| ingress | object | {…} | Ingress configuration |
| ingress.gateway | object | {…} | Kubernetes Gateway API (gateway.networking.k8s.io/v1) configuration |
| ingress.gateway.annotations | object | {} | Additional Gateway annotations (e.g. cert-manager.io/cluster-issuer to have cert-manager issue the certificate referenced by ingress.tls.secretName) |
| ingress.gateway.certificateRef.createReferenceGrant | bool | false | Create a ReferenceGrant in certificateRef.namespace allowing the Gateway to use the secret |
| ingress.gateway.certificateRef.namespace | string | "" | Namespace of the ingress.tls.secretName secret, if not the release namespace |
| ingress.gateway.create | bool | true | Whether to create the Gateway. Set to false to attach the HTTPRoute to an existing Gateway through parentRefs. |
| ingress.gateway.gatewayClassName | string | "" | GatewayClass that will implement the Gateway (required when creating the Gateway) |
| ingress.gateway.infrastructure | object | {} | Gateway spec.infrastructure (labels, annotations and parametersRef propagated to the resources the implementation creates, such as the load balancer Service) |
| ingress.gateway.labels | object | {} | Additional Gateway labels |
| ingress.gateway.listeners.controllerSuppliedTls | bool | false | When ingress.tls.enabled is false, use an HTTPS listener without certificateRefs (in place of an HTTP listener) for implementations that supply the certificate themselves. Requires tlsOptions. |
| ingress.gateway.listeners.httpPort | int | 80 | Port of the HTTP listener |
| ingress.gateway.listeners.httpRedirect | bool | false | Add an HTTP listener that redirects to HTTPS (when the Gateway has an HTTPS listener) |
| ingress.gateway.listeners.httpsPort | int | 443 | Port of the HTTPS listener |
| ingress.gateway.listeners.tlsOptions | object | {} | tls.options of the HTTPS listener (implementation-specific) |
| ingress.gateway.meshIntegrated | bool | false | Set to true if the GatewayClass implementation participates in the Istio mesh (e.g. Istio’s own Gateway API implementation), allowing STRICT mTLS when mesh.istio.enabled is true |
| ingress.gateway.name | string | "vantage-gateway" | Name of the Gateway to create |
| ingress.gateway.parentRefs | list | [] | Listeners of an existing Gateway to attach the HTTPRoute to, used when create is false. The Gateway’s allowedRoutes must admit routes from the release namespace. |
| ingress.gateway.regexCatchAll | bool | false | Render the / catch-all route as a RegularExpression match (/.*) in place of a PathPrefix match. Set to true for implementations that rank every PathPrefix match above RegularExpression matches (e.g. Istio), where a / prefix would shadow the regex routes. |
| ingress.gateway.route.annotations | object | {} | Additional HTTPRoute annotations |
| ingress.gateway.route.labels | object | {} | Additional HTTPRoute labels |
| ingress.istio | object | {…} | Istio ingress configuration |
| ingress.istio.gateway.annotations | object | {} | Additional gateway annotations |
| ingress.istio.gateway.labels | object | {} | Additional gateway labels |
| ingress.istio.internalDNSResolution.enabled | bool | false | indicates whether we should set up resources in Istio so that calls within the mesh to the vantage cluster FQDN are routed back through the ingress gateway (set this to true if vantage.DNSRecord does not actually have a public DNS record). (requires DNS Proxying) |
| ingress.kubernetes | object | {…} | Native Kubernetes Ingress configuration |
| ingress.kubernetes.annotations | object | {} | Additional ingress annotations |
| ingress.kubernetes.ingressClassName | string | "" | Defines which ingress controller will implement the resource |
| ingress.kubernetes.labels | object | {} | Additional ingress labels |
| ingress.kubernetes.nginx | bool | false | Set to true if using an ingress class not named “nginx” that implements nginx features (e.g. AKS web app routing) |
| ingress.tls.enabled | bool | true | Whether the ingress terminates TLS with a Kubernetes secret. Set to false when the ingress controller supplies the certificate out of band (e.g. an ACM certificate attached to the AWS ALB IngressClassParams). |
| ingress.type | string | "istio" | Ingress implementation. One of native, gateway, kubernetes, or istio. native means if Gateway APIs are available, they will be used; otherwise, the frozen Kubernetes Ingress API will be used. |
| mesh | object | {…} | Service mesh configuration |
| mesh.istio.enabled | bool | true | Set to true to deploy recommended Istio mesh config. |
| observability | object | {…} | Observability configuration |
| observability.prometheus | object | {…} | Prometheus observability configuration |
| observability.prometheus.namespace | string | "observability" | Namespace in which Prometheus instance is installed |
| observability.prometheus.serviceMonitor | object | {…} | Prometheus ServiceMonitor configuration |
| observability.prometheus.serviceMonitor.create | bool | false | whether to create a Prometheus ServiceMonitor to scrape Vantage application metrics |
| observability.prometheus.serviceMonitor.selectorMatchLabels | object | {} | any labels required by Prometheus to register a ServiceMonitor (should match your Prometheus CR’s spec.serviceMonitorSelector.matchLabels) |
| operator.controllerManagerServiceAccount | string | "vantage-operator-controller-manager" | |
| operator.namespace | string | "vantage-operator-system" | |
| serviceAccounts | object | {…} | ServiceAccounts used by Vantage workloads. Each section is optional: set create: true to have this chart create the ServiceAccount (in the release namespace) and wire it into the corresponding part of the Vantage CR, set only vantage.serviceAccountName / vantage.ociMigration.serviceAccountName to reference a ServiceAccount that already exists, or set neither and the corresponding pods run as the namespace’s default ServiceAccount. |
| serviceAccounts.ociMigration | object | {…} | ServiceAccount for the OCI migration job (vantage.ociMigration.serviceAccountName) |
| serviceAccounts.ociMigration.annotations | object | {} | Additional annotations (e.g. azure.workload.identity/client-id) |
| serviceAccounts.ociMigration.create | bool | false | Whether to create the ServiceAccount |
| serviceAccounts.ociMigration.imagePullSecrets | list | [] | Image pull secrets attached to the ServiceAccount |
| serviceAccounts.ociMigration.labels | object | {} | Additional labels |
| serviceAccounts.ociMigration.name | string | "" | Name of the ServiceAccount to create. Defaults to <release name>-oci-migration. |
| serviceAccounts.vantage | object | {…} | ServiceAccount for the Vantage application workloads (vantage.serviceAccountName) |
| serviceAccounts.vantage.annotations | object | {} | Additional annotations (e.g. azure.workload.identity/client-id) |
| serviceAccounts.vantage.create | bool | false | Whether to create the ServiceAccount |
| serviceAccounts.vantage.imagePullSecrets | list | [] | Image pull secrets attached to the ServiceAccount |
| serviceAccounts.vantage.labels | object | {} | Additional labels |
| serviceAccounts.vantage.name | string | "" | Name of the ServiceAccount to create. Defaults to the release name. |
| vantage | object | {…} | Vantage CR spec - these values are passed directly to the Vantage custom resource |
| vantage.databaseProvider | string | "SqlServer" | Database engine used by all Vantage services. One of “SqlServer” or “PostgreSQL”. Case-sensitive: the value is passed straight to each service’s *Database__Provider and must match the runtime DataProvider name exactly (“PostgreSQL”, not “Postgresql”/“PostgreSql”). |
| vantage.debug | bool | false | Whether to deploy Vantage workloads in debug mode |
| vantage.dnsRecord | string | "" | DNS record for the Vantage installation |
| vantage.keda | object | {…} | KEDA configuration |
| vantage.keda.enabled | bool | false | Whether to use KEDA for autoscaling |
| vantage.mailFrom | string | "" | Email address used as sender for outgoing emails |
| vantage.minimalInstall | bool | false | Whether to deploy Vantage workloads with minimal resource configurations. Also trims the default skill installation to the newest version of each skill (see files/default-skills.minimal.yml), which workloadsConfigMap.additionalMetadata can override. This default skill installation behavior is a Helm chart-only switch; if minimalInstall is toggled by means other than through the Helm chart, additional metadata will not be updated and default skill installation behavior will not be changed. |
| vantage.ociMigration | object | {…} | OCI migration configuration (optional, omit or set enabled: false to skip) |
| vantage.ociMigration.concurrency | int | 5 | Number of artifacts to copy in parallel |
| vantage.ociMigration.destination | object | {…} | Destination container registry (customer’s registry for mirrored images) |
| vantage.ociMigration.destination.host | string | "abbyy.com" | Registry hostname |
| vantage.ociMigration.destination.password | string | "" | Password for authentication (use credentialsRef for production) |
| vantage.ociMigration.destination.username | string | "" | Username for authentication (use credentialsRef for production) |
| vantage.ociMigration.enabled | bool | true | Enable OCI migration |
| vantage.ociMigration.sources | list | […] | Source registry where Vantage images are pulled from |
| vantage.ociMigration.sources[0] | object | {…} | Registry hostname |
| vantage.ociMigration.sources[0].password | string | "" | Password for authentication (use credentialsRef for production) |
| vantage.ociMigration.sources[0].username | string | "" | Username for authentication (use credentialsRef for production) |
| vantage.platformAdminEmail | string | "" | Email address of the platform administrator |
| vantage.reverseProxy | bool | false | Whether to configure Vantage to run behind a reverse proxy that terminates TLS. |
| vantage.secrets | object | {} | Secrets configuration (exactly one provider must be set: kubernetes or azure). |
| vantage.techcore | object | {…} | TechCore processing engine configuration |
| vantage.techcore.nnTrainingWorkers | object | {…} | Neural network training workers configuration |
| vantage.techcore.nnTrainingWorkers.enabled | bool | false | Enable neural network training workers |
| vantage.techcore.nnTrainingWorkers.gpu | bool | false | Enable GPU acceleration for training workers |
| vantage.techcore.versions | list | [3,4] | TechCore versions to deploy (available versions are 2, 3, 4). |
| vantage.updatePolicy | object | {…} | Update policy for Vantage upgrades |
| vantage.updatePolicy.manual | object | {} | Manual upgrades only (install a new operator Helm chart version to upgrade) |
| vantage.vantageVersion | string | "" | Version of Vantage to install |
| vantage.workloads | object | {…} | Workloads ConfigMap configuration |
| vantage.workloads.additionalMetadataKey | string | "additional-metadata.yml" | Additional workloads metadata key |
| vantage.workloads.configMap | string | "vantage-workloads" | ConfigMap name (if workloadsConfigMap.create is true (which is the default), this value will be used as a prefix for the created ConfigMap’s name.) |
| vantage.workloads.metadataTemplateKey | string | "workloads-metadata.yml.gotmpl" | Workloads metadata template key |
| vantage.workloads.secretsKey | string | "workloads-secrets.yml.gotmpl" | Workloads secrets key |
| vantage.workloads.workloadsKey | string | "workloads.yml" | Workloads key |
| workloadsConfigMap.additionalMetadata | object | {} | Advanced workload configuration. This object will be merged with the rendered workloads metadata. |
| workloadsConfigMap.create | bool | true | Whether to create the ConfigMap containing data about charts and images required to install vantage. When this option is true, deploying a new chart version will update the Vantage custom resource itself, effectively updating Vantage in-place (works under both helm install/helm upgrade and GitOps tools that render with helm template, e.g. ArgoCD/Flux). |
