Install
Values reference
The values you set in site.yaml, the file you pass to every helm install and helm upgrade with -f. One
file serves the base chart and every product: global values apply to all of them, and the rft-base table lists
the base chart's, of which the products read objectStorage too. A product's own values, such as
signIn.existingSecret, are on the pages that use them, such as Sign-in and
Object storage; its settings and secret settings go in a values file of its own,
which its page under Product settings lists.
Every chart
| Value | Default | Description |
|---|---|---|
global.imageRegistry | registry.rigfab.com | The registry the platform's images are pulled from; set it in site.yaml to your own registry and path when you install from a mirror; see Install without internet access. The PostgreSQL image comes from global.rigfab.database.imageName instead. |
global.imagePullSecrets | [] | The image pull Secrets every pod uses, such as [{name: rigfab-pull}], which rft login --pull-secret writes. |
global.rigfab.domain | "" | The site's base domain. Each product answers on <product>.<domain>, user provisioning on scim.<domain> and the bundled object store on s3.<domain>. Required. |
global.rigfab.hosts | {} | A full hostname for a product instead of <product>.<domain>, keyed by the product's host name, such as {pattern-shop: shop.example.com}. |
global.rigfab.timezone | UTC | The time zone of the products' pods (TZ) and of their scheduled jobs, such as America/New_York. |
global.rigfab.cpuLimits | false | Give each container a CPU limit as well as its request. |
global.rigfab.gateway.parentRefs | [] | The Gateway API Gateways the products' HTTPRoutes attach to. Set it instead of ingress to route with the Gateway API. |
global.rigfab.ingress.className | "" | The IngressClass of the products' Ingresses, such as traefik or nginx. |
global.rigfab.ingress.annotations | {} | Annotations on every Ingress, such as cert-manager.io/cluster-issuer. |
global.rigfab.ingress.tls | true | Serve each Ingress over TLS with a certificate in Secret <name>-tls, which your issuer annotation fills. |
global.rigfab.caBundle.configMap | "" | A ConfigMap in rft-system and in each product's namespace with your CA certificates, such as your identity provider's or object store's: bundle.pem holds your CA and the public ones, extra.pem your CA alone. See Sign-in. |
global.rigfab.caBundle.key | bundle.pem | The key in that ConfigMap the base chart's controller reads; the products always read bundle.pem and extra.pem. |
global.rigfab.monitoring.enabled | false | Have your Prometheus scrape the products: adds a ServiceMonitor for each product, turns on CloudNativePG's database metrics and lets Prometheus through the NetworkPolicies. Needs the Prometheus Operator's CustomResourceDefinitions. |
global.rigfab.monitoring.namespace | "" | The namespace your Prometheus runs in. Required with monitoring.enabled. |
global.rigfab.monitoring.pods | {} | The labels of your Prometheus pods, which the NetworkPolicies let in. |
global.rigfab.networkPolicy.ingressFrom | [] | NetworkPolicy peers that alone may reach the products' web ports and user provisioning, such as your ingress controller's namespace. Empty lets any source reach those ports; setting it shuts out every other source. |
global.rigfab.database.instances | 1 | The PostgreSQL instances in each product's CloudNativePG cluster; 2 or more gives a standby. |
global.rigfab.database.storageClass | "" | The StorageClass of the database volumes; empty for the cluster's default. |
global.rigfab.database.imageName | ghcr.io/cloudnative-pg/postgresql:18.6-standard-trixie@sha256:39add80f5b1e573e2f6b641c66fd1a2f8dede67ca0330e870285bc1078551390 | The PostgreSQL image CloudNativePG runs, by digest; point it at your mirror's copy when you install without internet access. |
global.rigfab.database.import.host | "" | The PostgreSQL server to import products' databases from, once, when each product's database is created. See Import a database. |
global.rigfab.database.import.port | 5432 | The port that server answers on. |
global.rigfab.database.import.sslMode | require | The libpq sslmode of the import's connection. One of require, prefer, disable. |
global.rigfab.database.import.existingSecret | "" | A Secret in each importing product's namespace with the import user's password under password. |
global.rigfab.database.import.to | [] | NetworkPolicy peers that let the products' databases reach that server, such as its namespace and pods. |
global.rigfab.database.import.apps | {} | Per product, keyed by its name: the database to import and the user to read it as. Empty imports nothing. |
global.rigfab.site.privateCIDRs | [] | More address ranges your network uses privately, which the products treat as inside the site rather than the internet. |
global.rigfab.site.internetEgress | allowed | Whether the products may reach the internet. With none, every service a product needs must be listed under destinations. One of allowed, none. |
global.rigfab.site.destinations | {} | Where services on your network answer, such as identityProvider, objectStorage or cache, each with its cidrs and ports; the NetworkPolicies let the products reach only those. |
global.rigfab.site.companyName | "" | Your company's name as the products show it, in page titles, mail and wherever a product names its owner. |
global.rigfab.site.logo | "" | Your logo, a PNG of at most 64 KiB, base64-encoded (base64 -w0 logo.png), which the products that show a logo use in pages and mail. Without it they show companyName. |
global.rigfab.site.logoDark | "" | Your logo for dark backgrounds, with the same rules as logo, which needs logo too; the two together are at most 96 KiB. Without it the products show logo on a light plate in dark mode. |
global.rigfab.site.brandColor | "" | Your brand colour as #RRGGBB, which the products use for buttons, links, highlights and the focus ring in light and dark mode, and in mail; where the colour itself would be hard to read, they use a lighter or darker shade of it. Without it they use the RigFabTech blue #1F5FA8. Warnings and errors keep their own colours. |
global.rigfab.site.e2.sqlHost | "" | The host name or address of your E2 SQL Server, for the products that read E2. Give its address under destinations as e2-sql too. |
global.rigfab.site.e2.sqlPort | 1433 | The port your E2 SQL Server answers on. |
global.rigfab.site.e2.sqlDatabase | "" | The name of your E2 database on that SQL Server. |
rft-base
| Value | Default | Description |
|---|---|---|
signIn.issuer | "" | Your OpenID Connect provider's issuer, such as https://login.microsoftonline.com/<tenant>/v2.0. With signIn.entra.tenantId, leave it empty: the tenant implies it, and a different issuer fails the install. |
signIn.entra.tenantId | "" | With Microsoft Entra ID, your tenant's ID; the controller then registers each product for you. See Sign-in. |
signIn.entra.clientId | "" | The client ID of the controller's own app registration at Entra ID. |
signIn.entra.existingSecret | rft-entra | The Secret in rft-system with the controller's Entra ID credential, tls.crt and tls.key or client-secret. |
signIn.entra.namePrefix | "" | The prefix of the products' registrations at Entra ID; empty for rft- and the domain with dashes for dots, cut to 60 characters. Give each cluster its own. |
signIn.entra.assignmentRequired | true | Let only the people and groups assigned to a product sign in to it. |
signIn.entra.secretLifetimeDays | 180 | How long each product's client secret at Entra ID lasts. |
signIn.entra.rotateDaysBefore | 30 | How many days before a client secret expires the controller renews it. |
signIn.entra.roleGroups | {} | Entra ID groups to assign to products' roles, keyed by <product>.<role>, such as {pattern-shop-tracker.admin: [<GROUP_OBJECT_ID>]}. |
signIn.entra.loginURL | https://login.microsoftonline.com | Entra ID's sign-in endpoint; change it only for a national cloud. |
signIn.entra.graphURL | https://graph.microsoft.com | Microsoft Graph's endpoint; change it only for a national cloud. |
objectStorage.mode | bundled | Run the bundled SeaweedFS object store, or use your own S3-compatible store. Every product reads it too, so keep it in the one values file. See Object storage. One of bundled, external. |
objectStorage.bundled.size | 50Gi | The size of the bundled store's volume. Matches ^[0-9]+(Mi|Gi|Ti)$. |
objectStorage.bundled.storageClass | "" | The StorageClass of the bundled store's volume; empty for the cluster's default. |
objectStorage.bundled.volumeSizeLimitMB | 1024 | The size in MB at which the bundled store starts a new volume file. At least 64. |
objectStorage.bundled.host | s3 | The host name under global.rigfab.domain browsers reach the bundled store on to upload and download files; global.rigfab.hosts.s3 gives a full name instead. See Object storage. Matches ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$. |
objectStorage.bundled.public | true | Route the bundled store to browsers. With false, the products answer that browser access to files is off. |
objectStorage.bundled.resources | {requests: {cpu: 50m, memory: 256Mi, ephemeral-storage: 64Mi}, limits: {memory: 1Gi}} | The bundled store's CPU and memory requests and limits. |
objectStorage.bundled.publicResources | {requests: {cpu: 10m, memory: 64Mi, ephemeral-storage: 64Mi}, limits: {memory: 512Mi}} | The CPU and memory requests and limits of the bundled store's listener for browsers. |
objectStorage.external.endpoint | "" | Your store's HTTPS endpoint, such as https://s3.us-east-2.amazonaws.com. |
objectStorage.external.publicEndpoint | "" | The HTTPS address browsers reach your store at, when it differs from endpoint; it must forward Host unchanged and add no path. Matches ^(https://[^/]+/?)?$. |
objectStorage.external.region | "" | Your store's region. |
objectStorage.external.pathStyle | false | Address buckets by path rather than by host name, as MinIO and Ceph RGW often need. |
objectStorage.external.existingSecret | "" | A Secret in rft-system with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, which the controller creates the buckets with. |
objectStorage.external.workloadIdentity | false | Reach the store with workload identity (EKS, AKS, GKE) instead of keys. |
objectStorage.external.namePrefix | "" | The prefix of the buckets the controller creates; empty for rft- and the domain with dashes for dots, cut to 30 characters. Matches ^([a-z0-9][a-z0-9-]{0,30})?$. |
objectStorage.apps | none | Per product, keyed by its name, read by the base chart and that product: existingSecret, a Secret in the product's namespace with its own key, and with your own store bucketName, an existing bucket, or serviceAccountAnnotations for workload identity. |
directory.host | scim | The host name of user provisioning (SCIM) under global.rigfab.domain. |
directory.resources | {requests: {cpu: 10m, memory: 32Mi}, limits: {memory: 128Mi}} | The directory's CPU and memory requests and limits. |
controller.interval | 30s | How often the controller checks every product; 1s or more. |
controller.resources | {requests: {cpu: 10m, memory: 32Mi}, limits: {memory: 128Mi}} | The controller's CPU and memory requests and limits. |
networkPolicy.apiServerPorts | [443, 6443] | The ports the Kubernetes API server answers on, which the base chart's controller and directory reach. |
networkPolicy.checkInPorts | [443] | The ports the licence agent reaches the licence service on. |
licensing-agent.site.id | "" | The site ID the licence agent reports with; optional. |