AIStor Server Operator Helm Chart

# Default values for AIStor Operators chart

# The Following annotations/labels are applied to all resources created by the Helm chart
annotations: {}
labels: {}

# Allow override the namespace for all resources
#namespaceOverride: "test"

# The MinIO license can be set directly from the Helm chart. Note that it is not advised
# to expose the license key in the Helm chart. Instead, it is recommended to create a
# secret manually. It's just here for convenience.
license: ""

# global settings are settings that will be applied to all operators
# unless explicitly overridden in the operator settings.
global:
  # The Helm chart will try to auto-detect OpenShift. If it cannot detect OpenShift
  # (i.e. when running helm template), then it will default to false. You can
  # override this setting to force OpenShift mode.
  #forceOpenShift: true

  # Enable FIPS 140-3 mode for all operators. When true, every image resolved by
  # the chart gets a ".fips" suffix appended to its tag, selecting the
  # FIPS-enabled image variants. Leave false for the normal (non-FIPS) images.
  fipsMode: false

  # Specify the default cluster domain. When it's not set, then it
  # will try to auto-detect the cluster. But you may want to set it
  # explicitly
  # clusterDomain: "cluster.xxx"

  # The following settings will be set for all operators. They can
  # be overridden per operator by setting the same key in the
  # .operator.<operator> section.
  operator:
    # Specify number of replicas
    replicas: 1

    # Specify `annotations <https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/>`__ to associate to pods.
    podAnnotations: {}

    # Specify `labels <https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/>`__ to associate to pods.
    podLabels: {}

    # This will add extra environment variables to the operator
    # containers.
    #
    # OpenTelemetry Configuration Example:
    # To enable OpenTelemetry logging, add OTEL environment variables:
    #
    # extraEnv:
    #   - name: OTEL_EXPORTER_OTLP_ENDPOINT
    #     # For gRPC protocol: use host:port (scheme optional, will be auto-stripped)
    #     value: "otel-collector.observability.svc.cluster.local:4317"
    #     # For HTTP protocol: include the http:// or https:// scheme
    #     # value: "http://otel-collector.observability.svc.cluster.local:4318"
    #   - name: OTEL_EXPORTER_OTLP_PROTOCOL
    #     value: "grpc"  # or "http"
    #   - name: OTEL_EXPORTER_OTLP_INSECURE
    #     value: "false"
    #   - name: OTEL_EXPORTER_OTLP_HEADERS
    #     value: "authorization=Bearer token123"  # Optional: for authentication
    extraEnv: []

    # Image pull policy (empty uses the default registry policy).
    imagePullPolicy: ""
    ###
    # You may need to set the image pull secrets when using a private registry.
    # Need to be set as an array of LocalObjectReference.
    #  .. code-block:: yaml
    #
    #    imagePullSecrets:
    #        - name: minio-registry-secret
    #          type: kubernetes.io/dockerconfigjson
    imagePullSecrets: []

    # Resources for the operator containers.
    resources:
      requests:
        cpu: 200m
        ephemeral-storage: 500Mi
        memory: 256Mi

    # Security context for the operator containers (runAsUser/runAsGroup are
    # dropped on OpenShift, where the SCC assigns them)
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      runAsGroup: 1000
      runAsNonRoot: true
      runAsUser: 1000
      seccompProfile:
        type: RuntimeDefault
      readOnlyRootFilesystem: true

    # Security context for the operator pods (ignored on OpenShift)
    podSecurityContext: {}
      # fsGroup: 2000

    # An array of `Toleration labels for Operator pods to associate.
    # .. code-block:: yaml
    #
    #    tolerations:
    #    - effect: "NoSchedule"
    #      operator: "Equal"
    #      key: "key1"
    #      value: "value1"
    tolerations: []

    # Node selector labels
    nodeSelector: {}

    # When set, the operator only monitors resources in the listed namespaces.
    # A RoleBinding is created in each namespace instead of a ClusterRoleBinding.
    # Leave empty (default) for cluster-wide mode.
    #
    # watchedNamespaces:
    #   - namespace1
    #   - namespace2
    #
    # Automatic certificates requires global cluster-wide permissions, so it you
    # may want to disable this in namespace-scoped mode. Since OpenShift uses
    # OpenShift Service CA Operator to issue certificates, this setting is not
    # applicable in OpenShift.
    #
    # optOutAutomaticCertificates: true


# All operators will be using the global setting, unless overridden
# in the section below. All keys in `.global.operator` can also be
# used here and will override (not extend) the global setting.
#
# All operators will be disabled by default, with the exception of
# the object-store.
operators:
  adminjob:
    disabled: false
  # DEPRECATED: the aihub controller is deprecated and will be removed in a
  #             future release.
  aihub:
    disabled: true
  object-store:
    disabled: false
    # affinity:
    #   podAntiAffinity:
    #     requiredDuringSchedulingIgnoredDuringExecution:
    #     - labelSelector:
    #         matchExpressions:
    #         - key: aistor.min.io/name
    #           operator: In
    #           values:
    #           - object-store-operator
    #       topologyKey: kubernetes.io/hostname

    # The operator uses a Kubernetes service account to connect to MinIO. There are
    # two modes for validating the Kubernetes tokens that are used for authentication:
    #
    # - TokenReview (default) - uses the Kubernetes `TokenReview` API to validate the tokens.
    # - OIDC - uses the OIDC discovery and JWKS document to validate the tokens.
    # - Disabled - disables using Kubernetes tokens for authentication. This cannot be used
    #              with the operator, because the operator itself needs to authenticate to
    #              MinIO using a Kubernetes token.
    #
    # `TokenReview`
    # -------------
    # This is the default mode, but it requires the following RBAC permissions:
    # - Helm installation will install the `aistor-tokenreview` cluster role
    # - Operator should be able to assign `aistor-tokenreview` cluster role to
    #   the AIStor service accounts, so it requires permission to create cluster role
    #   bindings.
    #
    # `OIDC`
    # ------
    # This will perform the token validation itself, so it does not require the
    # additional RBAC permissions. To validate the tokens, AIStor needs to be able:
    # - Fetch the Kubernetes OIDC discovery document
    # - Fetch the Kubernetes JWKS document (can be located outside the cluster)
    # Some clusters prevent access to these endpoints, because:
    # - The endpoints are outside the cluster and the cluster has network policies
    #   that prevent the AIStor pods access.
    # - The endpoints use a custom CA that is not trusted by the AIStor pods,
    #   so the AIStor pods won't trust the endpoints.
    #
    # Most clusters will allow this, but some clusters may have network policies
    # that prevent this. In such clusters, you must set `tokenValidation: TokenReview`
    # and grant the necessary permissions to AIStor. Clusters that do allow access to the
    # OIDC discovery and JWKS document can instead set `tokenValidation: OIDC` to avoid the
    # `aistor-tokenreview` cluster role binding.
    tokenValidation: TokenReview

    # hotReload controls how MinIO applies config.yaml changes. When false (the
    # default) the operator restarts MinIO to apply configuration changes, which is
    # required for AIStor versions that cannot hot-reload pool changes. Set to true
    # to have the sidecar send SIGHUP so MinIO reloads config.yaml in place.
    hotReload: false

    # disableImageDigestResolve opts out of determining the AIStor version of a MinIO
    # image that is pinned by digest (`image@sha256:...`) instead of by tag. A digest
    # names no version, but the operator needs one to decide how to configure MinIO
    # (config.yaml v3 or MINIO_ARGS) and whether a pool can be upgraded in place. By
    # default it runs the image once as a short-lived pod in the object-store
    # namespace to read its version, and remembers the answer per digest.
    #
    # Running that pod requires `create` and `get` on `pods` and `get` on `pods/log`
    # in the object-store namespaces. Setting this to true is the way to avoid
    # granting them: the `aistor-object-store` cluster role is then installed
    # without those permissions, and the operator never creates a pod of its own.
    #
    # The cost of opting out is that a digest-pinned image is assumed to run a recent
    # release, which is wrong for images that predate config.yaml v3 or in-place
    # rolling upgrades. Images pinned by tag are unaffected either way.
    disableImageDigestResolve: false

    webhook:
      enabled: true   # set to false to disable webhook deployment
      caBundle: ""    # custom CA bundle (base64 encoded PEM). Required when serving a custom certificate (see extraEnv below); for the autocert and OpenShift service-ca flows it is injected automatically.
      replicas: 1     # set number of replicas (default is only using a single webhook)
      # extraEnv adds environment variables to the webhook container. Set
      # WEBHOOK_CUSTOM_TLS_SECRET_NAME to serve a certificate issued externally
      # (for example by cert-manager) instead of the autocert flow. When you do,
      # also set caBundle above to the issuing CA so the apiserver trusts the webhook:
      #   extraEnv:
      #     - name: WEBHOOK_CUSTOM_TLS_SECRET_NAME
      #       value: object-store-webhook-tls
      extraEnv: []
      # affinity:
      #   podAntiAffinity:
      #     requiredDuringSchedulingIgnoredDuringExecution:
      #     - labelSelector:
      #         matchExpressions:
      #         - key: aistor.min.io/name
      #           operator: In
      #           values:
      #           - object-store-webhook
      #       topologyKey: kubernetes.io/hostname
  # DEPRECATED: the prompt controller is deprecated and will be removed in a
  #             future release.
  prompt:
    disabled: true
  warp:
    disabled: true

# The repositories allow overriding the default repositories that
# are used to determine the full image names.
#
# When image pull secrets are added, then they are also used by the
# operator to set the proper image pull secrets for deployments,
# statefulsets, ... that use that repository.
repositories:
  aistor:
    hostname: quay.io
    pathPrefix: minio/aistor/
    # imagePullPolicy: IfNotPresent
    # imagePullSecrets:
    # - name: pull-secret1
    # - name: pull-secret2

# Use an extraResources template section to include additional Kubernetes resources
# with the Helm deployment. This lets you ship your own resources (custom resources,
# ConfigMaps, Secrets, RBAC, policies, ...) alongside the operator without forking the
# chart. Each entry is rendered through the same template pipeline used by the
# aistor-objectstore, aistor-aihub, aistor-prompt and minkms charts, so values may
# reference other chart values.
#
# A custom resource can only be listed here once its CRD already exists in the
# cluster. Helm builds every object of a release before it applies any of them,
# so a CRD that ships in this same release is not registered yet and the install
# fails with "no matches for kind". Install the CRD first, for example with the
# chart that owns it, and then add the custom resource here.
#
# Keep this section above the "# AUTOGENERATE" marker below: update-versions.sh
# truncates values.yaml at that marker and regenerates everything after it.
#extraResources:
#  - |
#    apiVersion: v1
#    kind: ConfigMap
#    metadata:
#      name: my-extra-config
#      namespace: {{ include "aistor.namespace" . }}
#    data:
#      key: value

# The images allow overriding the default images that are used to
# determine the full image names. When overriding the images,
# you can specify the full image name (including registry and path)
# or just the image name. When specifying just the image name,
# then the repository settings will be used to determine the full
# image name.
#
# It's not required to override all images if you only need to
# override a few of them. The images that are not overridden will
# use the default images.
#
# If you want to override an image without using the repository settings,
# then you can specify the full image name (including registry and path).
#
# images:
#   minio: private.repo.org/aistor/minio:latest
#
# AUTOGENERATE
images:
  aihub:
    repository: aistor
    image: aihub:RELEASE.2025-12-11T18-08-15Z
  minwall:
    repository: aistor
    image: minwall:RELEASE.2026-05-21T06-25-56Z
  kes:
    repository: aistor
    image: kes:RELEASE.2026-08-24T11-11-49Z
  kes-sidecar:
    repository: aistor
    image: kes-sidecar:RELEASE.2026-07-14T22-03-37Z
  mc:
    repository: aistor
    image: mc:RELEASE.2026-09-06T02-44-40Z
  minio:
    repository: aistor
    image: minio:RELEASE.2026-09-07T08-39-31Z
  minio-sidecar:
    repository: aistor
    image: minio-sidecar:RELEASE.2026-07-14T22-07-12Z
  operator:
    repository: aistor
    image: operator:RELEASE.2026-07-21T22-41-48Z
  prompt:
    repository: aistor
    image: prompt:RELEASE.2025-01-17T21-55-43Z
  warp:
    repository: aistor
    image: warp:v1.7.0