Configuration Overview

All operator configuration options: command-line flags and feature toggles

The operator is configured through command-line flags, which map directly to Helm values when deploying via Helm. All features are opt-in except the core reconciliation controllers.

Feature matrix

Feature	Default	Flag	Description
ApplicationPersona controller	Enabled	Always on	Validates deployments against persona constraints
ClusterPersona controller	Enabled	Always on	Discovers cluster state and resource capacity
Self-healing loop	Disabled	--enable-health-check	Detection, diagnosis, and remediation proposals
AI diagnosis	Disabled	--llm-provider	LLM-enhanced root-cause analysis (requires an API key)
AI remediation planner	Enabled when a provider and key are set	--enable-ai-remediation	Ordered, AI-written remediation plans (Anthropic only)
Metrics-server integration	Enabled	--enable-metrics-server	Container-level CPU/memory signals
ClusterPersona bootstrap	Enabled	--auto-create-cluster-persona	Auto-creates dorgu-cluster on startup
ArgoCD watcher	Enabled	--enable-argocd	Watches ArgoCD Applications for sync status
Validating webhook	Disabled	--enable-webhook	Intercepts Deployment create/update
Prometheus integration	Disabled	--prometheus-url	Queries Prometheus for resource baselines
WebSocket server	Disabled	--enable-websocket	Real-time CLI communication
Leader election	Disabled (flag default; enabled in Helm chart)	--leader-elect	HA mode for multi-replica deployments
Secure metrics	Enabled	--metrics-secure	HTTPS metrics endpoint with RBAC

Command-line flags

Core

Flag	Type	Default	Description
--metrics-bind-address	string	0	Metrics endpoint bind address. Use :8443 for HTTPS or :8080 for HTTP. Set to 0 to disable.
--health-probe-bind-address	string	:8081	Health and readiness probe bind address
--leader-elect	bool	false	Enable leader election for HA deployments
--enable-http2	bool	false	Enable HTTP/2 for metrics and webhook servers

Webhook

Flag	Type	Default	Description
--enable-webhook	bool	false	Enable the validating admission webhook
--webhook-mode	string	advisory	advisory (warn only) or enforcing (reject on errors)
--webhook-cert-path	string	""	Directory containing webhook TLS certificate
--webhook-cert-name	string	tls.crt	Webhook certificate filename
--webhook-cert-key	string	tls.key	Webhook private key filename

Metrics

Flag	Type	Default	Description
--metrics-secure	bool	true	Serve metrics over HTTPS with RBAC
--metrics-cert-path	string	""	Directory containing metrics TLS certificate
--metrics-cert-name	string	tls.crt	Metrics certificate filename
--metrics-cert-key	string	tls.key	Metrics private key filename

Self-healing and AI

Flag	Type	Default	Description
--enable-health-check	bool	false	Enable the health-check reconciler — detection, diagnosis, and remediation
--health-check-interval	duration	60s	Detection cycle interval
--enable-metrics-server	bool	true	Enable metrics-server integration for container-level detection
--llm-provider	string	""	claude or gemini for AI-enhanced diagnosis. Empty disables AI.
--llm-api-key	string	""	API key, overriding the ANTHROPIC_API_KEY / GEMINI_API_KEY env vars
--llm-model	string	""	Model override for the provider
--enable-ai-remediation	bool	true	Enable AI-written ordered remediation plans. Requires --llm-provider=claude and a key; falls back to the deterministic rules otherwise.

The Helm chart never passes --llm-api-key. It injects the key as the ANTHROPIC_API_KEY environment variable from a Secret via secretKeyRef, so it stays out of the pod spec. See AI setup.

Bootstrap

Flag	Type	Default	Description
--auto-create-cluster-persona	bool	true	Auto-create a ClusterPersona named dorgu-cluster if none exists on startup
--cluster-persona-ensure-interval	duration	2m	How often to re-ensure that persona exists. Clamped to a 30s minimum.

Integrations

Flag	Type	Default	Description
--enable-argocd	bool	true	Enable ArgoCD Application watching
--prometheus-url	string	""	Prometheus server URL for baseline learning
--enable-websocket	bool	false	Enable WebSocket server for CLI
--websocket-addr	string	:9090	WebSocket server listen address

The ArgoCD watcher only activates if both --enable-argocd=true and the ArgoCD Application CRD (argoproj.io/v1alpha1) is detected in the cluster. If the CRD is missing, the watcher silently skips registration.

Example: Full-featured deployment

./bin/manager \
  --metrics-bind-address :8443 \
  --health-probe-bind-address :8081 \
  --leader-elect \
  --enable-webhook \
  --webhook-mode enforcing \
  --enable-health-check \
  --health-check-interval 30s \
  --llm-provider claude \
  --enable-ai-remediation \
  --enable-argocd \
  --prometheus-url http://prometheus-server.monitoring:9090 \
  --enable-websocket \
  --websocket-addr :9090

Helm values

Complete Helm values.yaml reference

Installation

Install methods and verification