Operator Helm values

Configure the ToolHive operator with these Helm values.

This reference lists values declared in the chart's default values.yaml. Templates can also accept optional settings and inherited global values.

Chart: toolhive-operator. Chart version: 0.52.0. Source: values.yaml at v0.52.0.

Values

`nameOverride`

Type: string

Default: ""

Override the chart name used in resource labels and generated names.

`fullnameOverride`

Type: string

Default: "toolhive-operator"

Override the generated name of the operator Deployment and related resources.

`operator`

Type: object

Default value

affinity: {}
autoscaling:
  enabled: false
  maxReplicas: 100
  minReplicas: 1
  targetCPUUtilizationPercentage: 80
containerSecurityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000
  seccompProfile:
    type: RuntimeDefault
defaultImagePullSecrets: []
defaultRedis:
  addr: ''
  existingSecret: ''
  existingSecretKey: ''
env: []
features:
  experimental: false
  storageVersionMigrator: true
gc:
  gogc: 75
  gomemlimit: 110MiB
image: ghcr.io/stacklok/toolhive/operator:v0.52.0
imageDiscovery:
  enabled: false
  resources: {}
imagePullPolicy: IfNotPresent
imagePullSecrets: []
leaderElectionRole:
  binding:
    name: toolhive-operator-leader-election-rolebinding
  name: toolhive-operator-leader-election-role
  rules:
    - apiGroups:
        - ''
      resources:
        - configmaps
      verbs:
        - get
        - list
        - watch
        - create
        - update
        - patch
        - delete
    - apiGroups:
        - coordination.k8s.io
      resources:
        - leases
      verbs:
        - get
        - list
        - watch
        - create
        - update
        - patch
        - delete
    - apiGroups:
        - events.k8s.io
      resources:
        - events
      verbs:
        - create
        - patch
livenessProbe:
  httpGet:
    path: /healthz
    port: health
  initialDelaySeconds: 15
  periodSeconds: 20
nodeSelector: {}
podAnnotations: {}
podLabels: {}
podSecurityContext:
  runAsNonRoot: true
ports:
  - containerPort: 8080
    name: metrics
    protocol: TCP
  - containerPort: 8081
    name: health
    protocol: TCP
proxyHost: 0.0.0.0
rbac:
  allowedNamespaces: []
  scope: cluster
readinessProbe:
  httpGet:
    path: /readyz
    port: health
  initialDelaySeconds: 5
  periodSeconds: 10
replicaCount: 1
resources:
  limits:
    cpu: 500m
    memory: 128Mi
  requests:
    cpu: 10m
    memory: 64Mi
serviceAccount:
  annotations: {}
  automountServiceAccountToken: true
  create: true
  labels: {}
  name: toolhive-operator
tolerations: []
toolhiveRunnerImage: ghcr.io/stacklok/toolhive/proxyrunner:v0.52.0
vmcpImage: ghcr.io/stacklok/toolhive/vmcp:v0.52.0
volumeMounts: []
volumes: []

Settings for the operator Deployment and related resources.

`operator.features.experimental`

Type: bool

Default: false

Enable experimental operator features.

`operator.features.storageVersionMigrator`

Type: bool

Default: true

Enable the storage version migration controller to rewrite resources in the current storage version and remove obsolete entries from CRD status.storedVersions. Applies to ToolHive CRDs with the toolhive.stacklok.dev/auto-migrate-storage-version label set to "true". Requires operator.rbac.scope=cluster; set this to false for namespace-scoped installations.

`operator.replicaCount`

Type: int

Default: 1

Number of operator replicas when autoscaling is disabled. Leader election selects one active controller replica.

`operator.imagePullSecrets`

Type: list

Default: []

Image pull Secrets for the operator pod, as objects with a name field. Secrets must exist in the release namespace.

`operator.defaultImagePullSecrets`

Type: list

Default: []

Default image pull Secrets for workloads created by the operator. Accepts Secret names or objects with a name field. Entries are merged with each resource's imagePullSecrets, with resource-level entries taking precedence for duplicate names. Secrets must exist in each workload's namespace.

`operator.defaultRedis`

Type: object

Default: {"addr":"","existingSecret":"","existingSecretKey":""}

Default Redis or Valkey session storage settings for workloads without spec.sessionStorage configured.

`operator.defaultRedis.addr`

Type: string

Default: ""

Redis or Valkey address in host:port format. When empty, uses global.redis.host and global.redis.port (default 6379) from a parent chart. No default session storage is configured when neither address is set.

`operator.defaultRedis.existingSecret`

Type: string

Default: ""

Name of an existing Secret containing the Redis password. When empty, uses global.redis.existingSecret. The Secret must exist in each workload's namespace. Used only when a Redis address is configured.

`operator.defaultRedis.existingSecretKey`

Type: string

Default: ""

Key containing the password in existingSecret. When empty, uses global.redis.existingSecretKey, then redis-password.

`operator.image`

Type: string

Default: "ghcr.io/stacklok/toolhive/operator:v0.52.0"

Container image for the operator.

`operator.imagePullPolicy`

Type: string

Default: "IfNotPresent"

Image pull policy for the operator container and image-discovery containers.

`operator.toolhiveRunnerImage`

Type: string

Default: "ghcr.io/stacklok/toolhive/proxyrunner:v0.52.0"

Container image for ToolHive proxy runners created by the operator.

`operator.vmcpImage`

Type: string

Default: "ghcr.io/stacklok/toolhive/vmcp:v0.52.0"

Container image for Virtual MCP Server (vMCP) deployments created by the operator.

`operator.imageDiscovery`

Type: object

Default: {"enabled":false,"resources":{}}

Image discovery settings for manifest scanners used to mirror images into air-gapped environments.

`operator.imageDiscovery.enabled`

Type: bool

Default: false

Render a zero-replica Deployment with image: entries for operator.toolhiveRunnerImage, operator.vmcpImage, and registryAPI.image. This lets manifest scanners discover images otherwise supplied to the operator through environment variables. The Deployment runs no pods.

`operator.imageDiscovery.resources`

Type: object

Default: {}

Resource requests and limits for image-discovery containers. Admission policies can require these values even when the Deployment has zero replicas.

`operator.proxyHost`

Type: string

Default: "0.0.0.0"

Bind address for proxy runners in managed MCPServer and MCPRemoteProxy workloads.

`operator.env`

Type: list

Default: []

Additional environment variables for the operator container. Chart-managed variables take precedence for duplicate names. Set TOOLHIVE_SKIP_UPDATE_CHECK to "true" to disable periodic update checks and the usage metrics collected with them.

`operator.ports`

Type: list

Default value

- containerPort: 8080
  name: metrics
  protocol: TCP
- containerPort: 8081
  name: health
  protocol: TCP

Ports declared on the operator container. The default metrics and health names identify the metrics and health-check ports.

`operator.podAnnotations`

Type: object

Default: {}

Annotations to add to the operator pod.

`operator.podLabels`

Type: object

Default: {}

Labels to add to the operator pod.

`operator.podSecurityContext`

Type: object

Default: {"runAsNonRoot":true}

Security context for the operator pod and image-discovery pod template.

`operator.containerSecurityContext`

Type: object

Default value

allowPrivilegeEscalation: false
capabilities:
  drop:
    - ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
  type: RuntimeDefault

Security context for the operator container and image-discovery containers.

`operator.livenessProbe`

Type: object

Default: {"httpGet":{"path":"/healthz","port":"health"},"initialDelaySeconds":15,"periodSeconds":20}

Liveness probe for the operator container. The default probe uses the named health port.

`operator.readinessProbe`

Type: object

Default: {"httpGet":{"path":"/readyz","port":"health"},"initialDelaySeconds":5,"periodSeconds":10}

Readiness probe for the operator container. The default probe uses the named health port.

`operator.autoscaling`

Type: object

Default: {"enabled":false,"maxReplicas":100,"minReplicas":1,"targetCPUUtilizationPercentage":80}

Horizontal Pod Autoscaler settings for the operator Deployment.

`operator.autoscaling.enabled`

Type: bool

Default: false

Create a Horizontal Pod Autoscaler for the operator Deployment. When enabled, the chart omits replicaCount from the Deployment.

`operator.autoscaling.minReplicas`

Type: int

Default: 1

Minimum number of operator replicas when autoscaling is enabled.

`operator.autoscaling.maxReplicas`

Type: int

Default: 100

Maximum number of operator replicas when autoscaling is enabled.

`operator.autoscaling.targetCPUUtilizationPercentage`

Type: int

Default: 80

Target average CPU utilization as a percentage of requested CPU for autoscaling.

`operator.resources`

Type: object

Default: {"limits":{"cpu":"500m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"64Mi"}}

Resource requests and limits for the operator container.

`operator.gc`

Type: object

Default: {"gogc":75,"gomemlimit":"110MiB"}

Go runtime memory and garbage collection settings for the operator container.

`operator.gc.gomemlimit`

Type: string

Default: "110MiB"

Go runtime soft memory limit, supplied as GOMEMLIMIT.

`operator.gc.gogc`

Type: int

Default: 75

Target heap growth percentage between garbage collections, supplied as GOGC. The Go runtime default is 100.

`operator.rbac`

Type: object

Default: {"allowedNamespaces":[],"scope":"cluster"}

Role-based access control (RBAC) settings for the operator.

`operator.rbac.scope`

Type: string

Default: "cluster"

Permission scope for the operator. cluster creates a ClusterRoleBinding for cluster-wide access. namespace creates a RoleBinding to the operator ClusterRole in each entry of allowedNamespaces and limits watches to those namespaces. Namespace scope requires operator.features.storageVersionMigrator=false.

`operator.rbac.allowedNamespaces`

Type: list

Default: []

Namespaces to watch and manage when scope is namespace. Each namespace receives a RoleBinding to the operator ClusterRole.

`operator.serviceAccount`

Type: object

Default value

annotations: {}
automountServiceAccountToken: true
create: true
labels: {}
name: toolhive-operator

ServiceAccount settings for the operator.

`operator.serviceAccount.create`

Type: bool

Default: true

Create the operator ServiceAccount.

`operator.serviceAccount.automountServiceAccountToken`

Type: bool

Default: true

Automatically mount Kubernetes API credentials for pods using the chart-created ServiceAccount. Used only when create is true.

`operator.serviceAccount.annotations`

Type: object

Default: {}

Annotations to add to the chart-created ServiceAccount.

`operator.serviceAccount.labels`

Type: object

Default: {}

Labels to add to the chart-created ServiceAccount.

`operator.serviceAccount.name`

Type: string

Default: "toolhive-operator"

Name of the ServiceAccount used by the operator. When empty, uses the generated resource name if create is true, or the namespace's default ServiceAccount if create is false.

`operator.leaderElectionRole`

Type: object

Default value

binding:
  name: toolhive-operator-leader-election-rolebinding
name: toolhive-operator-leader-election-role
rules:
  - apiGroups:
      - ''
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - events.k8s.io
    resources:
      - events
    verbs:
      - create
      - patch

Namespaced Role and RoleBinding settings for operator leader election.

`operator.leaderElectionRole.name`

Type: string

Default: "toolhive-operator-leader-election-role"

Name of the Role used for operator leader election.

`operator.leaderElectionRole.binding.name`

Type: string

Default: "toolhive-operator-leader-election-rolebinding"

Name of the RoleBinding used for operator leader election.

`operator.leaderElectionRole.rules`

Type: list

Default value

- apiGroups:
    - ''
  resources:
    - configmaps
  verbs:
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete
- apiGroups:
    - coordination.k8s.io
  resources:
    - leases
  verbs:
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete
- apiGroups:
    - events.k8s.io
  resources:
    - events
  verbs:
    - create
    - patch

Permission rules for the operator leader election Role.

`operator.volumes`

Type: list

Default: []

Additional volumes for the operator pod.

`operator.volumeMounts`

Type: list

Default: []

Additional volume mounts for the operator container.

`operator.nodeSelector`

Type: object

Default: {}

Node selector for scheduling the operator pod.

`operator.tolerations`

Type: list

Default: []

Tolerations for scheduling the operator pod.

`operator.affinity`

Type: object

Default: {}

Affinity rules for scheduling the operator pod.

`registryAPI`

Type: object

Default: {"image":"ghcr.io/stacklok/thv-registry-api:v1.5.2"}

Settings for the registry API workloads created by the operator.

`registryAPI.image`

Type: string

Default: "ghcr.io/stacklok/thv-registry-api:v1.5.2"

Container image for registry API workloads created by the operator.

Values
Related information

Values​

nameOverride​

fullnameOverride​

operator​

operator.features.experimental​

operator.features.storageVersionMigrator​

operator.replicaCount​

operator.imagePullSecrets​

operator.defaultImagePullSecrets​

operator.defaultRedis​

operator.defaultRedis.addr​

operator.defaultRedis.existingSecret​

operator.defaultRedis.existingSecretKey​

operator.image​

operator.imagePullPolicy​

operator.toolhiveRunnerImage​

operator.vmcpImage​

operator.imageDiscovery​

operator.imageDiscovery.enabled​

operator.imageDiscovery.resources​

operator.proxyHost​

operator.env​

operator.ports​

operator.podAnnotations​

operator.podLabels​

operator.podSecurityContext​

operator.containerSecurityContext​

operator.livenessProbe​

operator.readinessProbe​

operator.autoscaling​

operator.autoscaling.enabled​

operator.autoscaling.minReplicas​

operator.autoscaling.maxReplicas​

operator.autoscaling.targetCPUUtilizationPercentage​

operator.resources​

operator.gc​

operator.gc.gomemlimit​

operator.gc.gogc​

operator.rbac​

operator.rbac.scope​

operator.rbac.allowedNamespaces​

operator.serviceAccount​

operator.serviceAccount.create​

operator.serviceAccount.automountServiceAccountToken​

operator.serviceAccount.annotations​

operator.serviceAccount.labels​

operator.serviceAccount.name​

operator.leaderElectionRole​

operator.leaderElectionRole.name​

operator.leaderElectionRole.binding.name​

operator.leaderElectionRole.rules​

operator.volumes​

operator.volumeMounts​

operator.nodeSelector​

operator.tolerations​

operator.affinity​

registryAPI​

registryAPI.image​

Related information​

Values

`nameOverride`

`fullnameOverride`

`operator`

`operator.features.experimental`

`operator.features.storageVersionMigrator`

`operator.replicaCount`

`operator.imagePullSecrets`

`operator.defaultImagePullSecrets`

`operator.defaultRedis`

`operator.defaultRedis.addr`

`operator.defaultRedis.existingSecret`

`operator.defaultRedis.existingSecretKey`

`operator.image`

`operator.imagePullPolicy`

`operator.toolhiveRunnerImage`

`operator.vmcpImage`

`operator.imageDiscovery`

`operator.imageDiscovery.enabled`

`operator.imageDiscovery.resources`

`operator.proxyHost`

`operator.env`

`operator.ports`

`operator.podAnnotations`

`operator.podLabels`

`operator.podSecurityContext`

`operator.containerSecurityContext`

`operator.livenessProbe`

`operator.readinessProbe`

`operator.autoscaling`

`operator.autoscaling.enabled`

`operator.autoscaling.minReplicas`

`operator.autoscaling.maxReplicas`

`operator.autoscaling.targetCPUUtilizationPercentage`

`operator.resources`

`operator.gc`

`operator.gc.gomemlimit`

`operator.gc.gogc`

`operator.rbac`

`operator.rbac.scope`

`operator.rbac.allowedNamespaces`

`operator.serviceAccount`

`operator.serviceAccount.create`

`operator.serviceAccount.automountServiceAccountToken`

`operator.serviceAccount.annotations`

`operator.serviceAccount.labels`

`operator.serviceAccount.name`

`operator.leaderElectionRole`

`operator.leaderElectionRole.name`

`operator.leaderElectionRole.binding.name`

`operator.leaderElectionRole.rules`

`operator.volumes`

`operator.volumeMounts`

`operator.nodeSelector`

`operator.tolerations`

`operator.affinity`

`registryAPI`

`registryAPI.image`

Related information