Helm Chart Configuration

This page contains the complete Helm chart configuration reference for the latest version of PaletteAI.

Top-Level Sections

This section contains the top-level sections of the Helm chart in the order they appear.

Global

Refer to Configure Prometheus Agent Monitoring for guidance on configuring global.metrics, spoke-side Prometheus agents, and the Grafana dashboard link.

Feature Flags

The global.featureFlags values control deployment behavior, versioning, and default resource creation.

Flag	Type	Default	Description
versioningType	string	semantic	Definition revision versioning scheme. Accepted values are basic and semantic.
deploymentMode	string	connected	PaletteAI deployment mode. Accepted values are connected and airgap.
systemDefaultResources	boolean	true	Automatically creates the default Tenant, Project, Settings, and Compute Config resources during installation.
enableCreateSharedComputePoolOnAppDeployment	boolean	true	Allows creating a shared Compute Pool during App Deployment.
enableCreateSharedComputePoolOnModelDeployment	boolean	true	Allows creating a shared Compute Pool during Model Deployment.
enableCreateDedicatedComputePoolOnAppDeployment	boolean	true	Allows creating a dedicated Compute Pool during App Deployment.
enableCreateDedicatedComputePoolOnModelDeployment	boolean	true	Allows creating a dedicated Compute Pool during Model Deployment.
enableDeployAppToDedicatedComputePool	boolean	true	Allows App Deployment to dedicated Compute Pools.
enableDeployAppToSharedComputePool	boolean	true	Allows App Deployment to shared Compute Pools.
enableDeployModelToDedicatedComputePool	boolean	true	Allows Model Deployment to dedicated Compute Pools.
enableDeployModelToSharedComputePool	boolean	true	Allows Model Deployment to shared Compute Pools.
enableTenantScopedDeployments	boolean	true	Whether to enable Tenant-scoped App Deployments and Model Deployments. When enabled, the Canvas UI exposes the App Deployments and Model Deployments navigation menus at the Tenant level.

Use a configuration similar to the following:

```yaml title="Example global.featureFlags configuration" global: featureFlags: versioningType: semantic deploymentMode: connected systemDefaultResources: true enableCreateSharedComputePoolOnAppDeployment: true enableCreateSharedComputePoolOnModelDeployment: true enableCreateDedicatedComputePoolOnAppDeployment: true enableCreateDedicatedComputePoolOnModelDeployment: true enableDeployAppToDedicatedComputePool: true enableDeployAppToSharedComputePool: true enableDeployModelToDedicatedComputePool: true enableDeployModelToSharedComputePool: true enableTenantScopedDeployments: true

Use the following examples to tailor these options:

**Dedicated pools only**

```yaml
global:
  featureFlags:
    enableCreateSharedComputePoolOnAppDeployment: false
    enableCreateSharedComputePoolOnModelDeployment: false
    enableDeployAppToSharedComputePool: false
    enableDeployModelToSharedComputePool: false

Shared pools only

global:
  featureFlags:
    enableCreateDedicatedComputePoolOnAppDeployment: false
    enableCreateDedicatedComputePoolOnModelDeployment: false
    enableDeployAppToDedicatedComputePool: false
    enableDeployModelToDedicatedComputePool: false

Prevent automatic Compute Pool creation

global:
  featureFlags:
    enableCreateSharedComputePoolOnAppDeployment: false
    enableCreateSharedComputePoolOnModelDeployment: false
    enableCreateDedicatedComputePoolOnAppDeployment: false
    enableCreateDedicatedComputePoolOnModelDeployment: false
    enableDeployAppToDedicatedComputePool: true
    enableDeployAppToSharedComputePool: true
    enableDeployModelToDedicatedComputePool: true
    enableDeployModelToSharedComputePool: true

Disable default resource creation

global:
  featureFlags:
    systemDefaultResources: false

Use basic revision versioning

global:
  featureFlags:
    versioningType: basic

Set air-gapped deployment mode

global:
  featureFlags:
    deploymentMode: airgap

When you install PaletteAI with the appliance installer, some feature flags are managed by the installer. Refer to Deploy PaletteAI for details.

Certificates

Cleanup

FleetConfig

Spoke Cluster Values Overrides

When a spoke cluster joins the hub, the Brush controller installs the mural Helm chart on the spoke cluster. The fleetConfig.spokeValuesOverrides section allows administrators to provide global configuration for the mural chart as it is installed on every spoke cluster that joins the hub.

Each key under fleetConfig.spokeValuesOverrides, except enabled, matches a top-level section of the mural chart, such as hue or zot. The value of each key is a YAML string containing the overrides for that section. When fleetConfig.spokeValuesOverrides.enabled is set to true, the chart renders these keys into a ConfigMap named mural-spoke-values in the release namespace on the hub cluster. Brush reads this ConfigMap and merges the overrides into the Helm values of the mural release on every spoke cluster.

Example fleetConfig.spokeValuesOverrides configuration

fleetConfig:
  spokeValuesOverrides:
    enabled: true
    hue: |
      enabled: true
      clusterType: spoke
      defaultDefinitions:
        enabled: false
      ociRegistry:
        interval: 10m
    zot: |
      enabled: true

info

The cert-manager installation on spoke clusters is managed separately by Brush and is not part of the spoke cluster's mural release. Refer to Certificate Management on Spoke Clusters for details.

info

On appliance installations, the PaletteAI installer manages parts of fleetConfig.spokeValuesOverrides on top of any edits you make to the values.yaml file on the host. Refer to Appliance Installer Overrides for details. This does not apply to Helm-only installations.

Spoke Values Precedence

Brush builds the Helm values for each spoke cluster's mural release from several sources. When the same value is set in more than one source, the following order of precedence applies, from highest to lowest:

1. System overrides - Values that Brush enforces on every spoke cluster. fleetConfig.spokeValuesOverrides do not take precedence over these values; any conflicting overrides are reverted to the system defaults at runtime.

2. Spoke values overrides - The optional values you provide in fleetConfig.spokeValuesOverrides.

3. Spoke OCI registry values - The hue.ociRegistry values that Brush generates for each spoke cluster from the spoke cluster's OCI registry secret on the hub.

4. Chart defaults - The default values of the mural chart.

The system overrides keep hub-only components disabled on spoke clusters and ensure that Hue runs in spoke mode. Brush enforces the following values on every spoke cluster.

Value	Enforced Setting	Reason
global.dns.rootIngress.enabled	false	The root ingress is served by the hub cluster.
global.auditLogging.enabled	false	Audit logging is a hub-only feature.
global.instanceName	The hub's global.instanceName	Aligns spoke installations with the hub instance, when set.
alertmanager.enabled	false	Alertmanager is a hub-only component.
brush.enabled	false	Brush is a hub-only component.
canvas.enabled	false	Canvas is a hub-only component.
dex.enabled	false	Dex is a hub-only component.
fleetConfig.enabled	false	Hub and Spoke resources are managed by the hub cluster.
fleetconfig-controller.enabled	false	The FleetConfig controller is a hub-only component.
flux2.enabled	false	Flux is installed as an OCM add-on on spoke clusters.
fluxcd-manager.enabled	false	Fluxcd-manager is a hub-only component.
hue.enabled	true	Hue is required on every spoke cluster.
hue.clusterType	spoke	Hue runs in spoke mode on spoke clusters.
hue.defaultDefinitions.enabled	false	Hue does not create default Definitions on spoke clusters.
traefik.enabled	false	Traefik is a hub-only component.

Because system overrides always take precedence, you cannot use fleetConfig.spokeValuesOverrides to enable hub-only components, such as canvas or dex, on spoke clusters.

Appliance Installer Overrides

The precedence order applies to every installation method. Appliance installations add one more layer before the mural chart is installed on the hub cluster: each time the PaletteAI installer runs, it merges your edits to the values.yaml file on the host with runtime-generated values and installer system overrides, and the installer-managed values take priority over your edits. Refer to How the Installer Merges Values for the complete merge order and the full list of installer-managed fields. None of this applies to Helm-only installations, where the values you pass to Helm are used as-is.

For spoke cluster values, the installer manages the following keys of fleetConfig.spokeValuesOverrides. Edits to these keys in the values.yaml file on the host have no effect.

Key	Value Set by Installer
fleetConfig.spokeValuesOverrides.enabled	Always true
fleetConfig.spokeValuesOverrides.zot	enabled: false
fleetConfig.spokeValuesOverrides.global	dns.rootIngress.enabled: false
fleetConfig.spokeValuesOverrides.featureFlags	versioningType: semantic

Keys for other chart sections, such as hue, that you add to fleetConfig.spokeValuesOverrides in the values.yaml file on the host are preserved and merged into the final values.

On airgap appliance installations, the installer also points the brush.mural.source and brush.muralCrds.source repositories at the appliance's internal registry, so Brush pulls the mural and mural-crds charts for spoke clusters from the appliance instead of a public registry.

The installer-managed values become the mural chart values on the hub cluster, so they enter the spoke values precedence order as fleetConfig.spokeValuesOverrides. The Brush system overrides still take precedence over them on every spoke cluster.

Alertmanager

Brush

Certificate Management on Spoke Clusters

Brush installs cert-manager on every spoke cluster by default. When Brush installs cert-manager, the mural and mural-crds releases on the spoke cluster wait for cert-manager to become ready before they are installed. You can customize or disable this behavior with the brush.certManager section of the Helm values.

• brush.certManager.source - The Helm repository the cert-manager chart is pulled from, including optional basic authentication, TLS, and proxy configuration. The default repository is https://charts.jetstack.io.

• brush.certManager.release - The release name and namespace, which both default to cert-manager, as well as the reconciliation interval, timeout, CRD policy, and history limit.

• brush.certManager.values - Helm values passed to the cert-manager chart on every spoke cluster. When provided, the chart renders them into a ConfigMap named cert-manager-spoke-values, which Brush reads to configure cert-manager on each spoke cluster. The default values set crds.enabled: true so that the cert-manager chart installs its own CRDs, while the CRD policy of the release defaults to Skip.

Default brush.certManager configuration

brush:
  certManager:
    enabled: true
    source:
      repository: 'https://charts.jetstack.io'
    release:
      interval: 5m
      timeout: 20m
      name: cert-manager
      namespace: cert-manager
      crdPolicy: 'Skip'
    values:
      crds:
        enabled: true

Some clusters already have cert-manager installed, and a second installation would conflict and cause the installation on the spoke cluster to fail. To prevent Brush from installing cert-manager on any spoke cluster, set brush.certManager.enabled to false.

Disable cert-manager installation on all spoke clusters

brush:
  certManager:
    enabled: false

To skip the cert-manager installation on a single spoke cluster, apply the spectrocloud.com/cert-manager-ignore annotation to the corresponding Spoke resource on the hub cluster. Brush skips the cert-manager installation on any spoke cluster whose Spoke resource has this annotation, regardless of the annotation value.

kubectl annotate spoke <spoke-name> --namespace mural-system spectrocloud.com/cert-manager-ignore="true"

info

On appliance installations, the PaletteAI installer always sets brush.certManager.enabled to false as a system override, so Brush does not install cert-manager on any spoke cluster. Edits to brush.certManager in the values.yaml file on the host have no effect. The installer does not modify brush.certManager.source: while airgap appliance installations point the brush.mural.source and brush.muralCrds.source repositories at the appliance's internal registry, the Brush-managed cert-manager installation is disabled entirely instead. Refer to Installer-Managed Fields for the full list of fields the installer controls. Helm-only installations use the brush.certManager defaults.

Canvas

Dex

Refer to the Dex documentation for more information. To restrict a connector to a single Tenant subdomain in a multi-tenant deployment, refer to Scope Connectors per Tenant.

DexIngress

PaletteAI exposes Dex through its own ingress resource, configured in the top-level dexIngress section, instead of the ingress bundled with the Dex chart (dex.ingress).

Parameter	Description	Default
dexIngress.enabled	Enable the Dex ingress.	true
dexIngress.annotations	Annotations to be added to the ingress.	{}
dexIngress.className	Ingress class name.	traefik
dexIngress.matchAllHosts	Whether to match all hosts. If true, the host field for each host is ignored.	true
dexIngress.hosts[0].host	Ingress host.	""
dexIngress.hosts[0].paths[0].path	Ingress path.	/dex
dexIngress.hosts[0].paths[0].pathType	Ingress path type.	ImplementationSpecific
dexIngress.tls	Ingress TLS configuration.	[]

Default dexIngress configuration

dexIngress:
  enabled: true
  annotations: {}
  className: 'traefik'
  matchAllHosts: true
  hosts:
    - host: ''
      paths:
        - path: /dex
          pathType: ImplementationSpecific
  tls: []

Fleetconfig-Controller

Refer to the fleetconfig-controller repository for more information.

Flux2

Refer to the Flux documentation for more information.

Fluxcd-Manager

Hue

Traefik

PaletteAI uses Traefik as the default ingress controller. Refer to the Traefik documentation for operational details.

Zot

Refer to the Zot documentation for more information.

warning

For production deployments, enable persistent storage during initial installation. Use the migration guide only if you installed with persistence disabled and need to migrate to a Persistent Volume Claim (PVC). For configuration details and the implications of ephemeral storage, refer to Migrate Zot Registry to Persistent Storage.

Complete Values File