Chart values

Chart tailnet-operator 0.18.0 (app v0.18.0). Installation and what the site must provide: Install the operator .

Values

Key	Type	Default	Description
agent.imagePullSecrets	list	`[]`	Default agent pull-secret names, e.g. [dockerconfig]. Tailnet.spec.proxy.imagePullSecrets overrides these. Secrets must exist in each agent namespace.
agent.resources	object	`{"limits":{"memory":"128Mi"},"requests":{"cpu":"10m","memory":"32Mi"}}`	Default agent resource block, below CR spec.resources and Tailnet.spec.proxy.resources (no per-key merging). Set null to disable chart defaults; {} does not clear Helm defaults. Changes restart agents that inherit them. Tenant LimitRanges must admit these values.
agentImage.digest	string	`""`	Agent digest. An entirely empty agentImage inherits the complete operator image, including its digest.
agentImage.repository	string	`""`	Agent repository; empty inherits image.repository.
agentImage.tag	string	`""`	Agent tag. With an explicit repository, empty uses Chart.appVersion; otherwise inherits image.tag.
env.extra	list	`[]`	Additional EnvVar entries. POD_NAMESPACE, OPERATOR_IMAGE, AGENT_IMAGE_PULL_SECRETS, AGENT_RESOURCES and SSL_CERT_FILE are reserved.
fullnameOverride	string	`""`	Override the resource name with a letter-first DNS label (at most 53 characters). Install only one operator per cluster.
image.digest	string	`""`	Optional sha256 digest; takes precedence over the tag.
image.pullPolicy	string	`"IfNotPresent"`	Operator pull policy.
image.repository	string	`"docker.io/ff0x/tailnet-operator"`	Operator image repository. Verify mirror availability before installation.
image.tag	string	`""`	Image tag; empty uses Chart.appVersion.
imagePullSecrets	list	`[]`	Pull-secret references for the operator pod, e.g. [{name: dockerconfig}].
leaderElection.enabled	bool	`true`	Elect one active operator using a Lease in the operator namespace. Disable only for a single replica with Recreate updates.
monitoring.dashboard.allowCrossNamespaceImport	bool	`true`	Allow Grafana Operator to import into matching instances in other namespaces.
monitoring.dashboard.datasourceName	string	`"Prometheus"`	Grafana Operator datasource name mapped to the bundled DS_PROMETHEUS input. Sidecar users must configure input substitution separately.
monitoring.dashboard.enabled	bool	`false`	Render the bundled dashboard, or the json override below. Disabled by default.
monitoring.dashboard.folder	string	`"Tailnet"`	Grafana Operator dashboard folder.
monitoring.dashboard.instanceSelector	object	`{"matchLabels":{"grafana.internal/instance":"grafana"}}`	Grafana Operator instance selector.
monitoring.dashboard.json	string	`""`	Nonempty JSON replaces the bundled dashboard; custom JSON is not template evaluated.
monitoring.dashboard.kind	string	`"GrafanaDashboard"`	GrafanaDashboard requires Grafana Operator v5 CRDs; ConfigMap supports dashboard sidecars.
monitoring.dashboard.labels	object	`{"grafana_dashboard":"1"}`	Labels for the dashboard resource, including the optional ConfigMap sidecar label.
monitoring.podMonitor.enabled	bool	`false`	Scrape generated agents on health TCP/9080 and gateways on kernel-health TCP/8080 + metrics-dns TCP/9153. Requires PodMonitor CRD; allow your Prometheus through scrapeFrom.
monitoring.podMonitor.interval	string	`"30s"`	Agent scrape interval.
monitoring.podMonitor.labels	object	`{}`	Additional PodMonitor labels for your Prometheus selector.
monitoring.podMonitor.namespaceSelector	object	`{"any":true}`	Agent namespace selection. Set any: false with matchNames to restrict namespaces; any: false without names selects only the PodMonitor namespace.
monitoring.podMonitor.scrapeFrom	list	`[]`	NetworkPolicy peers (namespaceSelector / podSelector / ipBlock) that may scrape the generated agents on TCP/9080, rendered into every agent NetworkPolicy next to the operator. Empty adds none. Gateways carry no policy.
monitoring.rules.apiKeyExpiryWarningSeconds	int	`604800`	API-key expiry warning threshold in seconds (7 days). For shorter key lifetimes, set below half-life to avoid warning before normal rotation.
monitoring.rules.authKeyExpiryWarningSeconds	int	`86400`	Egress/ingress auth-key expiry warning threshold in seconds (1 day). For shorter key lifetimes, set below half-life to avoid warning before normal rotation.
monitoring.rules.enabled	bool	`false`	Render a PrometheusRule. Requires Prometheus Operator CRDs.
monitoring.rules.groups	list	`[]`	Nonempty groups replace all bundled rules, without merging or template evaluation.
monitoring.serviceMonitor.enabled	bool	`false`	Requires Prometheus Operator CRDs. Disabled for a fresh Kubernetes installation.
monitoring.serviceMonitor.interval	string	`"30s"`	Scrape interval.
monitoring.serviceMonitor.labels	object	`{}`	Additional ServiceMonitor labels for your Prometheus selector.
namespace	string	`""`	Operator namespace; empty uses the Helm release namespace. Bootstrap and working keys live here.
networkPolicy.cilium.headscalePeers	list	`[{"podSelector":{"matchLabels":{"app.kubernetes.io/name":"headscale"}}}]`	Headscale peers for provider cilium (namespaceSelector / podSelector; no ipBlock). Without a namespaceSelector the peer is scoped to the operator namespace. Set to `[]` when the Headscale control plane is reached by IP via `headscaleCIDRs` instead.
networkPolicy.dnsPeers	list	`[{"namespaceSelector":{"matchLabels":{"kubernetes.io/metadata.name":"kube-system"}},"podSelector":{"matchLabels":{"k8s-app":"kube-dns"}}}]`	DNS NetworkPolicy peers; customize for NodeLocal DNS or a different resolver.
networkPolicy.enabled	bool	`false`	Enable operator isolation. With provider kubernetes this requires explicit kubeAPI and Headscale CIDRs; CNI Service-DNAT behavior must be checked locally.
networkPolicy.headscaleCIDRs	list	`[]`	Headscale API endpoint CIDRs (not hostnames). Required for provider kubernetes; optional for provider cilium (renders a `toCIDR` egress for a remote Headscale). Update when the DNS address changes; prefer the stable control-plane IPs over resolver-dependent values.
networkPolicy.headscalePorts	list	`[443,8080]`	Headscale REST API TCP ports.
networkPolicy.kubeAPICIDRs	list	`[]`	API endpoint and/or Service CIDRs appropriate for your CNI, e.g. [10.96.0.1/32]. Required for provider kubernetes.
networkPolicy.kubeAPIPorts	list	`[443,6443]`	Kubernetes API TCP ports.
networkPolicy.metricsPeers	list	`[]`	Peers permitted to scrape metrics (provider kubernetes). Empty denies metrics ingress when isolation is enabled.
networkPolicy.provider	string	`"kubernetes"`	`kubernetes` renders a NetworkPolicy (ingress and egress, ipBlock-based). `cilium` renders an egress-only CiliumNetworkPolicy using `toEntities: kube-apiserver`, label selectors and `toCIDR`; ipBlock peers in `dnsPeers`/`cilium.headscalePeers` are rejected, ingress stays open, requires the cilium.io/v2 CRDs. For a Headscale that lives outside the cluster (shared control plane, spoke clusters) set `cilium.headscalePeers: []` and populate `headscaleCIDRs` — the template renders a `toCIDR` egress for the Headscale IPs on `headscalePorts`.
podSecurityContext	object	`{"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}`	Pod security context; the scratch image requires a numeric non-root UID.
replicas	int	`1`	Operator replicas; more than one requires leaderElection.enabled. A PDB with minAvailable=1 is rendered for multiple replicas.
resources	object	`{"limits":{"memory":"192Mi"},"requests":{"cpu":"25m","memory":"64Mi"}}`	Operator resource requests and limits. GOMEMLIMIT follows limits.memory.
securityContext	object	`{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true}`	Operator container hardening. Agents are configured separately by the controller.
topologySpreadConstraints	list	`[]`	Optional operator pod topology spread constraints. Supply a labelSelector matching app.kubernetes.io/name: tailnet-operator.

Source: docs/reference/values.md at v0.18.0 — found a mistake? Tell us.

CRD reference RBAC reference