> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Helm chart values: 2026.10.02

> Every value of the vantage-operator and vantage-selfhosted Helm charts at artifact version 0.84.29, with its type and default.

## Artifact versions

| Artifact | Version |
| - | - |
| `vantage-operator` chart | `0.84.29` |
| `vantage-selfhosted` chart | `0.84.29` |
| `vantage-operator` image | `v0.84.29` |

Every value both charts accept at this version, with its type and default. For what the charts do and the values you are most likely to set, see [Helm charts](https://docs.abbyy.com/vantage/self-hosted/v3.0/helm-charts.md). For field-level details of the `Vantage` custom resource, see [API reference](https://docs.abbyy.com/vantage/self-hosted/v3.0/reference/2026.10.02/api-reference.md).

## `vantage-operator`

| Key | Type | Default | Description |
| - | - | - | - |
| certManager.enable | bool | `false` | |
| crd.enable | bool | `true` | |
| crd.keep | bool | `true` | |
| manager.affinity | object | `{}` | |
| manager.args\[0] | string | `"--leader-elect"` | |
| manager.env\[0].name | string | `"POD_NAME"` | |
| manager.env\[0].valueFrom.fieldRef.fieldPath | string | `"metadata.name"` | |
| manager.env\[1].name | string | `"POD_NAMESPACE"` | |
| manager.env\[1].valueFrom.fieldRef.fieldPath | string | `"metadata.namespace"` | |
| manager.image.pullPolicy | string | `"IfNotPresent"` | |
| manager.image.repository | string | `"abyvtgsh.azurecr.io/vantage-operator"` | |
| manager.image.tag | string | `"v0.84.29"` | |
| manager.imagePullSecrets | list | `[]` | |
| manager.nodeSelector | object | `{}` | |
| manager.podSecurityContext.runAsNonRoot | bool | `true` | |
| manager.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
| manager.replicas | int | `1` | |
| manager.resources.limits.cpu | string | `"500m"` | |
| manager.resources.limits.memory | string | `"128Mi"` | |
| manager.resources.requests.cpu | string | `"10m"` | |
| manager.resources.requests.memory | string | `"64Mi"` | |
| manager.securityContext.allowPrivilegeEscalation | bool | `false` | |
| manager.securityContext.capabilities.drop\[0] | string | `"ALL"` | |
| manager.securityContext.readOnlyRootFilesystem | bool | `true` | |
| manager.tolerations | list | `[]` | |
| metrics.enable | bool | `true` | |
| metrics.port | int | `8443` | |
| prometheus.enable | bool | `false` | |
| rbacHelpers.enable | bool | `false` | |

## `vantage-selfhosted`

| Key | Type | Default | Description |
| - | - | - | - |
| ingress | object | `{…}` | Ingress configuration |
| ingress.gateway | object | `{…}` | Kubernetes Gateway API (`gateway.networking.k8s.io/v1`) configuration |
| ingress.gateway.annotations | object | `{}` | Additional Gateway annotations (e.g. `cert-manager.io/cluster-issuer` to have cert-manager issue the certificate referenced by `ingress.tls.secretName`) |
| ingress.gateway.certificateRef.createReferenceGrant | bool | `false` | Create a ReferenceGrant in `certificateRef.namespace` allowing the Gateway to use the secret |
| ingress.gateway.certificateRef.namespace | string | `""` | Namespace of the `ingress.tls.secretName` secret, if not the release namespace |
| ingress.gateway.create | bool | `true` | Whether to create the Gateway. Set to false to attach the HTTPRoute to an existing Gateway through `parentRefs`. |
| ingress.gateway.gatewayClassName | string | `""` | GatewayClass that will implement the Gateway (required when creating the Gateway) |
| ingress.gateway.infrastructure | object | `{}` | Gateway `spec.infrastructure` (labels, annotations and parametersRef propagated to the resources the implementation creates, such as the load balancer Service) |
| ingress.gateway.labels | object | `{}` | Additional Gateway labels |
| ingress.gateway.listeners.controllerSuppliedTls | bool | `false` | When `ingress.tls.enabled` is false, use an HTTPS listener without `certificateRefs` (in place of an HTTP listener) for implementations that supply the certificate themselves. Requires `tlsOptions`. |
| ingress.gateway.listeners.httpPort | int | `80` | Port of the HTTP listener |
| ingress.gateway.listeners.httpRedirect | bool | `false` | Add an HTTP listener that redirects to HTTPS (when the Gateway has an HTTPS listener) |
| ingress.gateway.listeners.httpsPort | int | `443` | Port of the HTTPS listener |
| ingress.gateway.listeners.tlsOptions | object | `{}` | `tls.options` of the HTTPS listener (implementation-specific) |
| ingress.gateway.meshIntegrated | bool | `false` | Set to true if the GatewayClass implementation participates in the Istio mesh (e.g. Istio's own Gateway API implementation), allowing STRICT mTLS when `mesh.istio.enabled` is true |
| ingress.gateway.name | string | `"vantage-gateway"` | Name of the Gateway to create |
| ingress.gateway.parentRefs | list | `[]` | Listeners of an existing Gateway to attach the HTTPRoute to, used when `create` is false. The Gateway's `allowedRoutes` must admit routes from the release namespace. |
| ingress.gateway.regexCatchAll | bool | `false` | Render the `/` catch-all route as a RegularExpression match (`/.*`) in place of a PathPrefix match. Set to true for implementations that rank every PathPrefix match above RegularExpression matches (e.g. Istio), where a `/` prefix would shadow the regex routes. |
| ingress.gateway.route.annotations | object | `{}` | Additional HTTPRoute annotations |
| ingress.gateway.route.labels | object | `{}` | Additional HTTPRoute labels |
| ingress.istio | object | `{…}` | Istio ingress configuration |
| ingress.istio.gateway.annotations | object | `{}` | Additional gateway annotations |
| ingress.istio.gateway.labels | object | `{}` | Additional gateway labels |
| ingress.istio.internalDNSResolution.enabled | bool | `false` | indicates whether we should set up resources in Istio so that calls within the mesh    to the vantage cluster FQDN are routed back through the ingress gateway    (set this to true if `vantage.DNSRecord` does not actually have a public DNS record).    (requires [DNS Proxying](https://istio.io/latest/docs/ops/configuration/traffic-management/dns-proxy)) |
| ingress.kubernetes | object | `{…}` | Native Kubernetes Ingress configuration |
| ingress.kubernetes.annotations | object | `{}` | Additional ingress annotations |
| ingress.kubernetes.ingressClassName | string | `""` | Defines which ingress controller will implement the resource |
| ingress.kubernetes.labels | object | `{}` | Additional ingress labels |
| ingress.kubernetes.nginx | bool | `false` | Set to true if using an ingress class not named "nginx" that implements nginx features (e.g. AKS web app routing) |
| ingress.tls.enabled | bool | `true` | Whether the ingress terminates TLS with a Kubernetes secret. Set to false when the ingress controller supplies the certificate out of band (e.g. an ACM certificate attached to the AWS ALB IngressClassParams). |
| ingress.type | string | `"istio"` | Ingress implementation. One of `native`, `gateway`, `kubernetes`, or `istio`. `native` means if Gateway APIs are available, they will be used; otherwise, the frozen Kubernetes Ingress API will be used. |
| mesh | object | `{…}` | Service mesh configuration |
| mesh.istio.enabled | bool | `true` | Set to `true` to deploy recommended Istio mesh config. |
| observability | object | `{…}` | Observability configuration |
| observability.prometheus | object | `{…}` | Prometheus observability configuration |
| observability.prometheus.namespace | string | `"observability"` | Namespace in which Prometheus instance is installed |
| observability.prometheus.serviceMonitor | object | `{…}` | Prometheus ServiceMonitor configuration |
| observability.prometheus.serviceMonitor.create | bool | `false` | whether to create a Prometheus ServiceMonitor to scrape Vantage application metrics |
| observability.prometheus.serviceMonitor.selectorMatchLabels | object | `{}` | any labels required by Prometheus to register a ServiceMonitor (should match your `Prometheus` CR's `spec.serviceMonitorSelector.matchLabels`) |
| operator.controllerManagerServiceAccount | string | `"vantage-operator-controller-manager"` | |
| operator.namespace | string | `"vantage-operator-system"` | |
| serviceAccounts | object | `{…}` | ServiceAccounts used by Vantage workloads. Each section is optional: set `create: true` to have this chart create the ServiceAccount (in the release namespace) and wire it into the corresponding part of the Vantage CR, set only `vantage.serviceAccountName` / `vantage.ociMigration.serviceAccountName` to reference a ServiceAccount that already exists, or set neither and the corresponding pods run as the namespace's `default` ServiceAccount. |
| serviceAccounts.ociMigration | object | `{…}` | ServiceAccount for the OCI migration job (`vantage.ociMigration.serviceAccountName`) |
| serviceAccounts.ociMigration.annotations | object | `{}` | Additional annotations (e.g. `azure.workload.identity/client-id`) |
| serviceAccounts.ociMigration.create | bool | `false` | Whether to create the ServiceAccount |
| serviceAccounts.ociMigration.imagePullSecrets | list | `[]` | Image pull secrets attached to the ServiceAccount |
| serviceAccounts.ociMigration.labels | object | `{}` | Additional labels |
| serviceAccounts.ociMigration.name | string | `""` | Name of the ServiceAccount to create. Defaults to `<release name>-oci-migration`. |
| serviceAccounts.vantage | object | `{…}` | ServiceAccount for the Vantage application workloads (`vantage.serviceAccountName`) |
| serviceAccounts.vantage.annotations | object | `{}` | Additional annotations (e.g. `azure.workload.identity/client-id`) |
| serviceAccounts.vantage.create | bool | `false` | Whether to create the ServiceAccount |
| serviceAccounts.vantage.imagePullSecrets | list | `[]` | Image pull secrets attached to the ServiceAccount |
| serviceAccounts.vantage.labels | object | `{}` | Additional labels |
| serviceAccounts.vantage.name | string | `""` | Name of the ServiceAccount to create. Defaults to the release name. |
| vantage | object | `{…}` | Vantage CR spec - these values are passed directly to the Vantage custom resource |
| vantage.databaseProvider | string | `"SqlServer"` | Database engine used by all Vantage services. One of "SqlServer" or "PostgreSQL". Case-sensitive: the value is passed straight to each service's `*Database__Provider` and must match the runtime DataProvider name exactly ("PostgreSQL", not "Postgresql"/"PostgreSql"). |
| vantage.debug | bool | `false` | Whether to deploy Vantage workloads in debug mode |
| vantage.dnsRecord | string | `""` | DNS record for the Vantage installation |
| vantage.keda | object | `{…}` | KEDA configuration |
| vantage.keda.enabled | bool | `false` | Whether to use KEDA for autoscaling |
| vantage.mailFrom | string | `""` | Email address used as sender for outgoing emails |
| vantage.minimalInstall | bool | `false` | Whether to deploy Vantage workloads with minimal resource configurations. Also trims the default skill installation to the newest version of each skill (see `files/default-skills.minimal.yml`), which `workloadsConfigMap.additionalMetadata` can override. This default skill installation behavior is a **Helm chart-only** switch; if `minimalInstall` is toggled by means other than through the Helm chart, additional metadata will *not* be updated and default skill installation behavior will *not* be changed. |
| vantage.ociMigration | object | `{…}` | OCI migration configuration (optional, omit or set enabled: false to skip) |
| vantage.ociMigration.concurrency | int | `5` | Number of artifacts to copy in parallel |
| vantage.ociMigration.destination | object | `{…}` | Destination container registry (customer's registry for mirrored images) |
| vantage.ociMigration.destination.host | string | `"abbyy.com"` | Registry hostname |
| vantage.ociMigration.destination.password | string | `""` | Password for authentication (use credentialsRef for production) |
| vantage.ociMigration.destination.username | string | `""` | Username for authentication (use credentialsRef for production) |
| vantage.ociMigration.enabled | bool | `true` | Enable OCI migration |
| vantage.ociMigration.sources | list | `[…]` | Source registry where Vantage images are pulled from |
| vantage.ociMigration.sources\[0] | object | `{…}` | Registry hostname |
| vantage.ociMigration.sources\[0].password | string | `""` | Password for authentication (use credentialsRef for production) |
| vantage.ociMigration.sources\[0].username | string | `""` | Username for authentication (use credentialsRef for production) |
| vantage.platformAdminEmail | string | `""` | Email address of the platform administrator |
| vantage.reverseProxy | bool | `false` | Whether to configure Vantage to run behind a reverse proxy that terminates TLS. |
| vantage.secrets | object | `{}` | Secrets configuration (exactly one provider must be set: kubernetes or azure). |
| vantage.techcore | object | `{…}` | TechCore processing engine configuration |
| vantage.techcore.nnTrainingWorkers | object | `{…}` | Neural network training workers configuration |
| vantage.techcore.nnTrainingWorkers.enabled | bool | `false` | Enable neural network training workers |
| vantage.techcore.nnTrainingWorkers.gpu | bool | `false` | Enable GPU acceleration for training workers |
| vantage.techcore.versions | list | `[3,4]` | TechCore versions to deploy (available versions are 2, 3, 4). |
| vantage.updatePolicy | object | `{…}` | Update policy for Vantage upgrades |
| vantage.updatePolicy.manual | object | `{}` | Manual upgrades only (install a new operator Helm chart version to upgrade) |
| vantage.vantageVersion | string | `""` | Version of Vantage to install |
| vantage.workloads | object | `{…}` | Workloads ConfigMap configuration |
| vantage.workloads.additionalMetadataKey | string | `"additional-metadata.yml"` | Additional workloads metadata key |
| vantage.workloads.configMap | string | `"vantage-workloads"` | ConfigMap name (if `workloadsConfigMap.create` is true (which is the default), this value will be used as a prefix for the created ConfigMap's name.) |
| vantage.workloads.metadataTemplateKey | string | `"workloads-metadata.yml.gotmpl"` | Workloads metadata template key |
| vantage.workloads.secretsKey | string | `"workloads-secrets.yml.gotmpl"` | Workloads secrets key |
| vantage.workloads.workloadsKey | string | `"workloads.yml"` | Workloads key |
| workloadsConfigMap.additionalMetadata | object | `{}` | Advanced workload configuration. This object will be merged with the rendered workloads metadata. |
| workloadsConfigMap.create | bool | `true` | Whether to create the ConfigMap containing data about charts and images required to install vantage. When this option is `true`, deploying a new chart version will update the Vantage custom resource itself, effectively updating Vantage in-place (works under both `helm install`/`helm upgrade` and GitOps tools that render with `helm template`, e.g. ArgoCD/Flux). |