Helm Values Reference

Complete reference for the dorgu-operator Helm chart values

The Helm chart provides a values.yaml that maps to the operator’s command-line flags and Kubernetes resource configuration.

​

Default values

replicaCount: 1

image:
  repository: ghcr.io/dorgu-ai/dorgu-operator
  tag: ""  # Defaults to chart appVersion
  pullPolicy: IfNotPresent

validation:
  requeueInterval: 60s

leaderElection:
  enabled: true

operator:
  autoCreateClusterPersona: true
  clusterPersonaEnsureInterval: ""

metrics:
  enabled: true
  bindAddress: ":8443"
  secure: true

healthProbe:
  bindAddress: ":8081"

argocd:
  enabled: true

prometheus:
  enabled: false
  url: ""

healthCheck:
  enabled: true
  interval: 60s
  readinessThreshold: 2m
  livenessRestarts:
    count: 2
    window: 10m
  recurrence:
    cap: 3
    window: 24h
  resolvedRetention: 720h

remediation:
  pendingTTL: 24h

safety:
  excludedNamespaces: []

metricsServer:
  enabled: true

eventPipeline:
  enabled: false

dorguEvents:
  retention: 24h
  maxRecords: 2000

llm:
  provider: ""
  model: ""
  cacheTTL: 30m
  existingSecret: ""
  existingSecretKey: "ANTHROPIC_API_KEY"
  apiKey: ""
  createSecret: false

aiRemediation:
  enabled: false

resources:
  limits:
    cpu: 500m
    memory: 128Mi
  requests:
    cpu: 10m
    memory: 64Mi

serviceAccount:
  create: true
  name: ""
  annotations: {}

nodeSelector: {}
tolerations: []
affinity: {}

​

Value reference

​

Image

Value	Type	Default	Description
image.repository	string	ghcr.io/dorgu-ai/dorgu-operator	Container image repository
image.tag	string	Chart appVersion	Image tag override
image.pullPolicy	string	IfNotPresent	Image pull policy
imagePullSecrets	array	[]	Image pull secrets for private registries

​

Replicas and scheduling

Value	Type	Default	Description
replicaCount	int	1	Number of operator replicas
leaderElection.enabled	bool	true	Enable leader election (required for replicas > 1)
nodeSelector	object	{}	Node selector for pod scheduling
tolerations	array	[]	Pod tolerations
affinity	object	{}	Pod affinity rules

​

Removed: the validating webhook

Chart 0.12.0 removed the Deployment validating admission webhook, its webhook.enabled, webhook.mode and webhook.port values, its Service, and its ValidatingWebhookConfiguration. It never produced a warning or a denial in any release, so removing it changes no admission behaviour on your cluster.

An install or upgrade that still sets webhook.enabled=true fails with a message saying the webhook was removed, rather than silently dropping the value. Remove webhook.* from your values files before upgrading to 0.12.0. If you run the binary directly, the --enable-webhook, --webhook-mode, --webhook-cert-path, --webhook-cert-name and --webhook-cert-key flags are gone too, and passing one stops the operator from starting.

Persona validation itself is unaffected: the controller still validates every Deployment against its persona and records the result on the persona’s status. See validation.

​

Self-healing

Value	Type	Default	Description
healthCheck.enabled	bool	true	Enable the health-check reconciler: detection, diagnosis, and remediation proposals. On by default since chart 0.8.0, and in the operator binary itself since 0.12.0. Set it to false to run without self-healing.
healthCheck.interval	duration	60s	How often the reconciler runs a detection cycle
healthCheck.readinessThreshold	duration	2m	How long a running container may stay not Ready before a ReadinessNotReady incident. Counted from the container start plus the probe’s initialDelaySeconds. Maps to --readiness-threshold. New in chart 0.13.0.
healthCheck.livenessRestarts.count	int	2	Container restarts within the window that raise a LivenessRestarts or RestartLoop incident without waiting for CrashLoopBackOff. Maps to --liveness-restart-count. New in chart 0.13.0.
healthCheck.livenessRestarts.window	duration	10m	The restart window. Must be at least twice healthCheck.interval, because the restart history is one observation per cycle: the operator refuses to start otherwise. Maps to --liveness-restart-window. New in chart 0.13.0.
healthCheck.recurrence.cap	int	3	Recurrences of one fault within the window before the latest incident is reopened instead of a new one being created. 0 disables the cap. Maps to --incident-recurrence-cap. New in chart 0.13.0.
healthCheck.recurrence.window	duration	24h	The recurrence window. Maps to --incident-recurrence-window. New in chart 0.13.0.
healthCheck.resolvedRetention	duration	720h	Resolved incidents whose last sighting is older than this are deleted, except the newest resolved incident of every fault and any a live RemediationAction names. 0 keeps them forever. Must not be shorter than healthCheck.recurrence.window. Maps to --resolved-incident-retention. New in chart 0.13.0. Needs the delete permission on incidentmemories, which the chart grants.
remediation.pendingTTL	duration	24h	A Pending proposal older than this becomes Expired: terminal, nothing applied, no cooldown. 0 disables the TTL. A proposal’s own spec.approval.deadline can shorten the window but never extend it. Maps to --remediation-pending-ttl. New in chart 0.13.0.
metricsServer.enabled	bool	true	Enable metrics-server integration for container-level CPU/memory detection

Rendered as --enable-health-check=<value> on the operator container either way, so the setting is always visible in the pod spec:

kubectl -n dorgu-system get deploy dorgu-operator \
  -o jsonpath='{.spec.template.spec.containers[0].args}{"\n"}'

When healthCheck.enabled is false, the operator still validates personas, records their health, and discovers the cluster, and from chart 0.12.0 it never opens an incident or proposes a fix. Chart 0.11.x and older did not fully honour this: an older code path still opened OOMKilled incidents and wrote RemediationAction proposals with detection off, without the guardrails the health-check path applies. Setting metricsServer.enabled=false passes --enable-metrics-server=false; OOM and crash-loop detection read pod status and are unaffected, but usage and saturation signals go dark. See Self-healing.

Upgrading from a chart older than 0.8.0 turns detection on. A release that never set healthCheck.enabled will start detecting after the upgrade: expect IncidentMemory records to appear, and RemediationAction proposals wherever the ClusterPersona self-healing mode is propose (the default). Nothing is applied without approval. To keep the old behaviour, upgrade with --set healthCheck.enabled=false.

​

Remediation safety

Value	Type	Default	Description
safety.excludedNamespaces	array	[]	Extra namespaces Dorgu never proposes a remediation in. Maps to --safety-excluded-namespaces. New in chart 0.12.0.

Dorgu never proposes a remediation for a persona in a protected namespace. Three sources make up the list:

• kube-system, always.
• The namespace the operator runs in, always. The chart sets POD_NAMESPACE on the operator container from the downward API, so with the documented install that is dorgu-system, and with any other --namespace it is that one.
• Anything you add, through safety.excludedNamespaces here or through spec.policies.selfHealing.excludeNamespaces on the ClusterPersona. Both are honoured.

safety:
  excludedNamespaces:
    - payments
    - ingress-nginx

From operator v0.13.0, pod detection skips these namespaces too. A pod that fails in a protected namespace raises no incident at all. Before 0.13.0 it raised one that was recorded and never remediated. Node and control-plane findings belong to no namespace and are unaffected. If the ClusterPersona list cannot be read, the pod collector fails rather than guess.

Fixed in operator v0.12.0. Older releases protected a hardcoded dorgu-operator-system, the kustomize default, rather than the namespace the chart actually installs into. With the documented --namespace dorgu-system install, Dorgu’s own namespace was not protected at all. Upgrade if you run 0.11.x.

​

Event pipeline and DorguEvent retention

Value	Type	Default	Description
eventPipeline.enabled	bool	false	Run the Kubernetes-Event watcher and write DorguEvent records. Off by default since chart 0.13.0: nothing in Dorgu reads those records. Maps to --enable-event-pipeline.
dorguEvents.retention	duration	24h	How long a DorguEvent record is kept before the cleaner removes it. Maps to --dorgu-event-retention.
dorguEvents.maxRecords	int	2000	Maximum records kept regardless of age; the oldest go first. 0 drops the cap and leaves retention as the only bound. Maps to --dorgu-event-max-records.

The two dorguEvents.* values apply only when eventPipeline.enabled=true, and the chart renders their flags only then. With the pipeline off no watcher or cleaner starts, no DorguEvent is written, and existing records are not pruned. Delete them with kubectl delete dorguevents -A --all. The Kubernetes Events on incidents, which kubectl describe shows, are separate and always on.

DorguEvent records are Dorgu’s own log of what it saw, readable with kubectl get dorguevent -A. They live in etcd, so they are bounded twice over: by age, and by count.

The count bound is the one that holds on a large cluster. Records arrive in proportion to cluster size, so a time window alone bounds nothing: a five-app clean-room cluster produced 187 records in 100 minutes, roughly 2,700 a day, every one of them inside the 24-hour window and all of them in etcd. The cleaner runs every 30 minutes, deletes oldest-first, and runs one pass at startup rather than waiting a full interval, because a restarted operator inherits the largest backlog it will ever see.

With the pipeline on, both flags are rendered on the operator container, so the pod spec states what bounds the record count, maxRecords: 0 included:

kubectl -n dorgu-system get deploy dorgu-operator \
  -o jsonpath='{.spec.template.spec.containers[0].args}{"\n"}'

New in operator v0.10.0. Before it, the cleaner had no delete permission on dorguevents.dorgu.io at all: it ran every cycle, failed, and removed nothing. The ClusterRole now grants delete on Dorgu’s own CRD and on no workload kind. See why that verb is there.

​

AI

Value	Type	Default	Description
llm.provider	string	""	claude enables Anthropic. Empty disables AI. gemini enables AI diagnosis only, since the remediation planner requires claude.
llm.model	string	""	Model override. Empty uses the provider default (claude-sonnet-4-6 for the planner).
llm.cacheTTL	duration	30m	How long an AI diagnosis or plan is reused while an incident’s signals are unchanged. A change asks the model again at once; this only bounds how stale an unchanged answer may get. 0 asks the model every health-check cycle. Maps to --llm-cache-ttl. New in chart 0.13.0.
llm.existingSecret	string	""	Name of a pre-created Secret holding the API key. Preferred.
llm.existingSecretKey	string	ANTHROPIC_API_KEY	Key within that Secret
llm.apiKey	string	""	Dev only. A raw key, requires createSecret=true
llm.createSecret	bool	false	When true and apiKey is set, the chart creates the Secret
aiRemediation.enabled	bool	false	Maps to --enable-ai-remediation. Only takes effect when llm.provider is set. false is also the current recommendation, not just the default: see why AI is off.

Both AI values default off, so a chart installed with no --set flags makes no API calls and spends nothing. Rules run either way.

The key is always delivered to the pod as an environment variable via secretKeyRef (ANTHROPIC_API_KEY for claude, GEMINI_API_KEY for gemini), and the chart never passes it as a container argument. llm.existingSecretKey defaults to the matching name, and any llm.provider other than claude or gemini fails the install.

See AI setup for the full walkthrough and the caveat about llm.apiKey being visible in helm get values.

A Secret you created yourself with kubectl create secret, which is the recommended path, is not part of the Helm release and survives helm uninstall. Delete it explicitly: Uninstall leads with it.

​

Bootstrap

Value	Type	Default	Description
operator.autoCreateClusterPersona	bool	true	Auto-create a ClusterPersona named dorgu-cluster on startup if none exists
operator.clusterPersonaEnsureInterval	duration	"" (operator default 2m)	How often the operator re-ensures that persona exists. Clamped to a 30s minimum. Only applies when autoCreateClusterPersona is true.

Set autoCreateClusterPersona: false if you manage ClusterPersonas through GitOps and do not want the operator creating one.

​

Validation

Value	Type	Default	Description
validation.requeueInterval	duration	60s	How often the ApplicationPersona controller re-validates

​

Metrics and probes

Value	Type	Default	Description
metrics.enabled	bool	true	Enable metrics endpoint
metrics.bindAddress	string	:8443	Metrics server bind address
metrics.secure	bool	true	Serve metrics over HTTPS with authentication
healthProbe.bindAddress	string	:8081	Health and readiness probe bind address

With metrics.enabled=true the chart creates a <release>-metrics Service on the metrics port and a <release>-metrics-reader ClusterRole. With metrics.secure=true every scrape is authenticated and authorized, so bind the reader role to whatever scrapes the operator:

kubectl create clusterrolebinding prometheus-dorgu-metrics \
  --clusterrole=dorgu-operator-metrics-reader \
  --serviceaccount=monitoring:prometheus

The operator itself needs create on tokenreviews and subjectaccessreviews to check those scrapes, and the chart grants both only while metrics.secure=true. The operator exports gate decisions, apply tickets, heal credit, stage durations, incident counters and model usage. Every family is listed in the metrics reference.

​

ArgoCD

Value	Type	Default	Description
argocd.enabled	bool	true	Enable ArgoCD Application watching

The watcher auto-detects whether the ArgoCD CRD exists. If enabled: true but the CRD is absent, the watcher silently skips.

​

Prometheus

Value	Type	Default	Description
prometheus.enabled	bool	false	Enable Prometheus baseline learning
prometheus.url	string	""	Prometheus server URL

Example: http://prometheus-server.monitoring:9090

​

Removed: the WebSocket server

Chart 0.13.0 removed the operator’s WebSocket server and its websocket.enabled, websocket.port, websocket.service.type and websocket.service.port values, the <release>-websocket Service and the container’s websocket port. The server was unauthenticated and nothing used it. A values file that still sets websocket.* installs unchanged, because Helm ignores unknown keys. See the upgrade guide.

​

Resources

Value	Type	Default	Description
resources.limits.cpu	string	500m	CPU limit
resources.limits.memory	string	128Mi	Memory limit
resources.requests.cpu	string	10m	CPU request
resources.requests.memory	string	64Mi	Memory request

​

Service account

Value	Type	Default	Description
serviceAccount.create	bool	true	Create a service account
serviceAccount.name	string	Release name	Service account name override
serviceAccount.annotations	object	{}	Service account annotations (e.g., for IRSA)

​

Example: the recommended default

Nothing to set. Detection, rule-based diagnosis, and rule-based remediation are all on, and no key is involved:

helm install dorgu-operator oci://ghcr.io/dorgu-ai/dorgu-operator-charts/dorgu-operator \
  --namespace dorgu-system --create-namespace

​

Example: opting in to AI

Create the Secret out of band, then:

# healthCheck.enabled and metricsServer.enabled are already true by default.
healthCheck:
  interval: 30s

llm:
  provider: claude
  existingSecret: dorgu-llm
  existingSecretKey: ANTHROPIC_API_KEY

# Leave this false for AI root-cause prose with rule-written plans, which is
# the recommended shape. Setting it true hands the plan to the model, and
# needs operator v0.11.0 or newer to produce one that can be applied.
aiRemediation:
  enabled: false

​

Example: Production deployment

replicaCount: 2

healthCheck:
  enabled: true
  interval: 30s

leaderElection:
  enabled: true

safety:
  excludedNamespaces:
    - payments

argocd:
  enabled: true

prometheus:
  enabled: true
  url: "http://prometheus-server.monitoring:9090"

resources:
  limits:
    cpu: "1"
    memory: 256Mi
  requests:
    cpu: 100m
    memory: 128Mi

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                  - dorgu-operator
          topologyKey: kubernetes.io/hostname

Configuration overview

Feature matrix and CLI flags

AI setup

Key handling, verification, and turning AI off

Self-healing

What the health-check reconciler does once enabled

Installation

Install the operator with these values