> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Helm chart values
> Reference for the values exposed by the vantage-operator and vantage-selfhosted Helm charts.
Vantage 3.0 self-hosted ships as two Helm charts: `vantage-operator` (the controller that watches the `Vantage` custom resource) and `vantage-selfhosted` (the chart that creates the `Vantage` resource and supporting manifests in your chosen install namespace). This page is the values reference for both.
For field-level CRD details, see [API reference](/vantage/self-hosted/v3.0/api-reference). For an install-time procedure, choose [Azure](/vantage/self-hosted/v3.0/providers/azure) or [Self-Managed Kubernetes](/vantage/self-hosted/v3.0/providers/self-managed).
Install matching versions of `vantage-operator` and `vantage-selfhosted`. The current self-managed procedure uses version `0.70.13` for both charts.
## `vantage-operator`
Installed once per cluster, into a namespace of your choice. The operator reconciles the Vantage installation defined by the `Vantage` custom resource.
**Install exactly one instance per cluster.** The chart uses cluster-scoped, non-templated resource names (`manager-role` ClusterRole, `manager-rolebinding` ClusterRoleBinding, `controller-manager` ServiceAccount). A second install into the same cluster (even in a different namespace) collides on these resources. See [Known Limitations](/vantage/self-hosted/v3.0/known-limitations#one-operator-instance-per-cluster).
### Top-level stanzas
* **`nameOverride` / `fullnameOverride`**: partially or fully override the generated resource name prefix.
* **`manager`**: the operator Deployment: `replicas`, `image`, container `args` (leader election is enabled by default), `env` (pod name and namespace via the downward API), `imagePullSecrets`, pod and container security contexts (non-root, no privilege escalation, read-only root filesystem), `resources`, and scheduling (`affinity`, `nodeSelector`, `tolerations`).
* **`rbacHelpers`**: optional admin/editor/viewer ClusterRoles for working with the `vantage.abbyy.com` CRDs. Disabled by default.
* **`crd`**: CRD lifecycle: install the CRDs with the chart (`enable`) and keep them on uninstall (`keep`).
* **`metrics`**: the RBAC-protected `/metrics` endpoint.
* **`certManager`**: cert-manager integration for webhook and metrics endpoint certificates. Disabled by default.
* **`prometheus`**: a Prometheus `ServiceMonitor` for the metrics endpoint. Requires the prometheus-operator in the cluster. Disabled by default.
### Notable values
Defaults reflect the chart's generated `values.yaml` for this release. The chart itself is canonical; see [Inspecting available values](#inspecting-available-values).
| Value | Purpose |
| ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `manager.replicas` | Operator replica count. Default `1`. |
| `manager.image.repository` / `tag` / `pullPolicy` | Operator container image. `pullPolicy` defaults to `IfNotPresent`. |
| `manager.imagePullSecrets` | Pull secrets for the operator image when your registry requires authentication, for example `--set "manager.imagePullSecrets[0].name=my-pull-secret"`. Default `[]`. Not needed on AKS when `AcrPull` is granted to the kubelet identity. See [Image pull access](/vantage/self-hosted/v3.0/providers/azure#image-pull-access). |
| `manager.args` | Container arguments. Default `[--leader-elect]` (leader election enabled). |
| `manager.resources` | CPU/memory requests and limits. Defaults: requests `10m` CPU / `64Mi` memory, limits `500m` CPU / `128Mi` memory. |
| `manager.affinity` / `manager.nodeSelector` / `manager.tolerations` | Standard Kubernetes scheduling controls for the operator pod. Empty by default. |
| `rbacHelpers.enable` | Install convenience admin/editor/viewer roles for the `vantage.abbyy.com` CRDs. Default `false`. |
| `crd.enable` | Install the CRDs with the chart. Default `true`. |
| `crd.keep` | Keep the CRDs (and the `Vantage` resources they define) in the cluster when the chart is uninstalled. Default `true`. |
| `metrics.enable` / `metrics.port` | Expose the RBAC-protected `/metrics` endpoint. Defaults `true` / `8443`. |
| `certManager.enable` | Use cert-manager for webhook and metrics endpoint certificates. Default `false`. |
| `prometheus.enable` | Create a Prometheus `ServiceMonitor` for the metrics endpoint. Requires the prometheus-operator in the cluster. Default `false`. |
The operator chart does **not** accept any Vantage-application configuration. Application configuration lives entirely on the `Vantage` custom resource, which is created by the `vantage-selfhosted` chart.
## `vantage-selfhosted`
Installed once per Vantage instance, into a namespace of your choice. This chart contains the `Vantage` custom resource, a ConfigMap containing the Vantage workloads data with its associated RBAC, and the Vantage-related CRDs and roles sourced from ABBYY's upstream infrastructure repository.
Most values map directly to fields on the `Vantage` custom resource. See the [API reference](/vantage/self-hosted/v3.0/api-reference) for the field-level contract.
### Top-level stanzas
* **`operator`**: pointer to the operator install (`namespace` and `controllerManagerServiceAccount`). The chart uses these values to bind the operator's Secret-reader ClusterRole in the Vantage release namespace.
* **`ingress`**: built-in Istio ingress wiring. Set `enabled: false` when supplying another ingress controller.
* **`vantage`**: the `Vantage.spec` payload: `databaseProvider`, `dnsRecord`, `mailFrom`, `platformAdminEmail`, `secrets`, `vantageVersion`, `workloads`, `idReadingEnabled`, `keda`, `ociMigration`, `reportingEnabled`, `serviceAccountName`, `smtp`, `storage`, `techcore`.
* **`observability`**: chart-rendered Prometheus `ServiceMonitor` configuration. This is a top-level stanza, not a `Vantage.spec` field.
### Required values
| Value | Maps to | Notes |
| ------------------------------------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `operator.namespace` | N/A | Where you installed `vantage-operator`. |
| `operator.controllerManagerServiceAccount` | N/A | Operator controller ServiceAccount to bind to the Secret-reader ClusterRole in this Vantage release namespace. Change it only when the operator installation uses a non-default name. |
| `ingress.tls.secretName` | N/A | Required when the built-in Istio ingress is enabled. Name of the existing `kubernetes.io/tls` Secret in the Istio external ingress gateway namespace. Not used when `ingress.enabled` is `false`. |
| `vantage.dnsRecord` | `Vantage.spec.dnsRecord` | DNS hostname Vantage is reachable at. |
| `vantage.mailFrom` | `Vantage.spec.mailFrom` | Sender for outbound mail. |
| `vantage.platformAdminEmail` | `Vantage.spec.platformAdminEmail` | Initial platform admin. |
| `vantage.secrets.azure` or `vantage.secrets.kubernetes` | `Vantage.spec.secrets` | Exactly one secrets provider is required. See [Secrets and Key Vault](/vantage/self-hosted/v3.0/secrets-and-keyvault). |
| `vantage.workloads.configMap` / `metadataTemplateKey` / `secretsKey` / `workloadsKey` | `Vantage.spec.workloads` | Points at the `ConfigMap` containing the workloads data. The chart itself ships and creates this ConfigMap. |
### Optional values
| Value | Purpose |
| ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ingress.enabled` | Enable the chart's built-in ingress. Set `false` when using Traefik or another customer-managed ingress controller. Default `true`. |
| `vantage.databaseProvider` | Database engine for Vantage services. Accepted values: `SqlServer` (default) or `PostgreSQL`; case-sensitive. |
| `vantage.secrets.azure.identityMode` | One of `workloadIdentity` (default), `podIdentity`, `vmManagedIdentity`. See [Secrets and Key Vault](/vantage/self-hosted/v3.0/secrets-and-keyvault#azure-key-vault-provider). |
| `vantage.secrets.azure.userAssignedIdentityID` | Client ID of the UAMI to use when `identityMode` is `vmManagedIdentity`. |
| `vantage.secrets.azure.objects` | Map of secret alias → `{objectName, objectType, objectVersion}` for Key Vault objects whose names don't match the alias. |
| `vantage.secrets.kubernetes` | Use pre-existing Kubernetes `Secret` resources instead of Azure Key Vault. Optional `objects` mapping overrides default secret names. |
| `vantage.smtp.host` / `port` / `login` / `password` | Outbound SMTP. Used only when set; SendGrid is the default. Maps to `Vantage.spec.smtp`. |
| `vantage.serviceAccountName` | Default ServiceAccount for Vantage workloads. Maps to `Vantage.spec.serviceAccountName`. Default `default`. To pull images with a pull Secret, add the Secret to this ServiceAccount's `imagePullSecrets`. See [Azure image pull access](/vantage/self-hosted/v3.0/providers/azure#image-pull-access) or [self-managed registry access](/vantage/self-hosted/v3.0/providers/self-managed#configure-registry-access). |
| `vantage.storage.custom.storageClass` / `size` | Use a Kubernetes `StorageClass`-backed backend instead of Azure Blob. Maps to `Vantage.spec.storage.custom`. |
| `vantage.idReadingEnabled` | Toggle ID reading features. Default `false`. |
| `vantage.reportingEnabled` | Toggle SQL Server reporting features. Default `false`. Must remain `false` with PostgreSQL. |
| `vantage.ociMigration.enabled` | Run the OCI migration job. Default `true`. |
| `vantage.ociMigration.serviceAccountName` | ServiceAccount the OCI migration job runs under. Maps to `Vantage.spec.ociMigration.serviceAccountName`. To pull the job image with a pull secret, add the secret to this ServiceAccount's `imagePullSecrets`. |
| `vantage.ociMigration.sources[]` | Source registries to copy artifacts from. The documented source is `sources[0].host=abbyy.jfrog.io` and `sources[0].repository=abbyy-docker`. Set `sources[].credentialsRef.name` to a Secret holding registry credentials; this is the alternative to a migration job ServiceAccount for pull configuration. |
| `vantage.ociMigration.destination.host` / `repository` | Destination registry that artifacts are copied into. |
| `vantage.keda.enabled` | Configures whether [KEDA](https://keda.sh/) is used for autoscaling Vantage workloads. The current Vantage workload charts require KEDA 2.17.x. See [Autoscaling with KEDA](/vantage/self-hosted/v3.0/performance/autoscaling). |
| `observability.prometheus.namespace` | Namespace containing Prometheus. Default `observability`. Some Vantage autoscalers require the `prometheus-operated` Service in this namespace. |
| `observability.prometheus.serviceMonitor.create` | Create the `ServiceMonitor` that scrapes Vantage `/metrics-text` endpoints. Default `false`. |
| `observability.prometheus.serviceMonitor.selectorMatchLabels` | Labels required for your Prometheus instance to select the Vantage `ServiceMonitor`. Default `{}`. |
| `vantage.techcore.versions` | TechCore engine version(s). |
| `vantage.techcore.nnTrainingWorkers.enabled` / `gpu` | Neural-network training workers. |
## Inspecting available values
The `vantage-operator` chart, including its `values.yaml`, is generated by the Kubebuilder Helm plugin; the `vantage-selfhosted` chart's templates are hand-maintained. In both cases the published chart is the canonical reference for what a given version accepts. The tables on this page summarize a tested snapshot; when this page and the chart disagree, trust the chart:
```bash theme={null}
# vantage-operator
helm show values $charts_uri/vantage-operator --version $operator_version
# vantage-selfhosted
helm show values $chart_uri/vantage-selfhosted --version $selfhosted_version
```
`$charts_uri`, `$chart_uri`, and the version variables follow the conventions in [Install variables](/vantage/self-hosted/v3.0/providers/azure#install-variables).
To inspect the rendered manifests before applying:
```bash theme={null}
helm template $release_name $chart_uri/vantage-selfhosted \
--version $selfhosted_version \
--namespace $install_namespace \
-f my-values.yaml
```
## Operator vs Vantage configuration
Configuration splits along a clear line:
| Concern | Lives on | Rationale |
| ------------------------------------------------------------------------------------ | ------------------------------------------------- | --------------------------------------------------------------------- |
| Operator runtime (replicas, image, pull secrets, scheduling, CRD lifecycle, metrics) | `vantage-operator` Helm values | Cluster-admin operational settings. |
| Vantage application (secrets, SMTP, workloads, storage, techcore) | `vantage-selfhosted` Helm values → `Vantage.spec` | The CRD is the API contract; the chart is just the way you author it. |
## TechCore worker deployment
The `vantage-selfhosted` chart applies a `Vantage` custom resource; the operator then deploys a subset of the TechCore worker charts based on `spec.techcore.*`. The selection happens in the operator, but the matrix below is the contract; use it to predict which workers will run for a given configuration.
### Naming convention
Worker charts are named `vtc-{version}-worker-{name}`, where `{version}` comes from `spec.techcore.version` and `{previousVersion}` from `spec.techcore.previousVersion`. The version numbers are pure name prefixes; they have no semantic meaning to the operator. The set of available workers comes from the workloads ConfigMap that ABBYY publishes with each release.
### Two deployment passes
| Pass | When it runs | Charts considered |
| ---------------- | ---------------------------------------------- | ------------------------------- |
| Current version | Always | `vtc-{version}-worker*` |
| Previous version | When `spec.techcore.keepPreviousVersion: true` | `vtc-{previousVersion}-worker*` |
Setting `keepPreviousVersion: true` keeps the previous TechCore version's workers running alongside the new ones, which is useful for staged TechCore upgrades. The CRD requires `previousVersion` to be set when this flag is true.
### Inclusion matrix: current version pass
| Chart pattern | Included when |
| ---------------------------- | -------------------------------------------------------------------- |
| `worker-id-reading` | Never (excluded in all configurations) |
| `nn-extraction-training` | `nnTrainingWorkers.enabled: true` and `nnTrainingWorkers.gpu: false` |
| `nn-extraction-training-gpu` | `nnTrainingWorkers.enabled: true` and `nnTrainingWorkers.gpu: true` |
| `nn-nlp-model-train` | `nnTrainingWorkers.enabled: true` and `nnTrainingWorkers.gpu: false` |
| `nn-nlp-model-train-gpu` | `nnTrainingWorkers.enabled: true` and `nnTrainingWorkers.gpu: true` |
| All other workers | Always |
### Inclusion matrix: previous version pass
Only runs when `spec.techcore.keepPreviousVersion: true`.
| Chart pattern | Included when |
| --------------------------------------- | ---------------------------------------------------- |
| `worker-id-reading` | Never |
| `nn-extraction-training*` (CPU and GPU) | Never (NN training only runs on the current version) |
| `nn-nlp-model-train*` (CPU and GPU) | Never (NN training only runs on the current version) |
| All other workers | Always |
ID reading is a platform-level concern, not a TechCore concern. The flag that controls it is `spec.idReadingEnabled`, which lives outside `spec.techcore`. See the [`Vantage.spec` reference](/vantage/self-hosted/v3.0/api-reference#vantagespec).
The matrix only decides inclusion within whatever workers exist in the workloads ConfigMap for the selected version. Charts that are not present in the workloads for that version are simply unavailable to deploy. For example, `worker-ocr-join` only ships in `vtc-2`'s workload set today, so even with `keepPreviousVersion: true` and `previousVersion: 2`, it deploys only as `vtc-2-worker-ocr-join`.
## What's next
Field-by-field reference for the `Vantage` custom resource.
The procedural install that uses these charts.
Install with customer-managed ingress, mesh, secrets, storage, and data services.