Skip to main content

Registry Server Helm values

Configure the Registry Server chart with these Helm values.

This reference lists values declared in the chart's default values.yaml. Templates can also accept optional settings and inherited global values.

Chart: toolhive-registry-server. Chart version: 0.22.0. Generated from the platform source at e71926418e98c7598815d0abf07039d3c1646f21.

Values​

ha​

Type: object

Default: {"podDisruptionBudget":{"minAvailable":1}}

High availability for the registry server. The replica count stays on the upstream chart value (upstream.replicaCount) — this overlay cannot rewrite it. Every replica serves the API; the Kubernetes source watch runs only on the leader (leader election), and catalog sync claims work through PostgreSQL row locks, so replicas do not sync the same source twice. This overlay renders a PodDisruptionBudget whenever upstream.replicaCount is above 1; a budget over a single replica would block every node drain.

ha.podDisruptionBudget.minAvailable​

Type: int

Default: 1

Minimum number of registry-server pods that must remain available.

upstream.affinity​

Type: object

Default value
podAntiAffinity:
  preferredDuringSchedulingIgnoredDuringExecution:
    - podAffinityTerm:
        labelSelector:
          matchLabels:
            app.kubernetes.io/component: registry-api
            app.kubernetes.io/name: upstream
        topologyKey: kubernetes.io/hostname
      weight: 100
    - podAffinityTerm:
        labelSelector:
          matchLabels:
            app.kubernetes.io/component: registry-api
            app.kubernetes.io/name: upstream
        topologyKey: topology.kubernetes.io/zone
      weight: 50

Spread registry-server replicas across nodes and zones. Preferred, not required, so it never blocks scheduling and does nothing at one replica. Setting your own upstream.affinity merges with this map; set podAntiAffinity: null to drop the default. The selector labels are what the upstream chart renders under alias: upstream (Helm renames an aliased dependency's .Chart.Name); component keeps it off the toolhive-operator pods, which share the same alias name.

upstream.fullnameOverride​

Type: string

Default: "registry-api"

Override the upstream Registry Server resource names. The default gives the deployment and Service the name registry-api.

upstream.image.registryServerUrl​

Type: string

Default value
image-proxy.stacklok.com/proxy/stacklok-enterprise/ghcr.io/stacklok/stacklok-enterprise/registry-api:0.22.0

Container image used by the standalone Stacklok Enterprise Registry Server.

upstream.imagePullSecrets​

Type: list

Default: [{"name":"enterprise-pull-secret"}]

Image pull Secrets for the Registry Server pod. The default authenticates to the Replicated image proxy with enterprise-pull-secret.

networkPolicy.enabled​

Type: bool

Default: false

Enable a NetworkPolicy for the registry-api pod. Default off: regulated customers running a default-deny CNI policy engine (Kyverno add-network-policy, OPA Gatekeeper) opt in explicitly.

networkPolicy.allowExternalEgress​

Type: bool

Default: true

Allow ALL egress traffic. NOTE: NetworkPolicies are additive, so this does not merely "not restrict" egress — it GRANTS allow-all egress to this pod, OVERRIDING any cluster-wide default-deny egress policy (Kyverno add-network-policy, Gatekeeper) that would otherwise apply. networkPolicy.enabled: true with this left true is NOT a locked-down workload — it only adds an ingress restriction.

Recommended default nonetheless: the PostgreSQL host (upstream.config.database.host / global.postgres.host) is known at template time, but sync sources (git/API) are customer-configured and not enumerable here — this chart has no way to know your actual sources at template time, so a fixed allow-list would be a guess. Set to false and populate egress below to actually lock this pod down (it holds the Postgres DSN, so this matters more than usual).

networkPolicy.egress​

Type: list

Default: []

Additional egress rules (Kubernetes NetworkPolicyEgressRule shape), applied when allowExternalEgress is false. Must cover DNS (UDP/TCP 53), the PostgreSQL backend, and every git/API sync source this registry actually pulls from — omitting one doesn't fail loudly, the registry just can't reach it.