Chart values
How to set the values of the Harthelm Helm chart, how Helm checks them, and which page lists which value.
Every value of the Harthelm Helm chart, grouped by topic. Each table lists the value's path, its type, its default and
what it does. A long default (a list of plans, say) is printed as YAML under the table. Link to a single value with
its path as the anchor, for example /reference/chart-values/platform-and-sign-in/#platform.host.
Where the chart comes from
Install the chart from oci://<your registry>/charts/harthelm. Releases are not published on a public registry yet;
Self-hosting › Install shows the whole command.
Set values
Two values are required: platform.host and
platform.workspaceDomain. Most installations
also set up sign-in and give the licence in a Secret. Keep your values in one file under
version control:
platform:
host: console.example.com # the console and the API
workspaceDomain: example-apps.net # workspace hosts: <ws>-<port>.example-apps.net, ide-<ws>.example-apps.net
oidc:
issuer: https://sso.example.com
existingSecret: harthelm-oidc # a Secret with the client's id and secret
license:
existingSecret: harthelm-license # a Secret with the licence fileThe workspace domain must be a different registrable domain from the console's, so workspace apps cannot read the console's cookies.
Install or upgrade with the file:
helm upgrade --install harthelm oci://<your registry>/charts/harthelm --version 1.1.0 \
-n harthelm-system --create-namespace -f my-values.yamlCheck values before you apply them
The chart ships a strict values.schema.json. Helm checks your values against it before it renders anything, and an
unknown key or a value of the wrong type fails the install or upgrade with a message that names it. The schema also
refuses combinations that cannot work, among them:
- an empty
platform.hostorplatform.workspaceDomain; database.modeexternalwithout a secret that holds the DSN;routing.edgegatewayAPIwithoutparentRefs;- an
oidc.issuerwithoutoidc.existingSecret.
Render the chart locally to see these errors before anything reaches the cluster. This matters most with Argo CD,
where an invalid value leaves the application Unknown instead of failing loudly:
helm template harthelm oci://<your registry>/charts/harthelm --version 1.1.0 -f my-values.yaml > /dev/nullWhen the values pass the schema, a preflight Job still runs before every install and upgrade. It checks that the cluster has what the values name (the Kubernetes version, the operators, Secrets and their keys, storage classes) and fails with a list of what is missing before anything of the release changes. See Hooks and extra objects to tune or turn it off.
Write sizes
Memory and storage values, such as a plan's memoryMiB and storageGiB or a team quota, take a number in the
unit their name says, or a string with a binary unit: 2Gi, 2GiB, 2048Mi, 2048MiB. Storage must be whole GiB.
Decimal units such as 2GB are refused.
Find a value
| Page | What it covers |
|---|---|
| Global and images | The image registry, pull secrets, image tags, internal TLS. |
| Platform and sign-in | Hosts, OIDC sign-in, the local admin, the encryption and signing keys, the licence. |
| Git and mail | Git providers and the SMTP relay for invitations. |
| Workspaces | Plans, base images, idle timeout, waking, container images. |
| Teams and storage | Team defaults and quotas, storage class and mode, custom domains, clean-up. |
| Managed services | The catalog of databases and other managed services. |
| Routing | Ingress or Gateway API, TLS certificates, trusted proxies. |
| Database and backups | The platform database (bundled or external) and the backup jobs. |
| Core, router and scheduling | Replicas, resources and where platform and workspace pods run. |
| Security | Pod security, RBAC, network policies. |
| Hooks and extra objects | The preflight, the chart's tests, and your own extra objects. |
For how to use the values for one task each, see Self-hosting › Configure.