Skip to main content

Helm Values

Below are the default and configurable values for an overrides file for the Tangram Pro™ Helm chart.

Chart Values

Version: 7.14.0-rc.4Version7.14.0-rc.4 Type: applicationTypeapplication AppVersion: 2.4.14-rc.4AppVersion2.4.14-rc.4 Kubernetes: 1.29+Kubernetes1.29+

Maintainers​

NameEmailUrl
Tangram Flexops@tangramflex.comhttps://tangramflex.com

Table of Contents​

Sub-Charts

NameRepositoryVersionChart URL
argo-workflowshttps://argoproj.github.io/argo-helm0.41.1https://artifacthub.io/packages/helm/argo/argo-workflows
docker-registryhttps://helm.twun.io2.2.3https://artifacthub.io/packages/helm/twuni/docker-registry
giteaTangram-vendored & customized10.3.0https://artifacthub.io/packages/helm/gitea/gitea
miniooci://registry-1.docker.io/bitnamicharts13.2.1https://artifacthub.io/packages/helm/bitnami/minio
ollamahttps://otwld.github.io/ollama-helm0.64.0https://artifacthub.io/packages/helm/ollama-helm/ollama
postgresqloci://registry-1.docker.io/bitnamicharts15.5.16https://artifacthub.io/packages/helm/bitnami/postgresql
redisoci://registry-1.docker.io/bitnamicharts20.6.2https://artifacthub.io/packages/helm/bitnami/redis

Values​

Toolkits​

KeyTypeDefaultDescription
tagsobject Tags are what enable the various Tangram Pro toolkits
tags.basicbooltrueenable or disable TPRO Basic toolkit
tags.designerbooltrueenable or disable TPRO Designer toolkit
tags.developerbooltrueenable or disable TPRO Developer toolkit
tags.verifierbooltrueenable or disable TPRO Verifier toolkit
tags.aiboolfalseenable or disable TPRO AI Assistant toolkit

Extra Labels​

KeyTypeDefaultDescription
extraLabelsTemplatesobject extra labels to apply across all deployments, pods, or statefulsets these are template strings. each section has access to the values file along with section specific variables detailed below.
extraLabelsTemplates.podsobject{}Pod labels. The following variables are available for use: 
pods:
  my-label: {{$.podName }}
  my-other-label: hello-world
extraLabelsTemplates.deploymentsobject{}Deployment labels. The following variables are available for use: 
deployments:
  my-label: {{ $.deploymentName }}
extraLabelsTemplates.statefulsetsobject{}Statefulset labels. The following variables are available for use: 
statefulsets:
  my-label: {{ $.statefulsetName }}

Global Config​

KeyTypeDefaultDescription
globalobject global config params for Tangram Pro
global.imageRegistrystring"registry-gitlab.tangramflex.tech/pro"container image registry for image pull
global.imagePullSecretslist["gitlab-pro-registry"]container image registry imagePullSecrets
global.postgresqlobject The postgres chart requires the secret be installed prior to a helm upgrade. The pre-upgrade hook does not run if the postgres chart fails to find an existing secret. It does run, however, if we provide a placeholder value for postgresPassword. This "posgresPassword" key-value pair can be removed once gitea and postgres shave been deployed everywhere.
global.postgresql.authobject The postgresql auth config
global.postgresql.auth.postgresPasswordstring"placeholder"placeholder value
global.postgresql.auth.passwordstring"placeholder"placeholder value
global.securityobject Section for Bitnami chart security config
global.security.allowInsecureImagesbooltrueThis is for Bitnami charts to check for images not provided by bitnami. Tangram vendors all of the images used in our chart and customize most of them so we will set this to a value of 'true' by default.
global.storageClassstring""Global storage class for PVCs

Misc​

KeyTypeDefaultDescription
metricsEnabledbooltrueGlobal toggle for Prometheus metrics
createClusterRolesbooltrueOnly set this to true if it is the first Tangram Pro install in your cluster and the installer has cluster-admin privileges
subdomainstring""sub-domain for TPRO instance.
domainstring"tangramflex.io"root domain for TPRO instance.
storagePathstring"/storage"Minio storage path
logEnvstring"production"Tangram Pro log level

ArgoCD​

KeyTypeDefaultDescription
argocdobject Using ArgoCD to deploy TPro For use when deploying the helm chart with Argo CD. ArgoCD and Helm differ in how they utilize hooks.
argocd.upgradeboolfalseSet argocd.upgrade = false if this is a clean/new deployment. Set it to "true" after you have successfully deploy TPro
argocd.enabledboolfalseSet argocd.enabled = true if you are using ArgoCD to deploy TPro

Tolerations​

KeyTypeDefaultDescription
tolerationslist[]Tolerations assigned to all pods 
tolerations:
  - key:"key1"
    operator:"Equal"
    value:"value1"
    effect:"NoSchedule"

Affinity​

KeyTypeDefaultDescription
affinityobject{}Affinity assigned to all pods

Topology Spread Constraints​

KeyTypeDefaultDescription
topologySpreadConstraintslist[]Topology spread constraints assigned to all pods The chart determines the labelSelector automatically, so do not specify it.
Example: 
topologySpreadConstraints:
  - maxSkew: 1 # max skew of 1
    topologyKey: "topology.kubernetes.io/zone" # topology key value
    whenUnsatisfiable: ScheduleAnyway # schedule behavior for topology

Registry​

KeyTypeDefaultDescription
registryobject Tangram Flex GitLab container registry credentials (use a PAT for local, and deploy token for anything else)
registry.usernamestring""username to connect to the container registry
registry.passwordstring""password to connect to the container registry
registry.existingSecretstring""use existingSecret if you already created the image pull secret

Licensing​

KeyTypeDefaultDescription
licenseobject Tangram Pro license public and private keys and password
license.publicKeyFilestring""public key file name
license.privateKeyFilestring""private key file name
license.privateKeyPassstring""private key password
license.existingSecretstring""use existingSecret if using existing license the secret needs to be created like this: 
kubectl create secret generic license \
  --from-file=tangram_id_rsa.pub="/path/to/tangram_id_rsa.pub" \
  --from-file=id_rsa="/path/to/id_rsa" \
  --from-literal=LICENSE_PRIVATE_KEY_PASS="TANGRAM_PROVIDED_KEY_PASS"

TLS​

KeyTypeDefaultDescription
tlsobject TLS certificate to be used for HTTPS. tls.certFile, tls.keyFile, tls.existingSecret, and tls.clusterIssuer are meant to be used with an Ingress like NGINX that is the TLS termination point. For Pod to Pod TLS, configure tls.ca.existingSecret and each service specific TLS settings
tls.certFilestring""certFile is only used if cert-manager is not used
tls.keyFilestring""keyFile is only used if cert-manager is not used
tls.clusterIssuerstring"letsencrypt-prod"clusterIssuer is to be used with cert-manager
tls.createCertificatebooltrueIf no certFile, keyFile, or existingSecret is provided, whether to create a Certmanager certificate
tls.existingSecretstring""use existingSecret if using existing TLS
tls.caobject Additional CA to trust, if different from tls.certFile
tls.ca.enabledboolfalseoption to toggle certificate authority
tls.ca.existingSecretslist[]Names between the secrets and configmaps must be unique. 
existingSecrets:
  - name: cert-service-backend
    key: ca.crt
tls.ca.existingConfigMapslist[]provide an existing configmap if available. 
existingConfigMaps:
  - name: "my-config-map"
    key:"ca.pem"
tls.pkiobject PKI for TLS
tls.pki.enabledboolfalsetoggle for pki

NetworkPolicy​

KeyTypeDefaultDescription
networkPolicyobject Enable NetworkPolicies to increase security
networkPolicy.enabledbooltruetoggle network policies on or off
networkPolicy.ingressControllerlist[]rules for the ingressController. anything placed here will be rendered out following standard k8s network policy resource https://kubernetes.io/docs/concepts/services-networking/network-policies/
Example: 
ingressController:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: nginx
      podSelector:
        matchLabels:
          app.kubernetes.io/name: ingress-nginx
networkPolicy.monitoringAccesslist[]rules for the allowing prometheus access. anything placed here will be rendered out following standard k8s network policy resource https://kubernetes.io/docs/concepts/services-networking/network-policies/
Example: 
monitoringAccess:
  - from:
    - namespaceSelector:
        matchLabels:
            kubernetes.io/metadata.name: monitoring
      podSelector:
        matchLabels:
          app.kubernetes.io/name: prometheus
networkPolicy.kedaHTTPProxylist[]rules for the kedaHTTPProxy. anything placed here will be rendered out following standard k8s network policy resource https://kubernetes.io/docs/concepts/services-networking/network-policies/
Example: 
kedaHTTPProxy:
  - from:
    - namespaceSelector:
        matchLabels:
            kubernetes.io/metadata.name: keda
      podSelector:
        matchLabels:
          app.kubernetes.io/component: interceptor
          app.kubernetes.io/instance: keda-http-add-on
networkPolicy.nodeCIDRstring"172.20.0.0/16"the k8s service CIDR defaults to the CIDR block for the Tangram Flex Prod clusters

Frontend​

KeyTypeDefaultDescription
frontendobject Tangram Pro frontend configuration
frontend.replicasint2number of replicas for frontend deployment
frontend.ingressobject frontend ingress config
frontend.ingress.enabledbooltruetoggles the ingress for frontend
frontend.tlsobject frontend TLS config
frontend.tls.enabledboolfalsetoggle for configuring TLS for frontend
frontend.tls.existingSecretstring"cert-frontend"provide an existing secret for TLS config
frontend.tls.cipherSuitesstring"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:TLS_AES_256_GCM_SHA384"See: https://www.openssl.org/docs/man1.1.1/man1/ciphers.html for an available list of ciphers
frontend.tls.tlsProtocolsstring"TLSv1.2"List of allowed TLS versions, space separated. Ex. TLSv1.2 TLSv1.3
frontend.imageobject image details for the deployment. See values.yaml
frontend.image.repositorystring"/service/frontend"frontend image repo
frontend.image.tagstring"2.4.14-578e87ae"frontend image tag
frontend.image.namestring"Tangram Pro Frontend"frontend image name
frontend.image.licensestring"Proprietary"frontend image license type
frontend.image.urlstring"https://tangramflex.com/tangram-pro"Tangram Pro product URL
frontend.image.releasedatestring"06/25/2025"frontend image release date
frontend.serviceobject service options for frontend
frontend.service.annotationsobject{}annotations to the service
frontend.resourceConstraintsobject configure resources for deployment
frontend.resourceConstraints.enabledbooltrueenable resourceConstraints for frontend deployment resources
frontend.resourceConstraints.cpuobject CPU options for frontend deployment resources
frontend.resourceConstraints.cpu.requeststring"10m"CPU request options for frontend deployment resources
frontend.resourceConstraints.cpu.limitstring"100m"CPU limit options for frontend deployment resources
frontend.resourceConstraints.memoryobject Memroy options for frontend deployment resources
frontend.resourceConstraints.memory.requeststring"25Mi"Memory request options for frontend deployment resources
frontend.resourceConstraints.memory.limitstring"200Mi"Memory limit options for frontend deployment resources
frontend.hpaobject HPA config options for frontend deployment
frontend.hpa.enabledbooltruetoggle to enable or disable frontend HPA
frontend.hpa.maxReplicasint8maxReplicas for frontend HPA
frontend.hpa.metricslist
metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type:  Utilization
        averageUtilization: 50
frontend HPA metrics options
frontend.hpa.behaviorobject frontend HPA scaling behavior
frontend.hpa.behavior.scaleDownobject HPA scale down behavior for frontend
frontend.hpa.behavior.scaleDown.policieslist
policies:
  - type: Percent
    value: 25
   periodSeconds: 60
HPA scaledown policy behavior
frontend.hpa.behavior.scaleDown.selectPolicystring"Min"min/max/disabled
frontend.podSecurityContextobject podSecurityContext config options for deployment
frontend.podSecurityContext.enabledbooltruetoggle podSecurityContext for deployment
frontend.podSecurityContext.fsGroupint1000podSecurityContext fsGroup value
frontend.containerSecurityContextobject containerSecurityContext config options for deployment
frontend.containerSecurityContext.enabledbooltruetoggle the containerSecurityContext for deployment
frontend.containerSecurityContext.runAsNonRootbooltrueset runAsNonRoot for deployment
frontend.containerSecurityContext.runAsUserint1000set runAsNonRoot for deployment
frontend.containerSecurityContext.runAsGroupint1000set runAsGroup for deployment
frontend.containerSecurityContext.privilegedboolfalseRunning as privileged or unprivileged
frontend.containerSecurityContext.readOnlyRootFilesystemboolfalseMounts the container's root filesystem as read-only
frontend.containerSecurityContext.allowPrivilegeEscalationboolfalseControls whether a process can gain more privileges than its parent process
frontend.containerSecurityContext.capabilitiesobject With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.
frontend.containerSecurityContext.capabilities.droplist["ALL"]set capability to drop
frontend.containerSecurityContext.seccompProfileobject The seccompProfile field is a SeccompProfile object consisting of type and localhostProfile.
frontend.containerSecurityContext.seccompProfile.typestring"RuntimeDefault"Valid options for type include RuntimeDefault, Unconfined, and Localhost.

Docs​

KeyTypeDefaultDescription
docsobject Tangram Pro Docs configuration
docs.replicasint2replica count for docs deployment
docs.ingressobject ingress config for docs deployment
docs.ingress.enabledbooltrueingress toggle for docs deployment
docs.tlsobject docs TLS config options
docs.tls.enabledboolfalsetoggle for docs TLS
docs.tls.existingSecretstring"cert-docs"provide an existing secret for TLS
docs.tls.cipherSuitesstring"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:TLS_AES_256_GCM_SHA384"TLS cipher suites to use for docs deployment See: https://www.openssl.org/docs/man1.1.1/man1/ciphers.html for an available list of ciphers
docs.tls.tlsProtocolsstring"TLSv1.2"List of allowed TLS versions, space separated. Ex. TLSv1.2 TLSv1.3
docs.imageobject Docs image info
docs.image.repositorystring"/docs"Docs image repo
docs.image.tagstring"2.4.14-ae68ec9c"Docs image tag
docs.image.namestring"Tangram Pro Docs"Docs image name
docs.image.licensestring"Proprietary"Docs image license type
docs.image.urlstring"https://tangramflex.com/tangram-pro"Tangram Pro product URL
docs.image.releasedatestring"06/26/2025"Tangram Pro docs image release date
docs.serviceobject docs deployment service opts
docs.service.annotationsobject{}annotations to the docs service. these can be templated
docs.resourceConstraintsobject resource constraint options for docs service
docs.resourceConstraints.enabledbooltruetoggle for docs resource constraint options
docs.resourceConstraints.cpuobject CPU config options for docs deployment
docs.resourceConstraints.cpu.requeststring"10m"CPU request value for docs deployment
docs.resourceConstraints.cpu.limitstring"100m"CPU request limits for docs deployment
docs.resourceConstraints.memoryobject Memory config options for docs deployment
docs.resourceConstraints.memory.requeststring"25Mi"Memory request value for docs deployment
docs.resourceConstraints.memory.limitstring"200Mi"Memory request value for docs deployment
docs.podSecurityContextobject podSecurityContext config options for deployment
docs.podSecurityContext.enabledbooltruetoggle podSecurityContext for deployment
docs.podSecurityContext.fsGroupint1000podSecurityContext fsGroup value
docs.containerSecurityContextobject containerSecurityContext config options for deployment
docs.containerSecurityContext.enabledbooltruetoggle the containerSecurityContext for deployment
docs.containerSecurityContext.runAsNonRootbooltrueset runAsNonRoot for deployment
docs.containerSecurityContext.runAsUserint1000set runAsNonRoot for deployment
docs.containerSecurityContext.runAsGroupint1000set runAsGroup for deployment
docs.containerSecurityContext.privilegedboolfalseRunning as privileged or unprivileged
docs.containerSecurityContext.readOnlyRootFilesystemboolfalseMounts the container's root filesystem as read-only
docs.containerSecurityContext.allowPrivilegeEscalationboolfalseControls whether a process can gain more privileges than its parent process
docs.containerSecurityContext.capabilitiesobject With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.
docs.containerSecurityContext.capabilities.droplist["ALL"]set capability to drop
docs.containerSecurityContext.seccompProfileobject The seccompProfile field is a SeccompProfile object consisting of type and localhostProfile.
docs.containerSecurityContext.seccompProfile.typestring"RuntimeDefault"Valid options for type include RuntimeDefault, Unconfined, and Localhost.

Preload Job​

KeyTypeDefaultDescription
preloadobject Preload image values
preload.enabledbooltruetoggle to enable or disable the preload image job
preload.jobobjectsee preload.job within values.yaml for full defaultsPreload job options
preload.job.imageobject Preload job image info
preload.job.image.repositorystring"/image/skopeo"Preload Job image repo
preload.job.image.tagstring"v1.14.2"Preload Job image tag
preload.job.image.urlstring"https://github.com/containers/skopeo"Tangram Pro product URL
preload.job.image.releasedatestring"02/01/2024"Preload Job image release date
preload.job.image.licensestring"Apache-2.0"Preload Job image license type
preload.job.image.namestring"Skopeo"Preload Job image name

Ollama​

KeyTypeDefaultDescription
ollamaobject AI Assistant model configuration
ollama.fullnameOverridestring"ollama"AI Assistant model configuration
ollama.imagePullSecretslist
imagePullSecrets:
  - name: gitlab-pro-registry
AI Assistant model configuration
ollama.orasobject Oras configuration for pulling model artifacts
ollama.oras.imageobject Oras image information
ollama.oras.image.repositorystring"image/oras"Oras image repository
ollama.oras.image.tagstring"1.2.2-40d9fc50"Oras image tag
ollama.oras.image.namestring"Oras"Oras image name
ollama.oras.image.licensestring"Apache-2.0"Oras image license type
ollama.oras.image.urlstring"https://oras.land"Oras product URL
ollama.oras.image.releasedatestring"03/17/2025"Oras image release date
ollama.modelslist
models:
  - nomic-embed-text:v1.5
  - gemma3:12b
List of AI models to be pulled and loaded into Ollama
ollama.imageobject Ollama image info
ollama.image.repositorystring"registry-gitlab.tangramflex.tech/pro/image/ollama"Ollama image repo
ollama.image.tagstring"0.6.4"Ollama image tag
ollama.image.namestring"Ollama"Ollama image name
ollama.image.licensestring"MIT"Ollama image license type
ollama.image.urlstring"https://ollama.com"Tangram Pro product URL
ollama.image.releasedatestring"04/03/2025"Ollama image release date
ollama.extraEnvlist
extraEnv:
  - name: OLLAMA_KEEP_ALIVE
    value: "-1"
AI Assistant model extra environment variables for Ollama
ollama.initContainerslist
initContainers:
  - name: pull-models
    image: "{{ .Values.global.imageRegistry }}/{{.Values.oras.image.repository}}:{{.Values.oras.image.tag}}"
      securityContext:
      env:
      command:
      volumeMounts:
Init containers configuration for Ollama deployment
ollama.volumeMountslist
volumeMounts:
  - name: emptydir
   mountPath: "/home/ollama/.ollama"
Volume mounts for the Ollama container
ollama.volumeslist
volumes:
  - name: emptydir
   emptyDir:   - name: dockerconfig
   secret:
      secretName: gitlab-pro-registry
Volumes configuration for the Ollama pod
ollama.kedaobject AI Assistant model configuration
ollama.keda.httpScaledObjectobject corresponds directly to https://github.com/kedacore/http-add-on/blob/main/docs/ref/v0.2.0/http_scaled_object.md#the-httpscaledobject. this will be templated to a K8s httpScaledObject YAML
ollama.keda.httpScaledObject.enabledboolfalsetoggle whether or not a httpScaledObject is created by K8s
ollama.keda.httpScaledObject.replicasobject httpScaledObject replicacount
ollama.keda.httpScaledObject.replicas.minint0min number of httpScaledObject to create
ollama.keda.httpScaledObject.replicas.maxint1max number of httpScaledObject to create
ollama.keda.httpScaledObject.scaledownPeriodint7200number of seconds that KEDA will wait to see if an event has occurred before scaling down
ollama.keda.httpScaledObject.scalingMetricobject This is the second most important part of the spec because it describes how the workload has to scale. This section contains 2 nested sections (requestRate and concurrency) which are mutually exclusive between themselves. https://github.com/kedacore/http-add-on/blob/main/docs/ref/v0.8.0/http_scaled_object.md#scalingmetric
ollama.keda.httpScaledObject.scalingMetric.concurrencyobject This section enables scaling based on the request concurrency. https://github.com/kedacore/http-add-on/blob/main/docs/ref/v0.8.0/http_scaled_object.md#concurrency
ollama.keda.httpScaledObject.scalingMetric.concurrency.targetValueint100This is the target value for the scaling configuration. https://github.com/kedacore/http-add-on/blob/main/docs/ref/v0.8.0/http_scaled_object.md#targetvalue
ollama.ollamaobject These values map exactly to chart values located at https://otwld.github.io/ollama-helm
ollama.ollama.gpuobject GPU options for Ollama
ollama.ollama.gpu.enabledboolfalsetoggle GPU enabled or disabled based on hardware available
ollama.ollama.mountPathstring"/home/ollama/.oras"directory where models are mounted
ollama.persistentVolumeobject persistentVolume options for storing models
ollama.persistentVolume.enabledbooltruetoggle option to enable or disable persistence using PVC
ollama.persistentVolume.sizestring"50Gi"disk size in gigabyte for PV to store models
ollama.networkPolicyobject networkPolicy config options
ollama.networkPolicy.enabledbooltrueWhether to deploy Ollama network policy
ollama.networkPolicy.egressCidrslist List of allowed egress IPs
ollama.podSecurityContextobject podSecurityContext config options for deployment
ollama.podSecurityContext.fsGroupint1000podSecurityContext fsGroup value
ollama.containerSecurityContextobject containerSecurityContext config options for deployment
ollama.containerSecurityContext.enabledbooltruetoggle the containerSecurityContext for deployment
ollama.containerSecurityContext.runAsNonRootbooltrueset runAsNonRoot for deployment
ollama.containerSecurityContext.runAsUserint1000set runAsNonRoot for deployment
ollama.containerSecurityContext.runAsGroupint1000set runAsGroup for deployment
ollama.containerSecurityContext.privilegedboolfalseRunning as privileged or unprivileged
ollama.containerSecurityContext.readOnlyRootFilesystemboolfalseMounts the container's root filesystem as read-only
ollama.containerSecurityContext.allowPrivilegeEscalationboolfalseControls whether a process can gain more privileges than its parent process
ollama.containerSecurityContext.capabilitiesobject With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.
ollama.containerSecurityContext.capabilities.droplist["ALL"]set capability to drop
ollama.containerSecurityContext.seccompProfileobject The seccompProfile field is a SeccompProfile object consisting of type and localhostProfile.
ollama.containerSecurityContext.seccompProfile.typestring"RuntimeDefault"Valid options for type include RuntimeDefault, Unconfined, and Localhost.

Chatbot​

KeyTypeDefaultDescription
chatbotobject AI Assistant configuration options
chatbot.modelProviderstring"ollama"model provider for the AI Assistant
chatbot.chatModelstring"gemma3:12b"model used for chat completion
chatbot.embeddingModelstring"nomic-embed-text:v1.5"model used for vector embeddings
chatbot.embeddingModelChunkSizeint512chunk size for the vector embeddings 512 relates to nomic-embed-text:v1.5.
chatbot.embeddingModelChunkOverlapint50amount of overlap between chunks for vector embeddings
chatbot.chatTemperaturefloat0.1chat completion temperature level for the chat experience
chatbot.minimumScoreThresholdfloat0.4minimum score threshold for the chat experience
chatbot.kDocumentChunksint5number of document chunks to use for the chat experience
chatbot.azureopenaiobject{"apiKey":{"existingSecret":"","keyName":""},"apiVersion":"2024-10-21","deploymentName":"chatgpt-4o","embeddingDeploymentName":"text-embedding-3-large","embeddingModel":"text-embedding-3-large","fallbackDeploymentName":"chatgpt-4o-mini","fallbackModel":"gpt-4o-mini","instanceName":"main","model":"gpt-4o"}Azure OpenAI configuration options
chatbot.azureopenai.apiKeyobject{"existingSecret":"","keyName":""}Azure OpenAI API key configuration
chatbot.azureopenai.apiKey.existingSecretstring""existing secret for Azure OpenAI API key
chatbot.azureopenai.apiKey.keyNamestring""existing secret key for Azure OpenAI API key
chatbot.azureopenai.instanceNamestring"main"Azure OpenAI instance name
chatbot.azureopenai.modelstring"gpt-4o"Azure OpenAI model name to use for chat completion
chatbot.azureopenai.deploymentNamestring"chatgpt-4o"Azure OpenAI deployment name for chat model
chatbot.azureopenai.fallbackModelstring"gpt-4o-mini"Azure OpenAI fallback model name to use for chat completion
chatbot.azureopenai.fallbackDeploymentNamestring"chatgpt-4o-mini"Azure OpenAI fallback deployment name for chat model
chatbot.azureopenai.embeddingModelstring"text-embedding-3-large"Azure OpenAI embedding model name
chatbot.azureopenai.embeddingDeploymentNamestring"text-embedding-3-large"Azure OpenAI deployment name for embedding model
chatbot.azureopenai.apiVersionstring"2024-10-21"Azure OpenAI API version
chatbot.numCtxint32768context length for the chat completion model. 32768 relates to the chatModel.
chatbot.metricsEnabledbooltruetoggle metrics for ai assistant
chatbot.podSecurityContextobject podSecurityContext config options for deployment
chatbot.podSecurityContext.enabledbooltruetoggle podSecurityContext for deployment
chatbot.podSecurityContext.fsGroupint1000podSecurityContext fsGroup value
chatbot.containerSecurityContextobject containerSecurityContext config options for deployment
chatbot.containerSecurityContext.enabledbooltruetoggle the containerSecurityContext for deployment
chatbot.containerSecurityContext.runAsNonRootbooltrueset runAsNonRoot for deployment
chatbot.containerSecurityContext.runAsUserint1000set runAsNonRoot for deployment
chatbot.containerSecurityContext.runAsGroupint1000set runAsGroup for deployment
chatbot.containerSecurityContext.privilegedboolfalseRunning as privileged or unprivileged
chatbot.containerSecurityContext.readOnlyRootFilesystemboolfalseMounts the container's root filesystem as read-only
chatbot.containerSecurityContext.allowPrivilegeEscalationboolfalseControls whether a process can gain more privileges than its parent process
chatbot.containerSecurityContext.capabilitiesobject With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.
chatbot.containerSecurityContext.capabilities.droplist["ALL"]set capability to drop
chatbot.containerSecurityContext.seccompProfileobject The seccompProfile field is a SeccompProfile object consisting of type and localhostProfile.
chatbot.containerSecurityContext.seccompProfile.typestring"RuntimeDefault"Valid options for type include RuntimeDefault, Unconfined, and Localhost.
chatbot.replicasint1number of replica pods for the AI Assistant.
chatbot.imageobject Chatbot image info
chatbot.image.repositorystring"/ai/chatbot"Chatbot image repo
chatbot.image.tagstring"2.4.13-04ae28e0"Chatbot image tag
chatbot.image.namestring"Tangram Pro Chatbot"Chatbot image name
chatbot.image.licensestring"Proprietary"Chatbot image license typ
chatbot.image.urlstring"https://tangramflex.com/tangram-pro"Tangram Pro product URL
chatbot.image.releasedatestring"06/13/2025"Chatbot image releasedate
chatbot.serviceobject Chatbot service opts
chatbot.service.annotationsobject{}Annotations to the chatbot service.
chatbot.postgresqlobject database config for chatbot
chatbot.postgresql.authobject database auth config for chatbot
chatbot.postgresql.auth.existingSecretstring""provide an existing secret containing postgresql connection information for chatbot deployment.
chatbot.hpaobject HPA options for chatbot
chatbot.hpa.enabledbooltruetoggle to enable or disable HPA for chatbot
chatbot.hpa.maxReplicasint8chatbot max replicas for deployment
chatbot.hpa.metricslist
metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type:  Utilization
        averageUtilization: 80
chatbot metrics
chatbot.hpa.behaviorobject HPA behavior options
chatbot.hpa.behavior.scaleDownobject scaledown behavior for deployment
chatbot.hpa.behavior.scaleDown.policieslist
policies:
  - type: Percent
    value: 25
    periodSeconds: 60
policy settings for HPA
chatbot.hpa.behavior.scaleDown.selectPolicystring"Min"min/max/disabled
chatbot.kedaobject specify options for using Keda with Chatbot
chatbot.keda.useProxyHostboolfalsetoggle for using proxyHost with keda
chatbot.keda.proxyHoststring"http://keda-add-ons-http-interceptor-proxy.keda.svc.cluster.local:8080"Proxy host URL to use with Keda/Chatbot. should point to the service of the interceptor proxy endpoint.
chatbot.resourceConstraintsobject resource constraint options for chatbot service
chatbot.resourceConstraints.enabledbooltruetoggle for chatbot resource constraint options
chatbot.resourceConstraints.cpuobject CPU config options for chatbot deployment
chatbot.resourceConstraints.cpu.requeststring"100m"CPU request value for chatbot deployment
chatbot.resourceConstraints.cpu.limitstring"2000m"CPU request limits for chatbot deployment
chatbot.resourceConstraints.memoryobject Memory config options for chatbot deployment
chatbot.resourceConstraints.memory.requeststring"100Mi"Memory request value for chatbot deployment
chatbot.resourceConstraints.memory.limitstring"750Mi"Memory request value for chatbot deployment
chatbot.tlsobject TLS options for the chatbot
chatbot.tls.enabledboolfalsetoggle TLS for chatbot
chatbot.tls.existingSecretstring"cert-service-chatbot"provide an existing Secret for use with chatbot TLS config
chatbot.tls.cipherSuitesstring"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"1.3 cipher suites. This should be a comma separated list. Only affects TLS 1.2 cipher suites, as golang doesn't allow you to change
chatbot.tls.minTlsVersionstring"TLS1_2"Min and max TLS version are in the format TLS_1_1, TLS1_2, TLS1_3, etc
chatbot.tls.maxTlsVersionstring"TLS1_2"Disable 1.3

Backend​

KeyTypeDefaultDescription
backendobject Tangram Pro backend configuration
backend.cleanupSchedulestring"0 * * * *"schedule for backend cleanup job
backend.cleanupEnabledbooltruewhether or not to enable the backend cleanup job
backend.minioobject Minio storage config for backend
backend.minio.enableAutoCleanupbooltruetoggle enableAutoCleanup for minio bucket storage
backend.minio.cleanupUpperThresholdPercentint40start cleanup at this allocation of the PVC cleanupUpperThresholdPercent
backend.minio.cleanupLowerThresholdPercentint30stop cleanup if storage consumed is at or below the cleanupLowerThresholdPercent
backend.dockerRegistryobject dockerRegistry storage config for backend
backend.dockerRegistry.enableAutoCleanupbooltruetoggle enableAutoCleanup for dockerRegistry bucket storage
backend.dockerRegistry.cleanupUpperThresholdPercentint40start cleanup at this allocation of the PVC cleanupUpperThresholdPercent
backend.dockerRegistry.cleanupLowerThresholdPercentint30stop cleanup if storage consumed is at or below the cleanupLowerThresholdPercent
backend.auditobject Audit config for backend
backend.audit.shutdownOnFailurebooltruetoggle to shutdown on backend pod failure
backend.audit.existingSecretstring"audit-checksum"provide an existing secret for backend audit
backend.authobject auth config for backend
backend.auth.tokenExpirationint86400duration in seconds before a user's auth token for TPRO expires.
backend.ingressobject ingress config for backend
backend.ingress.enabledbooltruetoggle ingress for backend
backend.licenseobject license options for backend
backend.license.enabledboolfalsetoggle for whether to mount an initial license to backend
backend.license.contentstring""content of license note: content will not be used to create a secret if existingSecret is set
backend.license.existingSecretstring""name of secret [arbitrary secret name] the secret needs to be created like this: 
kubectl create secret generic "[arbitrary secret name]" \
  --from-file=license.tflicense="[/path/to/license.tflicense]"
backend.oauthobject OAuth config options for backend
backend.oauth.configobject OAuth config options for backend
oauth:
  required: false            # boolean to force oauth only for all users
  providers:
    okta:                     # name of provider, i.e., 'okta' or 'Company SSO'
      url: ""                 # URL of provider, i,e., https://company.okta.com
      client_id: ""           # client_id
      client_secret: ""       # client_secret
      admin_users: []         # list of users to grant admin access, i.e., ["username1", "username2"] or yaml list using '-'
      preserve_admins: true   # whether to preserve admin users not in the oauth config
      toolkits: []            # list of toolkits ["DESIGNER", "DEVELOPER", "VERIFIER"] to grant, or yaml list using '-'
      required_domains: []    # list of domains which require oauth login
backend.oauth.config.requiredboolfalseboolean to force oauth only for all users
backend.oauth.existingSecretstring""this should the name of the secret containing the oauth config Create the Oauth Config Secret
read -r -d "" oauth_providers <<-EOF
  required: false            # boolean to force oauth only for all users
  providers:
    okta:                     # name of provider, i.e., 'okta' or 'Company SSO'
      url: ""                 # URL of provider, i,e., https://company.okta.com
      client_id: ""           # client_id
      client_secret: ""       # client_secret
      admin_users: []         # list of users to grant admin access, i.e., ["username1", "username2"] or yaml list using '-'
      preserve_admins: false  # whether to preserve admin users not in the oauth config, if unconfigured defaults to false
      toolkits: []            # list of toolkits ["DESIGNER", "DEVELOPER", "VERIFIER"] to grant, or yaml list using '-'
      required_domains: []    # list of domains which require oauth login
EOF

kubectl -n "[namespace]" \
  create secret generic "[oauth-secret-name]" \
  --from-literal=oauth-config.yml="$oauth_providers" -o yaml --dry-run=client | \
  kubectl apply -f -
backend.swaggerstring"false"toggle swagger availability for backend
backend.featureFlagsstring""comma separated list of feature flags
backend.podSecurityContextobject podSecurityContext config options for deployment
backend.podSecurityContext.enabledbooltruetoggle podSecurityContext for deployment
backend.podSecurityContext.fsGroupint1000podSecurityContext fsGroup value
backend.containerSecurityContextobject containerSecurityContext config options for deployment
backend.containerSecurityContext.enabledbooltruetoggle the containerSecurityContext for deployment
backend.containerSecurityContext.runAsNonRootbooltrueset runAsNonRoot for deployment
backend.containerSecurityContext.runAsUserint1000set runAsNonRoot for deployment
backend.containerSecurityContext.runAsGroupint1000set runAsGroup for deployment
backend.containerSecurityContext.privilegedboolfalseRunning as privileged or unprivileged
backend.containerSecurityContext.readOnlyRootFilesystemboolfalseMounts the container's root filesystem as read-only
backend.containerSecurityContext.allowPrivilegeEscalationboolfalseControls whether a process can gain more privileges than its parent process
backend.containerSecurityContext.capabilitiesobject With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.
backend.containerSecurityContext.capabilities.droplist["ALL"]set capability to drop
backend.containerSecurityContext.seccompProfileobject The seccompProfile field is a SeccompProfile object consisting of type and localhostProfile.
backend.containerSecurityContext.seccompProfile.typestring"RuntimeDefault"Valid options for type include RuntimeDefault, Unconfined, and Localhost.
backend.replicasint2number of backend pods to deploy
backend.imageobject Backend image info
backend.image.repositorystring"/service/backend"Backend image repo
backend.image.tagstring"2.4.13-b4abc123"Backend image tag
backend.image.namestring"Tangram Pro Backend"Backend image name
backend.image.licensestring"Proprietary"Backend image license type
backend.image.urlstring"https://tangramflex.com/tangram-pro"Tangram Pro product URL
backend.image.releasedatestring"06/17/2025"Backend image releasedate
backend.serviceobject annotation opts for backend service
backend.service.annotationsobject{}annotations for backend service
backend.postgresqlobject postgresql auth config for backend
backend.postgresql.authobject postgresql auth config for backend
backend.postgresql.auth.existingSecretstring""exisitng secret containing postgresql config information for backend to use for connection
backend.metricsEnabledbooltruetoggle for backend metricz
backend.smokeTestobject Smoke-test options for backend db
backend.smokeTest.enabledbooltrueoption to toggle the smokeTest for backend
backend.smokeTest.postgresqlobject smokeTest db config
backend.smokeTest.postgresql.databasestring"tangram_test"smokeTest db
backend.smokeTest.postgresql.authobject smokeTest auth config
backend.smokeTest.postgresql.auth.existingSecretstring""provide an existing secret containing auth information for smokeTest db connection
backend.smokeTest.debugboolfalsesmokeTest log-level
backend.smokeTest.imageobject Backend SmokeTest image info
backend.smokeTest.image.repositorystring"/k6-load-testing"Backend SmokeTest image repo
backend.smokeTest.image.tagstring"1.2.0"Backend SmokeTest image tag
backend.smokeTest.image.namestring"Tangram Pro Backend Smoke Testing"Backend SmokeTest image name
backend.smokeTest.image.licensestring"Proprietary"Backend SmokeTest image license type
backend.smokeTest.image.urlstring"https://tangramflex.com/tangram-pro"Tangram Pro product URL
backend.smokeTest.image.releasedatestring"06/08/2023"Backend SmokeTest image release date
backend.smokeTest.resourcesobject smokeTest resource constraint options
backend.smokeTest.resources.limitsobject smokeTest resource constraint limits
backend.smokeTest.resources.limits.memorystring"128Mi"smokeTest memory resource constraint limit
backend.smokeTest.resources.limits.cpustring"125m"smokeTest CPU resource constraint limit
backend.smokeTest.podSecurityContextobject podSecurityContext config options for smokeTest
backend.smokeTest.podSecurityContext.enabledbooltruetoggle podSecurityContext for smokeTest
backend.smokeTest.podSecurityContext.runAsNonRootbooltruerunAsNonRoot for smokeTest
backend.smokeTest.podSecurityContext.runAsUserint12345runAsUser for smokeTest
backend.smokeTest.podSecurityContext.runAsGroupint12345runAsGroup for smokeTest
backend.smokeTest.podSecurityContext.fsGroupint12345fsGroup for smokeTest
backend.smokeTest.testUserobject service account for use with the smokeTest
backend.smokeTest.testUser.existingSecretstring"service-backend-smoke-test-auth"existing secret to for the smokeTest to connect to the smokeTest db
backend.smokeTest.testUser.usernamePrefixstring"testuser"username prefix for the test user
backend.smokeTest.testUser.emailDomainstring"tangramflex.test"mail domain for the smokeTest user
backend.smokeTest.durationstring"1m"Keep this duration relatively short. Test user creation occurs once per run, so if the backend isn't up at the start of the test, the script needs to complete and start over again to create the user
backend.smokeTest.virtualUsersint1number of virtual users to use for smokeTest
backend.smokeTest.prometheusReadWriteServerUrlstring"http://monitoring-prometheus.monitoring.svc:9090/api/v1/write"prometheus endpoint to write smokeTest data
backend.smokeTest.insecureSkipTlsVerifyboolfalsetoggle for checking HTTPS for smokeTest
backend.resourceConstraintsobject resource constraint options for backend service
backend.resourceConstraints.enabledbooltruetoggle for backend resource constraint options
backend.resourceConstraints.cpuobject CPU config options for backend deployment
backend.resourceConstraints.cpu.requeststring"100m"CPU request value for backend deployment
backend.resourceConstraints.cpu.limitstring"2000m"CPU request limits for backend deployment
backend.resourceConstraints.memoryobject Memory config options for backend deployment
backend.resourceConstraints.memory.requeststring"100Mi"Memory request value for backend deployment
backend.resourceConstraints.memory.limitstring"750Mi"Memory request value for backend deployment
backend.hpaobject backend hpa config
backend.hpa.enabledbooltruetoggle to enable or disable hpa for backend
backend.hpa.maxReplicasint8max replicas for backend HPA config
backend.hpa.metricslist
metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type:  Utilization
        averageUtilization: 50
backend HPA metrics config
backend.hpa.behaviorobject backend HPA scaling behavior
backend.hpa.behavior.scaleDownobject scaledown behavior for deployment
backend.hpa.behavior.scaleDown.policieslist
policies:
  - type: Percent
    value: 25
    periodSeconds: 60
policy settings for HPA
backend.hpa.behavior.scaleDown.selectPolicystring"Min"min/max/disabled
backend.installTypestring"PRO"install type for backend. Placed in service-backend configmap
backend.workflowsobject workflow options for backend
backend.workflows.nodeAffinityobject nodeAffinity config for backend
backend.workflows.nodeAffinity.nodeSelectorKeystring""nodeSelectorKey to use for node affinity
backend.workflows.nodeAffinity.nodeSelectorValuesstring""nodeSelectorValues to use for node affinity
backend.workflows.tolerationobject toleration rules for backend
backend.workflows.toleration.nodeTaintKeystring""nodeTaintKey for backend pods
backend.workflows.resourcesobject resource config for backend workflow deployment
backend.workflows.resources.requestsobject resource request options for backend workflow deployment
backend.workflows.resources.requests.cpustring"1.5"CPU request options for backend workflow deployment
backend.workflows.resources.requests.memorystring"1.5Gi"Memory request options for backend workflow deployment
backend.workflows.resources.limitsobject resource limit options for backend workflow deployment
backend.workflows.resources.limits.cpustring"4"CPU limit options for backend workflow deployment
backend.workflows.resources.limits.memorystring"4Gi"Memory limit options for backend workflow deployment
backend.zohoobject Zoho Configuration
backend.zoho.enabledboolfalsetoggle for enabling Zoho integration
backend.zoho.secretNamestring"zoho-auth"name of the secret generated for zoho secret
backend.zoho.clientIdstring""clientID for the zoho app registration
backend.zoho.clientSecretstring""clientSecret for the zoho app registration
backend.zoho.refreshTokenstring""refresh token value for zoho
backend.zoho.layoutIdstring"6359469000000619222"ID of the layout for zoho
backend.zoho.contactLayoutIdstring"6359469000000091033"id of the contact layout for zoho
backend.tlsobject TLS config for backend
backend.tls.enabledboolfalsetoggle to enable or disable TLS for backend
backend.tls.existingSecretstring"cert-service-backend"existing k8s secret for backend TLS configuration
backend.tls.cipherSuitesstring"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"Only affects TLS 1.2 cipher suites, as golang doesn't allow you to change 1.3 cipher suites. This should be a comma separated list.
backend.tls.minTlsVersionstring"TLS1_2"Min and max TLS version are in the format TLS_1_1, TLS1_2, TLS1_3, etc
backend.tls.maxTlsVersionstring"TLS1_2"Disable 1.3
backend.flexInstanceobject flexInstance expiration option for backend
backend.flexInstance.expirationint3600Idle timeout of flex instance in seconds

Watcher​

KeyTypeDefaultDescription
watcherobject Tangram Pro watcher configuration
watcher.verifierDeletionDelaySecondsint600seconds before deletions should occur
watcher.replicasint2Watcher # of replicas
watcher.imageobject Watcher image info
watcher.image.repositorystring"/service/backend/watcher"Watcher image repo
watcher.image.tagstring"2.4.13-b4abc123"Watcher image tag
watcher.image.namestring"Tangram Pro Workflow Watcher"Watcher image name
watcher.image.licensestring"Proprietary"Watcher image license type
watcher.image.urlstring"https://tangramflex.com/tangram-pro"Tangram Pro product URL
watcher.image.releasedatestring"06/17/2025"Watcher image releasedate
watcher.serviceobject annotation opts to the watcher service.
watcher.service.annotationsobject{}annotations to the watcher service. these can be templated.
watcher.metricsEnabledbooltruetoggle to disable or enable metricz for watcher
watcher.resourceConstraintsobject watcher resource constraint config options
watcher.resourceConstraints.enabledbooltruetoggle to disable or enable resourceConstraints for watcher
watcher.resourceConstraints.limitsobject resourceConstraints limits for watcher
watcher.resourceConstraints.limits.cpustring"2000m"CPU resourceConstraints limits for watcher
watcher.resourceConstraints.limits.memorystring"750Mi"Memory resourceConstraints limits for watcher
watcher.resourceConstraints.requestsobject resourceConstraints requests for watcher
watcher.resourceConstraints.requests.cpustring"100m"CPU resourceConstraints requests for watcher
watcher.resourceConstraints.requests.memorystring"100Mi"Memory resourceConstraints requests for watcher
watcher.hpaobject hpa options for watcher
watcher.hpa.enabledbooltruetoggle to enable or disable hpa for watcher
watcher.hpa.maxReplicasint8maxReplicas for watcher HPA
watcher.hpa.metricslist
metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type:  Utilization
        averageUtilization: 50
metrics for watcher HPA
watcher.hpa.behaviorobject scaling behavior for watcher HPA
watcher.hpa.behavior.scaleDownobject scaledown behavior for deployment
watcher.hpa.behavior.scaleDown.policieslist
policies:
  - type: Percent
    value: 25
    periodSeconds: 60
policy settings for HPA
watcher.hpa.behavior.scaleDown.selectPolicystring"Min"min/max/disabled
watcher.podSecurityContextobject podSecurityContext config options for deployment
watcher.podSecurityContext.enabledbooltruetoggle podSecurityContext for deployment
watcher.podSecurityContext.fsGroupint1000podSecurityContext fsGroup value
watcher.containerSecurityContextobject containerSecurityContext config options for deployment
watcher.containerSecurityContext.enabledbooltruetoggle the containerSecurityContext for deployment
watcher.containerSecurityContext.runAsNonRootbooltrueset runAsNonRoot for deployment
watcher.containerSecurityContext.runAsUserint1000set runAsNonRoot for deployment
watcher.containerSecurityContext.runAsGroupint1000set runAsGroup for deployment
watcher.containerSecurityContext.privilegedboolfalseRunning as privileged or unprivileged
watcher.containerSecurityContext.readOnlyRootFilesystemboolfalseMounts the container's root filesystem as read-only
watcher.containerSecurityContext.allowPrivilegeEscalationboolfalseControls whether a process can gain more privileges than its parent process
watcher.containerSecurityContext.capabilitiesobject With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.
watcher.containerSecurityContext.capabilities.droplist["ALL"]set capability to drop
watcher.containerSecurityContext.seccompProfileobject The seccompProfile field is a SeccompProfile object consisting of type and localhostProfile.
watcher.containerSecurityContext.seccompProfile.typestring"RuntimeDefault"Valid options for type include RuntimeDefault, Unconfined, and Localhost.
watcher.postgresqlobject watcher postgresql config
watcher.postgresql.authobject watcher postgresql auth config
watcher.postgresql.auth.existingSecretstring""provide an existing secret containing auth information for watcher's db connection
watcher.tlsobject watcher TLS config
watcher.tls.enabledboolfalsetoggle for enabling or disabling TLS for watcher
watcher.tls.existingSecretstring"cert-service-watcher"provide an existing k8s secret for TLS config for watcher
watcher.tls.cipherSuitesstring"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"Only affects TLS 1.2 cipher suites, as golang doesn't allow you to change 1.3 cipher suites. This should be a comma separated list.
watcher.tls.minTlsVersionstring"TLS1_2"Min and max TLS version are in the format TLS_1_1, TLS1_2, TLS1_3, etc
watcher.tls.maxTlsVersionstring"TLS1_2"Disable 1.3

Lifecycle Hooks​

KeyTypeDefaultDescription
hooksobject Tangram Pro Helm chart hooks configuration Hooks run during chart installs, upgrades, rollbacks, and deletions
hooks.toolsobject The hook tools image contains commands needed to run hook scripts
hooks.tools.imageobject Hooks tools image info
hooks.tools.image.repositorystring"/image/helm-hook"Hooks image repo
hooks.tools.image.tagstring"2.4.11-9e633eec"Hooks image tag
hooks.tools.image.namestring"Tangram Pro Helm Hook"Hooks image name
hooks.tools.image.licensestring"Proprietary"Hooks image license type
hooks.tools.image.urlstring"https://tangramflex.com/tangram-pro"Tangram Pro product URL
hooks.tools.image.releasedatestring"04/24/2025"Hooks image release date
hooks.debugboolfalselog-level for helm hook events
hooks.podSecurityContextobject podSecurityContext config options for deployment
hooks.podSecurityContext.enabledbooltruetoggle podSecurityContext for deployment
hooks.podSecurityContext.fsGroupint1000podSecurityContext fsGroup value
hooks.containerSecurityContextobject containerSecurityContext config options for deployment
hooks.containerSecurityContext.enabledbooltruetoggle the containerSecurityContext for deployment
hooks.containerSecurityContext.runAsNonRootbooltrueset runAsNonRoot for deployment
hooks.containerSecurityContext.runAsUserint1000set runAsNonRoot for deployment
hooks.containerSecurityContext.runAsGroupint1000set runAsGroup for deployment
hooks.containerSecurityContext.privilegedboolfalseRunning as privileged or unprivileged
hooks.containerSecurityContext.readOnlyRootFilesystemboolfalseMounts the container's root filesystem as read-only
hooks.containerSecurityContext.allowPrivilegeEscalationboolfalseControls whether a process can gain more privileges than its parent process
hooks.containerSecurityContext.capabilitiesobject With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.
hooks.containerSecurityContext.capabilities.droplist["ALL"]set capability to drop
hooks.containerSecurityContext.seccompProfileobject The seccompProfile field is a SeccompProfile object consisting of type and localhostProfile.
hooks.containerSecurityContext.seccompProfile.typestring"RuntimeDefault"Valid options for type include RuntimeDefault, Unconfined, and Localhost.

Minio​

KeyTypeDefaultDescription
miniosub-charthttps://artifacthub.io/packages/helm/bitnami/minioSee the official chart values for param values

Argo Workflows​

KeyTypeDefaultDescription
argo-workflowssub-charthttps://artifacthub.io/packages/helm/argo/argo-workflowsSee the official chart values for param values

Docker Registry​

KeyTypeDefaultDescription
docker-registrysub-charthttps://artifacthub.io/packages/helm/twuni/docker-registrySee the official chart values for param values

Gitea​

KeyTypeDefaultDescription
giteasub-charthttps://artifacthub.io/packages/helm/gitea/giteaSee the official chart values for param values. Note: The chart uses a deployment and expects RWX PVC if the deployment has more than one replica. We are utilizing it more like a statefulset by setting the deployment strategy to recreate and only having 1 replica.

Database Option​

KeyTypeDefaultDescription
usePostgresbooltruechart toggle to use Postgresql as the application database.

Postgresql​

KeyTypeDefaultDescription
postgresqlsub-charthttps://artifacthub.io/packages/helm/bitnami/postgresqlSee the official chart values for param values.

Redis​

KeyTypeDefaultDescription
redissub-charthttps://artifacthub.io/packages/helm/bitnami/redisSee the official chart values for param values.

Redis Logger​

KeyTypeDefaultDescription
redisLoggerobject RedisLogger allows us to capture Redis logs for STIGs
redisLogger.intervalSecondsint10polling interval at which the redis pod logs are captured
redisLogger.podSecurityContextobject podSecurityContext config options for deployment
redisLogger.podSecurityContext.enabledbooltruetoggle podSecurityContext for deployment
redisLogger.podSecurityContext.fsGroupint1000podSecurityContext fsGroup value
redisLogger.containerSecurityContextobject containerSecurityContext config options for deployment
redisLogger.containerSecurityContext.enabledbooltruetoggle the containerSecurityContext for deployment
redisLogger.containerSecurityContext.runAsNonRootbooltrueset runAsNonRoot for deployment
redisLogger.containerSecurityContext.runAsUserint1000set runAsNonRoot for deployment
redisLogger.containerSecurityContext.runAsGroupint1000set runAsGroup for deployment
redisLogger.containerSecurityContext.privilegedboolfalseRunning as privileged or unprivileged
redisLogger.containerSecurityContext.readOnlyRootFilesystemboolfalseMounts the container's root filesystem as read-only
redisLogger.containerSecurityContext.allowPrivilegeEscalationboolfalseControls whether a process can gain more privileges than its parent process
redisLogger.containerSecurityContext.capabilitiesobject With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.
redisLogger.containerSecurityContext.capabilities.droplist["ALL"]set capability to drop
redisLogger.containerSecurityContext.seccompProfileobject The seccompProfile field is a SeccompProfile object consisting of type and localhostProfile.
redisLogger.containerSecurityContext.seccompProfile.typestring"RuntimeDefault"Valid options for type include RuntimeDefault, Unconfined, and Localhost.
redisLogger.imageobject Redis Logger image details
redisLogger.image.repositorystring"/image/redis-logger"Redis Logger image repo
redisLogger.image.tagstring"2.4.0-dc23cf4e"Redis Logger image tag
redisLogger.image.namestring"Tangram Pro Redis Logger"Redis Logger image name
redisLogger.image.licensestring"Proprietary"Redis Logger image license type
redisLogger.image.urlstring"https://tangramflex.com/tangram-pro"Tangram Pro product URL
redisLogger.image.releasedatestring"09/06/2024"Redis Logger image release date
redisLogger.resourcesobject Resource constraint options for redis logger
redisLogger.resources.limitsobject Resource limit options for redis logger
redisLogger.resources.limits.memorystring"128Mi"Memory resource constraint options for redis logger
redisLogger.resources.limits.cpustring"125m"CPU resource constraint options for redis logger

Plugins​

KeyTypeDefaultDescription
pluginslist["cargo","code-gen-3","flex-transpiler","gplusplus","kaniko","document-render"]Tangram Pro workflow plugins

Storage​

KeyTypeDefaultDescription
storageobject Pro Storage configuration
storage.cloudobject cloud storage config
storage.cloud.awsobject aws-specific storage config for TPRO storage
storage.cloud.aws.s3Endpointstring"s3.us-gov-west-1.amazonaws.com"Should be in the form of s3.[region].amazonaws.com or s3-fips.[region].amazonaws.com
storage.cloud.aws.irsaobject IRSA config options for aws-specific storage
storage.cloud.aws.irsa.enabledboolfalsethis toggle determines if the role_arn is set as an annotation on the service accounts for IRSA with EKS
storage.cloud.aws.irsa.role_arnstring""the arn of a role in aws, with access to the buckets, with the pattern: arn:[region]:iam::[account_id]:role/[role_name]
storage.cloud.aws.extraEnvVarsstringsee values.yaml storage.cloud.aws.extraEnvVars sectionauth details for the endpoint
storage.bucketsobjectsee values.yaml storage.buckets sectionbuckets to create for Minio Minio buckets to create within Minio
storage.buckets.USER_PROFILE_PICTUREobject
USER_PROFILE_PICTURE:
  bucket: "user-profile-photo"
  toolkits:
    basic: true
minio bucket for user profile photos
storage.buckets.API_RESOURCEobject
API_RESOURCE:
  bucket: "api-resources"
  toolkits:
    basic: true
minio bucket for api-resources
storage.buckets.BACKUPobject
BACKUP:
  bucket: "backup"
  toolkits:
    basic: true
minio bucket for backup data
storage.buckets.FILE_RESOURCEobject
FILE_RESOURCE:
  bucket: "file-resources"
  toolkits:
    basic: true
minio bucket for user-uploaded files
storage.buckets.COMPONENT_ARTIFACTSobject
COMPONENT_ARTIFACTS:
  bucket: "component-artifacts"
  toolkits:
   developer: true
    verifier: true
minio bucket for component artifacts
storage.buckets.ORG_ARTIFACTobject
ORG_ARTIFACT:
  bucket: "org-artifact"
  toolkits:
   developer: true
    verifier: true
minio bucket for org artifacts
storage.buckets.ORG_LOGOobject
ORG_LOGO:
  bucket: "org-logo"
  toolkits:
   developer: true
    verifier: true
minio bucket for the org logo
storage.buckets.USER_ARTIFACTobject
USER_ARTIFACT:
  bucket: "user-artifact"
  toolkits:
   developer: true
    verifier: true
minio bucket for user artifacts
storage.buckets.DOCKER_REGISTRYobject
DOCKER_REGISTRY:
  bucket: "docker-registry"
  toolkits:
   developer: true
    verifier: true
minio bucket for docker container images
storage.buckets.ARGO_ARTIFACTobject
ARGO_ARTIFACT:
  bucket: "argo-artifacts"
  toolkits:
   developer: true
    verifier: true
minio bucket for argo workflow artifacts
storage.buckets.RUN_LOGSobject
RUN_LOGS:
  bucket: "run-logs"
  toolkits:
   developer: true
    verifier: true
minio bucket for run logs
storage.buckets.PROJECT_IACobject
PROJECT_IAC:
  bucket: "project-iac"
  toolkits:
   developer: true
    verifier: true
minio bucket for project IAC resources
storage.buckets.CSI_ADAPTERSobject
CSI_ADAPTERS:
  bucket: "csi-adapters"
  toolkits:
   developer: true
    verifier: true
minio bucket for CSI adapters
storage.buckets.CSIobject
CSI:
  bucket: "csis"
  toolkits:
   developer: true
    verifier: true
minio bucket for CSIS resources
storage.buckets.PROVIDER_CLASSobject
PROVIDER_CLASS:
  bucket: "provider-classes"
  toolkits:
   developer: true
    verifier: true
minio bucket for provider classes resources
storage.buckets.INTEGRATION_LOGSobject
INTEGRATION_LOGS:
  bucket: "integration-logs"
  toolkits:
   developer: true
    verifier: true
minio bucket for integration logs

Backup​

KeyTypeDefaultDescription
backupobject Backup config for Pro
backup.enabledboolfalsetoggle to disable or enable backups
backup.schedulestring"0 0 31 2 0"schedule at which the backup occurs
backup.storageSizestring"60Gi"storage size for backup PVC
backup.skipDockerstring"false"toggle to include or exlude registry images in backup
backup.destinationobject optional S3-compatible backup location
backup.destination.typestring"internal""internal" for cluster minio (default), "external" for external S3-compatible storage
backup.destination.externalobject s3 config
backup.destination.external.endpointstring"https://s3.us-gov-west-1.amazonaws.com"s3 endpoint. only used if destination.type=external. e.g. https://s3.us-gov-west-1.amazonaws.com
backup.destination.external.bucketstring""external S3 bucket name
backup.destination.external.accessKeySecretNamestring"external-s3-creds"secret for external S3 access credentials
backup.destination.external.accessKeyFieldstring"access-key"key inside the secret
backup.destination.external.secretKeyFieldstring"secret-key"key inside the secret
backup.podSecurityContextobject podSecurityContext config options for deployment
backup.podSecurityContext.enabledbooltruetoggle podSecurityContext for deployment
backup.podSecurityContext.fsGroupint1000podSecurityContext fsGroup value
backup.containerSecurityContextobject containerSecurityContext config options for deployment
backup.containerSecurityContext.enabledbooltruetoggle the containerSecurityContext for deployment
backup.containerSecurityContext.runAsNonRootbooltrueset runAsNonRoot for deployment
backup.containerSecurityContext.runAsUserint1000set runAsNonRoot for deployment
backup.containerSecurityContext.runAsGroupint1000set runAsGroup for deployment
backup.containerSecurityContext.privilegedboolfalseRunning as privileged or unprivileged
backup.containerSecurityContext.readOnlyRootFilesystemboolfalseMounts the container's root filesystem as read-only
backup.containerSecurityContext.allowPrivilegeEscalationboolfalseControls whether a process can gain more privileges than its parent process
backup.containerSecurityContext.capabilitiesobject With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.
backup.containerSecurityContext.capabilities.droplist["ALL"]set capability to drop
backup.containerSecurityContext.seccompProfileobject The seccompProfile field is a SeccompProfile object consisting of type and localhostProfile.
backup.containerSecurityContext.seccompProfile.typestring"RuntimeDefault"Valid options for type include RuntimeDefault, Unconfined, and Localhost.