],"image":{"digest":"","pullPolicy":"IfNotPresent","registry":"","repository":"hub-discovery-aggregator","tag":""},"livenessProbe":{"failureThreshold":3,"httpGet":{"path":"/livez","port":"http"},"initialDelaySeconds":0,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1},"metricsPort":8085,"nodeSelector":{},"podAnnotations":{},"podLabels":{},"podSecurityContext":{"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"pollInterval":"30s","pollMaxBackoff":"5m","pollTimeout":"10s","rbac":{"create":true},"readinessDeadline":"45s","readinessProbe":{"failureThreshold":3,"httpGet":{"path":"/readyz","port":"http"},"initialDelaySeconds":2,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":2},"replicaCount":1,"resources":{},"resyncInterval":"10m","securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"service":{"annotations":{},"http":{"port":8080},"metrics":{"port":8085},"type":"ClusterIP"},"serviceAccount":{"annotations":{},"automount":true,"create":true,"name":""},"tolerations":[],"updateStrategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}}	The discovery aggregator serves one merged view of the API groups every Hub backend advertises, so a client can discover the whole surface in one place. It watches Services carrying the hub.upbound.io/api-backend label and polls each one's /apis document.
aggregator.backendPortName	string	"http"	Name of the Service port serving a backend's discovery document. Backends are addressed by port name so a backend can renumber its port without this changing.
aggregator.backendScheme	string	"http"	URL scheme used to reach backends. Backends serve plaintext behind the gateway today; set to https once they serve TLS directly. @schema enum: [http, https] @schema
aggregator.debug	bool	false	Run with debug logging.
aggregator.image.digest	string	""	Optional SHA256 digest pin.
aggregator.image.registry	string	""	Overrides the chart-wide registry for this workload.
aggregator.image.tag	string	""	Overrides the image tag whose default is the chart appVersion.
aggregator.pollInterval	string	"30s"	Steady-state interval between polls of a backend's discovery document.
aggregator.pollMaxBackoff	string	"5m"	Ceiling on the exponential backoff applied to a failing backend.
aggregator.pollTimeout	string	"10s"	Timeout for a single discovery request to a backend.
aggregator.rbac.create	bool	true	Create the namespaced read-only Role letting the aggregator watch Services. Disable only to supply an equivalent Role out of band.
aggregator.readinessDeadline	string	"45s"	How long readiness is withheld waiting for every backend to answer once. Bounds how long one permanently broken backend can hold the platform down.
aggregator.readinessProbe	object	{"failureThreshold":3,"httpGet":{"path":"/readyz","port":"http"},"initialDelaySeconds":2,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":2}	Readiness is withheld until every labelled backend has answered once, or until readinessDeadline elapses. While unready the gateway will not route, so a client gets a connection error rather than a silently short group list. @schema additionalProperties: true @schema
aggregator.resyncInterval	string	"10m"	Informer resync period, bounding how long a missed Service event goes unnoticed.
api.affinity	object	{}
api.args	list	[]	Additional command line arguments
api.autoscaling	object	{"enabled":false,"maxReplicas":100,"minReplicas":1,"targetCPUUtilizationPercentage":80}	This section is for setting up autoscaling more information can be found here: https://kubernetes.io/docs/concepts/workloads/autoscaling/
api.cors.allowedOrigins	list	[]	If empty, all origins are allowed
api.cors.enabled	bool	false	Auto-enabled (with the WebUI origin injected) when global.gateway.enabled, since the WebUI and API are routed to different subdomains. Also applies to the discovery aggregator, which the gateway serves under the same host.
api.externalURL	string	""	Externally reachable base URL used to construct the OIDC callback URI (e.g. https://api.example.com). Required when identity providers are configured; the callback will be: <externalURL>/oidc/callback
api.extraEnv	list	[]	Additional environment variables
api.extraInitContainers	list	[]	Additional init containers
api.extraVolumeMounts	list	[]	Additional volume mounts for the main container and its init-migrate gate
api.extraVolumes	list	[]	Additional volumes
api.featureFlags	object	(see fields below)	A built-in feature flag OFREP HTTP endpoint. When enabled, hub-core builds its flag definition in memory from the gates it ships (their defaults live in application code) and serves it over OFREP. Use gates below to override a gate's built-in default, and targetingOverlay to add rollout rules.
api.featureFlags.gates	object	{}	Feature gate overrides. Each gate ships a built-in default in application code; list a gate here only to override it, e.g. Catalog: true. Unknown or locked gates fail hub-core startup. Rendered to --feature-gates.
api.featureFlags.targetingOverlay	object	{"configMapRef":{"key":"flags.json","name":""}}	Optional targeting overlay: a ConfigMap holding a flagd flags.json that adds JSONLogic targeting rules or extra variants on top of the generated gate definition (for per-organization / per-control-plane rollout). It is hot-reloaded, so edits take effect without a pod restart.
api.frontendURL	string	""	Post-login redirect target (e.g. https://app.example.com). When empty and the Gateway integration is on, auto-derives from global.gateway.subdomains.ui + domain. When empty and gateway is off, hub-core redirects to "/" relative to the callback host.
api.fullnameOverride	string	""
api.hmacKey	object	(see fields below)	HMAC key used for session cookie signing (HMAC-SHA256). The Secret must hold a base64-encoded key of at least 32 raw bytes. This is NOT an ECDSA/JWK signing key - see signingKey below for that.
api.hmacKey.annotations	object	{}	Annotations to add to the generated Secret. Use this to configure CD-specific behavior (e.g. ArgoCD sync options, Flux drift detection).
api.hmacKey.existingPreviousSecretRef	object	{"key":"HMAC_KEY_PREVIOUS","name":""}	Optional reference for HMAC key rotation. May point at the same Secret as existingSecretRef with a different key, or a different Secret entirely.
api.hmacKey.existingSecretRef	object	{"key":"HMAC_KEY","name":""}	Reference to a pre-existing Secret holding the active HMAC key. When existingSecretRef.name is set, the chart will not generate one.
api.hmacKey.generate	bool	true	Generate a random 32-byte HMAC key on first install. Ignored when existingSecretRef.name is set.
api.hubAuthJWKSURL	string	""	Overrides the hub-auth JWKS endpoint hub-core verifies hub-issued JWTs against. Empty leaves hub-core's default, the in-cluster hub-auth Service (http://hub-auth:8444/openid/v1/jwks); set it when hub-auth runs outside the cluster or under a different Service name.
api.hubInit	object	{"image":{"digest":"","registry":"","repository":"hub-init","tag":""}}	Image used by the init-signing-key and init-hmac-key init containers. Runs the hub-init binary; defaults to the chart registry and appVersion like the main api image.
api.hubInit.image.digest	string	""	Optional SHA256 digest pin.
api.hubInit.image.registry	string	""	Overrides the chart-wide registry for this image.
api.hubInit.image.tag	string	""	Overrides the image tag whose default is the chart appVersion.
api.image.digest	string	""	Optional SHA256 digest pin.
api.image.pullPolicy	string	"IfNotPresent"
api.image.registry	string	""	Overrides the chart-wide registry for this workload.
api.image.repository	string	"hub-core"
api.image.tag	string	""	Overrides the image tag whose default is the chart appVersion.
api.initDb	object	(see fields below)	Image used by the init-db init container to wait for PostgreSQL.
api.livenessProbe.failureThreshold	int	3
api.livenessProbe.httpGet.path	string	"/livez"
api.livenessProbe.httpGet.port	string	"http"
api.livenessProbe.initialDelaySeconds	int	0
api.livenessProbe.periodSeconds	int	10
api.livenessProbe.successThreshold	int	1
api.livenessProbe.timeoutSeconds	int	1
api.migration	object	{"extraInitContainers":[],"extraVolumeMounts":[],"extraVolumes":[],"serviceAccount":{"annotations":{},"automount":true,"create":true,"name":""}}	Dedicated ServiceAccount for the DB migration Job.
api.migration.extraInitContainers	list	[]	Additional init containers to attach to the migration Job pod.
api.migration.extraVolumeMounts	list	[]	Additional volume mounts on the sql-migrate container.
api.migration.extraVolumes	list	[]	Additional volumes attached to the migration Job pod.
api.migration.serviceAccount.name	string	""	Override the generated SA name. When create is false this MUST be set to an SA that exists in the release namespace before install.
api.nameOverride	string	""
api.nodeSelector	object	{}
api.pdb	object	{"create":false,"maxUnavailable":1,"minAvailable":""}	PodDisruptionBudget. Off by default; turn on when replicaCount > 1 or autoscaling is enabled.
api.podAnnotations	object	{}	This is for setting Kubernetes Annotations to a Pod. For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
api.podLabels	object	{}	This is for setting Kubernetes Labels to a Pod. For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
api.podSecurityContext.fsGroup	int	65532
api.podSecurityContext.runAsGroup	int	65532
api.podSecurityContext.runAsNonRoot	bool	true
api.podSecurityContext.runAsUser	int	65532
api.podSecurityContext.seccompProfile.type	string	"RuntimeDefault"
api.readinessProbe.failureThreshold	int	3
api.readinessProbe.httpGet.path	string	"/readyz"
api.readinessProbe.httpGet.port	string	"http"
api.readinessProbe.initialDelaySeconds	int	5
api.readinessProbe.periodSeconds	int	3
api.readinessProbe.successThreshold	int	1
api.readinessProbe.timeoutSeconds	int	1
api.replicaCount	int	1	This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
api.resources	object	{}
api.sampleEmailBasedOIDCConfig	object	{"allowedDomain":"","clientID":"","clientSecret":"","groupsClaim":"groups","issuerURL":"","prompt":null,"providerName":"","requireVerifiedEmail":true,"usernameClaim":"email"}	Sample OIDC identity-provider bootstrap. When issuerURL and clientID are set, an IdentityProvider YAML file is appended to the bootstrap config Secret. This provider: - drives the browser redirect login, unless global.demo.enabled is set, in which case the demo keycloak provider keeps that role - redirects to the issuer's discovery-advertised authorization URL - uses the specified client ID and secret - authenticates user with username "<providerName>:<usernameClaim value>" - maps the groupsClaim to hub groups, prefixed with "<providerName>:" - (if requireVerifiedEmail) requires the email_verified claim to be true - (if allowedDomain is set) forces the username to end with @<allowedDomain>
api.sampleEmailBasedOIDCConfig.allowedDomain	string	""	Optional: restrict logins to a single email domain. Matches the mapped username, not the email claim, so it only means what it reads when usernameClaim is "email"; a provider login can carry a different domain or none at all, rejecting every user. Gate access in the provider instead.
api.sampleEmailBasedOIDCConfig.clientID	string	""	OIDC client ID (audience)
api.sampleEmailBasedOIDCConfig.clientSecret	string	""	OIDC client secret for the redirect flow
api.sampleEmailBasedOIDCConfig.groupsClaim	string	"groups"	Token claim carrying the user's group membership. Group values are prefixed with "<providerName>:", so an OrganizationRoleBinding subject for the "admin" group is named "<providerName>:admin". Providers that publish groups under a non-standard claim need this overridden -- e.g. Amazon Cognito uses "cognito:groups". Set to "" to omit the mapping, which leaves only per-user role bindings working. An absent claim is not an error: the user resolves with no groups, so group role bindings silently never match. Providers that withhold groups from the ID token must be configured provider-side -- Okta needs a groups claim on the authorization server set to "Always" for ID Token.
api.sampleEmailBasedOIDCConfig.issuerURL	string	""	OIDC issuer URL (e.g. https://accounts.google.com)
api.sampleEmailBasedOIDCConfig.prompt	string	nil	OIDC "prompt" parameter for the login redirect. Leave unset (null) to force re-consent on every login (prompt=consent), which providers like Google require to reissue a refresh token. Set to "" to omit the parameter entirely so a provider with consent already granted (e.g. Entra with org-wide admin consent) does not show a consent screen on every login. Other values ("login", "select_account") are sent as-is.
api.sampleEmailBasedOIDCConfig.providerName	string	""	Name of the OIDC provider (default: "oidc")
api.sampleEmailBasedOIDCConfig.requireVerifiedEmail	bool	true	Require the email_verified claim to be present and true. Set to false for providers that omit it: Okta serves it from /userinfo whenever an access token accompanies the ID token, which the authorization code flow always does, and Entra never emits it at all. This relaxes only the absent case -- with usernameClaim "email" the apiserver rejects email_verified: false on its own.
api.sampleEmailBasedOIDCConfig.usernameClaim	string	"email"	Token claim whose value becomes the hub username, prefixed with "<providerName>:". An absent claim fails authentication, so it must match what the provider emits. "email" covers Google, Keycloak, Okta, and Entra users with a mail attribute; use "preferred_username" where the provider login rather than the mail address is the identity.
api.securityContext.allowPrivilegeEscalation	bool	false
api.securityContext.capabilities.drop[0]	string	"ALL"
api.securityContext.privileged	bool	false
api.securityContext.readOnlyRootFilesystem	bool	true
api.securityContext.runAsGroup	int	65532
api.securityContext.runAsNonRoot	bool	true
api.securityContext.runAsUser	int	65532
api.securityContext.seccompProfile.type	string	"RuntimeDefault"
api.service	object	{"annotations":{},"api":{"port":8080,"type":"ClusterIP"},"metrics":{"port":8085,"type":"ClusterIP"}}	This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
api.service.api	object	{"port":8080,"type":"ClusterIP"}	The main service for the API.
api.service.metrics	object	{"port":8085,"type":"ClusterIP"}	The Prometheus metrics endpoint service for the API.
api.serviceAccount	object	{"annotations":{},"automount":true,"create":true,"name":""}	This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
api.serviceAccount.annotations	object	{}	Annotations to add to the service account
api.serviceAccount.automount	bool	true	Automatically mount a ServiceAccount's API credentials?
api.serviceAccount.create	bool	true	Specifies whether a service account should be created
api.serviceAccount.name	string	""	The name of the service account to use. If not set and create is true, a name is generated using the fullname template
api.signingKey	object	{"annotations":{},"existingSecretRef":{"name":""},"generate":true}	Signing key for hub-issued JWTs. Must be an ECDSA P-256 key pair in Kubernetes TLS Secret format (standard tls.crt + tls.key keys).
api.signingKey.existingSecretRef	object	{"name":""}	Reference to a pre-existing TLS Secret. When existingSecretRef.name is set, the chart will not generate one. The Secret MUST use the standard tls.crt / tls.key keys.
api.startupProbe	object	(see fields below)	Startup probe gives slow first-start work (signing-key gen, HMAC gen) room to finish before liveness starts evicting the pod.
api.tokenExchange	object	{"port":8444,"service":{"annotations":{},"type":"ClusterIP"}}	The internal Hub OIDC token exchange service for the API.
api.tolerations	list	[]
api.tracing	object	{"enabled":false,"url":""}	OpenTelemetry tracing configuration.
api.updateStrategy	object	{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}	Deployment update strategy. Defaults to RollingUpdate with maxSurge=1 / maxUnavailable=0. During a rolling upgrade the pod count stays at replicaCount + 1, never below replicaCount, so an in-flight request is always served by a Ready pod.
apisql	object	{"image":{"repository":"hub-sql-migrate","tag":""}}	Configuration for the hub-sql-migrate image, which runs the migration Job and the api pods' init-migrate gate
apisql.image.repository	string	"hub-sql-migrate"	Override the registry for this image (defaults to global registry) registry: ""
apisql.image.tag	string	""	Overrides the image tag whose default is the chart appVersion.
bootstrap	object	{"admins":[],"files":{}}	Bootstrap configuration loaded at startup.
bootstrap.admins	list	[]	Subjects granted both org-admin and realm-admin of the "default" realm. A convenience shortcut so operators declare admins in one place instead of maintaining an OrganizationRoleBinding and a RealmRoleBinding in lockstep. Users who need finer-grained scoping (org-admin only, or realm-admin of a non-default realm) should provide raw manifests via bootstrap.files instead.
bootstrap.files	object	{}	YAML files to include in the bootstrap config Secret. Each key is a filename and each value is the file content. Use this to register IdentityProviders, ControlPlanes, or OrganizationRoleBindings at install time. To register a connector against a bootstrapped ControlPlane, mint a token via the registrationtoken subresource after install. Example: files: my-cp.yaml:
global	object	{}	Populated by the umbrella chart at install time.
httpRoute	object	{"annotations":{},"domain":"","enabled":false,"hostnames":[],"labels":{},"parentRefs":[],"subdomain":"api"}	Kubernetes Gateway API HTTPRoute. When installed under the umbrella with global.gateway.enabled, the umbrella's parentRef and domain win. For standalone installs, set enabled=true and supply parentRefs (or subdomain+domain).
httpRoute.hostnames	list	[]	If set, replaces the composed <subdomain>.<domain> hostname.
imagePullSecrets	list	[]	Chart-wide image pull secrets. Falls back to global.imagePullSecrets.
otelGateway	object	(see fields below)	Feature gate: Metrics (alpha). These values configure the Metrics feature and are only consumed when the Metrics gate is enabled. Enabling that gate requires otelGateway.enabled=true. When enabled, deploys an OpenTelemetry Collector as a gateway that receives metrics from control plane collectors via OTLP and writes them to Prometheus.
otelGateway.extraMetricAllowlist	list	[]	Additional metric-name regular expressions the gateway accepts, on top of the chart's built-in list. The gateway drops any metric matching neither.
otelGateway.image	object	{"digest":"","pullPolicy":"IfNotPresent","registry":"","repository":"opentelemetry-collector-hub","tag":""}	OpenTelemetry Collector image for the otel-gateway. Defaults to Upbound's build, which includes only the components this pipeline needs; override the fields below to run any other collector image.
otelGateway.image.digest	string	""	Optional SHA256 digest pin.
otelGateway.image.registry	string	""	Overrides the chart-wide registry for this workload.
otelGateway.image.tag	string	""	Overrides the image tag whose default is the chart appVersion.
otelGateway.metrics	object	{"amp":{"region":"","writeEndpoint":""},"amw":{"identity":"workloadIdentity","ingestScope":"https://monitor.azure.com/.default","managedIdentity":{"clientID":""},"queryScope":"https://prometheus.monitor.azure.com/.default","servicePrincipal":{"clientID":"","secretRef":{"key":"client-secret","name":""},"tenantID":""},"writeEndpoint":""},"backend":"","gmp":{"project":""},"prometheus":{"insecure":true,"writeEndpoint":""},"queryURL":""}	metrics selects which Prometheus-compatible backend the gateway ships to, and where the metrics query API reads them back. Only the selected backend's settings are used.
otelGateway.metrics.backend	string	""	backend selects the exporter. Required when otelGateway.enabled - set it explicitly rather than relying on a default. prometheus - Prometheus remote-write (self-hosted, or any remote-write endpoint) gmp - native Google Managed Prometheus exporter (gRPC, ADC) amp - Amazon Managed Prometheus: remote-write signed with AWS SigV4 (credentials from the pod, e.g. IRSA) amw - Azure Monitor managed service for Prometheus: remote-write bearing a Microsoft Entra ID token (workload or managed identity)
otelGateway.metrics.gmp	object	{"project":""}	Settings for the "gmp" backend. The exporter writes to the Google Cloud Monitoring API - there is no endpoint to configure, only the project - and authenticates via Application Default Credentials, so the gateway ServiceAccount must carry a Google identity with roles/monitoring.metricWriter (Workload Identity or a mounted key), wired at deploy time.
otelGateway.metrics.gmp.project	string	""	GCP project metrics are written to. Auto-detected from the pod environment when empty.
otelGateway.metrics.prometheus	object	{"insecure":true,"writeEndpoint":""}	Settings for the "prometheus" backend.
otelGateway.metrics.prometheus.insecure	bool	true	Disable client transport security. Does not skip certificate verification: an https:// writeEndpoint stays verified either way.
otelGateway.metrics.prometheus.writeEndpoint	string	""	Remote-write URL the gateway pushes metrics to.
otelGateway.metrics.queryURL	string	""	Base URL the metrics query API reads from. Deployment-specific: a Prometheus/Thanos service, a GMP-compatible endpoint (e.g. a GMP frontend proxy) for the gmp backend, the AMP workspace URL for the amp backend, or the Azure Monitor workspace query endpoint for the amw backend.
otelGateway.service.grpc	object	{"port":4317}	The OTLP gRPC receiver port.
otelGateway.service.http	object	{"port":4318}	The OTLP HTTP receiver port.
postgresql.auth.aws	object	{"region":""}	AWS RDS IAM settings, used when cloud is "aws".
postgresql.auth.aws.region	string	""	RDS region. Falls back to the AWS_REGION env var when unset.
postgresql.auth.cloud	string	""	Cloud provider for IAM auth. Required when mode is "iam". One of: "aws", "gcp", "azure" (only "aws" is implemented today).
postgresql.auth.mode	string	"password"	Authentication mode: "password" (default) or "iam". In iam mode hub-core mints a short-lived cloud IAM token per connection - no static credential is set, and the connection is forced over TLS (sslmode=require minimum).
postgresql.auth.password	object	{"existingSecretRef":{"key":"password","name":""},"value":""}	Postgres password. Used in password auth mode. Provide either the plaintext value (dev only) or a reference to an existing Secret.
postgresql.auth.password.existingSecretRef	object	{"key":"password","name":""}	Reference to an existing Secret holding the password.
postgresql.auth.password.value	string	""	Plaintext password — dev only, not recommended for production.
postgresql.connectionString	string	""	Option 1: Provide a full connection string (takes precedence over individual parameters)
postgresql.database	string	"postgres"
postgresql.host	string	""	Option 2: Provide individual connection parameters
postgresql.port	int	5432
postgresql.sslmode	string	"disable"
postgresql.user	string	"postgres"
registry	string	"xpkg.upbound.io/upbound"	Chart-wide default registry. Per-workload <workload>.image.registry overrides this. Falls back to global.imageRegistry when both are empty.
transport	object	(see fields below)	Serves Kubernetes requests addressed to a control plane, over NATS. The hub-connector chart deploys the other end. Requires a NATS server whose account has auth callout configured. There is no credential to supply: the workload authenticates with its own ServiceAccount token.
transport.debug	bool	false	Log where each request was sent and why. Verbose; turn it on when calls fail in transit rather than at the control plane they were addressed to.
transport.extraArgs	list	[]	Additional command-line arguments.
transport.forwardMetrics	bool	false	Send the metrics that control plane connectors report over the transport to the OTel gateway, labelled with each control plane's realm and name. Requires otelGateway.enabled.
transport.image	object	{"digest":"","pullPolicy":"IfNotPresent","registry":"xpkg.upbound.io/upbound-dev","repository":"fabric-proxy","tag":"v0.0.0-599.g9b439e7"}	Transport proxy image.
transport.image.digest	string	""	Optional SHA256 digest pin.
transport.image.registry	string	"xpkg.upbound.io/upbound-dev"	Overrides the chart-wide registry for this workload.
transport.natsSentinel	string	""	Sentinel the proxy presents with its access token to reach the NATS auth callout: the public bearer JWT of its trust domain's auth account. Empty relies on the NATS server's default sentinel.
transport.natsUrl	string	""	NATS server URL. Empty addresses the NATS Service deployed alongside hub-core, in this release's namespace. Set it to reach a NATS elsewhere.
transport.otlp.metricEndpoint	string	""	OTLP HTTP endpoint for metrics. Empty disables metrics.
transport.otlp.traceEndpoint	string	""	OTLP gRPC endpoint for traces. Empty disables tracing.
transport.serviceAccount	object	{"annotations":{},"automount":true,"create":true,"name":""}	The chart annotates this ServiceAccount with the identity the NATS auth callout authorizes the connection against, so setting create=false means carrying those annotations over to the ServiceAccount you supply. Anything under annotations here is added alongside them.
transport.tokenCacheTTL	string	"60s"	How long a caller's validated bearer token stays cached. This is also how long a revoked token keeps working, so lower it to shorten that window at the cost of more API server traffic.

hub-connector chart

A Helm chart for deploying the Hub Connector

Key	Type	Default	Description
collector	object	(see fields below)	OTEL collector that scrapes control plane metrics, filters to a curated set, stamps identity labels, and exports to the hub-side gateway.
collector.image	object	{"digest":"","pullPolicy":"IfNotPresent","registry":"","repository":"opentelemetry-collector-hub","tag":""}	OpenTelemetry Collector image for the connector's scrape collector. Defaults to Upbound's build, which includes only the components this pipeline needs; override the fields below to run any other collector image.
collector.image.digest	string	""	Optional SHA256 digest pin.
collector.image.registry	string	""	Overrides the chart-wide registry for this workload.
collector.image.tag	string	""	Overrides the image tag whose default is the chart appVersion.
collector.metricAllowlist	list	["controller_runtime_reconcile_total","controller_runtime_reconcile_errors_total","controller_runtime_reconcile_time_seconds.*","upjet_resource_external_api_calls_total","function_run_function_seconds.*","kube_customresource_.*","modelplane_.*"]	Curated metric allowlist - only these metrics leave the control plane.
collector.otlp	object	{"enabled":false,"fromNamespaces":[],"port":4318}	Accept OTLP metrics sent from the listed namespaces on this cluster, and forward them to Hub. With none listed, nothing can send.
collector.scrapeNamespaces	list	["crossplane-system","upbound-system"]	Namespaces to scrape for Crossplane metrics. The collector discovers pods with label app=crossplane in these namespaces and scrapes port 8080. - Vanilla Crossplane: ["crossplane-system"] - UXP: ["upbound-system"]
connector	object	(see fields below)	Main connector workload. Exchanges registration token for a hub credential, pushes JWKS, and syncs cluster resources to the hub.
connector.credentials	object	{"existingSecretRef":{"key":"registrationToken","name":"hub-connector-credentials"}}	Credentials the connector exchanges for a Hub JWT on first start.
connector.featureFlags	object	{"enabled":false,"ofrepHost":"","ofrepPort":8016}	Feature flag evaluation via hub-core's OFREP endpoint.
connector.hub	object	{"issuer":"","tokenExchangeUrl":"","url":""}	hub-core connection. Where the connector talks to.
connector.hub.issuer	string	""	Hub issuer the connector pins when discovering the token exchange. Defaults to hub.url or, in-cluster, global.hubCoreExternalUrl.
connector.hub.tokenExchangeUrl	string	""	Pin the token exchange endpoint instead of discovering it (escape hatch).
connector.hub.url	string	""	hub-core URL. If empty, falls back to global.apiServiceName + global.apiServicePort.
connector.hubAuthServiceAccount	object	{"name":"","namespace":""}	ServiceAccount whose token the connector mints from the control plane it represents and exchanges for a hub credential. Defaults to the connector's own ServiceAccount in the release namespace, which is correct for an in-cluster install. For a connector that reaches its control plane through a mounted kubeconfig, set these to a ServiceAccount that exists in that cluster.
connector.image.registry	string	""	Overrides the chart-wide registry for this workload.
connector.initImage	string	"busybox:1.38"	Image used by the demo-mode init container that waits for hub-core.
connector.jwks	object	{"pushInterval":"1h"}	JWKS publishing. The connector pushes its cluster's signing keys to hub-core so the hub can verify the tokens the connector mints.
connector.livenessProbe	object	{}	TODO: connector binary doesn't yet serve /livez/readyz. Once a health listener is added, populate these with the standard probe quartet.
connector.rbac.clusterRole.rules	list	[{"apiGroups":["apiextensions.k8s.io"],"resources":["customresourcedefinitions"],"verbs":["get","list","watch"]},{"apiGroups":["*"],"resources":["*"],"verbs":["get","list","watch"]},{"apiGroups":[""],"resources":["namespaces"],"verbs":["get"]}]	Rules granting the connector access to the cluster it runs in.
connector.service	object	{"annotations":{},"port":4318,"type":"ClusterIP"}	The connector's local metrics-proxy Service. Only rendered when collector.enabled is true; the collector forwards through it to the upstream hub-side OTEL gateway.
connector.spaces	object	(see fields below)	Spaces integration. When enabled, reconciles ObjectRoleBinding and RealmRoleBinding resources against a Spaces API server.
connector.spaces.controlPlaneConnector	object	{"collector":{"enabled":false,"resources":{}},"debug":null,"excludeResources":[],"jwksPushInterval":null,"nodeSelector":{},"rediscoveryInterval":null,"resources":{},"rsm":{"enabled":false,"resources":{}},"tolerations":[],"transport":{"debug":false,"enabled":false,"maxConcurrentStreams":64,"maxConcurrentUnary":256,"requestTimeout":"30s","resources":{}}}	Config for the per-control-plane connectors a space connector deploys. Each field defaults to the space connector's own config; set one to override it for every control plane connector in the space.
connector.spaces.controlPlaneConnector.collector	object	{"enabled":false,"resources":{}}	Collector per control plane. Configured by the collector values.
connector.spaces.controlPlaneConnector.collector.resources	object	{}	Compute resource requests/limits for control plane connectors' OTEL collectors.
connector.spaces.controlPlaneConnector.excludeResources	list	[]	Resources to exclude from syncing, formatted as "apiVersion=<apiVersion>,kind=<Kind>". Can be repeated.
connector.spaces.controlPlaneConnector.nodeSelector	object	{}	Node selector for every per-control-plane pod.
connector.spaces.controlPlaneConnector.resources	object	{}	Compute resource requests/limits for control plane connectors.
connector.spaces.controlPlaneConnector.rsm	object	{"enabled":false,"resources":{}}	RSM per control plane. Configured by the rsm values. Requires collector.
connector.spaces.controlPlaneConnector.rsm.resources	object	{}	Compute resource requests/limits for control plane connectors' resource-state-metrics servers.
connector.spaces.controlPlaneConnector.tolerations	list	[]	Tolerations for every per-control-plane pod.
connector.spaces.controlPlaneConnector.transport.debug	bool	false	Emit routing decisions to the log.
connector.spaces.controlPlaneConnector.transport.enabled	bool	false	Run a transport sidecar in each control plane connector.
connector.spaces.controlPlaneConnector.transport.maxConcurrentStreams	int	64	Per-replica cap on concurrent streaming sessions (watch, logs).
connector.spaces.controlPlaneConnector.transport.maxConcurrentUnary	int	256	Per-replica cap on in-flight unary API server calls. Requests past the cap are answered 429.
connector.spaces.controlPlaneConnector.transport.requestTimeout	string	"30s"	Per-request API server call deadline on the unary lane.
connector.spaces.controlPlaneConnector.transport.resources	object	{}	Compute resource requests/limits for control plane connectors' transport sidecars.
connector.spaces.kubeconfig	object	{"existingSecretRef":{"key":"kubeconfig","name":""}}	Kubeconfig for a Spaces API server outside this cluster, read from a Secret in the release namespace. The connector syncs through it, and the transport sidecar sends the requests it receives to the same server. Leave the name empty to use the cluster the connector runs in.
connector.sync	object	{"excludeResources":[],"limitToClusterRoles":["crossplane-admin"],"rediscoveryInterval":"20s"}	Resource sync - controls which Kubernetes resources are synced to the Hub and how aggressively the connector rediscovers the cluster API surface.
connector.sync.excludeResources	list	[]	Resources to exclude from syncing, formatted as "apiVersion=<apiVersion>,kind=<Kind>". Can be repeated.
connector.sync.limitToClusterRoles	list	["crossplane-admin"]	ClusterRoles whose rules define which resources are synced. Only resources authorized by at least one of these roles are synced. Set to [] to sync all resources (no ClusterRole filtering). In demo mode (global.demo.enabled) this default is replaced with the built-in cluster-admin role to smooth the demo experience.
connector.terminationGracePeriodSeconds	int	30	Termination grace period, in seconds. The connector derives its shutdown drain budget from this value so the drain finishes before SIGKILL.
connector.transport	object	(see fields below)	The connector's NATS transport. Runs as a sidecar serving Kubernetes requests addressed to this control plane against its API server, answering the hub-side proxy in the hub-core chart. Identity is not configured here. The resolve-identity init container asks Hub which control plane this is and writes the answer to a file the sidecar reads, because a control plane's realm and name are only known after it has registered. The sidecar reuses the connector's ServiceAccount and forwards the caller identity the hub-side proxy asserts, so a request is authorized as the original caller rather than as the connector. That needs the impersonate rights granted in transport-rbac.yaml.
connector.transport.allowPlaintext	bool	false	Allow the transport sidecars to obtain their access token over NATS without TLS, which sends it in the clear. A NATS URL without TLS, such as the in-cluster default, needs it.
connector.transport.debug	bool	false	Emit routing decisions to the log. Verbose; useful when a call returns a fabric error rather than an API server response.
connector.transport.enabled	bool	true	Run the transport sidecar.
connector.transport.extraArgs	list	[]	Additional command-line arguments.
connector.transport.image	object	{"digest":"","pullPolicy":"IfNotPresent","registry":"xpkg.upbound.io/upbound-dev","repository":"cp-agent","tag":"v0.0.0-599.g9b439e7"}	Transport proxy image.
connector.transport.image.digest	string	""	Optional SHA256 digest pin.
connector.transport.image.registry	string	"xpkg.upbound.io/upbound-dev"	Overrides the chart-wide registry for this workload.
connector.transport.issuer	string	""	Issuer the transport sidecars trust to mint their access token. Empty uses connector.hub.issuer, or what that defaults to when connector.hub.tokenExchangeUrl is empty.
connector.transport.maxConcurrentStreams	int	64	Per-replica cap on concurrent streaming sessions (watch, logs).
connector.transport.maxConcurrentUnary	int	256	Per-replica cap on in-flight unary API server calls. Requests past the cap are answered 429.
connector.transport.natsSentinel	string	""	Sentinel the transport sidecars present with their access tokens to reach the NATS auth callout: the public bearer JWT of their trust domain's auth account. It applies to this connector's sidecar and to the sidecars of the control plane connectors it deploys. Empty relies on the NATS server's default sentinel.
connector.transport.natsUrl	string	""	NATS server URL. Empty derives it from connector.hub.url, which Hub serves NATS on as a websocket: the same host and port, one path over. When connector.hub.url is also empty the connector is addressing hub-core's in-cluster Service, which fronts no gateway, so it speaks TCP to the in-cluster NATS Service instead. Set this only for a NATS that is not on the Hub domain; ws:// and wss:// are both accepted. A URL without TLS needs allowPlaintext.
connector.transport.otlpEndpoint	string	""	OTLP gRPC endpoint for traces. Empty disables tracing.
connector.transport.requestTimeout	string	"30s"	Per-request API server call deadline on the unary lane.
global	object	{}	Populated by the umbrella chart at install time.
imagePullSecrets	list	[]	Chart-wide image pull secrets. Falls back to global.imagePullSecrets.
registry	string	"xpkg.upbound.io/upbound"	Chart-wide default registry. Per-workload <workload>.image.registry overrides this. Falls back to global.imageRegistry when both are empty.
rsm	object	(see fields below)	Resource State Metrics. Exposes per-resource condition gauges. Wired through the collector. Only rendered when collector.enabled AND rsm.enabled.
rsm.apiGroups	list	["*"]	API groups to watch. Controls both RBAC and the ResourceMetricsMonitor stores - one store per group. Each group creates informers that consume memory. Defaults to all groups. To reduce resource usage, scope to specific provider groups (e.g. ["pkg.crossplane.io", "s3.aws.upbound.io"]).
rsm.image.registry	string	"xpkg.crossplane.io"	Overrides the chart-wide registry for this workload.
rsm.monitor.create	bool	true	Whether to render the ResourceMetricsMonitor in the release namespace.

hub-inference chart

Installs and maintains Upbound Inference in every realm that declares it.

Key	Type	Default	Description
api.affinity	object	{}
api.apiKeyBundleInterval	string	"30s"	How often every realm's API key bundle is regenerated. It bounds how long a revoked key keeps working, before the bundle reaches the inference clusters.
api.args	list	[]	Additional command line arguments
api.auth	object	{"issuerURL":"","jwksURL":""}	Where a hub token is verified against. Only public keys are read; no key material is mounted.
api.auth.issuerURL	string	""	Issuer a hub token must name. Empty composes the in-cluster token exchange Service the hub-core chart deploys.
api.auth.jwksURL	string	""	Where the issuer's public keys are read from. Empty composes the same Service, which keeps verification off the gateway.
api.autoscaling	object	{"enabled":false,"maxReplicas":100,"minReplicas":1,"targetCPUUtilizationPercentage":80}	Horizontal autoscaling. Replicas beyond the lease holder stand by rather than share the work, so this buys a faster takeover, not throughput.
api.cors	object	{"allowedOrigins":[],"enabled":false}	Browsers call this API from the Web UI's origin, which the gateway serves on a different subdomain. Automatically on when a gateway is configured.
api.debug	bool	false	Enable debug logging.
api.extraEnv	list	[]	Additional environment variables
api.extraInitContainers	list	[]	Additional init containers
api.extraVolumeMounts	list	[]	Additional volume mounts for the main container
api.extraVolumes	list	[]	Additional volumes
api.fullnameOverride	string	""
api.image.digest	string	""	Optional SHA256 digest pin.
api.image.pullPolicy	string	"IfNotPresent"
api.image.registry	string	""	Overrides the chart-wide registry for this workload.
api.image.repository	string	"hub-inference"
api.image.tag	string	""	Overrides the image tag whose default is the chart appVersion.
api.initDb	object	{"image":{"digest":"sha256:dc2d74b28e4cf8984fa52af1f39bc7c3d9c73760b41a74d629f5d11b1ab28616","repository":"docker.io/library/busybox","tag":"1.38"}}	Image of the container that waits for the database before the API starts.
api.leaderElection	object	{"enabled":true}	Which replica reconciles. The lease is a coordination.k8s.io Lease named after the release, in the release namespace, and the chart grants the ServiceAccount the RBAC to hold it.
api.leaderElection.enabled	bool	true	Turning this off is safe only at a replicaCount of 0 or 1: two replicas without a lease run the same plan against the same control plane at the same time.
api.livenessProbe.failureThreshold	int	3
api.livenessProbe.httpGet.path	string	"/livez"
api.livenessProbe.httpGet.port	string	"http"
api.livenessProbe.initialDelaySeconds	int	0
api.livenessProbe.periodSeconds	int	10
api.livenessProbe.successThreshold	int	1
api.livenessProbe.timeoutSeconds	int	1
api.nameOverride	string	""
api.nodeSelector	object	{}
api.pdb	object	{"create":false,"maxUnavailable":1,"minAvailable":""}	PodDisruptionBudget. Off by default, where the one replica an eviction takes is the only one a budget could hold back. Turn it on alongside a higher replicaCount so a drain cannot evict every replica at once.
api.podAnnotations	object	{}	This is for setting Kubernetes Annotations to a Pod. For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
api.podLabels	object	{}	This is for setting Kubernetes Labels to a Pod. For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
api.podSecurityContext.fsGroup	int	65532
api.podSecurityContext.runAsGroup	int	65532
api.podSecurityContext.runAsNonRoot	bool	true
api.podSecurityContext.runAsUser	int	65532
api.podSecurityContext.seccompProfile.type	string	"RuntimeDefault"
api.readinessProbe.failureThreshold	int	3
api.readinessProbe.httpGet.path	string	"/readyz"
api.readinessProbe.httpGet.port	string	"http"
api.readinessProbe.initialDelaySeconds	int	5
api.readinessProbe.periodSeconds	int	3
api.readinessProbe.successThreshold	int	1
api.readinessProbe.timeoutSeconds	int	1
api.reconcileInterval	string	"30s"	How often every installation is reconciled.
api.replicaCount	int	1	Replicas of the installer. Only the one holding the lease reconciles; the rest stand by and take over when it stops renewing.
api.resources	object	{}
api.securityContext.allowPrivilegeEscalation	bool	false
api.securityContext.capabilities.drop[0]	string	"ALL"
api.securityContext.privileged	bool	false
api.securityContext.readOnlyRootFilesystem	bool	true
api.securityContext.runAsGroup	int	65532
api.securityContext.runAsNonRoot	bool	true
api.securityContext.runAsUser	int	65532
api.securityContext.seccompProfile.type	string	"RuntimeDefault"
api.service	object	{"annotations":{},"api":{"port":8080,"type":"ClusterIP"},"metrics":{"port":8085,"type":"ClusterIP"}}	This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
api.service.api	object	{"port":8080,"type":"ClusterIP"}	The Upbound Inference API. The port is named http on the Service, which is how the discovery aggregator finds a backend.
api.service.metrics	object	{"port":8085,"type":"ClusterIP"}	The Prometheus metrics endpoint service.
api.serviceAccount	object	{"annotations":{},"automount":true,"create":true,"name":""}	This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
api.serviceAccount.annotations	object	{}	Annotations to add to the service account
api.serviceAccount.automount	bool	true	The projected token of this ServiceAccount is what hub-inference presents to the fabric proxy, so turning automount off leaves it with no credential.
api.serviceAccount.create	bool	true	Specifies whether a service account should be created
api.serviceAccount.name	string	""	The name of the service account to use. If not set and create is true, a name is generated using the fullname template
api.startupProbe.failureThreshold	int	60
api.startupProbe.httpGet.path	string	"/livez"
api.startupProbe.httpGet.port	string	"http"
api.startupProbe.initialDelaySeconds	int	0
api.startupProbe.periodSeconds	int	5
api.startupProbe.successThreshold	int	1
api.startupProbe.timeoutSeconds	int	1
api.tolerations	list	[]
api.tracing	object	{"enabled":false,"url":""}	OpenTelemetry tracing configuration.
api.updateStrategy	object	{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}	Deployment update strategy. A surge replica stands by until the outgoing one gives up its lease, so a rollout hands over rather than leaving a gap.
global	object	{}	Populated by the umbrella chart at install time.
httpRoute	object	{"annotations":{},"domain":"","enabled":false,"hostnames":[],"labels":{},"parentRefs":[],"subdomain":"api"}	Kubernetes Gateway API HTTPRoute. It shares hub-core's hostname and routes only this API group, which Gateway API resolves by longest path prefix.
httpRoute.hostnames	list	[]	If set, replaces the composed <subdomain>.<domain> hostname.
imagePullSecrets	list	[]	Chart-wide image pull secrets. Falls back to global.imagePullSecrets.
postgresql	object	{"auth":{"aws":{"region":""},"cloud":"","mode":"password","password":{"existingSecretRef":{"key":"password","name":""},"value":""}},"connectionString":"","database":"postgres","host":"","port":5432,"sslmode":"disable","user":"postgres"}	The database authorization is answered from and Upbound Inference's own tables live in. Migrations are hub-core's, so these values must name the same database its chart is given.
postgresql.connectionString	string	""	Full connection string. Takes precedence over the fields below.
registry	string	"xpkg.upbound.io/upbound"	Chart-wide default registry. Per-workload <workload>.image.registry overrides this. Falls back to global.imageRegistry when both are empty.