Helm Values Reference

Complete reference for the dorgu-operator Helm chart values

The Helm chart provides a values.yaml that maps to the operator’s command-line flags and Kubernetes resource configuration.

Default values

replicaCount: 1

image:
  repository: ghcr.io/dorgu-ai/dorgu-operator
  tag: ""  # Defaults to chart appVersion
  pullPolicy: IfNotPresent

webhook:
  enabled: false
  mode: advisory
  port: 9443

validation:
  requeueInterval: 60s

leaderElection:
  enabled: true

operator:
  autoCreateClusterPersona: true
  clusterPersonaEnsureInterval: ""

metrics:
  enabled: true
  bindAddress: ":8443"
  secure: true

healthProbe:
  bindAddress: ":8081"

argocd:
  enabled: true

prometheus:
  enabled: false
  url: ""

websocket:
  enabled: false
  port: 9090
  service:
    type: ClusterIP
    port: 9090

healthCheck:
  enabled: false
  interval: 60s

metricsServer:
  enabled: true

llm:
  provider: ""
  model: ""
  existingSecret: ""
  existingSecretKey: "ANTHROPIC_API_KEY"
  apiKey: ""
  createSecret: false

aiRemediation:
  enabled: false

resources:
  limits:
    cpu: 500m
    memory: 128Mi
  requests:
    cpu: 10m
    memory: 64Mi

serviceAccount:
  create: true
  name: ""
  annotations: {}

nodeSelector: {}
tolerations: []
affinity: {}

Value reference

Image

Value	Type	Default	Description
image.repository	string	ghcr.io/dorgu-ai/dorgu-operator	Container image repository
image.tag	string	Chart appVersion	Image tag override
image.pullPolicy	string	IfNotPresent	Image pull policy
imagePullSecrets	array	[]	Image pull secrets for private registries

Replicas and scheduling

Value	Type	Default	Description
replicaCount	int	1	Number of operator replicas
leaderElection.enabled	bool	true	Enable leader election (required for replicas > 1)
nodeSelector	object	{}	Node selector for pod scheduling
tolerations	array	[]	Pod tolerations
affinity	object	{}	Pod affinity rules

Webhook

Value	Type	Default	Description
webhook.enabled	bool	false	Enable validating admission webhook
webhook.mode	string	advisory	advisory or enforcing
webhook.port	int	9443	Webhook server port

The webhook requires TLS certificates. In production, use cert-manager to provision certificates automatically. The Helm chart includes the necessary annotations when cert-manager is available.

Self-healing

Value	Type	Default	Description
healthCheck.enabled	bool	false	Enable the health-check reconciler — detection, diagnosis, and remediation proposals. This is the switch that turns self-healing on.
healthCheck.interval	duration	60s	How often the reconciler runs a detection cycle
metricsServer.enabled	bool	true	Enable metrics-server integration for container-level CPU/memory detection

When healthCheck.enabled is false, the operator still validates personas and discovers the cluster — it just never opens incidents or proposes fixes. Setting metricsServer.enabled=false passes --enable-metrics-server=false; OOM and crash-loop detection read pod status and are unaffected, but usage and saturation signals go dark. See Self-healing.

AI

Value	Type	Default	Description
llm.provider	string	""	claude enables Anthropic. Empty disables AI. gemini enables AI diagnosis only — the remediation planner requires claude.
llm.model	string	""	Model override. Empty uses the provider default (claude-sonnet-4-6 for the planner).
llm.existingSecret	string	""	Name of a pre-created Secret holding the API key. Preferred.
llm.existingSecretKey	string	ANTHROPIC_API_KEY	Key within that Secret
llm.apiKey	string	""	Dev only — raw key, requires createSecret=true
llm.createSecret	bool	false	When true and apiKey is set, the chart creates the Secret
aiRemediation.enabled	bool	false	Maps to --enable-ai-remediation. Only takes effect when llm.provider is set.

The key is always delivered to the pod as the ANTHROPIC_API_KEY environment variable via secretKeyRef — the chart never passes it as a container argument. See AI setup for the full walkthrough and the caveat about llm.apiKey being visible in helm get values.

Bootstrap

Value	Type	Default	Description
operator.autoCreateClusterPersona	bool	true	Auto-create a ClusterPersona named dorgu-cluster on startup if none exists
operator.clusterPersonaEnsureInterval	duration	"" (operator default 2m)	How often the operator re-ensures that persona exists. Clamped to a 30s minimum. Only applies when autoCreateClusterPersona is true.

Set autoCreateClusterPersona: false if you manage ClusterPersonas through GitOps and do not want the operator creating one.

Validation

Value	Type	Default	Description
validation.requeueInterval	duration	60s	How often the ApplicationPersona controller re-validates

Metrics and probes

Value	Type	Default	Description
metrics.enabled	bool	true	Enable metrics endpoint
metrics.bindAddress	string	:8443	Metrics server bind address
metrics.secure	bool	true	Serve metrics over HTTPS with authentication
healthProbe.bindAddress	string	:8081	Health and readiness probe bind address

ArgoCD

Value	Type	Default	Description
argocd.enabled	bool	true	Enable ArgoCD Application watching

The watcher auto-detects whether the ArgoCD CRD exists. If enabled: true but the CRD is absent, the watcher silently skips.

Prometheus

Value	Type	Default	Description
prometheus.enabled	bool	false	Enable Prometheus baseline learning
prometheus.url	string	""	Prometheus server URL

Example: http://prometheus-server.monitoring:9090

WebSocket

Value	Type	Default	Description
websocket.enabled	bool	false	Enable WebSocket server for CLI communication
websocket.port	int	9090	WebSocket server port
websocket.service.type	string	ClusterIP	Service type for the WebSocket endpoint
websocket.service.port	int	9090	Service port

When enabled, the chart creates a Service on the specified port.

Resources

Value	Type	Default	Description
resources.limits.cpu	string	500m	CPU limit
resources.limits.memory	string	128Mi	Memory limit
resources.requests.cpu	string	10m	CPU request
resources.requests.memory	string	64Mi	Memory request

Service account

Value	Type	Default	Description
serviceAccount.create	bool	true	Create a service account
serviceAccount.name	string	Release name	Service account name override
serviceAccount.annotations	object	{}	Service account annotations (e.g., for IRSA)

Example: AI self-healing

Create the Secret out of band, then:

healthCheck:
  enabled: true
  interval: 30s

metricsServer:
  enabled: true

websocket:
  enabled: true

llm:
  provider: claude
  existingSecret: dorgu-llm
  existingSecretKey: ANTHROPIC_API_KEY

aiRemediation:
  enabled: true

Example: Production deployment

replicaCount: 2

healthCheck:
  enabled: true
  interval: 30s

leaderElection:
  enabled: true

webhook:
  enabled: true
  mode: enforcing

argocd:
  enabled: true

prometheus:
  enabled: true
  url: "http://prometheus-server.monitoring:9090"

websocket:
  enabled: true

resources:
  limits:
    cpu: "1"
    memory: 256Mi
  requests:
    cpu: 100m
    memory: 128Mi

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                  - dorgu-operator
          topologyKey: kubernetes.io/hostname

Configuration overview

Feature matrix and CLI flags

AI setup

Key handling, verification, and turning AI off

Self-healing

What the health-check reconciler does once enabled

Installation

Install the operator with these values