| defaultSkills | object | {…} | Default skill installation: which entries of the bundled catalog (files/default-skills.yml, the defaultSkills value of the pinned skill-installer-def-installation chart) the skill-installer-operator installs. Installed skills are never removed, so choose the set before the first installation; see docs/default-skills.md. |
| defaultSkills.mode | string | "all" | all installs every version of every catalog skill, minimal the newest version of each skill plus the pins in files/default-skills.minimal.yml, custom only the entries in skills. all is the only safe default: skills derived from a default skill break without it, so trimming is always explicit. all with vantage.minimalInstall: true warns in the chart notes. |
| defaultSkills.skills | list | [] | Skills to install in custom mode, as {id, versions} entries. id is a catalog skill id. versions is optional: omitted installs the newest version, all every catalog version, and a list only those version numbers. An unknown id or version fails the render. Ignored in other modes. |
| ingress | object | {…} | Ingress configuration |
| ingress.gateway | object | {…} | Kubernetes Gateway API (gateway.networking.k8s.io/v1) configuration |
| ingress.gateway.annotations | object | {} | Additional Gateway annotations (e.g. cert-manager.io/cluster-issuer to have cert-manager issue the certificate referenced by ingress.tls.secretName) |
| ingress.gateway.certificateRef.createReferenceGrant | bool | false | Create a ReferenceGrant in certificateRef.namespace allowing the Gateway to use the secret |
| ingress.gateway.certificateRef.namespace | string | "" | Namespace of the ingress.tls.secretName secret, if not the release namespace |
| ingress.gateway.create | bool | true | Whether to create the Gateway. Set to false to attach the HTTPRoute to an existing Gateway through parentRefs. |
| ingress.gateway.gatewayClassName | string | "" | GatewayClass that will implement the Gateway (required when creating the Gateway) |
| ingress.gateway.infrastructure | object | {} | Gateway spec.infrastructure (labels, annotations and parametersRef propagated to the resources the implementation creates, such as the load balancer Service) |
| ingress.gateway.labels | object | {} | Additional Gateway labels |
| ingress.gateway.listeners.controllerSuppliedTls | bool | false | When ingress.tls.enabled is false, use an HTTPS listener without certificateRefs (in place of an HTTP listener) for implementations that supply the certificate themselves. Requires tlsOptions. |
| ingress.gateway.listeners.httpPort | int | 80 | Port of the HTTP listener |
| ingress.gateway.listeners.httpRedirect | bool | false | Add an HTTP listener that redirects to HTTPS (when the Gateway has an HTTPS listener) |
| ingress.gateway.listeners.httpsPort | int | 443 | Port of the HTTPS listener |
| ingress.gateway.listeners.tlsOptions | object | {} | tls.options of the HTTPS listener (implementation-specific) |
| ingress.gateway.meshIntegrated | bool | false | Set to true if the GatewayClass implementation participates in the Istio mesh (e.g. Istio’s own Gateway API implementation), allowing STRICT mTLS when mesh.istio.enabled is true |
| ingress.gateway.name | string | "vantage-gateway" | Name of the Gateway to create |
| ingress.gateway.parentRefs | list | [] | Listeners of an existing Gateway to attach the HTTPRoute to, used when create is false. The Gateway’s allowedRoutes must admit routes from the release namespace. |
| ingress.gateway.regexCatchAll | bool | false | Render the / catch-all route as a RegularExpression match (/.*) in place of a PathPrefix match. Set to true for implementations that rank every PathPrefix match above RegularExpression matches (e.g. Istio), where a / prefix would shadow the regex routes. |
| ingress.gateway.route.annotations | object | {} | Additional HTTPRoute annotations |
| ingress.gateway.route.labels | object | {} | Additional HTTPRoute labels |
| ingress.gateway.route.timeouts | object | {"request":"0s"} | timeouts for HTTPRoute rules. Requires the HTTPRouteRequestTimeout feature. Set to {} to leave the implementation default. |
| ingress.istio | object | {…} | Istio ingress configuration |
| ingress.istio.gateway.annotations | object | {} | Additional gateway annotations |
| ingress.istio.gateway.labels | object | {} | Additional gateway labels |
| ingress.istio.internalDNSResolution.enabled | bool | false | indicates whether we should set up resources in Istio so that calls within the mesh to the vantage cluster FQDN are routed back through the ingress gateway (set this to true if vantage.DNSRecord does not actually have a public DNS record). (requires DNS Proxying) |
| ingress.kubernetes | object | {…} | Native Kubernetes Ingress configuration |
| ingress.kubernetes.annotations | object | {} | Additional ingress annotations |
| ingress.kubernetes.ingressClassName | string | "" | Defines which ingress controller will implement the resource |
| ingress.kubernetes.labels | object | {} | Additional ingress labels |
| ingress.kubernetes.nginx | bool | false | Set to true if using an ingress class not named “nginx” that implements nginx features (e.g. AKS web app routing) |
| ingress.tls.enabled | bool | true | Whether the ingress terminates TLS with a Kubernetes secret. Set to false when the ingress controller supplies the certificate out of band (e.g. an ACM certificate attached to the AWS ALB IngressClassParams). |
| ingress.type | string | "istio" | Ingress implementation. One of native, gateway, kubernetes, or istio. native means if Gateway APIs are available, they will be used; otherwise, the frozen Kubernetes Ingress API will be used. |
| mesh | object | {…} | Service mesh configuration |
| mesh.istio.enabled | bool | true | Set to true to deploy recommended Istio mesh config. |
| observability | object | {…} | Observability configuration |
| observability.prometheus | object | {…} | Prometheus observability configuration |
| observability.prometheus.namespace | string | "observability" | Namespace in which Prometheus instance is installed |
| observability.prometheus.serviceMonitor | object | {…} | Prometheus ServiceMonitor configuration |
| observability.prometheus.serviceMonitor.create | bool | false | whether to create a Prometheus ServiceMonitor to scrape Vantage application metrics |
| observability.prometheus.serviceMonitor.interval | string | 15s, or 60s when vantage.minimalInstall is true | how often Prometheus scrapes Vantage application metrics. KEDA’s Prometheus scalers read these metrics, so this also bounds how quickly workers can react to queued work. If not set, the default value depends on vantage.minimalInstall: 60s when true; 15s otherwise. |
| observability.prometheus.serviceMonitor.selectorMatchLabels | object | {} | any labels required by Prometheus to register a ServiceMonitor (should match your Prometheus CR’s spec.serviceMonitorSelector.matchLabels) |
| operator.controllerManagerServiceAccount | string | "vantage-operator-controller-manager" | |
| operator.namespace | string | "vantage-operator-system" | |
| serviceAccounts | object | {…} | ServiceAccounts used by Vantage workloads. Each section is optional: set create: true to have this chart create the ServiceAccount (in the release namespace) and wire it into the corresponding part of the Vantage CR, set only vantage.serviceAccountName / vantage.ociMigration.serviceAccountName to reference a ServiceAccount that already exists, or set neither and the corresponding pods run as the namespace’s default ServiceAccount. Individual workloads will run as the vantage ServiceAccount unless specifically configured in workloads. |
| serviceAccounts.annotations | object | {} | Annotations added to every ServiceAccount this chart creates. Annotations set on an individual ServiceAccount take precedence. |
| serviceAccounts.imagePullSecrets | list | [] | Image pull secrets attached to every ServiceAccount this chart creates, in addition to those set on an individual ServiceAccount |
| serviceAccounts.labels | object | {} | Labels added to every ServiceAccount this chart creates. Labels set on an individual ServiceAccount take precedence. |
| serviceAccounts.ociMigration | object | {…} | ServiceAccount for the OCI migration job (vantage.ociMigration.serviceAccountName) |
| serviceAccounts.ociMigration.annotations | object | {} | Additional annotations (e.g. azure.workload.identity/client-id) |
| serviceAccounts.ociMigration.create | bool | false | Whether to create the ServiceAccount |
| serviceAccounts.ociMigration.imagePullSecrets | list | [] | Image pull secrets attached to the ServiceAccount |
| serviceAccounts.ociMigration.labels | object | {} | Additional labels |
| serviceAccounts.ociMigration.name | string | "" | Name of the ServiceAccount to create. Defaults to <release name>-oci-migration. |
| serviceAccounts.vantage | object | {…} | ServiceAccount for the Vantage application workloads (vantage.serviceAccountName) |
| serviceAccounts.vantage.annotations | object | {} | Additional annotations (e.g. azure.workload.identity/client-id) |
| serviceAccounts.vantage.create | bool | false | Whether to create the ServiceAccount |
| serviceAccounts.vantage.imagePullSecrets | list | [] | Image pull secrets attached to the ServiceAccount |
| serviceAccounts.vantage.labels | object | {} | Additional labels |
| serviceAccounts.vantage.name | string | "" | Name of the ServiceAccount to create. Defaults to the release name. |
| serviceAccounts.workloads | object | {} | ServiceAccounts for individual workloads, overriding the vantage ServiceAccount, keyed by chart name and then workload kind (migrator, deployment or statefulSet). Each entry supports create (default true), name (default <chart name without -helm>-<kind>; required when create is false), labels, annotations, imagePullSecrets and roles. Workloads may share a ServiceAccount by using the same name; entries that create a shared ServiceAccount must configure it identically. Each ServiceAccount is bound to roles (default migration-writer and serviceversion-reader for migrators, migration-reader and serviceversion-reader otherwise). |
| vantage | object | {…} | Vantage CR spec - these values are passed directly to the Vantage custom resource |
| vantage.databaseProvider | string | "SqlServer" | Database engine used by all Vantage services. One of “SqlServer” or “PostgreSQL”. Case-sensitive: the value is passed straight to each service’s *Database__Provider and must match the runtime DataProvider name exactly (“PostgreSQL”, not “Postgresql”/“PostgreSql”). |
| vantage.debug | bool | false | Whether to deploy Vantage workloads in debug mode |
| vantage.dnsRecord | string | "" | DNS record for the Vantage installation |
| vantage.keda | object | {…} | KEDA configuration |
| vantage.keda.enabled | bool | false | Whether to use KEDA for autoscaling |
| vantage.mailFrom | string | "" | Email address used as sender for outgoing emails |
| vantage.minimalInstall | bool | false | Whether to deploy Vantage workloads with minimal resource configurations. Pair it with defaultSkills.mode: minimal (or custom); the full skill set on a minimal install only warns. |
| vantage.ociMigration | object | {…} | OCI migration configuration (optional, omit or set enabled: false to skip) |
| vantage.ociMigration.concurrency | int | 5 | Number of artifacts to copy in parallel |
| vantage.ociMigration.destination | object | {…} | Destination container registry (customer’s registry for mirrored images) |
| vantage.ociMigration.destination.host | string | "abbyy.com" | Registry hostname |
| vantage.ociMigration.destination.password | string | "" | Password for authentication (use credentialsRef for production) |
| vantage.ociMigration.destination.username | string | "" | Username for authentication (use credentialsRef for production) |
| vantage.ociMigration.enabled | bool | true | Enable OCI migration |
| vantage.ociMigration.sources | list | […] | Source registry where Vantage images are pulled from |
| vantage.ociMigration.sources[0] | object | {…} | Registry hostname |
| vantage.ociMigration.sources[0].password | string | "" | Password for authentication (use credentialsRef for production) |
| vantage.ociMigration.sources[0].username | string | "" | Username for authentication (use credentialsRef for production) |
| vantage.platformAdminEmail | string | "" | Email address of the platform administrator |
| vantage.reverseProxy | bool | false | Whether to configure Vantage to run behind a reverse proxy that terminates TLS. |
| vantage.secrets | object | {} | Secrets configuration (exactly one provider must be set: kubernetes or azure). |
| vantage.techcore | object | {…} | TechCore processing engine configuration |
| vantage.techcore.nnTrainingWorkers | object | {…} | Neural network training workers configuration |
| vantage.techcore.nnTrainingWorkers.enabled | bool | false | Enable neural network training workers |
| vantage.techcore.nnTrainingWorkers.gpu | bool | false | Enable GPU acceleration for training workers |
| vantage.techcore.versions | list | [3,4] | TechCore versions to deploy (available versions are 2, 3, 4). |
| vantage.updatePolicy | object | {…} | Update policy for Vantage upgrades |
| vantage.updatePolicy.manual | object | {} | Manual upgrades only (install a new operator Helm chart version to upgrade) |
| vantage.vantageVersion | string | "" | Version of Vantage to install |
| vantage.workloads | object | {…} | Workloads ConfigMap configuration |
| vantage.workloads.additionalMetadataKey | string | "additional-metadata.yml" | Additional workloads metadata key |
| vantage.workloads.configMap | string | "vantage-workloads" | ConfigMap name (if workloadsConfigMap.create is true (which is the default), this value will be used as a prefix for the created ConfigMap’s name.) |
| vantage.workloads.metadataTemplateKey | string | "workloads-metadata.yml.gotmpl" | Workloads metadata template key |
| vantage.workloads.secretsKey | string | "workloads-secrets.yml.gotmpl" | Workloads secrets key |
| vantage.workloads.workloadsKey | string | "workloads.yml" | Workloads key |
| workloadsConfigMap.additionalMetadata | object | {} | Advanced workload configuration. This object will be merged with the rendered workloads metadata. |
| workloadsConfigMap.create | bool | true | Whether to create the ConfigMap containing data about charts and images required to install vantage. When this option is true, deploying a new chart version will update the Vantage custom resource itself, effectively updating Vantage in-place (works under both helm install/helm upgrade and GitOps tools that render with helm template, e.g. ArgoCD/Flux). |
