Helm Chart Values Reference

This page is a reference for the configurable Helm values of the GoodData.CN (gooddata-cn) Helm chart.

The values listed below are auto-generated from a specific chart version and are provided for convenience only. To get the authoritative list of values for the exact version you are deploying, run:

helm show values gooddata/gooddata-cn --version <x.y.z>

You can also browse the chart, its dependencies, and its values on ArtifactHub: https://artifacthub.io/packages/helm/gooddata/gooddata-cn.

Looking for the GoodData.CN 4.0 changes?

The one-time migration steps and breaking changes introduced in GoodData.CN 4.0 (etcd configuration updates, the PostgreSQL migration guide, API Gateway authentication changes, and other breaking changes) that used to live on this page have moved to Upgrade to GoodData.CN 4.0.

The chart bundles dependent subcharts (redis-ha and qdrant — see Requirements below). The former postgresql-ha subchart is deprecated and removed, so an external PostgreSQL instance is required. Internal etcd is provided through the useInternalGDEtcd and customEtcd values. See the Upgrade to GoodData.CN 4.0 guide for details.

Requirements

RepositoryNameVersion
file://../gooddata-commongooddata-common0.1.0
https://dandydeveloper.github.io/chartsredis-ha4.39.0
https://qdrant.github.io/qdrant-helmqdrant1.18.2

Values

Keeping This Table Up to Date

This table is maintained manually and may not always reflect the latest chart release. For the authoritative, always-current list of values, run helm show values gooddata/gooddata-cn --version <GOODDATA_CN_RELEASE> against the chart version you are deploying.

Generated from gooddata-cn chart version 4.12.1. Feature flags reflect version 4.13.1.

KeyTypeDefaultDescription
afmExecApi.actuator.portint9001
afmExecApi.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
afmExecApi.gracefulShutdownTimeoutSecondsint180
afmExecApi.image.namestring"afm-exec-api"
afmExecApi.jvmOptionsstring"-XX:ReservedCodeCacheSize=100M -Xms320m -Xmx320m -XX:MaxMetaspaceSize=170M"Custom JVM options
afmExecApi.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":1800},"scaleUp":{"policies":[{"periodSeconds":60,"type":"Pods","value":2}],"stabilizationWindowSeconds":60}},"enabled":null}KEDA autoscaling opt-in. enabled: null inherits the global kedaAutoscaling master switch. Policy (min/max replicas, CPU target, behavior) inherits the global kedaAutoscaling defaults. Override any field here.
afmExecApi.livenessProbe.initialDelaySecondsint30
afmExecApi.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
afmExecApi.podLabelsobject{}
afmExecApi.readinessProbe.initialDelaySecondsint30
afmExecApi.resourcesobject{"limits":{"cpu":"750m","memory":"965Mi"},"requests":{"cpu":"100m","memory":"600Mi"}}container resources
afmExecApi.resultIdHmacobject{"historyLength":10,"rotationPeriod":86400}Configuration related to the result id HMAC signing
afmExecApi.resultIdHmac.historyLengthint10How many HMAC keys are valid at the same time
afmExecApi.resultIdHmac.rotationPeriodint86400Time interval in seconds after which the HMAC key is rotated
afmExecApi.service.externalPortint9000
afmExecApi.service.grpcExternalPortint6571
afmExecApi.service.grpcInternalPortint6571
afmExecApi.service.internalPortint9000
afmExecApi.service.namestring"afm-exec-api"
afmExecApi.service.typestring"ClusterIP"
afmExecApi.startupProbe.initialDelaySecondsint30
agenticWorkflows.customTemplatesobject{"enabled":false,"path":"/app/custom-templates"}Custom Jinja2 templates (prompts) from ConfigMap When enabled, mounts templates from ConfigMap and sets TEMPLATES_DIR Use with Stakater Reloader for auto-reload on ConfigMap changes
agenticWorkflows.extraEnvVarslist[]Additional environment variables
agenticWorkflows.image.namestring"agentic-workflows"
agenticWorkflows.langfuse.secretstringnil
agenticWorkflows.livenessProbeobject{"failureThreshold":5,"httpGet":{"path":"/health","port":9211},"initialDelaySeconds":30,"periodSeconds":10,"timeoutSeconds":5}Liveness probe configuration
agenticWorkflows.logging.formatstring"json"
agenticWorkflows.logging.levelstring"INFO"
agenticWorkflows.readinessProbeobject{"failureThreshold":5,"httpGet":{"path":"/health","port":9211},"initialDelaySeconds":10,"periodSeconds":10,"timeoutSeconds":5}Readiness probe configuration
agenticWorkflows.resources.limits.cpustring"1000m"
agenticWorkflows.resources.limits.memorystring"1024Mi"
agenticWorkflows.resources.requests.cpustring"500m"
agenticWorkflows.resources.requests.memorystring"512Mi"
agenticWorkflows.service.externalPortint9271
agenticWorkflows.service.grpcInternalPortint9271
agenticWorkflows.service.healthPortint9211
agenticWorkflows.service.namestring"agentic-workflows"
agenticWorkflows.service.typestring"ClusterIP"
agenticWorkflows.startupProbeobject{"failureThreshold":12,"httpGet":{"path":"/health","port":9211},"initialDelaySeconds":10,"periodSeconds":10,"timeoutSeconds":5}Startup probe configuration
agenticWorkflows.temporal.clusterNamestring""
agenticWorkflows.temporal.mtlsSecretNamestring"temporal-mtls"
agenticWorkflows.temporal.namespacestring"agentic-workflows"
agenticWorkflows.temporal.taskQueuestring""
agenticWorkflows.temporal.tlsEnabledbooltrue
agenticWorkflowsPilot.customConfigobject{"enabled":false,"knowledgeGraphPath":"","promptsPath":""}Custom configuration When enabled, mounts a ConfigMap with custom prompts and knowledge graph
agenticWorkflowsPilot.extraEnvVarslist[]Additional environment variables
agenticWorkflowsPilot.image.namestring"agentic-workflows-pilot"
agenticWorkflowsPilot.langfuse.enabledstring"no"
agenticWorkflowsPilot.langfuse.secretstringnil
agenticWorkflowsPilot.langfuse.tracingEnvironmentstring"development"
agenticWorkflowsPilot.livenessProbeobject{"failureThreshold":5,"httpGet":{"path":"/health","port":9210},"initialDelaySeconds":30,"periodSeconds":10,"timeoutSeconds":5}Liveness probe configuration
agenticWorkflowsPilot.logging.formatstring"json"
agenticWorkflowsPilot.logging.levelstring"INFO"
agenticWorkflowsPilot.readinessProbeobject{"failureThreshold":5,"httpGet":{"path":"/health","port":9210},"initialDelaySeconds":10,"periodSeconds":10,"timeoutSeconds":5}Readiness probe configuration
agenticWorkflowsPilot.replicaCountint2
agenticWorkflowsPilot.resources.limits.cpustring"1000m"
agenticWorkflowsPilot.resources.limits.memorystring"1024Mi"
agenticWorkflowsPilot.resources.requests.cpustring"500m"
agenticWorkflowsPilot.resources.requests.memorystring"512Mi"
agenticWorkflowsPilot.service.externalPortint9270
agenticWorkflowsPilot.service.grpcInternalPortint9270
agenticWorkflowsPilot.service.healthPortint9210
agenticWorkflowsPilot.service.namestring"agentic-workflows-pilot"
agenticWorkflowsPilot.service.typestring"ClusterIP"
agenticWorkflowsPilot.startupProbeobject{"failureThreshold":12,"httpGet":{"path":"/health","port":9210},"initialDelaySeconds":10,"periodSeconds":10,"timeoutSeconds":5}Startup probe configuration
agenticWorkflowsPilot.temporal.clusterNamestring""
agenticWorkflowsPilot.temporal.mtlsSecretNamestring"temporal-mtls"
agenticWorkflowsPilot.temporal.namespacestring"lynx-agentic"
agenticWorkflowsPilot.temporal.taskQueuestring""
agenticWorkflowsPilot.temporal.tlsEnabledbooltrue
aiLake.database.existingSecretstring""you can specify custom secret with ai-lake database password
aiLake.database.existingSecretKeystring"postgresql-password"you can specify custom secret key to get ai-lake database password from
aiLake.database.namestring"ailake"
aiLake.database.passwordstring""
aiLake.database.userstring""if user is empty, default postgres user and password is used
aiLake.image.namestring"ai-lake"
aiLake.infrastructureobject{"extraConfig":{}}extra TOML config files from Helm (merged after base paths). Keys are filenames, values are TOML strings. When set, a ConfigMap is created and paths are appended to INFRASTRUCTURE_CONFIG_PATHS. Example (e.g. in a release patch): infrastructure.extraConfig: { “override.toml”: “[starrocks_clusters.prod]\n…” }
aiLake.infrastructureConfigPathsstring"/config/infrastructure.toml"comma-separated paths to TOML infrastructure config (mount ConfigMap or use extraConfig)
aiLake.lfUsedstring"true"Whether Lake Formation is used for S3 Tables access control (disables LF grants when false)
aiLake.livenessProbeobject{"failureThreshold":3,"httpGet":{"path":"/health","port":8080},"initialDelaySeconds":30,"periodSeconds":10,"timeoutSeconds":5}Liveness probe configuration
aiLake.logging.formatstring"json"
aiLake.logging.levelstring"INFO"
aiLake.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
aiLake.podLabelsobject{}
aiLake.podMonitor.enabledbooltrue
aiLake.podMonitor.pathstring"/metrics"
aiLake.podMonitor.portstring"metrics"
aiLake.readinessProbeobject{"failureThreshold":3,"httpGet":{"path":"/ready","port":8080},"initialDelaySeconds":10,"periodSeconds":5,"timeoutSeconds":3}Readiness probe configuration
aiLake.replicaCountint2
aiLake.resourcesobject{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"512Mi"}}container resources for the service
aiLake.service.externalPortint6800
aiLake.service.extraEnvVarslist[]Additional environment variables for the service for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
aiLake.service.grpcHoststring"0.0.0.0"
aiLake.service.healthPortint8080
aiLake.service.icebergRestPortint8181Port for the Iceberg REST Catalog proxy; api-gw routes catalog calls here
aiLake.service.internalPortint6800
aiLake.service.metricsPortint9136Port for Prometheus metrics (app-side: tasks received, scheduling success/failure)
aiLake.service.namestring"ai-lake"
aiLake.service.typestring"ClusterIP"
aiLake.startupProbeobject{"failureThreshold":60,"httpGet":{"path":"/health","port":8080},"periodSeconds":10,"timeoutSeconds":5}Startup probe configuration
aiLake.telemetryobject{"metrics":{"path":"/metrics","port":"9136"}}Prometheus metrics (annotation-based scrape and optional PodMonitor)
aiLake.workerobject{"extraEnvVars":[],"maxAsyncTasks":10,"metricsPort":9137,"name":"ai-lake-worker","podDisruptionBudget":{"maxUnavailable":"","minAvailable":""},"podLabels":{},"replicaCount":2,"resources":{"limits":{"cpu":"1000m","memory":"1024Mi"},"requests":{"cpu":"500m","memory":"1024Mi"}},"shutdownTimeout":15,"telemetry":{"metrics":{"path":"/metrics","port":"9137"}}}Override OpenTelemetry exporter type, see .monitoring.tracing.pythonOtelExporterType otelExporterType: “zipkin”
aiLake.worker.extraEnvVarslist[]Additional environment variables for the workers for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
aiLake.worker.maxAsyncTasksint10Maximum number of async tasks running concurrently per worker pod (taskiq –max-async-tasks). Keep low to bound per-pod memory: each provisioning task allocates ~10-15 MiB of clients/pools.
aiLake.worker.metricsPortint9137Port for Prometheus metrics (Taskiq worker: received/success/errors, execution time)
aiLake.worker.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
aiLake.worker.resourcesobject{"limits":{"cpu":"1000m","memory":"1024Mi"},"requests":{"cpu":"500m","memory":"1024Mi"}}container resources for worker
aiLake.worker.shutdownTimeoutint15Number of seconds the worker will wait for the running tasks to finish gracefully when shutting down.
aiLakeWorkerobject{"podMonitor":{"enabled":true,"path":"/metrics","port":"metrics"}}Override OpenTelemetry exporter type, see .monitoring.tracing.pythonOtelExporterType otelExporterType: “zipkin” PodMonitor for ai-lake worker (distinct from main service; uses component aiLakeWorker)
aiMeteringEnforcementstring"LOGGING"AI metering enforcement phase (LOGGING, SOFT, or HARD)
allowUnsafeFlexConnectEndpointsboolfalseIf set to true, FlexConnect data sources can use non-TLS endpoints. Otherwise, only TLS-enabled endpoints may be used.
analyticalDesigner.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
analyticalDesigner.image.namestring"analytical-designer"
analyticalDesigner.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":600,"type":"Percent","value":25}],"stabilizationWindowSeconds":900},"scaleUp":{"stabilizationWindowSeconds":30}},"enabled":null,"targetCPUUtilization":80}KEDA autoscaling opt-in. enabled: null inherits the global kedaAutoscaling master switch. Policy (min/max replicas, CPU target, behavior) inherits the global kedaAutoscaling defaults. Override any field here.
analyticalDesigner.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
analyticalDesigner.podLabelsobject{}
analyticalDesigner.resourcesobject{"limits":{"cpu":"150m","memory":"35Mi"},"requests":{"cpu":"50m","memory":"15Mi"}}container resources
analyticalDesigner.service.externalPortint9300
analyticalDesigner.service.internalPortint9300
analyticalDesigner.service.namestring"analytical-designer"
analyticalDesigner.service.typestring"ClusterIP"
antiAffinity.enabledboolfalseenables antiAffinity for all GoodData.CN Pods
antiAffinity.topologyKeystring"kubernetes.io/hostname"Topology key for antiAffinity
antiAffinity.typestring"preferredDuringSchedulingIgnoredDuringExecution"“requiredDuringSchedulingIgnoredDuringExecution” or “preferredDuringSchedulingIgnoredDuringExecution”
apiDocs.enabledbooltrueCan be optionally disabled by setting enabled: false
apiDocs.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
apiDocs.image.namestring"apidocs"
apiDocs.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
apiDocs.podLabelsobject{}
apiDocs.resourcesobject{"limits":{"cpu":"100m","memory":"35Mi"},"requests":{"cpu":"10m","memory":"15Mi"}}container resources
apiDocs.service.externalPortint9999
apiDocs.service.internalPortint8080
apiDocs.service.namestring"apidocs"
apiDocs.service.typestring"ClusterIP"
apiGatewayobject{"actuator":{"port":9093},"extraEnvVars":[],"image":{"name":"api-gateway"},"jvmOptions":"-XX:ReservedCodeCacheSize=60M -Xms140m -Xmx140m -XX:MaxMetaspaceSize=100M","linkHeaders":{},"livenessProbe":{"initialDelaySeconds":30},"podDisruptionBudget":{"maxUnavailable":"","minAvailable":""},"podLabels":{},"readinessProbe":{"initialDelaySeconds":30},"resources":{"limits":{"cpu":"500m","memory":"540Mi"},"requests":{"cpu":"100m","memory":"300Mi"}},"service":{"externalPort":9092,"internalPort":9092,"name":"api-gateway","type":"ClusterIP"},"startupProbe":{"initialDelaySeconds":30}}Override default gracefulShutdownTimeoutSeconds when needed gracefulShutdownTimeoutSeconds: 60
apiGateway.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
apiGateway.jvmOptionsstring"-XX:ReservedCodeCacheSize=60M -Xms140m -Xmx140m -XX:MaxMetaspaceSize=100M"Custom JVM options
apiGateway.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
apiGateway.resourcesobject{"limits":{"cpu":"500m","memory":"540Mi"},"requests":{"cpu":"100m","memory":"300Mi"}}container resources
apiGw.apiExtensions.allowedHostSuffixes[0]string".svc.cluster.local"
apiGw.apiExtensions.enabledboolfalse
apiGw.apiExtensions.fileslist[]
apiGw.cache.organization.expireAfterWritestring"1m"
apiGw.cache.organization.expireAfterWriteSecondsstringnil
apiGw.cache.organization.jitterstring"10s"
apiGw.cache.organization.sizestring"1000"
apiGw.cache.user.expireAfterWritestring"1m"
apiGw.cache.user.expireAfterWriteSecondsstringnil
apiGw.cache.user.sizestring"100"
apiGw.callForwarder.rawExportTimeouts.requeststring"10m"
apiGw.callForwarder.timeouts.connectstring"1m"
apiGw.callForwarder.timeouts.requeststring"4m"
apiGw.callForwarder.timeouts.socketstring"3m"
apiGw.cloudIdentity.aws.regionstring"us-east-1"
apiGw.cloudIdentity.aws.roleArnstring""
apiGw.cloudIdentity.enabledboolfalse
apiGw.coroutines.debugMetrics.enabledboolfalse
apiGw.database.existingSecretstring""you can specify custom secret with api-gw database password
apiGw.database.existingSecretKeystring"postgresql-password"you can specify custom secret key to get api-gw database password from
apiGw.database.passwordstring""
apiGw.database.pool.initialSizeint1
apiGw.database.pool.maxAcquireTimestring"5s"
apiGw.database.pool.maxLifeTimestring"5m"
apiGw.database.pool.maxSizeint16
apiGw.database.pool.minIdleint4
apiGw.database.userstring""dedicated DB user for api-gw; when empty, falls back to the default Postgres superuser
apiGw.dex.enabledboolfalse
apiGw.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
apiGw.gracefulShutdownTimeoutSecondsint185
apiGw.image.namestring"gateway-api-gw"
apiGw.jvmOptionsstring"-Xms280m -Xmx800m"Custom JVM options These settings must be aligned with resource.limits.memory value
apiGw.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":1800},"scaleUp":{"policies":[{"periodSeconds":60,"type":"Pods","value":2}],"stabilizationWindowSeconds":60}},"enabled":null,"targetCPUUtilization":75}KEDA autoscaling opt-in. enabled: null inherits the global kedaAutoscaling master switch. Policy (min/max replicas, CPU target, behavior) inherits the global kedaAutoscaling defaults. Override any field here.
apiGw.livenessProbe.initialDelaySecondsint30
apiGw.locationService.custom.styleslist[]
apiGw.locationService.mapbox.existingSecretstring""name of a pre-existing Secret containing the Mapbox token; when set, no Secret is created by the chart
apiGw.locationService.mapbox.existingSecretKeystring"token"key inside the Secret that holds the token value
apiGw.locationService.mapbox.tokenstring""
apiGw.locationService.pluginstring"AwsLocation"
apiGw.oauth.provider.auth0.customDomainstring""
apiGw.oauth.refresh.leaseTtlstring"15s"
apiGw.oauth.refresh.maxRetriesint15
apiGw.oauth.refresh.retryDelaystring"500ms"
apiGw.oauth.timeouts.connectstring"2s"
apiGw.oauth.timeouts.requeststring"5s"
apiGw.oauth.timeouts.socketstring"5s"
apiGw.organizationResolver.maxAttemptsint5
apiGw.organizationResolver.retryDelaystring"100ms"
apiGw.organizationResolver.retryDelayMsstringnil
apiGw.otelMetricsCardinalityLimitint10000OTel metrics cardinality limit per instrument (default SDK value is 2000). Increase when otel_metric_overflow=true is observed in metrics. https://opentelemetry.io/docs/languages/dotnet/metrics/best-practices/#cardinality-limits
apiGw.outboundHttp.proxy.enabledboolfalse
apiGw.outboundHttp.proxy.hoststring""
apiGw.outboundHttp.proxy.nonProxyHosts[0]string"localhost"
apiGw.outboundHttp.proxy.nonProxyHosts[1]string"127.0.0.1"
apiGw.outboundHttp.proxy.portint0
apiGw.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
apiGw.podLabelsobject{}
apiGw.podMonitor.pathstring"/metrics"
apiGw.podMonitor.portstring"metrics"
apiGw.rateLimiter.enabledbooltrue
apiGw.rateLimiter.filesstringnil
apiGw.readinessProbe.initialDelaySecondsint30
apiGw.resourcesobject{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"280m","memory":"400Mi"}}container resources
apiGw.service.externalPortint9201
apiGw.service.healthPortint9203
apiGw.service.internalPortint9201
apiGw.service.metricsPortint9202
apiGw.service.namestring"api-gw"
apiGw.service.typestring"ClusterIP"
apiGw.session.secretGracePeriodstring"30s"
apiGw.startupProbe.initialDelaySecondsint30
authService.actuator.portint9051
authService.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
authService.image.namestring"auth-service"
authService.jvmOptionsstring"-XX:ReservedCodeCacheSize=100M -Xms190m -Xmx190m -XX:MaxMetaspaceSize=150M"Custom JVM options
authService.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":1800},"scaleUp":{"policies":[{"periodSeconds":60,"type":"Pods","value":2}],"stabilizationWindowSeconds":60}},"enabled":null,"targetCPUUtilization":75}KEDA autoscaling opt-in. enabled: null inherits the global kedaAutoscaling master switch; policy/minReplicaCount resolve as documented in the global block. NOTE: confirm OIDC sessions are Redis/DB-backed (not pod-local) before relying on scale-down, or sessions may drop.
authService.livenessProbe.initialDelaySecondsint30
authService.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
authService.podLabelsobject{}
authService.pulsar.inviteGenerator.enabledboolfalse
authService.pulsar.inviteGenerator.messageTTLint300
authService.pulsar.inviteGenerator.topicstring"invitations"
authService.readinessProbe.initialDelaySecondsint30
authService.resourcesobject{"limits":{"cpu":"500m","memory":"750Mi"},"requests":{"cpu":"100m","memory":"400Mi"}}container resources
authService.service.externalPortint9050
authService.service.grpcExternalPortint6573
authService.service.grpcInternalPortint6573
authService.service.internalPortint9050
authService.service.namestring"auth-service"
authService.service.typestring"ClusterIP"
authService.startupProbe.initialDelaySecondsint30
automation.actuator.portint9098
automation.database.existingSecretstring""you can specify custom secret with automation database password
automation.database.existingSecretKeystring"postgresql-password"you can specify custom secret key to get automation database password from
automation.database.namestring"automation"
automation.database.passwordstring""
automation.database.userstring""if user is empty, default postgres user and password is used
automation.enableHikariMonitoringbooltrueWhether to enable HikariCP monitoring: true | false
automation.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
automation.image.namestring"automation"
automation.jvmOptionsstring"-XX:ReservedCodeCacheSize=60M -Xms200m -Xmx700m -XX:MaxMetaspaceSize=210M"Custom JVM options
automation.livenessProbe.initialDelaySecondsint30
automation.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
automation.podLabelsobject{}
automation.pulsar.exportRawScheduled.messageTTLint300
automation.pulsar.exportRawScheduled.topicstring"export-raw-scheduled.request"
automation.pulsar.exportSlideshowScheduled.messageTTLint300
automation.pulsar.exportSlideshowScheduled.topicstring"export-slideshow-scheduled.request"
automation.pulsar.exportTabularScheduled.messageTTLint300
automation.pulsar.exportTabularScheduled.topicstring"export-tabular-scheduled.request"
automation.pulsar.exportVisualScheduled.messageTTLint300
automation.pulsar.exportVisualScheduled.topicstring"export-visual-scheduled.request"
automation.pulsar.metadataBackSync.messageTTLint300
automation.pulsar.metadataBackSync.topicstring"metadata.back-sync"
automation.pulsar.metadataResync.topicstring"metadata.resync.v2"
automation.pulsar.metadataResyncRequest.topicstring"metadata.resync-request"
automation.pulsar.metadataSync.deadLetter.topicstring"metadata.sync.DLQ"
automation.pulsar.metadataSync.topicstring"metadata.sync"
automation.readinessProbe.initialDelaySecondsint30
automation.reportMetadataVersion.dataVersionint1
automation.reportMetadataVersion.enabledbooltruePost-startup version-announce trigger. On by default now that V2 is the reconciliation mechanism; bump dataVersion on a schema/sync-logic change to force a one-time full resync.
automation.resourcesobject{"limits":{"cpu":"500m","memory":"1200Mi"},"requests":{"cpu":"100m","memory":"450Mi"}}container resources
automation.scheduleobject{"automationResultCleanup":{"cron":"0 0 0 * * ?","retention":"15d"},"notificationsCleanup":{"cron":"0 0 0 * * ?","retention":"30d"}}Override default gracefulShutdownTimeoutSeconds when needed gracefulShutdownTimeoutSeconds: 60
automation.schedule.automationResultCleanup.cronstring"0 0 0 * * ?"Cron expression for the scheduled job
automation.schedule.automationResultCleanup.retentionstring"15d"Retention period for notifications
automation.schedule.notificationsCleanup.cronstring"0 0 0 * * ?"Cron expression for the scheduled job
automation.schedule.notificationsCleanup.retentionstring"30d"Retention period for notifications
automation.service.externalPortint9097
automation.service.internalPortint9097
automation.service.namestring"automation"
automation.service.typestring"ClusterIP"
automation.smtp.existingSecretstring""use existing Secret with keys “smtp_host”, “smtp_username”, and “smtp_password”
automation.smtp.hoststring""SMTP host
automation.smtp.passwordstring""password for SMTP authentication
automation.smtp.usernamestring""username for SMTP authentication
automation.startupProbe.initialDelaySecondsint30
calcique.actuator.portint9012
calcique.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
calcique.image.namestring"calcique"
calcique.jvmOptionsstring"-XX:ReservedCodeCacheSize=110M -Xms380m -Xmx380m -XX:MaxMetaspaceSize=170M"Custom JVM options
calcique.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":1800},"scaleUp":{"policies":[{"periodSeconds":60,"type":"Pods","value":2}],"stabilizationWindowSeconds":60}},"enabled":null}KEDA autoscaling opt-in. enabled: null inherits the global kedaAutoscaling master switch. Policy (min/max replicas, CPU target, behavior) inherits the global kedaAutoscaling defaults. Override any field here.
calcique.livenessProbe.initialDelaySecondsint30
calcique.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
calcique.podLabelsobject{}
calcique.pulsar.dataSourceChange.deadLetter.topicstring"data-source.change.calcique.DLQ"
calcique.pulsar.dataSourceChange.topicstring"data-source.change"
calcique.pulsar.modelUpdate.deadLetter.topicstring"metadata.model.calcique.DLQ"
calcique.pulsar.modelUpdate.topicstring"metadata.model"
calcique.pulsar.sqlExecutor.messageTTLint300
calcique.pulsar.sqlExecutor.topicstring"sql.select"
calcique.pulsar.workspaceChange.deadLetter.topicstring"workspace.change.calcique.DLQ"
calcique.pulsar.workspaceChange.topicstring"workspace.change"
calcique.readinessProbe.initialDelaySecondsint30
calcique.resourcesobject{"limits":{"cpu":"500m","memory":"1024Mi"},"requests":{"cpu":"150m","memory":"500Mi"}}container resources
calcique.service.externalPortint9011
calcique.service.grpcExternalPortint6577
calcique.service.grpcInternalPortint6577
calcique.service.internalPortint9011
calcique.service.namestring"calcique"
calcique.service.typestring"ClusterIP"
calcique.startupProbe.initialDelaySecondsint30
cdnobject{"url":""}Optional URL prefix for CDN assets
chartTests.hookDeletePolicystring"before-hook-creation,hook-succeeded"Value for annotation ‘helm.sh/hook-delete-policy’ used on test objects except NetworkPolicies. NetworkPolicy objects are deleted after successful tests for security reasons. They use a hook-succeeded, before-hook-creation policy. (‘hook-failed’ not used due to https://github.com/helm/helm/issues/10279) NetworkPolicies aren’t deleted after failed tests. You should remove them manually.
chartTests.resourcesobject{"limits":{"cpu":"250m","memory":"200Mi"},"requests":{"cpu":"10m","memory":"5Mi"}}container resources
chartTests.testDirstring"/tests"Directory where a configmap containing test scripts will be mounted
clusterDomainstring"cluster.local"Domain name of the cluster. If you change this from the “cluster.local” default, make sure to also set etcd.clusterDomain to the same value.
commonEnvlist[]
cookiePolicystring"Lax"Defines value for SameSite attribute of authentication cookies. Allowed values are ‘Strict’, ‘Lax’ and ‘None’ When set to ‘None’, GoodData.UI applications can run on different domains.
customEtcd.antiAffinityobject{"enabled":true,"topologyKey":"kubernetes.io/hostname","type":"requiredDuringSchedulingIgnoredDuringExecution"}Pod anti-affinity ensures etcd pods are spread across different nodes
customEtcd.antiAffinity.enabledbooltrueEnable anti-affinity scheduling
customEtcd.antiAffinity.topologyKeystring"kubernetes.io/hostname"Topology key for anti-affinity
customEtcd.antiAffinity.typestring"requiredDuringSchedulingIgnoredDuringExecution"Type: requiredDuringSchedulingIgnoredDuringExecution or preferredDuringSchedulingIgnoredDuringExecution
customEtcd.autoCompactionobject{"mode":"periodic","retention":"5m"}Auto compaction configuration
customEtcd.autoCompaction.modestring"periodic"Compaction mode: periodic or revision
customEtcd.autoCompaction.retentionstring"5m"Compaction retention period
customEtcd.containerSecurityContext.readOnlyRootFilesystembooltrue
customEtcd.containerSecurityContext.runAsGroupint1001
customEtcd.containerSecurityContext.runAsNonRootbooltrue
customEtcd.containerSecurityContext.runAsUserint1001
customEtcd.defragobject{"activeDeadlineSeconds":1200,"commandTimeout":"20s","defragTimeout":"60s","enabled":true,"pauseDuration":"1m","resources":{"limits":{"cpu":"50m","memory":"50Mi"}},"schedule":"15 3 * * *"}Defragmentation CronJob configuration
customEtcd.defrag.activeDeadlineSecondsint1200Job-level deadline in seconds. With concurrencyPolicy Forbid, a hung job would otherwise block all subsequent scheduled runs.
customEtcd.defrag.commandTimeoutstring"20s"etcdctl command timeout
customEtcd.defrag.defragTimeoutstring"60s"Timeout for the defrag command itself; defragmentation of a grown database takes much longer than regular etcdctl operations
customEtcd.defrag.enabledbooltrueEnable defragmentation CronJob
customEtcd.defrag.pauseDurationstring"1m"Pause duration between defrag operations on different members
customEtcd.defrag.resourcesobject{"limits":{"cpu":"50m","memory":"50Mi"}}Resources for defrag job container
customEtcd.defrag.schedulestring"15 3 * * *"Cron schedule for defragmentation (default: 3:15 AM daily)
customEtcd.enabledbooltrueEnable the custom etcd StatefulSet deployment
customEtcd.image.namestring"etcd"etcd image name (uses repositoryPrefix from global/cascade settings)
customEtcd.livenessProbeobject{"failureThreshold":5,"initialDelaySeconds":30,"path":"/livez","periodSeconds":30,"port":8080,"successThreshold":1,"timeoutSeconds":5}Liveness probe configuration
customEtcd.persistenceobject{"size":"8Gi","storageClassName":""}Persistence configuration for etcd data
customEtcd.persistence.sizestring"8Gi"Storage size for etcd data PVC
customEtcd.persistence.storageClassNamestring""Storage class (empty uses cluster default)
customEtcd.podAnnotationsobject{}Pod annotations
customEtcd.podDisruptionBudgetobject{"maxUnavailable":1,"minAvailable":""}define PodDisruptionBudget. Enabled by default so that node drains (e.g. during cluster upgrades) can never evict two etcd members at once, which would break quorum.
customEtcd.podLabelsobject{}Pod labels
customEtcd.podMonitorobject{"enabled":true,"interval":"20s","path":"/metrics","port":"etcd-metrics","scrapeTimeout":"10s"}PodMonitor configuration for Prometheus Operator
customEtcd.podMonitor.enabledbooltrueEnable PodMonitor creation
customEtcd.podMonitor.intervalstring"20s"Scrape interval
customEtcd.podMonitor.pathstring"/metrics"Metrics path
customEtcd.podMonitor.portstring"etcd-metrics"Port name for metrics
customEtcd.podMonitor.scrapeTimeoutstring"10s"Scrape timeout
customEtcd.podSecurityContext.fsGroupint1001
customEtcd.podSecurityContext.fsGroupChangePolicystring"Always"
customEtcd.readinessProbeobject{"failureThreshold":5,"initialDelaySeconds":30,"path":"/readyz","periodSeconds":10,"port":8080,"successThreshold":1,"timeoutSeconds":5}Readiness probe configuration
customEtcd.replicaCountint3Number of etcd replicas (should be an odd number for quorum)
customEtcd.resourcesobject{"limits":{"cpu":"400m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"768Mi"}}Resources for etcd container
customEtcd.service.clientPortint2379Client port for etcd connections
customEtcd.service.metricsPortint8080Metrics port for Prometheus scraping
customEtcd.service.peerPortint2380Peer port for etcd cluster communication
customEtcd.snapshotCountint5000Snapshot count for compaction trigger
dashboards.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
dashboards.image.namestring"dashboards"
dashboards.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":600,"type":"Percent","value":25}],"stabilizationWindowSeconds":900},"scaleUp":{"stabilizationWindowSeconds":30}},"enabled":null,"targetCPUUtilization":80}KEDA autoscaling opt-in. enabled: null inherits the global kedaAutoscaling master switch. Policy (min/max replicas, CPU target, behavior) inherits the global kedaAutoscaling defaults. Override any field here.
dashboards.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
dashboards.podLabelsobject{}
dashboards.resourcesobject{"limits":{"cpu":"150m","memory":"35Mi"},"requests":{"cpu":"50m","memory":"15Mi"}}container resources
dashboards.service.externalPortint9500
dashboards.service.internalPortint9500
dashboards.service.namestring"dashboards"
dashboards.service.typestring"ClusterIP"
deployAILakeboolfalseIf set to true, this chart will install the AI Lake service, including its Iceberg REST Catalog proxy (the proxy server in ai-lake and its catalog route in afm-exec-api)
deployAgenticWorkflowsboolfalseIf set to true, this chart will install the Agentic Workflows microservice
deployAgenticWorkflowsPilotboolfalseIf set to true, this chart will install the Agentic Workflows pilot (legacy Temporal workers)
deployDedicatedPolicyNodesboolfalseIf set to true, Quiver will be deployed so that cache nodes and policy-handling nodes will be separated. Otherwise, both caching and policies will be handled by the same nodes. Enabling this can be useful on busy deployments with a lot of flights coming in: the policy tracking can get CPU-intensive and when performed on the cache nodes, can lead to them having latency spikes.
deployDexIdPbooltrueIf set to true, Dex Identity Provider will be installed and configured according to values in “dex:” key below. Follow the guidelines in https://artifacthub.io/packages/helm/dex/dex how to customize settings. Disabling this component will require every Organization to use an external Identity Provider.
deployExportBuilderbooltrueIf set to true, this chart will install export-builder service used for slides exports
deployGenAIMetadataSyncboolfalse
deployGenAIServiceboolfalseIf set to true, this chart will install gen-ai service
deployMCPServerbooltrueIf set to true, this chart will install the MCP server component
deployQdrantboolfalseIf set to true, this chart will install Qdrant vector database
deployQuiverDatasourceboolfalseIf set to true, additional FlexQuery nodes will be deployed and used to provide additional datasource capabilities.
deployQuiverDatasourceFsboolfalseIf set to true, FlexQuery nodes will be deployed with additional FS-based datasource capabilities. Implies deployQuiverDatasource: true.
deployQuiverGeoCollectionsboolfalseIf set to true, FlexQuery nodes will be deployed with additional FS-based datasource capabilities. Implies deployQuiverDatasource: true.
deployRedisHAbooltrueIf set to true, this chart will install stable/redis-ha as a part of the deployment. If false, your existing Redis-compatible server must be configured in section service.redis below.
deploySpiceDBboolfalseDeploy SpiceDB as plain chart resources. See the spicedb: section for datastore credential options.
deployUIbooltrueIf set to true, this chart will deploy all UI services (analytical-designer, dashboards, host-application, home-ui, web-components). If false, UI services will not be deployed.
deploymentInfo.clusterNamestring""Deployment cluster name
deploymentInfo.regionstring""Deployment region.
dex.config.database.existingSecretstring""you can specify custom secret with dex database password; the key needs to be “postgresql-password”
dex.config.database.namestring"dex"
dex.config.database.passwordstring""
dex.config.database.sslModestring"disable"possible values: disable, require, verify-ca, verify-full
dex.config.database.userstring""if user is empty, default postgres user and password is used
dex.config.enablePasswordDBbooltrueMap containing set of configured connectors. The key is the id of a connector, value is a map of connector’s parameters (excluding id and redirectURI that are added by template automatically).
dex.config.expiry.deviceRequestsstring"24h"
dex.config.expiry.idTokensstring"24h"
dex.config.expiry.signingKeysstring"48h"
dex.config.frontend.dirstring"web/"
dex.config.frontend.issuerstring"GoodData.CN"
dex.config.frontend.logoUrlstring"theme/logo.svg"
dex.config.frontend.themestring"gdc"
dex.config.grpc.addressstring"0.0.0.0"
dex.config.logger.formatstring"json"
dex.config.logger.levelstring"info"
dex.config.oauth2.alwaysShowLoginScreenboolfalse
dex.config.oauth2.responseTypes[0]string"code"
dex.config.oauth2.responseTypes[1]string"token"
dex.config.oauth2.responseTypes[2]string"id_token"
dex.config.oauth2.skipApprovalScreenbooltrue
dex.config.web.addressstring"0.0.0.0"
dex.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
dex.image.namestring"dex"set to repository in local registry for air-gapped installations
dex.ingress.annotationsobject{}Custom annotations that will be added to every Ingress object created by this chart, e.g. cert-manager.io/cluster-issuer: letsencrypt-auth-production or using namespace-specific Issuer: cert-manager.io/issuer: local-ca-issuer
dex.ingress.authHoststring"localhost"hostname where the application will have its authentication Endpoint (Dex). It will be used for organizations without their own external Identity Provider.
dex.ingress.tls.authSecretNamestring""If you have pre-existing secret with your own certificate and key, put its name here. Also, if you want cert-manager, set to some Secret name where TLS certificate and key will be stored. Note that dex.ingress.authHost is required when enabling TLS. If you’re deploying to AWS, you may prefer TLS termination on AWS ELB and keep this value empty.
dex.podAnnotationsobject{}
dex.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
dex.podLabelsobject{}
dex.ports.grpc.containerPortint5000
dex.ports.grpc.servicePortint5000
dex.ports.metrics.containerPortint5558
dex.ports.metrics.servicePortint37000
dex.ports.web.containerPortint5556
dex.ports.web.servicePortint32000
dex.resourcesobject{"limits":{"cpu":"100m","memory":"50Mi"},"requests":{"cpu":"30m","memory":"50Mi"}}container resources
dex.service.namestring"dex"
dex.service.typestring"ClusterIP"
dex.serviceMonitor.additionalLabelsobject{}
dex.serviceMonitor.enabledboolfalse
dex.serviceMonitor.intervalstring"20s"
dex.serviceMonitor.scrapeTimeoutstring"10s"
dex.uriPrefixstring"/dex"base context path prefix used by Dex to serve its resources
enableA2AServerboolfalseIf set to true, A2A server routing (/api/v1/ai/workspaces/*/a2a) is enabled; when false, requests get 404
enableAIDataSettingbooltrueIf set to true, AI data setting feature will be enabled
enableAIKnowledgebooltrueIf set to true, AI knowledge document APIs and skill will be enabled
enableAfmLongPollbooltrueIf set to true, afm-exec-api uses server-side long-poll instead of tight polling for execution results
enableAiAgenticConversationsbooltrueIf set to true, the new HTTP agentic conversation chatbot will be enabled
enableAiAgenticMultiConversationsbooltrueIf set to true, the agentic chatbot supports multiple conversations (history + new conversation); surfaced to the FE only
enableAiAssistantEmbeddingbooltrueIf set to true, AI Assistant can be embedded in iframes
enableAiContextSetupboolfalseIf set to true, users can edit or attach the AI assistant context (dashboards, widgets)
enableAiHubbooltrueIf set to true, AI Hub agent resolution will be used to select the agent for conversations
enableAiLlmAnthropicProviderbooltrueIf set to true, the Anthropic LLM provider can be configured for AI features
enableAnalyticalCatalogbooltrueIf set to true, analytical catalog will be enabled
enableAnomalyDetectionAlertbooltrueIf set to true, anomaly detection alert will be enabled
enableAnomalyDetectionVisualizationbooltrueIf set to true, anomaly detection visualization will be enabled
enableArbitraryFilterADbooltrue
enableArbitraryFilterKDbooltrue
enableAutomationExportRetriesboolfalseIf set to true, the automation service will retry failing exports.
enableAutomationRunPersistenceboolfalseIf set to true, enable logging AutomationRun data to DB
enableCacheRetentionPolicyboolfalseIf set to true, users with DS MANAGE can set cache retention policies on their data sources. This feature is still under development.
enableCatalogSmartSearchResultsbooltrueIf set to true, catalog smart search results will be enabled
enableCertificationboolfalseIf set to true, the certification feature is enabled for metrics, visualizations and dashboards
enableChangeAnalysisboolfalseIf set to true, Change Analysis will be enabled
enableColumnLevelPermissionsboolfalse
enableComputedAttributesboolfalseIf set to true, reports may slice by computed attributes ({computed_attribute/…} in MAQL)
enableCustomFiscalCalendarsboolfalseIf set to true, custom fiscal calendars can be stored in the logical data model
enableCustomGeoCollectionbooltrueIf set to true, custom geo collections are enabled
enableDashboardFilterGroupsbooltrue
enableDashboardShareDialogLinkboolfalseIf set to true, the share dashboard dialog share link will be enabled
enableDashboardTabularExportbooltrueIf set to true, enables the dashboard tabular export feature
enableDataLocalizationbooltrueIf set to true, visualization data localization is enabled, i.e., transactions for secondary labels can be defined
enableDataSourceRoutingbooltrueIf set to true, alternative data source can be defined for data source. If the report can not be computed in primary data source, system attempts to route report computation to alternative data source.
enableDefaultSmtpboolfalseIf set to true, DEFAULT_SMTP notification channels will be enabled Disabled by default, because sender email and name is currently unchangeable.
enableDenodoDataSourceboolfalseIf set to true, Denodo data source will be enabled
enableDeploymentInfoboolfalseIf set to true, then the current deployment cluster_name and region will be included in organization (metadata-api, readonly). Requires the actual values to be injected to env properties by Kubernetes
enableExecutionCancellingbooltrueIf set to true, the frontend will interrupt execution requests that are no longer needed.
enableExtendedFilteringboolfalseIf set to true, the extended filtering is enabled
enableFiscalCalendarsbooltrueIf set to true, fiscal calendar granularities will be available
enableFlexConnectDataSourceboolfalseIf set to true, the FlexConnect data source will be enabled.
enableFlexibleDashboardLayoutbooltrueIf set to true, the frontend dashboard app will use the new layout engine.
enableGenAICatalogQualityCheckerbooltrueIf set to true, GenAI catalog quality checker will be enabled
enableGenAIChatbooltrueIf set to true, GenAI chat will be enabled
enableGenAIMemorybooltrueIf set to true, GenAI memory will be enabled
enableGenAIPromptRedesignboolfalseIf set to true, GenAI prompt redesign will be enabled
enableGenAIReasoningVisibilityboolfalseIf set to true, GenAI reasoning visibility will be enabled
enableGenAiAgentSwitchingbooltrueIf set to true, agent switcher will be enabled
enableGenAiAgenticbooltrueIf set to true, GenAI agentic mode will be enabled
enableGenAiAiModuleGatingboolfalseIf set to true, AI module entitlement gating will be enabled
enableGenAiAlertSkillbooltrueIf set to true, GenAI alert skill will be enabled
enableGenAiAlertsbooltrueIf set to true, GenAI alerts feature will be enabled
enableGenAiAnomalySkillbooltrueIf set to true, GenAI anomaly detection skill will be enabled
enableGenAiAttributeValuesbooltrueIf set to true, GenAI assistant will try to search for attribute values
enableGenAiClusteringSkillbooltrueIf set to true, GenAI clustering skill will be enabled
enableGenAiDashboardBuilderSkillboolfalseIf set to true, GenAI dashboard builder skill will be enabled
enableGenAiDashboardSummarySkillbooltrueIf set to true, GenAI dashboard summary skill will be enabled
enableGenAiForecastingSkillbooltrueIf set to true, GenAI forecasting skill will be enabled
enableGenAiHeadlessSummarybooltrueIf set to true, GenAI headless summary skill will be enabled
enableGenAiInteractionIntelligenceboolfalseIf set to true, AI Interaction Intelligence trace (Explain) is enabled
enableGenAiKdaSkillboolfalseIf set to true, GenAI key driver analysis skill will be enabled
enableGenAiMemoryAgentboolfalseIf set to true, GenAI memory agent (propose memory on negative feedback) will be enabled
enableGenAiMetricSkillboolfalseIf set to true, GenAI metric creation skill will be enabled
enableGenAiObservabilitybooltrueIf set to true, AI usage metrics are shown on the AI Hub homepage
enableGenAiRankingFilterbooltrueIf set to true, GenAI ranking filter feature will be enabled
enableGenAiReasoningEffortboolfalseIf set to true, chat requests may set a per-message reasoning effort
enableGenAiTraceRedactionboolfalseIf set to true, AI observability traces omit prompt and response content when enableAiOnData is on
enableGenAiVisualizationSkillbooltrueIf set to true, GenAI visualization skill will be enabled
enableGenAiVisualizationSummarySkillbooltrueIf set to true, GenAI visualization summary skill will be enabled
enableGenAiWhatifSkillboolfalseIf set to true, GenAI what-if analysis skill will be enabled
enableGeoAreabooltrueIf set to true, geo area charts are enabled
enableGeoBasemapConfigbooltrueIf set to true, geo basemap config is enabled
enableGeoPushpinIconbooltrueIf set to true, geo pushpin icon is enabled
enableGeoSatelliteBasemapOptionbooltrueIf set to true, satellite basemap option is enabled
enableHLLboolfalse
enableImprovedAdFiltersbooltrue
enableImprovedHttpStatusesboolfalseIf set to true, improved HTTP status codes will be returned for conflict scenarios (e.g., 409 instead of 400)
enableImprovedRankingFilterbooltrueIf set to true, enables the improved ranking filter behavior
enableInsideJoinFiltersboolfalseIf set to true, the addition filters inside join is enabled
enableInternalApiTokensboolfalseIf set to true, short-lived internal API tokens used by scheduled exports are minted and validated at the gateway rather than through metadata-api.
enableLowerFilterGranularitybooltrueIf set to true, filter date granularity can be lowered, i.e. from day to month or year, if it does not change the result
enableMariaDbDataSourcebooltrueIf set to true, MariaDB data source will be enabled
enableMatchFilterADbooltrue
enableMatchFilterKDbooltrue
enableMcpGeneratedToolsboolfalseIf set to true, the MCP server reveals the auto-generated v1 OpenAPI tools (read + allowlisted create) to the org. Single control for the feature (ADR-26-10); the surface is always built but inert until this flag is on.
enableMcpToolSearchboolfalseIf set to true, the MCP server exposes tools via on-demand search (search_tools/call_tool) instead of listing every tool up front
enableMeasureValueFilterKDbooltrue
enableMetricFormatOverridesboolfalseIf set to true, the metric format overrides feature is enabled
enableMetricPermissionsboolfalse
enableMetriclessViaBothWitnessesboolfalseIf set to true, the metricless reports are constructed via both witnesses
enableMetriclessViaNumericbooltrueIf set to true, the metricless via numeric optimization is enabled
enableModernQuiverRoutingboolfalseIf set to true, Quiver will use a more modern routing setup that is also compatible with service meshes like Istio.
enableModularizedDashboardsForExportboolfalseIf set to true, dashboard exports render through the modularized dashboards of the shell application. Gates the export path separately from enableShellApplication_dashboards, which must be enabled as well.
enableMongoDbDataSourcebooltrueIf set to true, MongoDB data source will be enabled
enableMotherDuckDataSourcebooltrueIf set to true, MotherDuck data source will be enabled
enableMultiDatasetDateEnumerationboolfalseIf set to true, enumeration of a date dimension present in multiple datasets unions all backing tables
enableMultilingualAIAssistantboolfalseIf set to true, GenAI chat will answer in same language as the question
enableMySqlDataSourcebooltrueIf set to true, MySQL data source will be enabled
enableNestedFilterFactoringboolfalseIf set to true, a filter condition nested in a composite condition (e.g. a date range) can also be factored out of an OR into the WHERE
enableNewGeoPushpinbooltrueIf set to true, new geo pushpin charts are enabled
enableNewPivotTablebooltrueIf set to true, the new pivot table will be used (requires AG_GRID_TOKEN setting, else it will have a watermark)
enableNullableJoinsbooltrueIf set to true, the null joins comparison is enabled
enableOidcAuthbooltrueIf set to true, enables OIDC authentication
enableOracleDataSourcebooltrueIf set to true, Oracle data source will be enabled
enableOrgLevelAIMemorybooltrueIf set to true, org-level GenAI memory (CRUD + inheritance into chat) will be enabled
enableParametersbooltrueIf set to true, the parameters feature (parameter entities and parametrized executions) is enabled
enablePartialDataResultsboolfalseIf set to true, partial data result feature will be enabled by default on given deployment
enablePdmRemovalbooltrueIf set to true, PDM removal is enabled and metadata are migrated
enablePinotDataSourcebooltrueIf set to true, Pinot data source will be enabled
enablePopWeekSlicingValidationboolfalsePoP executions sliced by week are rejected when the period is shifted by month or quarter
enablePreAggregationDatasetsbooltrueIf set to true, the pre-aggregation datasets feature is enabled
enableRankingStrictLimitbooltrueIf set to true, ranking filters enforce a strict limit
enableRankingWithMvfboolfalseIf set to true, new afm requests accept both ranking and mvf in a single request
enableRawExportAwaitCompletionboolfalseIf set to true, a chunked raw export is only offered for download once the whole result has been written, instead of as soon as its first chunk is ready. Losing that head start is what makes a failure reportable: the outcome is known before any response is committed, so a failed export answers with an error status instead of a 200 carrying a partial file. It also lets the download declare Content-Length. Note that gdc.raw-exports-chunked-status-timeout-ms then has to cover the whole write rather than just the first chunk.
enableRawExportsbooltrueIf set to true, enables the Quiver Raw Exports data source Implies deployQuiverDatasource: true.
enableScanTypeByDatabaseTypebooltrueIf set to true, Databricks scan recognizes TIMESTAMP as GD TIMESTAMP_TZ
enableScheduledExportSkillboolfalseIf set to true, scheduled export skill will be enabled in AI assistant
enableSecondGranularitiesboolfalseIf set to true, second-level date granularities (second, secondOfMinute, secondOfDay, minuteOfDay) are available
enableSemanticSearchboolfalseIf set to true, semantic search will be enabled
enableSemanticSearchInChatbooltrueIf set to true, semantic search in chat will be enabled
enableSharedCacheCommonWhereboolfalseIf set to true, a filter condition common to all metrics of a shared cache is generated once in the shared scan WHERE instead of being repeated in every per-metric CASE
enableShellApplicationbooltrueIf set to true, the host application is enabled (currently it affects which Home UI app instance is used)
enableShellApplication_analyticalDesignerboolfalseIf set to true, the analytical designer is enabled in the shell application
enableShellApplication_catalogbooltrueIf set to true, the catalog is enabled in the shell application
enableShellApplication_dashboardsboolfalseIf set to true, the dashboards are enabled in the shell application
enableSingleStoreDataSourcebooltrueIf set to true, SingleStore data source will be enabled
enableSpiceDBLiveboolfalse
enableStarrocksDataSourcebooltrueIf set to true, Starrocks data source will be enabled
enableStreamingXlsxExportboolfalseIf set to true, XLSX exports use the row-major streaming (constant_memory) writer instead of the legacy column-major writer
enableSystemAccountFilteringbooltrueIf set to true, user systemAccount filtering is enabled
enableUdfCountContextbooltrueIf set to true, the UDF count context feature is enabled
enableUseDateFiltersboolfalseIf set to true, filters will use DATE instead of TIMESTAMP on date columns
enableWorkspaceCacheInvalidationbooltrueIf set to true, clients can invalidate workspace-level caches using the actions API uploadNotification
enableWorkspacesHierarchyViewbooltrueIf set to true, the workspaces hierarchy view feature will be enabled
exportBuilderobject{"actuator":{"port":9129},"enableHikariMonitoring":true,"export":{"slides":{"evaluateTimeout":"180s","navigateTimeout":"20s","screenshotsMaxSize":"40MB"},"visual":{"evaluateTimeout":"180s","navigateTimeout":"20s"}},"extraEnvVars":[],"gracefulShutdownTimeoutSeconds":185,"grpcServerMaxConnectionAge":10,"image":{"name":"export-builder"},"jvmOptions":"-XX:ReservedCodeCacheSize=60M -Xms200m -Xmx1000m -XX:MaxMetaspaceSize=210M","kedaAutoscaling":{"behavior":{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":300},"scaleUp":{"policies":[{"periodSeconds":90,"type":"Percent","value":100}],"selectPolicy":"Max","stabilizationWindowSeconds":0}},"enabled":false,"maxReplicaCount":5,"minReplicaCount":2,"query":"","threshold":"0.5"},"livenessProbe":{"initialDelaySeconds":30},"playwright":{"browser":{"type":"cdp"},"concurrency":{"maxInstances":4},"proxy":{"enabled":true},"tracing":{"enabled":false,"outputDir":"/tmp/playwright-tracing"}},"podDisruptionBudget":{"maxUnavailable":"","minAvailable":""},"podLabels":{},"readinessProbe":{"initialDelaySeconds":30},"resources":{"limits":{"cpu":"2000m","memory":"1600Mi"},"requests":{"cpu":"200m","memory":"550Mi"}},"service":{"externalPort":9128,"grpcExternalPort":6528,"grpcInternalPort":6528,"internalPort":9128,"name":"export-builder","type":"ClusterIP"},"startupProbe":{"initialDelaySeconds":30}}Override OpenTelemetry exporter type, see .monitoring.tracing.pythonOtelExporterType otelExporterType: “zipkin”
exportBuilder.enableHikariMonitoringbooltrueWhether to enable HikariCP monitoring: true | false
exportBuilder.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
exportBuilder.gracefulShutdownTimeoutSecondsint185Single knob for the shutdown drain: drives SPRING_LIFECYCLE_TIMEOUT_PER_SHUTDOWN_PHASE, the sidecar preStop drain-wait, and terminationGracePeriodSeconds (= 20 + value). Keep above the per-export ceiling (navigate 20s + evaluate 180s) and >= the gRPC shutdown-grace-period (180s).
exportBuilder.grpcServerMaxConnectionAgeint10Maximum time the GRPC connection is kept alive on the server side. Override the global default here… Lowered well below the global 300s default: export-builder autoscales aggressively via KEDA, and the gRPC client only rebalances onto new replicas when connections recycle. 300s is slower than the KEDA scale-up/scale-down cycle, so new pods never receive jobs. Connection-age grace is infinite (Netty default), so in-flight exports drain on the old connection instead of being killed.
exportBuilder.jvmOptionsstring"-XX:ReservedCodeCacheSize=60M -Xms200m -Xmx1000m -XX:MaxMetaspaceSize=210M"Custom JVM options
exportBuilder.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":300},"scaleUp":{"policies":[{"periodSeconds":90,"type":"Percent","value":100}],"selectPolicy":"Max","stabilizationWindowSeconds":0}},"enabled":false,"maxReplicaCount":5,"minReplicaCount":2,"query":"","threshold":"0.5"}KEDA autoscaling for export-builder
exportBuilder.kedaAutoscaling.behaviorobject{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":300},"scaleUp":{"policies":[{"periodSeconds":90,"type":"Percent","value":100}],"selectPolicy":"Max","stabilizationWindowSeconds":0}}Scale behavior
exportBuilder.kedaAutoscaling.behavior.scaleDownobject{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":300}Scale-down behavior — conservative to account for ~2-3 min pod startup time
exportBuilder.kedaAutoscaling.behavior.scaleDown.stabilizationWindowSecondsint300Wait 5 minutes of stable low load before scaling down
exportBuilder.kedaAutoscaling.behavior.scaleUpobject{"policies":[{"periodSeconds":90,"type":"Percent","value":100}],"selectPolicy":"Max","stabilizationWindowSeconds":0}Scale-up: react immediately (no stabilization), then add capacity in 2x steps.
exportBuilder.kedaAutoscaling.enabledboolfalseEnable KEDA ScaledObject for export-builder. Requires KEDA operator installed in the cluster.
exportBuilder.kedaAutoscaling.maxReplicaCountint5Maximum replica count when autoscaling is active
exportBuilder.kedaAutoscaling.minReplicaCountint2Minimum replica count when autoscaling is active
exportBuilder.kedaAutoscaling.querystring""PromQL query for the scaling trigger. Empty string (default): chart auto-computes a binary browser-pool saturation gate at render time, scoping to the Helm release namespace via a tolerant regex matcher that matches series with or without the namespace label: sum(export_builder_browser_pool_active_browser_count{namespace=~"<RELEASE_NAMESPACE>|"}) / clamp_min(sum(export_builder_browser_pool_browser_count{namespace=~"<RELEASE_NAMESPACE>|"}),1) >= bool 0.7 The fraction of busy browsers is a fast, leading saturation signal: it rises the moment the pool starts to fill, before any request has to wait. The >= bool 0.7 makes the query emit 1 (scale) or 0 (hold) — the 0.7 saturation cut-off lives here in the metric, NOT in threshold, so that threshold is free to encode the desired scale step (see below). Set to a non-empty string to use a fully custom query instead.
exportBuilder.kedaAutoscaling.thresholdstring"0.5"Threshold for the Value-type trigger. With metricType Value, desiredReplicas = ceil(currentReplicas * query / threshold). The query is a 0/1 gate, so threshold 0.5 makes a firing gate request exactly double the pods: ceil(current * 1 / 0.5) = 2 * current. (This is why the saturation cut-off is in the query, not the threshold: threshold’s only job is to set the 2x scale step.)
exportBuilder.playwright.browser.typestring"cdp"Browser type for Playwright. Can be either “local” or “cdp”. When set to “local”, Playwright will use the local browser installation. When set to “cdp”, Playwright will connect to a Chrome DevTools Protocol server.
exportBuilder.playwright.proxy.enabledbooltrueEnable proxy deployment for export-builder
exportBuilder.playwright.tracing.enabledboolfalseEnable Playwright tracing, users can add an x-gdc-debug header to store the trace in file storage.
exportBuilder.playwright.tracing.outputDirstring"/tmp/playwright-tracing"Path to a directory where the trace will be initially stored (final location depends on the used file storage, e.g., S3 bucket).
exportBuilder.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
exportBuilder.resourcesobject{"limits":{"cpu":"2000m","memory":"1600Mi"},"requests":{"cpu":"200m","memory":"550Mi"}}container resources
exportBuilderChromium.resources.limits.cpustring"6000m"
exportBuilderChromium.resources.limits.memorystring"6000Mi"
exportBuilderChromium.resources.requests.cpustring"2000m"
exportBuilderChromium.resources.requests.memorystring"4000Mi"
exportController.actuator.portint6581
exportController.builderRetry.deadlinestring"300s"Number of export-builder pods probed per retry sweep. Defaults to half of kedaAutoscaling.maxReplicaCount (autoscaling on) or half of replicaCount (autoscaling off). Override to fix a specific count. podsPerRetry: ~
exportController.builderRetry.intervalstring"4s"
exportController.builderRetry.jitterFractionfloat0.2
exportController.existingSecretstring""you can specify existing secret with cloud credentials instead. For s3:// URLs, it mus contain keys access-key-id and secret-access-key
exportController.exportABSStorage.absAccountKeystring""ABS account access key of IAM account with access to storage container
exportController.exportABSStorage.absAccountNamestring""ABS storage account name to store export files
exportController.exportABSStorage.absAuthoritystring""ABS authority to use (e.g.: .blob.core.windows.net)
exportController.exportABSStorage.absClientIdstring""ABS ClientID used to authenticate with user-assigned managed identity
exportController.exportABSStorage.absContainerstring""ABS container name to store export files
exportController.exportABSStorage.absContainerPrefixstring""Custom container prefix
exportController.exportFSStorage.fsRootDirstring"/tmp/exports"local/mounted filesystem root dir to save exports under
exportController.exportS3Storage.endpointOverridestring""If non-empty, override S3 host with a connection string such as “localhost:3000”
exportController.exportS3Storage.s3Bucketstring""AWS bucket name to store export files
exportController.exportS3Storage.s3BucketPrefixstring""Custom bucket prefix
exportController.exportS3Storage.s3Regionstring""AWS region, default “us-east-1”
exportController.exportS3Storage.schemestring""S3 connection scheme, default “https”
exportController.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
exportController.fileStorageBaseUrlstring"/tmp/exports"Base url for export file storage. Can be a local directory (mounted directory when fsExportStorage.storageClassName is set) or S3 bucket “s3://s3..amazonaws.com//”. If used with useNewExportFlow=true, fileStorageBaseUrl takes precedence to values defined within exportFSStorage/exportS3Storage (values are ignored).
exportController.fsExportStorage.pvcRequestStorageSizestring"1Gi"Size of the export storage volume. It’s up to the sc provider to ensure the requested size and regular cleanup.
exportController.fsExportStorage.storageClassNamestring""External storage class name providing ReadWriteMany accessMode
exportController.globalCspDirectivesobject{}
exportController.image.namestring"export-controller"
exportController.jvmOptionsstring"-XX:ReservedCodeCacheSize=90M -Xms200m -Xmx200m -XX:MaxMetaspaceSize=192M -Dsun.net.inetaddr.ttl=5"Custom JVM options. The -Dsun.net.inetaddr.ttl=5 lowers the JVM positive-DNS TTL (default ~30s) so the gRPC PollDnsNameResolver picks up newly autoscaled export-builder pods at its ~10s poll cadence instead of resolving against a stale cached pod set.
exportController.livenessProbe.initialDelaySecondsint30
exportController.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
exportController.podLabelsobject{}
exportController.pulsar.exportRaw.maxConcurrentMessagesint4
exportController.pulsar.exportRaw.messageTTLint600
exportController.pulsar.exportRaw.topicstring"export-raw.request"
exportController.pulsar.exportRawScheduled.deadLetter.topicstring"export-raw-scheduled.request.DLQ"
exportController.pulsar.exportRawScheduled.topicstring"export-raw-scheduled.request"
exportController.pulsar.exportSlideshow.deadLetter.topicstring"export-slideshow.request.DLQ"
exportController.pulsar.exportSlideshow.messageTTLint300
exportController.pulsar.exportSlideshow.topicstring"export-slideshow.request"
exportController.pulsar.exportSlideshowScheduled.deadLetter.topicstring"export-slideshow-scheduled.request.DLQ"
exportController.pulsar.exportSlideshowScheduled.topicstring"export-slideshow-scheduled.request"
exportController.pulsar.exportTabular.deadLetter.topicstring"export-tabular.request.DLQ"
exportController.pulsar.exportTabular.messageTTLint300
exportController.pulsar.exportTabular.topicstring"export-tabular.request"
exportController.pulsar.exportTabularScheduled.deadLetter.topicstring"export-tabular-scheduled.request.DLQ"
exportController.pulsar.exportTabularScheduled.topicstring"export-tabular-scheduled.request"
exportController.pulsar.exportVisual.deadLetter.topicstring"export-visual.request.DLQ"
exportController.pulsar.exportVisual.messageTTLint300
exportController.pulsar.exportVisual.topicstring"export-visual.request"
exportController.pulsar.exportVisualScheduled.deadLetter.topicstring"export-visual-scheduled.request.DLQ"
exportController.pulsar.exportVisualScheduled.topicstring"export-visual-scheduled.request"
exportController.readinessProbe.initialDelaySecondsint30
exportController.resourcesobject{"limits":{"cpu":"500m","memory":"800Mi"},"requests":{"cpu":"100m","memory":"560Mi"}}container resources
exportController.s3.accessKeystring""AWS access key id of IAM account with access to S3 bucket
exportController.s3.secretKeystring""AWS secret access key of IAM account with access to S3 bucket
exportController.service.externalPortint6580
exportController.service.grpcExternalPortint6578
exportController.service.grpcInternalPortint6578
exportController.service.internalPortint6580
exportController.service.namestring"export-controller"
exportController.service.typestring"ClusterIP"
exportController.startupProbe.initialDelaySecondsint30
exportController.storageTypestring""
exportController.useNewExportFlowbooltrueFor scheduled exports,the following settings is used to set TTL for pre-signed url from S3. expireInSeconds: 600
extraEnvVarslist[]
fullnameOverridestring""If not set, a name is generated using the fullname template.
gatewayForge.actuator.portint9099
gatewayForge.database.existingSecretstring""you can specify custom secret with gateway-forge database password
gatewayForge.database.existingSecretKeystring"postgresql-password"you can specify custom secret key to get gateway-forge database password from
gatewayForge.database.gwOwnerExistingSecretstring""you can specify custom secret with GW owner user database password
gatewayForge.database.gwOwnerExistingSecretKeystring"postgresql-password"you can specify custom secret key to get GW owner user database password from
gatewayForge.database.gwOwnerPasswordstring""
gatewayForge.database.gwOwnerUserstring""enabling this is effectively a one-way ownership migration and should be rolled out carefully
gatewayForge.database.namestring"gw"
gatewayForge.database.passwordstring""
gatewayForge.database.pool.initialSizeint4
gatewayForge.database.pool.maxAcquireTimeint30000
gatewayForge.database.pool.maxCreateConnectionTimeint10000
gatewayForge.database.pool.maxIdleTimeint1800000
gatewayForge.database.pool.maxLifeTimeint1800000
gatewayForge.database.pool.maxSizeint16
gatewayForge.database.pool.minIdleint4
gatewayForge.database.pool.validationQuerystring"SELECT 1"
gatewayForge.database.userstring""dedicated DB user for gateway-forge; when empty, falls back to the default Postgres superuser
gatewayForge.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
gatewayForge.image.namestring"gateway-forge"
gatewayForge.jvmOptionsstring"-XX:ReservedCodeCacheSize=60M -Xms200m -Xmx700m -XX:MaxMetaspaceSize=210M"Custom JVM options
gatewayForge.livenessProbe.initialDelaySecondsint30
gatewayForge.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
gatewayForge.podLabelsobject{}
gatewayForge.pulsar.metadataBackSync.messageTTLint300
gatewayForge.pulsar.metadataBackSync.topicstring"metadata.back-sync"
gatewayForge.pulsar.metadataResync.topicstring"metadata.resync.v2"
gatewayForge.pulsar.metadataResyncRequest.messageTTLint300
gatewayForge.pulsar.metadataResyncRequest.topicstring"metadata.resync-request"
gatewayForge.pulsar.metadataSync.deadLetter.topicstring"metadata.sync.DLQ"
gatewayForge.pulsar.metadataSync.topicstring"metadata.sync"
gatewayForge.readinessProbe.initialDelaySecondsint30
gatewayForge.resourcesobject{"limits":{"cpu":"500m","memory":"1200Mi"},"requests":{"cpu":"100m","memory":"450Mi"}}container resources
gatewayForge.service.grpcExternalPortint6574
gatewayForge.service.grpcInternalPortint6574
gatewayForge.service.namestring"gateway-forge"
gatewayForge.startupProbe.initialDelaySecondsint30
genAi.a2aServer.allowedOriginslist[]
genAi.a2aServer.extraAllowedHostslist[]
genAi.a2aServer.portint9204
genAi.absBlobStorage.absAccountNamestring""ABS storage account name
genAi.absBlobStorage.absClientIdstring""ABS client ID for workload identity authentication (optional)
genAi.absBlobStorage.absContainerstring""ABS container name
genAi.absBlobStorage.absContainerPrefixstring""Custom container prefix
genAi.absBlobStorage.authTypestring""Authentication type (“azure_default” | “azure_tokens”), default “azure_default” “azure_default”: Use Azure default credential chain (Workload Identity, managed identity, etc.) “azure_tokens”: Use explicit credentials (absAccountKey must be provided)
genAi.agenticMaxIterationsint40max iterations of the agentic loop before the turn is aborted
genAi.blobStorage.enabledboolfalseEnable blob storage for knowledge document files
genAi.blobStorage.maxFileSizestring"10485760"Maximum file size in bytes (default 10MB)
genAi.blobStorage.storageTypestring"S3"Storage backend type (“S3” | “ABS”), default “S3”
genAi.database.existingSecretstring""you can specify custom secret with gen-ai database password
genAi.database.existingSecretKeystring"postgresql-password"you can specify custom secret key to get gen-ai database password from
genAi.database.namestring"genai"
genAi.database.passwordstring""
genAi.database.userstring""if user is empty, default postgres user and password is used
genAi.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
genAi.httpServer.portint8989
genAi.image.namestring"gen-ai"
genAi.langfuse.enabledstring"no"
genAi.langfuse.secretstringnil
genAi.langfuse.tracingEnvironmentstring"development"
genAi.llmModelCallobject{"maxAttempts":1,"retryBackoffSeconds":1,"timeoutSeconds":60}Upstream LLM model call timeout and retry policy.
genAi.metricScoreBoostingMultiplierfloat1.2
genAi.moveHnswAndQuantizedVectorsToDiskboolfalse
genAi.observability.datasourceUrlstring""JDBC url for the managed AI Observability data source. When set, gen-ai emits this instead of deriving it from DATABASE_* (which targets the shared session-mode pooler). Point it at the dedicated transaction-mode pooler so per-org obs_ roles stay within their CONNECTION LIMIT. Empty = derive from DATABASE_* (on-prem / local, where no separate obs pooler exists).
genAi.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
genAi.podLabelsobject{}
genAi.podMonitor.pathstring"/metrics"
genAi.podMonitor.portstring"metrics"
genAi.pulsar.metadataSyncRequest.messageTTLint300
genAi.pulsar.metadataSyncRequest.topicstring"metadata.sync-request"
genAi.qdrantStartupWait.enabledbooltrue
genAi.qdrantStartupWait.intervalSecondsint5
genAi.qdrantStartupWait.requestTimeoutSecondsint5
genAi.qdrantStartupWait.timeoutSecondsint300
genAi.qdrantStartupWait.uvicornShutdownTimeoutSecondsint10
genAi.qualityCheckService.enabledboolfalse
genAi.qualityCheckService.unknownAbbreviationDetection.enabledboolfalse
genAi.qualityCheckService.useLLMboolfalse
genAi.reranker.enabledbooltrue
genAi.resourcesobject{"limits":{"cpu":"2000m","memory":"2048Mi"},"requests":{"cpu":"500m","memory":"1024Mi"}}container resources
genAi.s3BlobStorage.endpointOverridestring""If non-empty, override S3 host with a connection string such as “localhost:3000”
genAi.s3BlobStorage.s3AccessKeystring""AWS access key ID (optional; if empty, uses default credential chain)
genAi.s3BlobStorage.s3Bucketstring""AWS S3 bucket name to store knowledge documents
genAi.s3BlobStorage.s3BucketPrefixstring""Custom bucket prefix
genAi.s3BlobStorage.s3Regionstring""AWS region, default “us-east-1”
genAi.s3BlobStorage.s3SecretKeystring""AWS secret access key (optional; must be provided if s3AccessKey is set)
genAi.s3BlobStorage.schemestring""S3 connection scheme, default “https”
genAi.service.externalPortint6799
genAi.service.internalPortint6799
genAi.service.metricsPortint9134
genAi.service.namestring"gen-ai"
genAi.service.typestring"ClusterIP"
genAi.teiEmbedder.maxBatchSizeint128Maximum number of strings per gRPC EmbedStream call
genAi.teiEmbedder.maxConcurrentBatchesint4Maximum concurrent embed batches in-flight (controls TEI queue pressure). TEI processes one inference batch at a time per pod (multiple CPUs speed up each batch, not add parallelism). Set to num_pods + small buffer (1-2) so the queue always has the next batch ready without piling up excess queue time.
genAi.usePgForSyncEntitiesboolfalse
genAi.usePgForSyncStatusesboolfalse
genAi.usePostgresOnlyboolfalse
genAi.vectorStores.qdrant.grpc_portint6334
genAi.vectorStores.qdrant.hoststring"qdrant-db"
genAi.vectorStores.qdrant.prefer_grpcbooltrue
genAi.vectorStores.qdrant.rest_portint6333
genAi.vectorStores.qdrant.timeoutint5
genAi.vectorStores.storesstring"qdrant"
genAi.yieldToolCallEventsboolfalse
genAiMetadataSync.blacklistedOrganizationIdslist[]
genAiMetadataSync.db.maxOverflowint10
genAiMetadataSync.db.poolSizeint5Async engine connection pool for the shared DB session manager. Size for projectionOutbox.entryConcurrency plus the resync consumer’s checkout (~pulsar.metadataSync.max_consumer_concurrency) so concurrent outbox draining doesn’t starve claims/release. Total PG connections ≈ replicas * (poolSize + maxOverflow) — keep under the server’s max_connections.
genAiMetadataSync.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
genAiMetadataSync.image.namestring"gen-ai"
genAiMetadataSync.kedaAutoscaling.behaviorobject{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":600}}Scale-down behavior; spiky signal uses a shorter stabilization window than the global 30-min default.
genAiMetadataSync.kedaAutoscaling.enabledboolfalseEnable KEDA ScaledObject for gen-ai-metadata-sync. Requires KEDA operator + kedaAutoscaling.prometheusAddress.
genAiMetadataSync.kedaAutoscaling.maxReplicaCountint10
genAiMetadataSync.kedaAutoscaling.minReplicaCountint2
genAiMetadataSync.kedaAutoscaling.querystring""PromQL trigger. Empty: chart auto-computes, scoping to release namespace + the gen-ai-metadata-sync container: max(gen_ai_projection_outbox_queue_size{namespace=~"<RELEASE_NAMESPACE>|",container=“gen-ai-metadata-sync”})
genAiMetadataSync.kedaAutoscaling.thresholdstring"10000"AverageValue threshold: outbox rows per replica (desiredReplicas = ceil(queue/threshold)).
genAiMetadataSync.langfuse.enabledstring"no"
genAiMetadataSync.langfuse.secretstringnil
genAiMetadataSync.langfuse.tracingEnvironmentstring"development"
genAiMetadataSync.llmProviderSync.enabledbooltrue
genAiMetadataSync.moveHnswAndQuantizedVectorsToDiskboolfalse
genAiMetadataSync.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
genAiMetadataSync.podLabelsobject{}
genAiMetadataSync.podMonitor.pathstring"/metrics"
genAiMetadataSync.podMonitor.portstring"metrics"
genAiMetadataSync.projectionOutbox.entryConcurrencyint1Outbox rows a single pod projects to Qdrant concurrently. Each in-flight entry holds one DB connection, so keep this below the engine pool capacity (shared with the resync consumer). Drain throughput scales ~linearly with this and with replica count.
genAiMetadataSync.projectionOutbox.livenessMaxStallSecondsint120
genAiMetadataSync.projectionOutbox.opTimeoutSecondsint30
genAiMetadataSync.pulsar.aiObservabilityRoleReady.topicstring"ai-observability-role-ready"
genAiMetadataSync.pulsar.maxRedeliverCountint2
genAiMetadataSync.pulsar.metadataResync.deadLetter.topicstring"metadata.resync.DLQ"
genAiMetadataSync.pulsar.metadataResync.topicstring"metadata.resync"
genAiMetadataSync.pulsar.metadataResyncV2.deadLetter.topicstring"metadata.resync.v2.DLQ"
genAiMetadataSync.pulsar.metadataResyncV2.topicstring"metadata.resync.v2"
genAiMetadataSync.pulsar.metadataSync.deadLetter.topicstring"metadata.sync.DLQ"
genAiMetadataSync.pulsar.metadataSync.max_consumer_concurrencyint5
genAiMetadataSync.pulsar.metadataSync.topicstring"metadata.sync"
genAiMetadataSync.pulsar.metadataSyncRequest.topicstring"metadata.sync-request"
genAiMetadataSync.qdrantStartupWait.enabledbooltrue
genAiMetadataSync.qdrantStartupWait.intervalSecondsint5
genAiMetadataSync.qdrantStartupWait.requestTimeoutSecondsint5
genAiMetadataSync.qdrantStartupWait.timeoutSecondsint300
genAiMetadataSync.qdrantStartupWait.uvicornShutdownTimeoutSecondsint10
genAiMetadataSync.resourcesobject{"limits":{"cpu":"2000m","memory":"4096Mi"},"requests":{"cpu":"500m","memory":"2048Mi"}}container resources
genAiMetadataSync.service.metricsPortint9135
genAiMetadataSync.service.namestring"gen-ai-metadata-sync"
genAiMetadataSync.service.typestring"ClusterIP"
genAiMetadataSync.teiEmbedder.maxBatchSizeint128Maximum number of strings per gRPC EmbedStream call
genAiMetadataSync.teiEmbedder.maxConcurrentBatchesint4Maximum concurrent embed batches in-flight. Metadata sync is the bulk caller — keep this equal to or slightly above the number of TEI pods to maximize throughput without queue overflow.
genAiMetadataSync.usePgForSyncEntitiesboolfalse
genAiMetadataSync.usePgForSyncStatusesboolfalse
genAiMetadataSync.usePostgresOnlyboolfalse
genAiMetadataSync.vectorStores.qdrant.grpc_portint6334
genAiMetadataSync.vectorStores.qdrant.hoststring"qdrant-db"
genAiMetadataSync.vectorStores.qdrant.prefer_grpcbooltrue
genAiMetadataSync.vectorStores.qdrant.rest_portint6333
genAiMetadataSync.vectorStores.qdrant.timeoutint5
genAiMetadataSync.vectorStores.storesstring"qdrant"
global.imageRegistrystringnilSet the following variable to your private docker registry if you want to deploy to air-gapped installations.
global.security.allowInsecureImagesbooltruethis is needed to accept bitnamilegacy images
gracefulShutdownTimeoutSecondsint60Default timeout for a microservice to gracefully stop, i.e., to wait for active requests to finish (in seconds). It might be overridden in component definitions.
grpcClientMaxInboundMetadataSizeint32768Maximum gRPC inbound metadata size in bytes for gRPC clients (e.g. api-gw). Can be overridden per service.
grpcServerMaxConnectionAgeint300Maximum time the GRPC connection is kept alive on the server side. After the time elapses the connection is closed. This impacts GRPC load balancing, since client only rediscovers new servers when some connection is closed. In other words the newly spawned GRPC service is discovered after this time in worst case. The value is in seconds. Can be overridden per service.
grpcServerMaxInboundMetadataSizeint32768Maximum gRPC inbound metadata size in bytes. Can be overridden per service.
grpcServerPermitKeepAliveTimeint25Minimum time the GRPC client is allowed sending keep alive to the server. This must be lower than keep alive time on clients (currently 30s by default)
grpcServerPermitKeepAliveWithoutCallsbooltrueWhether GRPC server allows clients to send keep alive when there are no calls.
homeUi.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
homeUi.extraVolumeMountslist[]Additional volumes to mount.
homeUi.extraVolumeslist[]Additional volumes
homeUi.image.namestring"home-ui"
homeUi.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":600,"type":"Percent","value":25}],"stabilizationWindowSeconds":900},"scaleUp":{"stabilizationWindowSeconds":30}},"enabled":null,"targetCPUUtilization":80}KEDA autoscaling opt-in. enabled: null inherits the global kedaAutoscaling master switch. Policy (min/max replicas, CPU target, behavior) inherits the global kedaAutoscaling defaults. Override any field here.
homeUi.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
homeUi.podLabelsobject{}
homeUi.resourcesobject{"limits":{"cpu":"150m","memory":"35Mi"},"requests":{"cpu":"50m","memory":"15Mi"}}container resources
homeUi.service.externalPortint9600
homeUi.service.internalPortint9600
homeUi.service.namestring"home-ui"
homeUi.service.typestring"ClusterIP"
hookAnnotationsobject{"argocd.argoproj.io/hook-delete-policy":"BeforeHookCreation"}Annotations added to every Helm hook Job. Default lets ArgoCD delete a completed hook Job before recreating it (else the immutable Job blocks sync); no-op under helm/Flux. Set to null to clear.
hostApplication.enabledbooltrue
hostApplication.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
hostApplication.extraVolumeMountslist[]Additional volumes to mount.
hostApplication.extraVolumeslist[]Additional volumes
hostApplication.image.namestring"host-application"
hostApplication.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
hostApplication.podLabelsobject{}
hostApplication.resourcesobject{"limits":{"cpu":"150m","memory":"35Mi"},"requests":{"cpu":"50m","memory":"15Mi"}}container resources
hostApplication.service.externalPortint9900
hostApplication.service.internalPortint9900
hostApplication.service.namestring"host-application"
hostApplication.service.typestring"ClusterIP"
image.dockerhubPrefixstring"docker.io"Registry prefix for DockerHub images. Set to docker.io if your cluster has access to DockerHub either directly or via configured registry proxy On air-gapped installations, set to local registry namespace with pre-pulled images
image.pullPolicystring"IfNotPresent"Image pull policy. One of Always, IfNotPresent, Never
image.repositoryPrefixstring"gooddata"Registry where the GoodData.CN images are stored. Normally it points to GoodData namespace on Docker Hub. Set to repository prefix in the local registry if you plan deploying to air-gapped installation
imagePullSecretslist[]
ingress.annotationsobject{"nginx.ingress.kubernetes.io/proxy-body-size":"20m","nginx.ingress.kubernetes.io/proxy-read-timeout":"180"}Custom annotations that will be added to every Ingress object created by this chart
ingress.ingressClassNamestring"nginx"Class of the Ingress controller used for this deployment
ingress.lbProtocolstring"https"This setting informs applications if the load balancer exposes the applications on HTTPS or plain unencrypted HTTP. For production workload, we strongly suggest using HTTPS. For local development purposes (e.g. in k3d cluster), HTTP is sufficient.
istioobject{"enabled":false,"gateway":{"enabled":false,"existingGateway":"","selector":{"istio":"ingressgateway"},"sharedVirtualServiceName":"gooddata-cn"}}Istio configuration
istio.enabledboolfalseenable Istio support
istio.gateway.enabledboolfalseEnable Gateway creation
istio.gateway.existingGatewaystring""Optional pre-existing Gateway to use instead of creating our own. Can be ‘gateway-name’ for same namespace or ‘other-namespace/gateway-name’ for cross-namespace. When set, the chart/controller will NOT create or manage a Gateway and Organization.spec.tls is ignored.
istio.gateway.selectorobject{"istio":"ingressgateway"}List of labels picking pods where this config should be applied
istio.gateway.sharedVirtualServiceNamestring"gooddata-cn"Name of shared VirtualService for delegating routes
jvmOptionsstring"-XX:+ExitOnOutOfMemoryError -XX:+UseG1GC -Xss384k -XX:+UseStringDeduplication -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=25 -XX:AdaptiveSizePolicyWeight=50 -XX:InitiatingHeapOccupancyPercent=25 -XX:GCTimeRatio=25 -XX:CompressedClassSpaceSize=32M --add-opens=java.base/sun.net=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --sun-misc-unsafe-memory-access=allow --enable-native-access=ALL-UNNAMED"
kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":1800}},"enabled":false,"ignoreNullValues":true,"maxReplicaCount":5,"minReplicaCount":2,"pollingInterval":10,"prometheusAddress":"","targetCPUUtilization":60,"unsafeSsl":false}KEDA Autoscaling global configuration
kedaAutoscaling.behaviorobject{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":1800}}Default HPA behavior: aggressive scale-up, 30-min stabilized scale-down (anti-flap).
kedaAutoscaling.enabledboolfalseMaster switch for KEDA autoscaling. Set to true to enable autoscaling for every supported component at once. Individual components inherit this value and can still override it via <component>.kedaAutoscaling.enabled: true|false.
kedaAutoscaling.ignoreNullValuesbooltrueWhether to ignore null/empty values from the prometheus query
kedaAutoscaling.maxReplicaCountint5Shared default for the autoscaling ceiling. Each component inherits this value unless it sets its own kedaAutoscaling.maxReplicaCount.
kedaAutoscaling.minReplicaCountint2Shared default for the autoscaling floor (multi-AZ HA). Each component inherits this value unless it sets its own kedaAutoscaling.minReplicaCount.
kedaAutoscaling.pollingIntervalint10Polling interval in seconds for KEDA triggers
kedaAutoscaling.prometheusAddressstring""Prometheus-compatible URL for KEDA triggers. Only required when a component supplies a Prometheus-based customTrigger; the default CPU trigger (Kubernetes Metrics Server) does not need it.
kedaAutoscaling.targetCPUUtilizationint60Default target average CPU utilization (% of the container CPU request).
kedaAutoscaling.unsafeSslboolfalseWhether to skip TLS certificate verification for the prometheus endpoint
license.existingSecretstring""Existing secret containing the license key in the license property. Overrides the license.key The secret must be precreated before helm chart installation, e.g. using command: kubectl -n <namespace> create secret generic gd-license --from-literal=license="<put-your-license-key-here>"
license.keystring"<put-your-license-key-here>"set to license key provided by GoodData. Used only if license.existingSecret is not set.
loggerRingBufferSizeint262144Default Log4J ring buffer size (in bytes).
mapIngestionJob.enabledboolfalseEnables post-install/post-upgrade hook for uploading map data to storage Map ingestion job reuses storage configuration from Quiver geoCollections settings. Storage type is determined by .Values.quiver.geoCollections.storageType (“S3” or “ABS”). For S3: uses .Values.quiver.s3GeoCollectionsStorage.s3Bucket and .Values.quiver.s3GeoCollectionsStorage.s3BucketPrefix For ABS: uses .Values.quiver.absGeoCollectionsStorage.absContainer, .Values.quiver.absGeoCollectionsStorage.absContainerPrefix, .Values.quiver.absGeoCollectionsStorage.absAccountName, .Values.quiver.absGeoCollectionsStorage.absAccountKey, .Values.quiver.absGeoCollectionsStorage.absBlobStorageScheme, and .Values.quiver.absGeoCollectionsStorage.absBlobStorageAuthority
mapIngestionJob.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
mapIngestionJob.image.namestring"map-ingestion-job"
mapIngestionJob.podLabelsobject{}
maxHttpRequestHeaderSizeint32768Maximum HTTP request header size in bytes. Can be overridden per service.
mcpServer.aiHttpTimeoutSecondsint120HTTP timeout (seconds) for long-running AI tools (ai_chat/ai_search)
mcpServer.generatedToolsobject{"maxResponseBytes":1000000,"services":"metadata"}Auto-generated v1 OpenAPI tool surface. Built unconditionally at startup and gated per request by the single per-org enableMcpGeneratedTools feature flag (ADR-26-10) — no deploy-time build switch. The flag’s platform-default false is the env kill switch.
mcpServer.generatedTools.maxResponseBytesint1000000Hard cap (bytes) on a generated tool’s backend response body
mcpServer.generatedTools.servicesstring"metadata"Comma-separated v1 services to fetch+merge specs from
mcpServer.image.namestring"mcp-server"
mcpServer.podMonitor.enabledbooltrue
mcpServer.podMonitor.pathstring"/metrics"
mcpServer.podMonitor.portstring"metrics"
mcpServer.resources.limits.cpustring"500m"
mcpServer.resources.limits.memorystring"512Mi"
mcpServer.resources.requests.cpustring"250m"
mcpServer.resources.requests.memorystring"256Mi"
mcpServer.resultCachePollTimeoutSecondsint30Max seconds to wait for a result-cache result to become ready before giving up
mcpServer.service.externalPortint9200
mcpServer.service.internalPortint9200
mcpServer.service.metricsPortint9138
mcpServer.service.namestring"mcp-server"
mcpServer.service.typestring"ClusterIP"
metadataApi.actuator.portint9008
metadataApi.bootstrap.existingSecretstring""If set, existing secret containing user and password can be used instead of the two values above.
metadataApi.bootstrap.passwordstring"VerySecretPassword"
metadataApi.bootstrap.userstring"bootstrap"
metadataApi.cacheStrategystring""String in the format organization1:DURABLE;organization2:EPHEMERAL this allows setting particular organization’s cache strategy. Allowed values of the second part are DURABLE and EPHEMERAL
metadataApi.dataSourceUploadIdGracePeriodint900How long to wait before actually deleting the execution data after an upload id change (in seconds). This is meant to give users that are using the old data time to finish their work like computations that were already running when the upload id was changed.
metadataApi.database.existingExporterSecretstring""you can specify custom secret with md database exporter password; the key needs to be “exporter-password”
metadataApi.database.existingSecretstring""you can specify custom secret with md database password
metadataApi.database.existingSecretKeystring"postgresql-password"you can specify custom secret key to get md database password from
metadataApi.database.exporterPasswordstring"VerySecretPassword"MD access for export views (user ‘md_exporter’)
metadataApi.database.namestring"md"
metadataApi.database.passwordstring""
metadataApi.database.userstring""if user is empty, default postgres user and password is used
metadataApi.encryptor.enabledbooltrueenable datasource credentials organization oidc secret encryption in database.
metadataApi.encryptor.existingSecretstring""optionally, pass “keySet” in Secret instead.
metadataApi.encryptor.keySetstring""keyset generated by tinkey tool, must be set if encryptor is enabled
metadataApi.extraCachestring""String in the format organization1:12345;organization2:54321 this allows setting particular organization’s extraCache budgets in bytes
metadataApi.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
metadataApi.globalCspDirectivesobject{}Additional directives for Content-Security policy. It is a map of keys (CSP directives) and their values. Refer to https://w3c.github.io/webappsec-csp/#csp-directives for list of available directives These directives are merged with a preloaded set of CSP directives essential for basic GoodData.CN operation
metadataApi.grpc.client.federation.channel.hoststring""
metadataApi.grpc.client.federation.enabledboolfalse
metadataApi.image.namestring"metadata-api"
metadataApi.jvmOptionsstring"-XX:ReservedCodeCacheSize=140M -Xms1100m -Xmx1800m -XX:MaxMetaspaceSize=210M"Custom JVM options
metadataApi.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":600,"type":"Pods","value":1}],"stabilizationWindowSeconds":3600},"scaleUp":{"policies":[{"periodSeconds":60,"type":"Pods","value":2}],"stabilizationWindowSeconds":300}},"enabled":null,"targetCPUUtilization":75}KEDA autoscaling opt-in. enabled: null inherits the global kedaAutoscaling master switch; policy/minReplicaCount resolve as documented in the global block. NOTE: each pod claims ~16 Hikari DB connections — size Postgres max_connections / pooler max_pool for maxReplicaCount before enabling.
metadataApi.livenessProbe.initialDelaySecondsint30
metadataApi.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
metadataApi.podLabelsobject{}
metadataApi.pulsar.aiObservabilityRoleReady.deadLetter.topicstring"ai-observability-role-ready.DLQ"
metadataApi.pulsar.aiObservabilityRoleReady.topicstring"ai-observability-role-ready"
metadataApi.pulsar.cacheCommand.messageTTLint300
metadataApi.pulsar.cacheCommand.topicstring"metadata.cache-command"
metadataApi.pulsar.cacheSettingsBootstrap.topicstring"cache-settings.bootstrap"
metadataApi.pulsar.cacheSettingsChange.messageTTLint300
metadataApi.pulsar.cacheSettingsChange.topicstring"cache-settings.change"
metadataApi.pulsar.dataSourceChange.messageTTLint3600
metadataApi.pulsar.dataSourceChange.topicstring"data-source.change"
metadataApi.pulsar.identityManagement.messageTTLint300
metadataApi.pulsar.identityManagement.topicstring"identity-management"
metadataApi.pulsar.idpManagement.messageTTLint300
metadataApi.pulsar.idpManagement.topicstring"idp-management"
metadataApi.pulsar.inviteGenerator.enabledboolfalse
metadataApi.pulsar.inviteGenerator.messageTTLint300
metadataApi.pulsar.inviteGenerator.topicstring"invitations"
metadataApi.pulsar.memoryLimitMbint1024Pulsar client memory buffer limit in MB (default 64MB in Pulsar 4.x)
metadataApi.pulsar.metadataBackSync.topicstring"metadata.back-sync"
metadataApi.pulsar.metadataResync.messageTTLint86400
metadataApi.pulsar.metadataResync.sendTimeoutSecondsint30
metadataApi.pulsar.metadataResync.topicstring"metadata.resync.v2"
metadataApi.pulsar.metadataResyncRequest.topicstring"metadata.resync-request"
metadataApi.pulsar.metadataSync.messageTTLint300
metadataApi.pulsar.metadataSync.topicstring"metadata.sync"
metadataApi.pulsar.metadataSyncRequest.topicstring"metadata.sync-request"
metadataApi.pulsar.modelUpdate.messageTTLint3600
metadataApi.pulsar.modelUpdate.topicstring"metadata.model"
metadataApi.pulsar.workspaceChange.messageTTLint3600
metadataApi.pulsar.workspaceChange.topicstring"workspace.change"
metadataApi.readinessProbe.initialDelaySecondsint30
metadataApi.resourcesobject{"limits":{"cpu":"1250m","memory":"2400Mi"},"requests":{"cpu":"100m","memory":"1500Mi"}}container resources
metadataApi.service.externalPortint9007
metadataApi.service.grpcExternalPortint6572
metadataApi.service.grpcInternalPortint6572
metadataApi.service.internalPortint9007
metadataApi.service.namestring"metadata-api"
metadataApi.service.typestring"ClusterIP"
metadataApi.startupProbe.initialDelaySecondsint30
metadataApi.txnBindToPrimaryboolfalseIf set to true, metadata-api sends selected select statements always to primary node via pgpool in PG-HA configuration
monitoring.tracing.enabledboolfalse
monitoring.tracing.exporterstring"otlp"Exporter format for Kotlin/Spring Boot services: “otlp” or “zipkin”. Use “otlp” for OTLP HTTP (management.otlp.tracing.endpoint). Use “zipkin” for Zipkin HTTP (management.zipkin.tracing.endpoint) — backward-compatible.
monitoring.tracing.otel.grpc.hoststring"alloy-cluster"
monitoring.tracing.otel.grpc.namespacestring"monitoring"
monitoring.tracing.otel.grpc.portint4317
monitoring.tracing.otel.public.collectorUrlstring""Publicly accessible URL of OTel Collector
monitoring.tracing.otlp.hoststring"alloy-cluster"
monitoring.tracing.otlp.namespacestring"monitoring"
monitoring.tracing.otlp.portint4318
monitoring.tracing.pythonOtelExporterTypestring"zipkin"OpenTelemetry exporter type for Python nodes, like FlexQuery or GenAI ("", “zipkin”, “otlp-grpc”).
monitoring.tracing.zipkin.hoststring"alloy-cluster"
monitoring.tracing.zipkin.namespacestring"monitoring"
monitoring.tracing.zipkin.portint9411
nameOverridestring""If not set, a name is generated using the name template.
networkPolicy.enabledboolfalseKubernetes Network Policy enablement.
networkPolicy.ingressControllerNamespaceLabelSelectorobject{"kubernetes.io/metadata.name":"ingress-nginx"}Kubernetes Namespace label(s) of ingressController. Required to allow ingress traffic.
networkPolicy.ingressControllerPodLabelSelectorobject{"app.kubernetes.io/name":"ingress-nginx"}Kubernetes Pod label(s) of ingressController. Required to allow ingress traffic.
networkPolicy.pgpoolAccessSelectorlist[]List of additional selectors for pgpool NetworkPolicy ingress rule. Templatable.
nodeSelectorobject{}Kubernetes nodeSelector labels; applies to all GoodData.CN Pods
organizationController.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
organizationController.image.namestring"organization-controller"
organizationController.kubeClientTimeoutint10
organizationController.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
organizationController.podLabelsobject{}
organizationController.podMonitor.pathstring"/"
organizationController.podMonitor.portstring"metrics"
organizationController.resourcesobject{"limits":{"cpu":"100m","memory":"200Mi"},"requests":{"cpu":"10m","memory":"50Mi"}}container resources
organizationController.service.metricsPortint8081
peeringAnnotationsobject{"argocd.argoproj.io/sync-options":"SkipDryRunOnMissingResource=true"}Annotations for the KopfPeering CR. Default lets a first ArgoCD sync skip the dry-run before its CRD exists; no-op under helm/Flux. Set to null to clear.
platform_limits.export_result_timeout_secondsint300Maximum time the UI should spend retrieving a single export result.
platform_limits.max_afm_result_page_bytesstring"5_242_880"Max size (bytes) of Arrow representation (FlexQuery) of the single page requested from the AFM execution result API.
platform_limits.max_column_sizestring"1_000"Max Column Size. Limit used for FlexQuery.
platform_limits.max_dimension_sizestring"10_000"Max Single Dimension Size. When a query returns a bigger dimension, the computation fails.
platform_limits.max_flexconnect_bytesstring"209_715_200"Max size (bytes) of data that a single FlexConnect function can return.
platform_limits.max_flexconnect_columnsstring"1_000"Max number of columns that a single FlexConnect function can have.
platform_limits.max_flexconnect_countint200IMPORTANT: just changing this limit will not have an impact on existing FlexConnect data sources. A data source that wants to benefit from an increased limit needs to be ‘refreshed’ (e.g., make some fake update that re-saves the data source state; the new limit will then be applied)
platform_limits.max_flexconnect_total_input_bytesstring"1_073_741_824"Max size (bytes) of data that a single FlexConnect query can load. Can be unset to disable this limit.
platform_limits.max_raw_execution_bytesstring"1_048_576_000"The max total size (bytes) of a raw data export (CSV with raw data). Exceeding it fails the export.
platform_limits.max_result_bytesstring"100_000_000"The max size of the raw result (bytes). Getting bigger results from DB ends with computation failure.
platform_limits.max_result_cell_countstring"1_000_000"Max Result Cell Count how many cells are allowed in a returned result.
platform_limits.max_zoom_levelstringnilMaximum zoom level allowed for map visualizations (0-22). If null – no max zoom level restriction.
podDisruptionBudget.maxUnavailableint1general maxUnavailable podDisruptionBudget, unless overridden per component
podDisruptionBudget.minAvailablestring""general minAvailable podDisruptionBudget, unless overridden per component
podMonitor.additionalLabelsobject{}
podMonitor.enabledboolfalse
podMonitor.intervalstring"20s"
podMonitor.pathstring"/actuator/prometheus"
podMonitor.portstring"actuator"
podMonitor.scrapeTimeoutstring"10s"
podSecurityContextobject{"runAsNonRoot":true}Kubernetes Pod Security Context settings.
prometheusRule.enabledboolfalse
prometheusRule.labelsobject{}
prometheusRule.ruleslist[]
pulsarCleanup.enabledbooltrueEnables post-delete hook for cleanup of Pulsar topics, namespace and tenant
pulsarCleanup.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
pulsarJob.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
pulsarJob.namespacePerReleasebooltrueIf false, uncomment and set the ’tenant’ and ’namespace’ below. If true, the name of Pulsar’s tenant and namespace will be generated from the k8s namespace and release name. Note that if you set fixed names, you must avoid conflicts among multiple instances of this chart sharing the same Pulsar cluster.
qdrant.config.storage.collection.replication_factorint3
qdrant.config.storage.collection.write_consistency_factorint2
qdrant.fullnameOverridestring"qdrant-db"
qdrant.persistence.sizestring"10Gi"
qdrant.podDisruptionBudget.enabledbooltrueenable PDB
qdrant.replicaCountint3
qdrant.resourcesobject{"limits":{"cpu":"1000m","memory":"512Mi"},"requests":{"cpu":"500m","memory":"368Mi"}}container resources
quiver.absDatasourceFsStorage.absAccountKeystring""ABS secret access key of storage account
quiver.absDatasourceFsStorage.absAccountNamestring""ABS storage account name to store export files
quiver.absDatasourceFsStorage.absAuthoritystring""ABS authority to use for GDC ABS BlobStorage client (e.g.: .blob.core.windows.net)
quiver.absDatasourceFsStorage.absBlobStorageAuthoritystring""ABS Blob authority override - defaults to “.blob.core.windows.net”
quiver.absDatasourceFsStorage.absBlobStorageSchemestring""ABS Blob Storage scheme override - defaults to “https”
quiver.absDatasourceFsStorage.absClientIdstring""ABS ClientID used to authenticate with user-assigned managed identity
quiver.absDatasourceFsStorage.absContainerstring""ABS container name to store export files
quiver.absDatasourceFsStorage.absContainerPrefixstring""Custom container prefix
quiver.absDatasourceFsStorage.absDfsStorageAuthoritystring""ABS DFS authority override - defaults to “.dfs.core.windows.net”
quiver.absDatasourceFsStorage.absDfsStorageSchemestring""ABS DFS scheme override - defaults to “https”
quiver.absDatasourceFsStorage.authTypestring""Authentication type (“azure_tokens” | “azure_default”), default “azure_default”
quiver.absDurableStorage.absAccountKeystring""ABS secret storage account key
quiver.absDurableStorage.absAccountNamestring""ABS account name to store datasource files
quiver.absDurableStorage.absBlobStorageAuthoritystring""ABS Blob Storage authority override - defaults to “.blob.core.windows.net”
quiver.absDurableStorage.absBlobStorageSchemestring""ABS Blob Storage scheme override - defaults to “https”
quiver.absDurableStorage.absClientIdstring""ABS ClientID used to authenticate using User-assigned Managed Identity
quiver.absDurableStorage.absContainerstring""ABS container name to store datasource files
quiver.absDurableStorage.absContainerPrefixstring""Custom container prefix
quiver.absDurableStorage.absDfsStorageAuthoritystring""ABS DFS authority override - defaults to “.dfs.core.windows.net”
quiver.absDurableStorage.absDfsStorageSchemestring""ABS DFS scheme override - defaults to “https”
quiver.absDurableStorage.authTypestring""Authentication type (“azure_tokens” | “azure_default”), default “azure_default”
quiver.absDurableStorage.durableABSWritesInProgressstring""Maximum number of write streams to ABS (empty = default)
quiver.absGeoCollectionsStorage.absAccountKeystring""ABS secret access key for geoCollections storage (REQUIRED if authType is “azure_tokens”). These credentials are separate from datasource files storage credentials. If authType is “azure_default” (or empty), uses Azure default credential chain and this explicit credential is not used.
quiver.absGeoCollectionsStorage.absAccountNamestring""ABS storage account name to store geo collection files
quiver.absGeoCollectionsStorage.absAuthoritystring""ABS authority to use for GDC ABS BlobStorage client (e.g.: .blob.core.windows.net)
quiver.absGeoCollectionsStorage.absBlobStorageAuthoritystring""ABS Blob authority override - defaults to “.blob.core.windows.net”
quiver.absGeoCollectionsStorage.absBlobStorageSchemestring""ABS Blob Storage scheme override - defaults to “https”
quiver.absGeoCollectionsStorage.absClientIdstring""ABS ClientID used to authenticate with user-assigned managed identity. Optional - used for user-assigned managed identity authentication.
quiver.absGeoCollectionsStorage.absContainerstring""ABS container name to store geo collection files
quiver.absGeoCollectionsStorage.absContainerPrefixstring""Custom container prefix
quiver.absGeoCollectionsStorage.absDfsStorageAuthoritystring""ABS DFS authority override - defaults to “.dfs.core.windows.net”
quiver.absGeoCollectionsStorage.absDfsStorageSchemestring""ABS DFS scheme override - defaults to “https”
quiver.absGeoCollectionsStorage.authTypestring""Authentication type (“azure_tokens” | “azure_default”), default “azure_default” “azure_tokens”: Use explicit credentials (absAccountKey must be provided). These are separate from datasource files storage credentials - no fallback. “azure_default”: Use Azure default credential chain (Workload Identity, managed identity, etc.)
quiver.advertiseFlightPortstring"16001"Note that quiver is an internal name for the FlexQuery service. Port which quiver advertises to clients. Client will use this port when connecting.
quiver.cacheCountLimitint5000
quiver.clientMaxBatchSizeint3145728Override the maxBatchSize for Quiver clients in bytes. Defaults to 3MB
quiver.clientMaxInboundMessageSizeint4194304Override the maxInboundMessageSize for Quiver clients in bytes. Defaults to 4MB
quiver.clientPutEstablishingTimeoutstring""Defaults to 15000 (15s) if not set.
quiver.concurrentPutRequestsstring""Override for the maximum number of DoPut requests that can be processed concurrently (by default derived from CPU count). An increase of concurrent DoPut requests should typically be accompanied by upsize of the memory for the pods; this is because most DoPut requests also write to object storage which often comes with a per-stream overhead.
quiver.datasourceFs.analysisSampleSizeint1048576Maximal size of the sample used while analyzing a CSV file (in bytes).
quiver.datasourceFs.fullTypeDetectionbooltrueIf true, full type analysis will be run when analyzing CSV files.
quiver.datasourceFs.maxAnalysisRunsint1Maximal number of analysis runs we allow to run in parallel (per node).
quiver.datasourceFs.maxConnectionsint8Maximal number of open connections to the FS datasource
quiver.datasourceFs.maxFileColumnsint1000Maximal number of columns we allow the users to use in a CSV file.
quiver.datasourceFs.maxFileSizeint20971520Maximal size of a CSV file we allow the users to use (in bytes).
quiver.datasourceFs.maxFileSizeTotalint209715200Maximal size of all the CSV files we allow the users to use per organization (in bytes).
quiver.datasourceFs.poolReplicasint2Number of pool replicas of the datasource service
quiver.datasourceFs.storageTypestring"S3"Type of the storage where to store datasource files (“FS” | “S3” | “ABS”).
quiver.durableStorageTypestring""Type of storage where to store durable caches ("" or “S3”, “FS”, or “ABS”). Any change of this value requires ETCD wipe to refresh configuration!
quiver.enableMetadataManipulationboolfalseWhen true, enables Arrow Flight schema metadata updates during DO_PUT needed for Partial Data. This is a rollout toggle and it will be removed in the near future.
quiver.etcdRegistrationTtlstring""Seconds how long can a FlexQuery node go without refreshing its registration in etcd (empty = default 30)
quiver.extraEnvVarsCachelist[]
quiver.extraEnvVarsDatasourcelist[]
quiver.extraEnvVarsMllist[]
quiver.extraEnvVarsPolicylist[]
quiver.extraEnvVarsXtablist[]Additional environment variables for xtab and cache deployments for example: extraEnvVarsXtab: [{"name":"QUIVER_FOO","value":"1"}]
quiver.flightDriver.maxSchemaMetadataBytesint4096Maximal size of flight schema metadata of the flights coming into the flight data source
quiver.fsDatasourceFsStorage.storageClassNamestring""External storage class name providing ReadWriteMany accessMode
quiver.fsDatasourceFsStorage.storageSizestring"1Gi"Size of the datasource storage volume
quiver.fsDurableStorage.storageClassNamestring""External storage class name providing ReadWriteMany accessMode (maximum cache storage size taken from resultCache.totalCacheLimit)
quiver.fsGeoCollectionsStorage.storageClassNamestring""External storage class name providing ReadWriteMany accessMode
quiver.fsGeoCollectionsStorage.storageSizestring"1Gi"Size of the datasource storage volume
quiver.geoCollections.maxConnectionsint8Maximal number of open connections to the geo collections datasource
quiver.geoCollections.poolReplicasint2Number of pool replicas of the datasource service
quiver.geoCollections.storageTypestring"S3"Type of the storage where to store datasource files (“FS” | “S3” | “ABS”)
quiver.glibcTunablesstring"glibc.malloc.trim_threshold=128:glibc.malloc.arena_max=2"
quiver.image.namestring"quiver"
quiver.limitFlightCountint50000
quiver.optimizations.etcd_disk_flight_catalogboolfalse
quiver.optimizations.etcd_init_page_sizeint5000
quiver.podAnnotations.prometheus.io/pathstring"/"
quiver.podAnnotations.prometheus.io/scrapestring"true"
quiver.podDisruptionBudgetobject{"maxUnavailable":1,"minAvailable":""}define PodDisruptionBudget
quiver.podLabelsobject{}
quiver.podManagementPolicystring"Parallel"
quiver.podMonitor.pathstring"/"
quiver.podMonitor.portstring"metrics"
quiver.putQueueSizestring""Size of DoPut queue, DoPut requests are parked here if max DoPut concurrency is reached OR if the request was throttled because it reached the putThrottlingKeyLimit. (default queue size is 256)
quiver.putThrottlingKeyLimitstring""Override for the maximum number of DoPut requests with same throttling key (throttling key = organization) that can be processed concurrently. If not specified, there is no limit and a single throttling key can run as many DoPut requests as there are available slots (see concurrentPutRequests above). If specified, the limit must be a positive number. It may be equal or greater than the total number of available DoPut slots - in that case it will have no effect. (default is no limit)
quiver.rawExportsFs.maxConnectionsint8Maximal number of open connections to the raw exports datasource
quiver.rawExportsFs.poolReplicasint2Number of pool replicas of the datasource service
quiver.rawExportsFs.prefixstring"raw-exports"Prefix for the raw exports storage inside the export storage
quiver.replicaCountobject{}replica count overrides for FlexQuery compoments
quiver.resources.cacheobject{"limits":{"cpu":"300m","memory":"768Mi"},"requests":{"cpu":"100m","memory":"256Mi"}}container resources
quiver.resources.datasourceobject{"limits":{"cpu":"1500m","memory":"768Mi"},"requests":{"cpu":"400m","memory":"384Mi"}}container resources
quiver.resources.mlobject{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"200m","memory":"256Mi"}}container resources
quiver.resources.policyobject{"limits":{"cpu":"300m","memory":"768Mi"},"requests":{"cpu":"100m","memory":"256Mi"}}container resources
quiver.resources.xtabobject{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"200m","memory":"256Mi"}}container resources
quiver.s3DatasourceFsStorage.authTypestring""Authentication type (“aws_tokens” | “aws_default” | “none”), default “aws_default”
quiver.s3DatasourceFsStorage.endpointOverridestring""If non-empty, override S3 host with a connection string such as “localhost:3000”
quiver.s3DatasourceFsStorage.s3AccessKeystring""AWS secret access key of IAM account with access to S3 bucket
quiver.s3DatasourceFsStorage.s3Bucketstring""AWS bucket name to store datasource files
quiver.s3DatasourceFsStorage.s3BucketPrefixstring""Custom bucket prefix
quiver.s3DatasourceFsStorage.s3Regionstring""AWS region, default “us-east-1”
quiver.s3DatasourceFsStorage.s3SecretKeystring""AWS access key id of IAM account with access to S3 bucket
quiver.s3DatasourceFsStorage.schemestring""S3 connection transport, default “https”
quiver.s3DurableStorage.authTypestring""Authentication type (“aws_tokens” | “aws_default” | “none”), default “aws_default”
quiver.s3DurableStorage.durableS3WritesInProgressstring""Maximum number of write streams to S3 (empty = default)
quiver.s3DurableStorage.endpointOverridestring""If non-empty, override S3 host with a connect string such as “localhost:3000”
quiver.s3DurableStorage.s3AccessKeystring""AWS secret access key of IAM account with access to S3 bucket
quiver.s3DurableStorage.s3Bucketstring""AWS bucket name to store caches
quiver.s3DurableStorage.s3BucketPrefixstring""Custom bucket prefix
quiver.s3DurableStorage.s3Regionstring""AWS region, default “us-east-1”
quiver.s3DurableStorage.s3SecretKeystring""AWS access key id of IAM account with access to S3 bucket
quiver.s3DurableStorage.schemestring""S3 connection transport, default “https”
quiver.s3GeoCollectionsStorage.authTypestring""Authentication type (“aws_tokens” | “aws_default” | “none”), default “aws_default” “aws_tokens”: Use explicit credentials (s3AccessKey and s3SecretKey must be provided). These are separate from datasource files storage credentials - no fallback. “aws_default”: Use AWS default credential chain (IAM roles, instance profiles, env vars)
quiver.s3GeoCollectionsStorage.endpointOverridestring""If non-empty, override S3 host with a connection string such as “localhost:3000”
quiver.s3GeoCollectionsStorage.s3AccessKeystring""AWS access key ID for geoCollections storage (REQUIRED if authType is “aws_tokens”). These credentials are separate from datasource files storage credentials. If authType is “aws_default” (or empty), uses AWS default credential chain (IAM roles, env vars, etc.) and these explicit credentials are not used.
quiver.s3GeoCollectionsStorage.s3Bucketstring""AWS bucket name to store geo collection files
quiver.s3GeoCollectionsStorage.s3BucketPrefixstring""Custom bucket prefix
quiver.s3GeoCollectionsStorage.s3Regionstring""AWS region, default “us-east-1”
quiver.s3GeoCollectionsStorage.s3SecretKeystring""AWS secret access key for geoCollections storage (REQUIRED if s3AccessKey is set). These credentials are separate from datasource files storage credentials.
quiver.s3GeoCollectionsStorage.schemestring""S3 connection transport, default “https”
quiver.serverCriticalRssGraceint15Grace period, in seconds, for which the server’s RSS usage may remain in critical state (90% memory used)
quiver.serverFlightDrainTimeoutstring""Set a timeout in seconds that the server waits for in-progress flights to end when shutting down. You should set it with the longest possible flight operation (most likely execution result upload) in mind.
quiver.serverMallocTrimIntervalint5Interval in seconds influencing how often does server call malloc_trim() which returns unused memory to system
quiver.service.flightPortint16001
quiver.service.liveness.initialDelaySecondsint10
quiver.service.liveness.pathstring"/live"
quiver.service.liveness.periodSecondsint15
quiver.service.liveness.portint8877
quiver.service.liveness.timeoutSecondsint4
quiver.service.metricsPortint16101
quiver.service.mlServiceNamestring"dataframe-ml-svc"
quiver.service.namestring"quiver"
quiver.service.readiness.initialDelaySecondsint5
quiver.service.readiness.pathstring"/ready"
quiver.service.readiness.periodSecondsint15
quiver.service.readiness.portint8877
quiver.service.readiness.timeoutSecondsint2
quiver.service.typestring"ClusterIP"
quiver.service.xtabServiceNamestring"dataframe-svc"
quiver.sslCertFilestring""
quiver.storage.cache.diskCachePathstring"/quiver/cache/data"
quiver.storage.cache.diskCacheSizestring"900Mi"
quiver.storage.cache.diskSizestring"1Gi"
quiver.storage.serverWorkDirstring"/quiver/server/data"
quiver.storage.serverWorkDirSizestring"256Mi"
rawExport.endToEndTimeoutMarginMsint90000Added to timeoutMs to form the export-controller end-to-end deadline (timeoutMs + this) that marks a stuck export TIMEOUT so it can’t hang. The client normally decides the outcome; keep this deadline above the gdc-ui client poll timeout so this only ever acts as a server-side backstop.
rawExport.timeoutMsint300000How long in milliseconds a raw export’s query + result streaming may run. Read by the sql-executor SqlCanceller (cancels the query and fails the export when exceeded) and by export-controller’s first-chunk wait; must stay equal.
redis-ha.exporter.enabledbooltrueenable redis metrics exporter
redis-ha.exporter.imagestring"oliver006/redis_exporter"set to repository in local registry for air-gapped installations
redis-ha.image.repositorystring"redis"set to repository in local registry for air-gapped installations
redis-ha.redis.config.maxmemorystring"100m"This value should be tuned according to the real load. It should be set to 75 - 80% of the total memory (resources.limits.memory).
redis-ha.redis.config.maxmemory-policystring"allkeys-lru"
replicaCountint2
resources.limits.cpustring"500m"Maximum CPU timeshare per pod
resources.limits.memorystring"500Mi"Maximum memory per pod
resources.requests.cpustring"150m"Scheduled CPU timeshare per pod
resources.requests.memorystring"250Mi"Scheduled memory per pod
resultCache.actuator.portint9041
resultCache.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
resultCache.gracefulShutdownTimeoutSecondsint180
resultCache.grpcShutdownGracePeriodSecondsint20gRPC drain budget for this service’s unary RPC traffic (status/metadata lookups), kept small and independent of gracefulShutdownTimeoutSeconds above. Spring runs the gRPC-drain SmartLifecycle phase and the Pulsar-consumer-drain SmartLifecycle phase sequentially, each with its own full timeout budget - they do not share one. terminationGracePeriodSeconds for this service is computed to cover both (see gooddata-common.terminationGracePeriodSecondsWithGrpcDrain in _springboot.tpl), so raising this value also requires raising terminationGracePeriodSeconds accordingly.
resultCache.image.namestring"result-cache"
resultCache.jvmOptionsstring"-XX:ReservedCodeCacheSize=60M -Xms1100m -Xmx1100m -XX:MaxMetaspaceSize=180M"Custom JVM options
resultCache.kedaAutoscalingobject{"behavior":{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Percent","value":25}],"stabilizationWindowSeconds":1800},"scaleUp":{"policies":[{"periodSeconds":60,"type":"Pods","value":2}],"stabilizationWindowSeconds":60}},"enabled":null}KEDA autoscaling opt-in. enabled: null inherits the global kedaAutoscaling master switch; policy/minReplicaCount resolve as documented in the global block. NOTE: monitor Redis connected_clients vs maxclients as replicas grow.
resultCache.livenessProbe.initialDelaySecondsint30
resultCache.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
resultCache.podLabelsobject{}
resultCache.pulsar.cacheSettingsBootstrap.messageTTLint300
resultCache.pulsar.cacheSettingsBootstrap.topicstring"cache-settings.bootstrap"
resultCache.pulsar.cacheSettingsChange.deadLetter.topicstring"cache-settings.change.DLQ"
resultCache.pulsar.cacheSettingsChange.topicstring"cache-settings.change"
resultCache.pulsar.executionFinish.maxConcurrentMessagesint64
resultCache.pulsar.executionFinish.messageTTLint300
resultCache.pulsar.executionFinish.topicstring"execution.finish"
resultCache.pulsar.invalidation.enabledbooltrue
resultCache.pulsar.invalidation.intervalint5
resultCache.pulsar.invalidation.processingThreadsint1
resultCache.pulsar.invalidation.rateint3
resultCache.pulsar.invalidation.timeoutint500
resultCache.pulsar.resultXtab.deadLetter.topicstring"result.xtab.DLQ"
resultCache.pulsar.resultXtab.messageTTLint300
resultCache.pulsar.resultXtab.topicstring"result.xtab"
resultCache.pulsar.sqlExecutorCancel.messageTTLint300
resultCache.pulsar.sqlExecutorCancel.topicstring"sql.cancel"
resultCache.pulsar.sqlExecutorRaw.messageTTLint600
resultCache.pulsar.sqlExecutorRaw.topicstring"sql.select.raw"
resultCache.rawExecutionFlightCopyTimeoutMsint60000Timeout in milliseconds for the copying of existing execution flights to the raw execution storage.
resultCache.readinessProbe.initialDelaySecondsint30
resultCache.resourcesobject{"limits":{"cpu":"750m","memory":"1555Mi"},"requests":{"cpu":"100m","memory":"1330Mi"}}container resources
resultCache.service.externalPortint9040
resultCache.service.grpcExternalPortint6567
resultCache.service.grpcInternalPortint6567
resultCache.service.internalPortint9040
resultCache.service.namestring"result-cache"
resultCache.service.typestring"ClusterIP"
resultCache.startupProbe.initialDelaySecondsint30
resultCache.throttleobject{"enabled":false}Quiver throttle kill switch: when true, the bounded pull consumer + adaptive gate own result.xtab post-processing instead of the original push consumer. Drives both PULSAR_CONSUMERS_RESULT_ENABLED (negated) and QUIVER_THROTTLE_ENABLED from this one value.
resultCache.totalCacheLimitint34359738368
resultCache.workspaceBaselineCacheint0
resultCache.workspaceBaselineFlightCountint0
scanModel.actuator.portint9061
scanModel.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
scanModel.image.namestring"scan-model"
scanModel.jvmOptionsstring"-XX:ReservedCodeCacheSize=90M -Xms110m -Xmx110m -XX:MaxMetaspaceSize=130M"Custom JVM options
scanModel.livenessProbe.initialDelaySecondsint30
scanModel.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
scanModel.podLabelsobject{}
scanModel.readinessProbe.initialDelaySecondsint30
scanModel.resourcesobject{"limits":{"cpu":"500m","memory":"560Mi"},"requests":{"cpu":"100m","memory":"300Mi"}}container resources
scanModel.service.externalPortint9060
scanModel.service.internalPortint9060
scanModel.service.namestring"scan-model"
scanModel.service.typestring"ClusterIP"
scanModel.startupProbe.initialDelaySecondsint30
securityContextobject{}Kubernetes Security Context settings.
service.etcd.headlessHostslist["host1","host2"]If you have ETCD deployed externally, set headlessHosts to list of fully qualified names of ETCD headless hosts. Used only when useInternalGDEtcd: false otherwise let it empty.
service.etcd.portint2379If you have ETCD deployed externally, set port to a port of external ETCD. Used only when useInternalGDEtcd: false.
service.postgres.existingSecretstring""You can define your own existing secret here containing postgresql-password key with the actual password.
service.postgres.hoststring""Here you should define basic parameters for connecting to external, Postgresql-compatible DB engine (like RDS) where metadata and application configuration will be stored.
service.postgres.passwordstring"topsecret"
service.postgres.portint5432
service.postgres.usernamestring"postgres"
service.pulsar.brokerPortint6650
service.pulsar.hoststring"pulsar-broker.pulsar"If you have Apache Pulsar deployed externally, set host to fully qualified name of the broker. For default setup, when Pulsar is deployed to Kubernetes cluster using Helm chart, using pattern -broker. should be OK and this value doesn’t need to be changed.
service.pulsar.wsPortint8080
service.redis.client.socket.keepalive.countint3Time in seconds between subsequent keepalive packets
service.redis.client.socket.keepalive.enabledbooltrueEnables TCP keepalive for Redis client
service.redis.client.socket.keepalive.idleint30Time in seconds after which the first keepalive packet is sent
service.redis.client.socket.keepalive.intervalint10Time in seconds after which the connection is considered dead
service.redis.client.socket.tcpUserTimeoutint60TCP user timeout in seconds, recommended value is computed from keep alive: idle + (count * interval)
service.redis.clusterModeboolfalseWhen true, it will use Redis cluster protocol for communication. Useful for HA deployment.
service.redis.existingSecretstring""You can define your own existing secret here containing redis-password key with the actual password
service.redis.hostslist[]Used when using external Redis service (like Elasticache on AWS, Memorystore on GCP or so). Format is a list of hostnames where the Redis is running.
service.redis.passwordstring""Password for accessing Redis if the Redis authentication is turned on
service.redis.portint6379
service.redis.useSSLboolfalseUse SSL for communication with Redis cache
serviceAccount.annotationsobject{}Optional annotations for a service account. Useful for IAM role assignment.
serviceAccount.createbooltrueSpecifies whether a service account should be created.
serviceAccount.nameboolnilThe name of the service account to use. If not set and create is true, a name is generated using the fullname template.
settings.agGridTokenstring"Using_this_{AG_Grid}_Enterprise_key_{AG-091374}_in_excess_of_the_licence_granted_is_not_permitted___Please_report_misuse_to_legal@ag-grid.com___For_help_with_changing_this_key_please_contact_info@ag-grid.com___{GoodData_Corporation}_is_granted_a_{Single_Application}_Developer_License_for_the_application_{GoodData}_only_for_{10}_Front-End_JavaScript_developers___All_Front-End_JavaScript_developers_working_on_{GoodData}_need_to_be_licensed___{GoodData}_has_been_granted_a_Deployment_License_Add-on_for_{14}_Production_Environments___This_key_works_with_{AG_Grid}_Enterprise_versions_released_before_{11_August_2026}____[v3]_[01]_MTc4NjQwMjgwMDAwMA==a7c6b09191eb78185aae796ea45282aa"AG Grid enterprise token for grid features
spicedbobject{"config":{"datastoreEngine":"postgres","dispatch":{"enabled":true,"hashringReplicationFactor":100,"hashringSpread":1},"drainDelaySeconds":5,"gc":{"interval":"","maxOperationTime":"","window":""},"logLevel":"info","replicas":3,"shutdownGracePeriodSeconds":5},"database":{"existingSecret":"","existingSecretKey":"postgresql-password","name":"spicedb","password":"","pool":{"maxIdleTime":"5m","maxLifeTime":"30m","read":{"maxOpen":10,"minOpen":2},"write":{"maxOpen":5,"minOpen":1}},"user":""},"grpc":{"existingSecret":"","existingSecretKey":"preshared_key","presharedKey":"localdevelopmentkey"},"image":{"name":"spicedb","repositoryPrefix":"authzed"},"mode":"ENABLED","podDisruptionBudget":{"maxUnavailable":1,"minAvailable":""},"podMonitor":{"enabled":false,"path":"/metrics","port":"metrics"},"reconcile":{"cron":"-"},"resources":{"limits":{"cpu":"1000m","memory":"512Mi"},"requests":{"cpu":"100m","memory":"256Mi"}}}Deploy and override default PrometheusRule CRD for a Prometheus Operator with specific rules https://github.com/prometheus-operator/prometheus-operator prometheusRule: enabled: false namespace: monitoring labels: {} rules: [] SpiceDB configuration — applicable only when deploySpiceDB: true. Datastore credentials follow the automation.database model (see database.* below).
spicedb.config.datastoreEnginestring"postgres"SpiceDB datastore engine (“postgres”, “cockroachdb”, “mysql”, “spanner”, “memory”)
spicedb.config.dispatchobject{"enabled":true,"hashringReplicationFactor":100,"hashringSpread":1}Clustered dispatch. Each pod serves dispatch RPCs on :50053 and forms a consistent-hash ring with its peers (discovered via the kubernetes:/// resolver watching the Service Endpoints), so subproblems route to the owning node and share its cache. Requires the dispatch RBAC (ServiceAccount/Role/RoleBinding) this chart renders when enabled.
spicedb.config.dispatch.hashringReplicationFactorint100Points each node occupies on the hashring
spicedb.config.dispatch.hashringSpreadint1Number of nodes a single key may spread across
spicedb.config.drainDelaySecondsint5preStop sleep so the Service deregisters the pod’s endpoint before SIGTERM (zero-downtime rollouts).
spicedb.config.gcobject{"interval":"","maxOperationTime":"","window":""}SpiceDB datastore garbage collection. Shorten the window on high-churn envs (e.g., CI).
spicedb.config.logLevelstring"info"SpiceDB log level
spicedb.config.replicasint3Number of SpiceDB replicas
spicedb.config.shutdownGracePeriodSecondsint5Seconds SpiceDB drains in-flight gRPC after SIGTERM (SPICEDB_GRPC_SHUTDOWN_GRACE_PERIOD).
spicedb.database.existingSecretstring""Existing Secret with the custom database.user password (takes precedence over password).
spicedb.database.existingSecretKeystring"postgresql-password"Key within database.existingSecret.
spicedb.database.namestring"spicedb"SpiceDB database name
spicedb.database.passwordstring""Password for a custom database.user, when database.existingSecret is unset. Prefer existingSecret on a fresh installation.
spicedb.database.poolobject{"maxIdleTime":"5m","maxLifeTime":"30m","read":{"maxOpen":10,"minOpen":2},"write":{"maxOpen":5,"minOpen":1}}Postgres connection pool. Total Postgres connections SpiceDB requires ≈ replicas × (read.maxOpen + write.maxOpen) — sized below SpiceDB’s own defaults (read 20 / write 10) to keep the footprint modest. Observed active concurrency is only a few connections per pod; the rest are held, so low minOpen releases idle connections and maxOpen is burst headroom. Raise read.maxOpen for high-authz-load deployments if you see pgxpool_empty_acquire.
spicedb.database.pool.maxLifeTimestring"30m"Recycle/release pooled connections (read + write). Empty = SpiceDB default.
spicedb.database.userstring""Runtime database user. When empty, connects as service.postgres.username and the database.* fields below are ignored.
spicedb.grpc.existingSecretstring""Existing Secret holding the preshared key (takes precedence over presharedKey).
spicedb.grpc.existingSecretKeystring"preshared_key"Key within grpc.existingSecret.
spicedb.grpc.presharedKeystring"localdevelopmentkey"Pre-shared key value. This default is a local-dev key — override it for any non-dev environment, or supply grpc.existingSecret instead.
spicedb.imageobject{"name":"spicedb","repositoryPrefix":"authzed"}SpiceDB workload image.
spicedb.modestring"ENABLED"SpiceDB authorization mode for metadata-api. Only takes effect when deploySpiceDB is true. ENABLED: SpiceDB runs alongside metadata (use enableSpiceDBLive flag to toggle which is authoritative). FULL: SpiceDB is the sole authoritative source, no metadata cross-check.
spicedb.podDisruptionBudgetobject{"maxUnavailable":1,"minAvailable":""}PodDisruptionBudget for the SpiceDB Deployment. With 3 replicas this keeps a node drain from taking the whole authorization service down at once.
spicedb.podMonitorobject{"enabled":false,"path":"/metrics","port":"metrics"}Prometheus PodMonitor scraping SpiceDB’s metrics endpoint (container port 9090). Rendered only when enabled and the monitoring.coreos.com/v1 CRD is present.
spicedb.reconcile.cronstring"-"Cron expression (UTC, Spring 6-field: sec min hour day month weekday) for the per-org SpiceDB reconcile sweep in metadata-api. Default is disabled Once per 12 hours example: 0 0 12 * * * You can debug your expressions at https://crontab.cronhub.io
spicedb.resourcesobject{"limits":{"cpu":"1000m","memory":"512Mi"},"requests":{"cpu":"100m","memory":"256Mi"}}container resources for the SpiceDB Deployment
springProfilesstring"default"
sqlExecutor.actuator.portint9101
sqlExecutor.enableHikariMonitoringbooltrueWhether to enable HikariCP monitoring: true | false
sqlExecutor.extraDriversInitContainerstring""see documentation how to mount the image with extra drivers to GoodData.CN
sqlExecutor.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
sqlExecutor.gdstorage.maxConnectionsPerDataSourceint2Maximal number of connections per data source running on the GDSTORAGE data source
sqlExecutor.gracefulShutdownTimeoutSecondsint180
sqlExecutor.grpcShutdownGracePeriodSecondsint20gRPC drain budget for this service’s unary RPC traffic (small/label-elements lookups), kept small and independent of gracefulShutdownTimeoutSeconds above. Spring runs the gRPC-drain SmartLifecycle phase and the Pulsar-consumer-drain SmartLifecycle phase sequentially, each with its own full timeout budget - they do not share one. terminationGracePeriodSeconds for this service is computed to cover both (see gooddata-common.terminationGracePeriodSecondsWithGrpcDrain in _springboot.tpl), so raising this value also requires raising terminationGracePeriodSeconds accordingly.
sqlExecutor.image.namestring"sql-executor"
sqlExecutor.jvmOptionsstring"-XX:ReservedCodeCacheSize=110M -Xms460m -Xmx460m -XX:MaxMetaspaceSize=256M"Custom JVM options
sqlExecutor.livenessProbe.initialDelaySecondsint30
sqlExecutor.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
sqlExecutor.podLabelsobject{}
sqlExecutor.pulsar.dataSourceChange.topicstring"data-source.change"
sqlExecutor.pulsar.sqlCancel.topicstring"sql.cancel"
sqlExecutor.pulsar.sqlSelect.deadLetter.topicstring"sql.select.DLQ"
sqlExecutor.pulsar.sqlSelect.topicstring"sql.select"
sqlExecutor.pulsar.sqlSelectRaw.maxConcurrentMessagesint4
sqlExecutor.pulsar.sqlSelectRaw.topicstring"sql.select.raw"
sqlExecutor.readinessProbe.initialDelaySecondsint30
sqlExecutor.resourcesobject{"limits":{"cpu":"500m","ephemeral-storage":"500Mi","memory":"1356Mi"},"requests":{"cpu":"100m","ephemeral-storage":"500Mi","memory":"550Mi"}}container resources
sqlExecutor.service.externalPortint6570
sqlExecutor.service.internalPortint6570
sqlExecutor.service.namestring"sql-executor"
sqlExecutor.service.typestring"ClusterIP"
sqlExecutor.startupProbe.initialDelaySecondsint30
tabularExporter.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
tabularExporter.image.namestring"tabular-exporter"
tabularExporter.limits.pdf.maxRowsstring"10_000"If set, reports that end up having more rows than this will not be possible to export.
tabularExporter.optimizations.AFMExecPageSizeint1000The data for export will be fetched from the backend in pages of this many rows. This should be set so that the worst case scenario of results having platform_limits.max_column_size columns still fit in the current size limit defined in platform_limits.max_afm_result_page_bytes.
tabularExporter.optimizations.exportChunkBytesstring"2_097_152"The data of the export result gets streamed in a chunked manner. These chunks will have this many bytes at most.
tabularExporter.optimizations.glibcTunablesstring"glibc.malloc.trim_threshold=128:glibc.malloc.arena_max=2"
tabularExporter.optimizations.mallocTrimIntervalint30
tabularExporter.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
tabularExporter.podLabelsobject{}
tabularExporter.podMonitor.pathstring"/"
tabularExporter.podMonitor.portstring"metrics"
tabularExporter.resourcesobject{"limits":{"cpu":"200m","memory":"250Mi"},"requests":{"cpu":"50m","memory":"150Mi"}}container resources
tabularExporter.service.externalPortint6789
tabularExporter.service.internalPortint6789
tabularExporter.service.metricsPortint9132
tabularExporter.service.namestring"tabular-exporter"
tabularExporter.service.typestring"ClusterIP"
teiEmbedder.healthCheck.failureThresholdint3
teiEmbedder.healthCheck.initialDelaySecondsint60
teiEmbedder.healthCheck.periodSecondsint30
teiEmbedder.healthCheck.timeoutSecondsint10
teiEmbedder.image.namestring"tei-embedder"
teiEmbedder.metricsPortint9000
teiEmbedder.podMonitor.intervalstring"20s"
teiEmbedder.podMonitor.pathstring"/metrics"
teiEmbedder.podMonitor.portstring"metrics"
teiEmbedder.podMonitor.scrapeTimeoutstring"10s"
teiEmbedder.resources.limits.cpustring"4000m"
teiEmbedder.resources.limits.memorystring"2048Mi"
teiEmbedder.resources.requests.cpustring"500m"
teiEmbedder.resources.requests.memorystring"1536Mi"
teiEmbedder.service.namestring"tei-embedder"
teiEmbedder.service.portint8080
teiReranker.healthCheck.failureThresholdint3
teiReranker.healthCheck.initialDelaySecondsint60
teiReranker.healthCheck.periodSecondsint30
teiReranker.healthCheck.timeoutSecondsint10
teiReranker.image.namestring"tei-reranker"
teiReranker.metricsPortint9000
teiReranker.podMonitor.intervalstring"20s"
teiReranker.podMonitor.pathstring"/metrics"
teiReranker.podMonitor.portstring"metrics"
teiReranker.podMonitor.scrapeTimeoutstring"10s"
teiReranker.resources.limits.cpustring"1000m"
teiReranker.resources.limits.memorystring"1536Mi"
teiReranker.resources.requests.cpustring"500m"
teiReranker.resources.requests.memorystring"1024Mi"
teiReranker.service.namestring"tei-reranker"
teiReranker.service.portint8080
telemetry.enabledbooltrueIf set to true, deployed services will report telemetry data to enabled providers
telemetry.providers.amplitude.apiKeys.aiProjectApiKeystring"f2db721bd53a2b2bd4d3b4c653f368ab"Amplitude API key for AI telemetry
telemetry.providers.amplitude.apiKeys.gdCommonApiKeystring"aec86aa23103cff2d04805fd7cab507f"Amplitude API key for GD Common telemetry
telemetry.providers.amplitude.enabledbooltrueIf set to true, deployed services will report telemetry data to https://api.amplitude.com/2/httpapi
telemetry.providers.amplitude.reportingEndpointstring"/tlm/amp"Optional reporting endpoint for proxying telemetry through API gateway
telemetry.providers.matomo.enabledbooltrueIf set to true, deployed services will report telemetry data to https://matomo.anywhere.gooddata.com/matomo.php
telemetry.providers.matomo.reportingEndpointstring"/tlm/mat"Optional reporting endpoint for proxying telemetry through API gateway
telemetrySiteIDstring"2"Backwards compatibility for legacy telemetry configuration
temporalobject{"host":"temporal-server-frontend.temporal.svc.cluster.local","port":7233}Global Temporal server configuration
tolerationslist[]Kubernetes tolerations; applies to all GoodData.CN Pods tolerations: - key: “example-key” operator: “Exists” effect: “NoSchedule”
tools.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
tools.image.namestring"tools"
tools.podLabelsobject{}
tools.replicaCountint1
tools.resourcesobject{"limits":{"cpu":"200m","memory":"200Mi"},"requests":{"cpu":"10m","memory":"5Mi"}}container resources
topologySpreadConstraints.enabledboolfalseenables topologySpreadConstraints for all GoodData.CN Pods
topologySpreadConstraints.maxSkewint1Degree of uneven pod distribution
topologySpreadConstraints.topologyKeystring"kubernetes.io/hostname"Topology key
topologySpreadConstraints.whenUnsatisfiablestring"ScheduleAnyway"What to do when constraint is not met. Either “DoNotSchedule” or “ScheduleAnyway”
uiServicesPrefixstring""Prefix for UI services. If not set, defaults to release fullname. Use this to point to UI services deployed separately (e.g., from UI component chart) Example: “tiger-ui” when UI component uses its own HelmRelease with name “tiger-ui”
useInternalGDEtcdbooltrueIf set to true, Quiver will use the internal custom etcd if customEtcd.enabled is also true. If customEtcd.enabled is false, tries to use external etcd instead (configured in service.etcd section).
visualExporterProxy.image.namestring"export-proxy"
visualExporterProxy.permittedDestinationsstring""Space-delimited list of RFC1918 IPs or CIDRs where visual exporter can connect For security reasons, exporter can’t connect to hosts belonging to the following ranges: 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 If your organizations have IP address from these ranges, you need to add this IP(s) to make visual exports (PDF) working. Example: permittedDestinations: “10.1.2.3/32 172.16.0.0/24”
visualExporterProxy.resourcesobject{"limits":{"cpu":"100m","memory":"215Mi"},"requests":{"cpu":"50m","memory":"215Mi"}}container resources
webComponents.extraEnvVarslist[]Additional environment variables for example: extraEnvVars: [{"name":"SOME_VAR","value":"some value"}]
webComponents.image.namestring"web-components"
webComponents.podDisruptionBudgetobject{"maxUnavailable":"","minAvailable":""}define PodDisruptionBudget
webComponents.podLabelsobject{}
webComponents.resourcesobject{"limits":{"cpu":"150m","memory":"35Mi"},"requests":{"cpu":"50m","memory":"15Mi"}}container resources
webComponents.service.externalPortint9800
webComponents.service.internalPortint8080
webComponents.service.namestring"web-components"
webComponents.service.typestring"ClusterIP"
Execution Limits
Releases and Version Tags