# Beyond Defaults

The chart ships with sensible defaults for every value. The full list is on the
[Helm Chart Configuration](chart) page. A few values have no working default and
must be provided, namely the container images and the secrets. Every other value
can be overridden to suit your environment.

There are two ways to override values: a **values file** (recommended for a repeatable
deployment) or **`--set` flags** (handy for occasional overrides).  They can be
combined.  Values are merged with this precedence, lowest to highest:

1. the chart's built-in `values.yaml`;
2. each `-f`/`--values` file, in the order given (later files win);
3. each `--set` / `--set-string` / `--set-file` flag (these win over files).

## Required values

These have no usable default, and the deployment fails without them:

| Component | Values you must set |
| --------- | ------------------- |
| Proxy | `Proxy.satosa-image`, `Proxy.state-encryption-key`, `Proxy.user-id-hash-salt` |
| Discovery | `Discovery.httpd-image` |
| Registry | `Registry.image`, `Registry.database-password`, `Registry.email-account-password`, `Registry.security-salt` |
| Ldap | `Ldap.image` |

## Using a values file

Create a file, conventionally named `my-values.yaml`, that contains only the
values you want to change from their defaults:

```yaml
# my-values.yaml
Ldap:
  image: registry.example.org/rdct/attribute-authority:latest
Proxy:
  satosa-image: registry.example.org/satosa:8.5.1
  state-encryption-key: CHANGE_ME          # secret
  user-id-hash-salt: CHANGE_ME             # secret
  hostname: auth.example.org
  base-url: https://auth.example.org
Discovery:
  httpd-image: registry.example.org/cortex-discovery:latest
  hostname: wayf.example.org
Registry:
  image: i2incommon/comanage-registry-pe:5.2.0-rocky10.1
  database-password: CHANGE_ME             # secret
  email-account-password: CHANGE_ME        # secret
  security-salt: CHANGE_ME                 # secret
  hostname: registry.example.org
```

Install or upgrade with the file using `-f`:

```bash
helm install <Release.Name> cortex/cortex -f my-values.yaml \
  -n <NAMESPACE> --create-namespace
helm upgrade <Release.Name> cortex/cortex -f my-values.yaml -n <NAMESPACE>
```

## Overriding on the terminal

For a small number of changes, use `--set` instead of a file.  Use dots for
nested keys; the chart's kebab-case keys work as written:

```bash
helm upgrade <Release.Name> cortex/cortex -n <NAMESPACE> \
  --set Proxy.hostname=auth.example.org \
  --set Proxy.satosa-image=registry.example.org/satosa:8.5.1 \
  --set Registry.database.storage-size=10Gi
```

Use `--set-string` when a value must stay a string (for example a port
that looks like a number), and `--set-file` to read a value from a file (useful for secrets):

```bash
helm upgrade <Release.Name> cortex/cortex -n <NAMESPACE> \
  --set-string Registry.database.port=5432 \
  --set-file Proxy.state-encryption-key=./state-encryption-key.txt
```