Helm Values Reference

Complete reference for the dorgu-operator Helm chart values

The Helm chart provides a values.yaml that maps to the operator’s command-line flags and Kubernetes resource configuration.

Default values

replicaCount: 1

image:
  repository: ghcr.io/dorgu-ai/dorgu-operator
  tag: ""  # Defaults to chart appVersion
  pullPolicy: IfNotPresent

webhook:
  enabled: false
  mode: advisory
  port: 9443

validation:
  requeueInterval: 60s

leaderElection:
  enabled: true

operator:
  autoCreateClusterPersona: true
  clusterPersonaEnsureInterval: ""

metrics:
  enabled: true
  bindAddress: ":8443"
  secure: true

healthProbe:
  bindAddress: ":8081"

argocd:
  enabled: true

prometheus:
  enabled: false
  url: ""

websocket:
  enabled: false
  port: 9090
  service:
    type: ClusterIP
    port: 9090

healthCheck:
  enabled: true
  interval: 60s

metricsServer:
  enabled: true

dorguEvents:
  retention: 24h
  maxRecords: 2000

llm:
  provider: ""
  model: ""
  existingSecret: ""
  existingSecretKey: "ANTHROPIC_API_KEY"
  apiKey: ""
  createSecret: false

aiRemediation:
  enabled: false

resources:
  limits:
    cpu: 500m
    memory: 128Mi
  requests:
    cpu: 10m
    memory: 64Mi

serviceAccount:
  create: true
  name: ""
  annotations: {}

nodeSelector: {}
tolerations: []
affinity: {}

Value reference

Image

Value	Type	Default	Description
image.repository	string	ghcr.io/dorgu-ai/dorgu-operator	Container image repository
image.tag	string	Chart appVersion	Image tag override
image.pullPolicy	string	IfNotPresent	Image pull policy
imagePullSecrets	array	[]	Image pull secrets for private registries

Replicas and scheduling

Value	Type	Default	Description
replicaCount	int	1	Number of operator replicas
leaderElection.enabled	bool	true	Enable leader election (required for replicas > 1)
nodeSelector	object	{}	Node selector for pod scheduling
tolerations	array	[]	Pod tolerations
affinity	object	{}	Pod affinity rules

Webhook

Value	Type	Default	Description
webhook.enabled	bool	false	Enable validating admission webhook
webhook.mode	string	advisory	advisory or enforcing
webhook.port	int	9443	Webhook server port

The webhook requires TLS certificates. In production, use cert-manager to provision certificates automatically. The Helm chart includes the necessary annotations when cert-manager is available.

Self-healing

Value	Type	Default	Description
healthCheck.enabled	bool	true	Enable the health-check reconciler: detection, diagnosis, and remediation proposals. On by default since chart 0.8.0. Set it to false to run without self-healing.
healthCheck.interval	duration	60s	How often the reconciler runs a detection cycle
metricsServer.enabled	bool	true	Enable metrics-server integration for container-level CPU/memory detection

Rendered as --enable-health-check=<value> on the operator container either way, so the setting is always visible in the pod spec:

kubectl -n dorgu-system get deploy dorgu-operator \
  -o jsonpath='{.spec.template.spec.containers[0].args}{"\n"}'

When healthCheck.enabled is false, the operator still validates personas and discovers the cluster; it just never opens incidents or proposes fixes. Setting metricsServer.enabled=false passes --enable-metrics-server=false; OOM and crash-loop detection read pod status and are unaffected, but usage and saturation signals go dark. See Self-healing.

Upgrading from a chart older than 0.8.0 turns detection on. A release that never set healthCheck.enabled will start detecting after the upgrade: expect IncidentMemory records to appear, and RemediationAction proposals wherever the ClusterPersona self-healing mode is propose (the default). Nothing is applied without approval. To keep the old behaviour, upgrade with --set healthCheck.enabled=false.

DorguEvent retention

Value	Type	Default	Description
dorguEvents.retention	duration	24h	How long a DorguEvent record is kept before the cleaner removes it. Maps to --dorgu-event-retention.
dorguEvents.maxRecords	int	2000	Maximum records kept regardless of age; the oldest go first. 0 drops the cap and leaves retention as the only bound. Maps to --dorgu-event-max-records.

DorguEvent records are Dorgu’s own log of what it saw, readable with kubectl get dorguevent -A. They live in etcd, so they are bounded twice over: by age, and by count.

The count bound is the one that holds on a large cluster. Records arrive in proportion to cluster size, so a time window alone bounds nothing: a five-app clean-room cluster produced 187 records in 100 minutes, roughly 2,700 a day, every one of them inside the 24-hour window and all of them in etcd. The cleaner runs every 30 minutes, deletes oldest-first, and runs one pass at startup rather than waiting a full interval, because a restarted operator inherits the largest backlog it will ever see.

Both flags are rendered on the operator container unconditionally, so the pod spec always states what bounds the record count, maxRecords: 0 included:

kubectl -n dorgu-system get deploy dorgu-operator \
  -o jsonpath='{.spec.template.spec.containers[0].args}{"\n"}'

New in operator v0.10.0. Before it, the cleaner had no delete permission on dorguevents.dorgu.io at all: it ran every cycle, failed, and removed nothing. The ClusterRole now grants delete on Dorgu’s own CRD and on no workload kind. See why that verb is there.

AI

Value	Type	Default	Description
llm.provider	string	""	claude enables Anthropic. Empty disables AI. gemini enables AI diagnosis only, since the remediation planner requires claude.
llm.model	string	""	Model override. Empty uses the provider default (claude-sonnet-4-6 for the planner).
llm.existingSecret	string	""	Name of a pre-created Secret holding the API key. Preferred.
llm.existingSecretKey	string	ANTHROPIC_API_KEY	Key within that Secret
llm.apiKey	string	""	Dev only. A raw key, requires createSecret=true
llm.createSecret	bool	false	When true and apiKey is set, the chart creates the Secret
aiRemediation.enabled	bool	false	Maps to --enable-ai-remediation. Only takes effect when llm.provider is set. false is also the current recommendation, not just the default: see why AI is off.

Both AI values default off, so a chart installed with no --set flags makes no API calls and spends nothing. Rules run either way.

The key is always delivered to the pod as the ANTHROPIC_API_KEY environment variable via secretKeyRef, and the chart never passes it as a container argument. See AI setup for the full walkthrough and the caveat about llm.apiKey being visible in helm get values.

A Secret you created yourself with kubectl create secret, which is the recommended path, is not part of the Helm release and survives helm uninstall. Delete it explicitly: Uninstall leads with it.

Bootstrap

Value	Type	Default	Description
operator.autoCreateClusterPersona	bool	true	Auto-create a ClusterPersona named dorgu-cluster on startup if none exists
operator.clusterPersonaEnsureInterval	duration	"" (operator default 2m)	How often the operator re-ensures that persona exists. Clamped to a 30s minimum. Only applies when autoCreateClusterPersona is true.

Set autoCreateClusterPersona: false if you manage ClusterPersonas through GitOps and do not want the operator creating one.

Validation

Value	Type	Default	Description
validation.requeueInterval	duration	60s	How often the ApplicationPersona controller re-validates

Metrics and probes

Value	Type	Default	Description
metrics.enabled	bool	true	Enable metrics endpoint
metrics.bindAddress	string	:8443	Metrics server bind address
metrics.secure	bool	true	Serve metrics over HTTPS with authentication
healthProbe.bindAddress	string	:8081	Health and readiness probe bind address

ArgoCD

Value	Type	Default	Description
argocd.enabled	bool	true	Enable ArgoCD Application watching

The watcher auto-detects whether the ArgoCD CRD exists. If enabled: true but the CRD is absent, the watcher silently skips.

Prometheus

Value	Type	Default	Description
prometheus.enabled	bool	false	Enable Prometheus baseline learning
prometheus.url	string	""	Prometheus server URL

Example: http://prometheus-server.monitoring:9090

WebSocket

Value	Type	Default	Description
websocket.enabled	bool	false	Enable WebSocket server for CLI communication
websocket.port	int	9090	WebSocket server port
websocket.service.type	string	ClusterIP	Service type for the WebSocket endpoint
websocket.service.port	int	9090	Service port

When enabled, the chart creates a Service on the specified port.

Resources

Value	Type	Default	Description
resources.limits.cpu	string	500m	CPU limit
resources.limits.memory	string	128Mi	Memory limit
resources.requests.cpu	string	10m	CPU request
resources.requests.memory	string	64Mi	Memory request

Service account

Value	Type	Default	Description
serviceAccount.create	bool	true	Create a service account
serviceAccount.name	string	Release name	Service account name override
serviceAccount.annotations	object	{}	Service account annotations (e.g., for IRSA)

Example: the recommended default

Nothing to set. Detection, rule-based diagnosis, and rule-based remediation are all on, and no key is involved:

helm install dorgu-operator oci://ghcr.io/dorgu-ai/dorgu-operator-charts/dorgu-operator \
  --namespace dorgu-system --create-namespace

Example: opting in to AI

Create the Secret out of band, then:

# healthCheck.enabled and metricsServer.enabled are already true by default.
healthCheck:
  interval: 30s

websocket:
  enabled: true

llm:
  provider: claude
  existingSecret: dorgu-llm
  existingSecretKey: ANTHROPIC_API_KEY

# Leave this false for AI root-cause prose with rule-written plans, which is
# the recommended shape. Setting it true hands the plan to the model, and
# needs operator v0.11.0 or newer to produce one that can be applied.
aiRemediation:
  enabled: false

Example: Production deployment

replicaCount: 2

healthCheck:
  enabled: true
  interval: 30s

leaderElection:
  enabled: true

webhook:
  enabled: true
  mode: enforcing

argocd:
  enabled: true

prometheus:
  enabled: true
  url: "http://prometheus-server.monitoring:9090"

websocket:
  enabled: true

resources:
  limits:
    cpu: "1"
    memory: 256Mi
  requests:
    cpu: 100m
    memory: 128Mi

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                  - dorgu-operator
          topologyKey: kubernetes.io/hostname

Configuration overview

Feature matrix and CLI flags

AI setup

Key handling, verification, and turning AI off

Self-healing

What the health-check reconciler does once enabled

Installation

Install the operator with these values