Reference for the values exposed by the vantage-operator and vantage-selfhosted Helm charts.
Vantage 3.0 self-hosted ships as two Helm charts: vantage-operator (the controller that watches the Vantage custom resource) and vantage-selfhosted (the chart that creates the Vantage resource and supporting manifests in your chosen install namespace). This page is the values reference for both.For field-level CRD details, see API reference. For an install-time procedure, choose Azure or Self-Managed Kubernetes.
Install matching versions of vantage-operator and vantage-selfhosted. The current self-managed procedure uses version 0.70.13 for both charts.
Installed once per cluster, into a namespace of your choice. The operator reconciles the Vantage installation defined by the Vantage custom resource.
Install exactly one instance per cluster. The chart uses cluster-scoped, non-templated resource names (manager-role ClusterRole, manager-rolebinding ClusterRoleBinding, controller-manager ServiceAccount). A second install into the same cluster (even in a different namespace) collides on these resources. See Known Limitations.
nameOverride / fullnameOverride: partially or fully override the generated resource name prefix.
manager: the operator Deployment: replicas, image, container args (leader election is enabled by default), env (pod name and namespace via the downward API), imagePullSecrets, pod and container security contexts (non-root, no privilege escalation, read-only root filesystem), resources, and scheduling (affinity, nodeSelector, tolerations).
rbacHelpers: optional admin/editor/viewer ClusterRoles for working with the vantage.abbyy.com CRDs. Disabled by default.
crd: CRD lifecycle: install the CRDs with the chart (enable) and keep them on uninstall (keep).
metrics: the RBAC-protected /metrics endpoint.
certManager: cert-manager integration for webhook and metrics endpoint certificates. Disabled by default.
prometheus: a Prometheus ServiceMonitor for the metrics endpoint. Requires the prometheus-operator in the cluster. Disabled by default.
Defaults reflect the chart’s generated values.yaml for this release. The chart itself is canonical; see Inspecting available values.
Value
Purpose
manager.replicas
Operator replica count. Default 1.
manager.image.repository / tag / pullPolicy
Operator container image. pullPolicy defaults to IfNotPresent.
manager.imagePullSecrets
Pull secrets for the operator image when your registry requires authentication, for example --set "manager.imagePullSecrets[0].name=my-pull-secret". Default []. Not needed on AKS when AcrPull is granted to the kubelet identity. See Image pull access.
Standard Kubernetes scheduling controls for the operator pod. Empty by default.
rbacHelpers.enable
Install convenience admin/editor/viewer roles for the vantage.abbyy.com CRDs. Default false.
crd.enable
Install the CRDs with the chart. Default true.
crd.keep
Keep the CRDs (and the Vantage resources they define) in the cluster when the chart is uninstalled. Default true.
metrics.enable / metrics.port
Expose the RBAC-protected /metrics endpoint. Defaults true / 8443.
certManager.enable
Use cert-manager for webhook and metrics endpoint certificates. Default false.
prometheus.enable
Create a Prometheus ServiceMonitor for the metrics endpoint. Requires the prometheus-operator in the cluster. Default false.
The operator chart does not accept any Vantage-application configuration. Application configuration lives entirely on the Vantage custom resource, which is created by the vantage-selfhosted chart.
Installed once per Vantage instance, into a namespace of your choice. This chart contains the Vantage custom resource, a ConfigMap containing the Vantage workloads data with its associated RBAC, and the Vantage-related CRDs and roles sourced from ABBYY’s upstream infrastructure repository.Most values map directly to fields on the Vantage custom resource. See the API reference for the field-level contract.
operator: pointer to the operator install (namespace and controllerManagerServiceAccount). The chart uses these values to bind the operator’s Secret-reader ClusterRole in the Vantage release namespace.
ingress: built-in Istio ingress wiring. Set enabled: false when supplying another ingress controller.
Operator controller ServiceAccount to bind to the Secret-reader ClusterRole in this Vantage release namespace. Change it only when the operator installation uses a non-default name.
ingress.tls.secretName
N/A
Required when the built-in Istio ingress is enabled. Name of the existing kubernetes.io/tls Secret in the Istio external ingress gateway namespace. Not used when ingress.enabled is false.
vantage.dnsRecord
Vantage.spec.dnsRecord
DNS hostname Vantage is reachable at.
vantage.mailFrom
Vantage.spec.mailFrom
Sender for outbound mail.
vantage.platformAdminEmail
Vantage.spec.platformAdminEmail
Initial platform admin.
vantage.secrets.azure or vantage.secrets.kubernetes
Enable the chart’s built-in ingress. Set false when using Traefik or another customer-managed ingress controller. Default true.
vantage.databaseProvider
Database engine for Vantage services. Accepted values: SqlServer (default) or PostgreSQL; case-sensitive.
vantage.secrets.azure.identityMode
One of workloadIdentity (default), podIdentity, vmManagedIdentity. See Secrets and Key Vault.
vantage.secrets.azure.userAssignedIdentityID
Client ID of the UAMI to use when identityMode is vmManagedIdentity.
vantage.secrets.azure.objects
Map of secret alias → {objectName, objectType, objectVersion} for Key Vault objects whose names don’t match the alias.
vantage.secrets.kubernetes
Use pre-existing Kubernetes Secret resources instead of Azure Key Vault. Optional objects mapping overrides default secret names.
vantage.smtp.host / port / login / password
Outbound SMTP. Used only when set; SendGrid is the default. Maps to Vantage.spec.smtp.
vantage.serviceAccountName
Default ServiceAccount for Vantage workloads. Maps to Vantage.spec.serviceAccountName. Default default. To pull images with a pull Secret, add the Secret to this ServiceAccount’s imagePullSecrets. See Azure image pull access or self-managed registry access.
vantage.storage.custom.storageClass / size
Use a Kubernetes StorageClass-backed backend instead of Azure Blob. Maps to Vantage.spec.storage.custom.
vantage.idReadingEnabled
Toggle ID reading features. Default false.
vantage.reportingEnabled
Toggle SQL Server reporting features. Default false. Must remain false with PostgreSQL.
vantage.ociMigration.enabled
Run the OCI migration job. Default true.
vantage.ociMigration.serviceAccountName
ServiceAccount the OCI migration job runs under. Maps to Vantage.spec.ociMigration.serviceAccountName. To pull the job image with a pull secret, add the secret to this ServiceAccount’s imagePullSecrets.
vantage.ociMigration.sources[]
Source registries to copy artifacts from. The documented source is sources[0].host=abbyy.jfrog.io and sources[0].repository=abbyy-docker. Set sources[].credentialsRef.name to a Secret holding registry credentials; this is the alternative to a migration job ServiceAccount for pull configuration.
The vantage-operator chart, including its values.yaml, is generated by the Kubebuilder Helm plugin; the vantage-selfhosted chart’s templates are hand-maintained. In both cases the published chart is the canonical reference for what a given version accepts. The tables on this page summarize a tested snapshot; when this page and the chart disagree, trust the chart:
# vantage-operatorhelm show values $charts_uri/vantage-operator --version $operator_version# vantage-selfhostedhelm show values $chart_uri/vantage-selfhosted --version $selfhosted_version
$charts_uri, $chart_uri, and the version variables follow the conventions in Install variables.To inspect the rendered manifests before applying:
The vantage-selfhosted chart applies a Vantage custom resource; the operator then deploys a subset of the TechCore worker charts based on spec.techcore.*. The selection happens in the operator, but the matrix below is the contract; use it to predict which workers will run for a given configuration.
Worker charts are named vtc-{version}-worker-{name}, where {version} comes from spec.techcore.version and {previousVersion} from spec.techcore.previousVersion. The version numbers are pure name prefixes; they have no semantic meaning to the operator. The set of available workers comes from the workloads ConfigMap that ABBYY publishes with each release.
Setting keepPreviousVersion: true keeps the previous TechCore version’s workers running alongside the new ones, which is useful for staged TechCore upgrades. The CRD requires previousVersion to be set when this flag is true.
Only runs when spec.techcore.keepPreviousVersion: true.
Chart pattern
Included when
worker-id-reading
Never
nn-extraction-training* (CPU and GPU)
Never (NN training only runs on the current version)
nn-nlp-model-train* (CPU and GPU)
Never (NN training only runs on the current version)
All other workers
Always
ID reading is a platform-level concern, not a TechCore concern. The flag that controls it is spec.idReadingEnabled, which lives outside spec.techcore. See the Vantage.spec reference.
The matrix only decides inclusion within whatever workers exist in the workloads ConfigMap for the selected version. Charts that are not present in the workloads for that version are simply unavailable to deploy. For example, worker-ocr-join only ships in vtc-2’s workload set today, so even with keepPreviousVersion: true and previousVersion: 2, it deploys only as vtc-2-worker-ocr-join.
