Beyond Defaults

Beyond Defaults#

The chart ships with sensible defaults for every value. The full list is on the Helm Chart Configuration page. A few values have no working default and must be provided, namely the container images and the secrets. Every other value can be overridden to suit your environment.

There are two ways to override values: a values file (recommended for a repeatable deployment) or --set flags (handy for occasional overrides). They can be combined. Values are merged with this precedence, lowest to highest:

  1. the chart’s built-in values.yaml;

  2. each -f/--values file, in the order given (later files win);

  3. each --set / --set-string / --set-file flag (these win over files).

Required values#

These have no usable default, and the deployment fails without them:

Component

Values you must set

Proxy

Proxy.satosa-image, Proxy.state-encryption-key, Proxy.user-id-hash-salt

Discovery

Discovery.httpd-image

Registry

Registry.image, Registry.database-password, Registry.email-account-password, Registry.security-salt

Ldap

Ldap.image

Using a values file#

Create a file, conventionally named my-values.yaml, that contains only the values you want to change from their defaults:

# my-values.yaml
Ldap:
  image: registry.example.org/rdct/attribute-authority:latest
Proxy:
  satosa-image: registry.example.org/satosa:8.5.1
  state-encryption-key: CHANGE_ME          # secret
  user-id-hash-salt: CHANGE_ME             # secret
  hostname: auth.example.org
  base-url: https://auth.example.org
Discovery:
  httpd-image: registry.example.org/cortex-discovery:latest
  hostname: wayf.example.org
Registry:
  image: i2incommon/comanage-registry-pe:5.2.0-rocky10.1
  database-password: CHANGE_ME             # secret
  email-account-password: CHANGE_ME        # secret
  security-salt: CHANGE_ME                 # secret
  hostname: registry.example.org

Install or upgrade with the file using -f:

helm install <Release.Name> cortex/cortex -f my-values.yaml \
  -n <NAMESPACE> --create-namespace
helm upgrade <Release.Name> cortex/cortex -f my-values.yaml -n <NAMESPACE>

Overriding on the terminal#

For a small number of changes, use --set instead of a file. Use dots for nested keys; the chart’s kebab-case keys work as written:

helm upgrade <Release.Name> cortex/cortex -n <NAMESPACE> \
  --set Proxy.hostname=auth.example.org \
  --set Proxy.satosa-image=registry.example.org/satosa:8.5.1 \
  --set Registry.database.storage-size=10Gi

Use --set-string when a value must stay a string (for example a port that looks like a number), and --set-file to read a value from a file (useful for secrets):

helm upgrade <Release.Name> cortex/cortex -n <NAMESPACE> \
  --set-string Registry.database.port=5432 \
  --set-file Proxy.state-encryption-key=./state-encryption-key.txt