Chart Values

Table of Contents

• Global
• Pod Security Context
• Container Security Context
• Service Account & RBAC
• licensed (seat arbitrator)
• adminToken
• activity (Action Events)
• dashboard (operator UI)
• valkey (seat-state store)
• keygen (in-enclave keypair)
• trust (delegation material)
• networkPolicy

---

Global

Key	Type	Default	Description
global.imageRegistry	string	""	Override the registry host for ALL images. When set, replaces the per-image .registry. Use for air-gapped mirror deployments.
global.imagePullSecrets	list	[]	Image pull Secrets used by every pod (names of pre-created dockerconfigjson Secrets).
nameOverride	string	""	Override the chart name (part of resource names).
fullnameOverride	string	""	Fully override the generated resource name prefix.
commonLabels	object	{}	Extra labels added to every resource.
commonAnnotations	object	{}	Extra annotations added to every resource.

---

Pod Security Context

Applied at the pod level across all components. Compatible with restricted Pod Security Admission and OpenShift SCCs.

Key	Type	Default	Description
podSecurityContext.enabled	bool	true	Set to false to omit the pod security context entirely.
podSecurityContext.runAsNonRoot	bool	true	Require the container to run as a non-root user.
podSecurityContext.runAsUser	int	65532	UID to run containers as.
podSecurityContext.runAsGroup	int	65532	GID to run containers as.
podSecurityContext.fsGroup	int	65532	fsGroup for volume ownership.
podSecurityContext.seccompProfile.type	string	RuntimeDefault	Seccomp profile type.

---

Container Security Context

Applied to all app containers (licensed, dashboard, activityd).

Key	Type	Default	Description
containerSecurityContext.enabled	bool	true	Toggle the container security context.
containerSecurityContext.runAsNonRoot	bool	true	Run the container as a non-root user.
containerSecurityContext.runAsUser	int	65532	Container UID.
containerSecurityContext.runAsGroup	int	65532	Container GID.
containerSecurityContext.allowPrivilegeEscalation	bool	false	Prevent privilege escalation.
containerSecurityContext.readOnlyRootFilesystem	bool	true	Mount the root filesystem read-only.
containerSecurityContext.privileged	bool	false	Disable privileged mode.
containerSecurityContext.capabilities.drop	list	["ALL"]	Drop all Linux capabilities.
containerSecurityContext.seccompProfile.type	string	RuntimeDefault	Seccomp profile type.

---

Service Account & RBAC

Key	Type	Default	Description
serviceAccount.create	bool	true	Create ServiceAccounts for chart components.
serviceAccount.annotations	object	{}	Annotations for the created ServiceAccounts (e.g. for IRSA).
rbac.create	bool	true	Create least-privilege Roles and RoleBindings. The keygen Job's ServiceAccount may only create the delegate Secret/ConfigMap; the dashboard may only patch the licensed Deployment.

---

licensed

The stateless seat arbitrator — the core service that tenon CLI clients talk to for checkout, heartbeat, and checkin.

Key	Type	Default	Description
licensed.image.registry	string	registry-gitlab.tangramflex.tech	Image registry.
licensed.image.repository	string	pro/flex-cli/licensing-self-host/licensed	Image repository path.
licensed.image.tag	string	"0.3.0"	Image tag. Must be pinned explicitly to a release tag.
licensed.image.pullPolicy	string	IfNotPresent	Image pull policy.
licensed.replicaCount	int	2	Number of licensed replicas. Stateless — safe to scale for HA.
licensed.leaseTTL	string	4h	Floating (shared-pool) lease time-to-live. A dead client's seat frees itself after this.
licensed.nodeLockTTL	string	2160h	Node-locked lease TTL (machine-bound seats).
licensed.service.type	string	ClusterIP	Service type. Use NodePort for k3d/dev environments.
licensed.service.port	int	8080	Service port.
licensed.service.nodePort	string	""	NodePort (only when type=NodePort). Empty = auto-assign.
licensed.resources.requests.cpu	string	25m	CPU request.
licensed.resources.requests.memory	string	32Mi	Memory request.
licensed.resources.limits.memory	string	128Mi	Memory limit.
licensed.podDisruptionBudget.enabled	bool	true	Create a PodDisruptionBudget for licensed.
licensed.podDisruptionBudget.minAvailable	int	1	Minimum available licensed pods during voluntary disruptions.
licensed.autoscaling.enabled	bool	false	Enable a HorizontalPodAutoscaler for licensed.
licensed.autoscaling.minReplicas	int	2	HPA minimum replicas.
licensed.autoscaling.maxReplicas	int	6	HPA maximum replicas.
licensed.autoscaling.targetCPUUtilizationPercentage	int	80	HPA CPU utilization target.
licensed.fips	bool	false	Enable Go FIPS 140-3 mode at runtime (requires a FIPS-built image).
licensed.extraEnv	list	[]	Extra environment variables for licensed (list of {name, value}).
licensed.nodeSelector	object	{}	Node selector for licensed pods.
licensed.tolerations	list	[]	Tolerations for licensed pods.
licensed.affinity	object	{}	Affinity rules for licensed pods.

---

adminToken

The shared admin credential for licensed's protected read APIs and for activityd.

Key	Type	Default	Description
adminToken.existingSecret	string	""	Use an existing Secret instead of generating one. The Secret must contain key token.

---

activity

Controls the Action Events subsystem: activityd and its SQLite activity store.

Key	Type	Default	Description
activity.enabled	bool	true	Enable Action Events. When false, no activityd is deployed, POST /v1/actions accepts and discards, and activity reads return 404.
activity.retentionDays	int	365	Events older than this are deleted. Also the window in which an expired lease may still read its own history.
activity.lateAcceptDays	int	7	How long after a lease expires its offline-spooled actions are still accepted.
activity.maxActionsPerLeasePerHour	int	1000	Abuse guard: maximum accepted actions per lease per clock hour.
activity.bufferMaxLen	int	500000	Hard cap on the Valkey ingest buffer if activityd is down.
activity.logToStdout	bool	true	Log every event as a structured JSON line on licensed's stdout (for SIEM integration).
activity.persistence.size	string	10Gi	activityd database PVC size. (~5 MB/day for 50 users × 200 runs.)
activity.persistence.storageClass	string	""	StorageClass for the data PVC. Empty = cluster default.
activity.persistence.accessMode	string	ReadWriteOnce	PVC access mode.
activity.backup.enabled	bool	true	Take online SQLite snapshots.
activity.backup.interval	string	24h	Snapshot interval (Go duration).
activity.backup.keep	int	14	Number of newest snapshots to keep.
activity.backup.existingClaim	string	""	Use an existing PVC for snapshots. Empty = chart creates one.
activity.backup.size	string	10Gi	Size of the chart-created backup PVC.
activity.backup.storageClass	string	""	StorageClass for the backup PVC. Empty = cluster default.
activity.activityd.resources.requests.cpu	string	25m	CPU request for activityd.
activity.activityd.resources.requests.memory	string	64Mi	Memory request for activityd.
activity.activityd.resources.limits.memory	string	256Mi	Memory limit for activityd.
activity.activityd.nodeSelector	object	{}	Node selector for the activityd pod.
activity.activityd.tolerations	list	[]	Tolerations for the activityd pod.
activity.activityd.affinity	object	{}	Affinity for the activityd pod.
activity.activityd.extraEnv	list	[]	Extra environment variables for activityd.

---

dashboard

The operator web UI for viewing seat status, pool controls, and activity events.

Key	Type	Default	Description
dashboard.enabled	bool	true	Deploy the operator dashboard.
dashboard.image.registry	string	registry-gitlab.tangramflex.tech	Image registry.
dashboard.image.repository	string	pro/flex-cli/licensing-self-host/dashboard	Image repository path.
dashboard.image.tag	string	"0.3.0"	Image tag. Must be pinned explicitly.
dashboard.image.pullPolicy	string	IfNotPresent	Image pull policy.
dashboard.replicaCount	int	1	Dashboard replica count.
dashboard.service.type	string	ClusterIP	Service type. Expose via ingress or port-forward.
dashboard.service.port	int	8080	Service port.
dashboard.ingress.enabled	bool	false	Create a Kubernetes Ingress for the dashboard.
dashboard.ingress.className	string	""	IngressClass to use (e.g. nginx). Empty = cluster default IngressClass.
dashboard.ingress.annotations	object	{}	Ingress annotations (e.g. cert-manager, nginx).
dashboard.ingress.hosts	list	(see values.yaml)	Hostnames and paths routed to the dashboard.
dashboard.ingress.tls	list	[]	TLS blocks. Reference an existing Secret or one cert-manager creates.
dashboard.resources.requests.cpu	string	25m	CPU request.
dashboard.resources.requests.memory	string	32Mi	Memory request.
dashboard.resources.limits.memory	string	128Mi	Memory limit.
dashboard.nodeSelector	object	{}	Node selector for dashboard pods.
dashboard.tolerations	list	[]	Tolerations for dashboard pods.
dashboard.affinity	object	{}	Affinity for dashboard pods.
dashboard.auth.enabled	bool	true	Require admin sign-in for mutating actions (Release-all, Restart). Viewing is always read-only without sign-in.
dashboard.auth.existingSecret	string	""	Use an existing Secret instead of generating one (keys: admin-user, admin-password).
dashboard.auth.adminUser	string	admin	Admin username.

---

valkey

Bundled single-node Valkey (Redis-compatible) for seat-state storage.

Key	Type	Default	Description
valkey.enabled	bool	true	Deploy a bundled single-node Valkey. Set false to use an external instance.
valkey.externalAddr	string	""	External Valkey address (host:port) when enabled: false.
valkey.existingPasswordSecret	string	""	Name of a pre-created Secret holding a Valkey password (enables AUTH).
valkey.existingPasswordSecretKey	string	password	Key within the password Secret.
valkey.image.registry	string	docker.io	Valkey image registry.
valkey.image.repository	string	valkey/valkey	Valkey image repository.
valkey.image.tag	string	8-alpine	Valkey image tag.
valkey.image.pullPolicy	string	IfNotPresent	Image pull policy.
valkey.fsGroup	int	999	fsGroup for the Valkey pod (matches the valkey uid/gid in the official image).
valkey.persistence.enabled	bool	true	Persist seat state (AOF) on a PVC so seats survive a Valkey restart.
valkey.persistence.size	string	1Gi	PVC size.
valkey.persistence.storageClass	string	""	StorageClass. Empty = cluster default CSI.
valkey.persistence.accessMode	string	ReadWriteOnce	PVC access mode.
valkey.resources.requests.cpu	string	50m	CPU request.
valkey.resources.requests.memory	string	64Mi	Memory request.
valkey.resources.limits.memory	string	256Mi	Memory limit.

---

keygen

The Helm pre-install/pre-upgrade hook that generates the in-enclave delegate keypair.

Key	Type	Default	Description
keygen.enabled	bool	true	Run the in-enclave keygen Job. Idempotent — never rotates an existing key.
keygen.delegateSecret	string	licensed-delegate	Secret the keygen Job writes the delegate private key into. Never leaves the enclave.
keygen.delegatePubConfigMap	string	licensed-delegate-pub	ConfigMap the keygen Job writes the delegate public key into (for the operator to KMS-sign).
keygen.backoffLimit	int	3	Kubernetes Job backoffLimit.

---

trust

The KMS-signed delegation and KMS root public key applied by the operator after keygen.

Key	Type	Default	Description
trust.secretName	string	licensed-trust	Name of the Secret holding delegation.json + root-pub.pem. Normally applied out-of-band after KMS signing.
trust.waitForTrust	bool	true	Block licensed from starting until the trust Secret exists. When false, licensed will crash-loop until trust is present.
trust.delegation	string	""	Inline delegation.json content. If set (e.g. --set-file trust.delegation=delegation.json), the chart creates the trust Secret for you (single-step install).
trust.rootPublicKey	string	""	Inline root-pub.pem content. Pair with trust.delegation.

---

networkPolicy

Default-deny + explicit-allow NetworkPolicies (recommended for enclaves).

Key	Type	Default	Description
networkPolicy.enabled	bool	true	Install default-deny + explicit-allow NetworkPolicies.
networkPolicy.clientNamespaces	list	[]	Namespaces (by name) whose pods may reach licensed:8080. Empty = same namespace only.
networkPolicy.clientCIDRs	list	[]	Additional ingress CIDRs allowed to reach licensed:8080 (e.g. the enclave LAN).
networkPolicy.dashboardFromNamespaces	list	[]	Namespaces allowed to reach the dashboard on port 8080. Set to your ingress controller namespace (e.g. ingress-nginx) when exposing the dashboard via ingress under a strict CNI.