Helm values

Where the image comes from. Change it for a mirror inside your company.

The version to run. Leave it empty: each chart version runs its own release.

sha256:… pins the exact image, and wins over the tag.

When the cluster downloads the image again.

The Secret with the registry’s user name and token, such as [{name: ghcr}]. GoRunner’s image is private, so this is needed. The chart is private for now too: sign Helm in first (helm registry login ghcr.io). Every pod that runs GoRunner’s image uses it, the bundled file store’s relay included.

The address people open. Every email, approval page and OAuth redirect is built from it. Empty: ingress.host, with https when ingress.tls.enabled.

Make an Ingress. Off: route to the <release>-api Service yourself, on port 80.

The IngressClass, such as nginx, traefik or alb. Empty: the cluster’s default.

The domain name. Required with an Ingress.

GoRunner needs the whole host; a sub-path isn’t supported. With ingress.pathType, Prefix.

Serve the address over https. Turn it on unless something in front ends https.

The certificate’s Secret, or the one cert-manager writes.

Your own, such as cert-manager.io/cluster-issuer. They win over the chart’s.

With className: nginx: no response buffering, an hour’s read and send timeout, and a 6 MiB body.

Who may name the caller’s address. Empty trusts every private address, safe only while the network policy is on.

Only this address can make the first account. Optional without existingSecret; with it, see admin.allowOpenFirstSignup. It does nothing once an account exists.

With existingSecret and no admin.email: true lets whoever has the setup code be first.

false: people join by invitation. true: anyone who can open the address can make an account.

Leave it.

Your own Secret, its keys the setting names. Set, the chart writes none, and every secret value here is ignored.

64 hex characters (openssl rand -hex 32). Opens every stored credential. The chart never makes one up.

The license. Optional: the first admin is asked for one after signing in. One loaded in the dashboard comes first while in force.

The key to the operator console at /admin. Empty keeps it closed; set it only when GoRunner asks.

Any other secret setting by its name, such as OAUTH_MANAGED_GOOGLE_CLIENT_SECRET.

none: people sign in with a password. resend or smtp: sign-in by emailed link.

The sender, on a domain your mail service may send for.

With backend: resend.

With backend: smtp.

587, or 465 for TLS from the first byte.

starttls, tls or none. Empty: tls on 465, otherwise STARTTLS.

With mail.smtp.password. Leave both empty for a server with no sign-in.

Your database, PostgreSQL 15 or newer, as one address. It wins over the fields below.

The host alone, without its port. With port (5432), database (gorunner), user and password.

disable, require, verify-ca or verify-full.

The CA for verify-ca or verify-full, as a path in the pods, such as /certs/rds.pem.

The most connections each pod keeps (DB_MAX_CONNS). All pods, plus one of each while an upgrade rolls, must fit max_connections.

Connections the check keeps free for backups and an admin, at least 5.

Run the chart’s own PostgreSQL 15.6: one pod, an 8Gi volume, no backups. Evaluation only.

Your Redis 6.2 or newer as one address, rediss:// for TLS. Not in cluster mode, with noeviction.

Separate fields: port (6379), db (0), user, password.

true for an encrypted connection.

Run the chart’s own Redis: one pod, a 2Gi volume, no replica. Evaluation only.

none: step data stays in PostgreSQL. external: your bucket. bundled: one SeaweedFS pod, evaluation only.

With objectStorage.region, us-east-1.

Step data larger than this goes to the bucket. 0: all of it.

How long one storage call may take. maxAttempts: how often it is tried, 4.

Your store’s address.

true for MinIO and SeaweedFS.

With secretKey.

docker.io/library/postgres (image.repository). image.digest is empty: a new image string would restart the database. Set it yourself to pin one.

docker.io/library/redis. The release sets image.digest to the one the tag named when it was tested.

docker.io/chrislusf/seaweedfs, with its digest set by the release.

Redis 2Gi, SeaweedFS 10Gi. Each also takes persistence.storageClass (empty: the cluster’s default) and resources.

Also redis.bundled.password and objectStorage.bundled.accessKey / secretKey. Empty: made once and kept in the <release>-bundled Secret, which outlives an uninstall.

Keep at least 2, so a drain or a crash never leaves nobody to answer.

CPU and memory for each.

Runs that finished longer ago than this are deleted hourly, with their data. Each workflow keeps its newest finished run in each environment.

Requests a minute per credential. Also webhook 3000, oauth 120, embedApi 3000, embedAccount 300, embedOauthRequest 600 (from v2026.10.31), embedPerson 20, embedRenew 4.

How long the embed renews its own session, 1 to 24 hours.

Other websites that may call the API from a browser, separated by commas.

off: AI apps’ sign-in addresses (discovery, register, token, revoke) keep the API’s own CORS instead of answering any website. For an installation reached only from your own network (OAUTH_PUBLIC_CORS, from v2026.10.31).

More app callbacks AI apps may register: whole addresses, separated by commas, no query (OAUTH_EXTRA_REDIRECT_URIS, from v2026.10.31).

Adds the caller’s address and browser to each request’s line (ACCESS_LOG).

public: health checks show their details to anyone (HEALTH_DETAILS).

When a pod stops, how long it has to finish requests, after preStopSeconds (10).

Keep at least minAvailable (1) app pod through node drains.

The Service in front of the app, on port 80, with annotations of your own.

More environment variables for the app pods, as a Kubernetes env list.

Also tolerations, affinity, topologySpreadConstraints, priorityClassName, podAnnotations, podLabels.

More workers is the safer way to grow than larger ones.

Runs one worker runs at once. Raise its memory limit with it.

CPU and memory for each.

Keel conversations one worker serves at once. 0 turns Keel off on it.

off: Keel builds without its compile step. Leave it unless GoRunner asks.

Notifications to your server one worker sends at once.

Test step and connection tests one worker serves at once.

How long a stopping worker may finish its runs. After that, another worker picks them up.

And the same placement values as the app.

Private addresses steps may reach: empty for none, all, or ranges. See Outbound access.

Runs of one organization that may wait before new ones are refused. 0: no cap.

The same for one workflow, editor test runs included.

Run the migrations Job at every install and upgrade. Leave it on.

Extra flags, only when GoRunner asks.

Retries. activeDeadlineSeconds: 900 in all.

The finished Job and its log go after a day.

CPU and memory for the Job.

A problem the check finds fails the Job. false: only logged, except one that protects data.

With proxy.http: the proxy’s address, kept in the Secret.

Names reached directly. GoRunner adds its own, the cluster’s .svc and .cluster.local among them.

name or ip. See By name, or by address.

More volumes on every pod, with extraVolumeMounts. Every .pem mounted at /certs is trusted.

LOG_LEVEL. And logFormat: LOG_FORMAT.

OTEL_EXPORTER_OTLP_ENDPOINT. Each telemetry.otel.* value is the OTEL_* setting of the same meaning; headers is kept in the Secret.

METRICS_ENABLED: /metrics on port 9464 of every pod, with token and workflowLabels.

SENTRY_DSN, kept in the Secret, with environment.

CLIENT_ERRORS_ENABLED. Also auditRetentionDays, auditCredentialUseRetentionDays, auditIpRetentionDays and eventStreamingEnabled.

Any setting the values above don’t cover, by its name, such as OUTBOUND_ALLOW_PRIVATE: "true".

GoRunner never calls the Kubernetes API, so the account holds no token. Also name and annotations.

With the default seccomp profile.

No privilege escalation, every capability dropped.

Only your controller and helm test reach the app; the workers accept nothing. Needs a plugin that enforces NetworkPolicy.

Who may reach the app. Change it for any other controller, or the app answers nobody.

Who may read /metrics on port 9464.

The checks helm test runs.

With fullnameOverride: other names for the chart’s objects.