> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Helm chart values: 2026.10.16

> Every value of the vantage-operator and vantage-selfhosted Helm charts at artifact version 0.91.1, with its type and default.

## Artifact versions

| Artifact | Version |
| - | - |
| `vantage-operator` chart | `0.91.1` |
| `vantage-selfhosted` chart | `0.91.1` |
| `vantage-operator` image | `v0.91.1` |

Every value both charts accept at this version, with its type and default. For what the charts do and the values you are most likely to set, see [Helm charts](https://docs.abbyy.com/vantage/self-hosted/v3.0/helm-charts.md). For field-level details of the `Vantage` custom resource, see [API reference](https://docs.abbyy.com/vantage/self-hosted/v3.0/reference/2026.10.16/api-reference.md).

## `vantage-operator`

| Key | Type | Default | Description |
| - | - | - | - |
| certManager.enable | bool | `false` | |
| crd.enable | bool | `true` | |
| crd.keep | bool | `true` | |
| manager.affinity | object | `{}` | |
| manager.args\[0] | string | `"--leader-elect"` | |
| manager.env\[0].name | string | `"POD_NAME"` | |
| manager.env\[0].valueFrom.fieldRef.fieldPath | string | `"metadata.name"` | |
| manager.env\[1].name | string | `"POD_NAMESPACE"` | |
| manager.env\[1].valueFrom.fieldRef.fieldPath | string | `"metadata.namespace"` | |
| manager.image.pullPolicy | string | `"IfNotPresent"` | |
| manager.image.repository | string | `"abyvtgsh.azurecr.io/vantage-operator"` | |
| manager.image.tag | string | `"v0.91.1"` | |
| manager.imagePullSecrets | list | `[]` | |
| manager.nodeSelector | object | `{}` | |
| manager.podSecurityContext.runAsNonRoot | bool | `true` | |
| manager.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
| manager.replicas | int | `1` | |
| manager.resources.limits.cpu | string | `"500m"` | |
| manager.resources.limits.memory | string | `"128Mi"` | |
| manager.resources.requests.cpu | string | `"10m"` | |
| manager.resources.requests.memory | string | `"64Mi"` | |
| manager.securityContext.allowPrivilegeEscalation | bool | `false` | |
| manager.securityContext.capabilities.drop\[0] | string | `"ALL"` | |
| manager.securityContext.readOnlyRootFilesystem | bool | `true` | |
| manager.tolerations | list | `[]` | |
| metrics.enable | bool | `true` | |
| metrics.port | int | `8443` | |
| prometheus.enable | bool | `false` | |
| rbacHelpers.enable | bool | `false` | |

## `vantage-selfhosted`

| Key | Type | Default | Description |
| - | - | - | - |
| defaultSkills | object | `{…}` | Default skill installation: which entries of the bundled catalog (`files/default-skills.yml`, the `defaultSkills` value of the pinned skill-installer-def-installation chart) the skill-installer-operator installs. Installed skills are never removed, so choose the set before the first installation; see `docs/default-skills.md`. |
| defaultSkills.mode | string | `"all"` | `all` installs every version of every catalog skill, `minimal` the newest version of each skill plus the pins in `files/default-skills.minimal.yml`, `custom` only the entries in `skills`. `all` is the only safe default: skills derived from a default skill break without it, so trimming is always explicit. `all` with `vantage.minimalInstall: true` warns in the chart notes. |
| defaultSkills.skills | list | `[]` | Skills to install in `custom` mode, as `{id, versions}` entries. `id` is a catalog skill id. `versions` is optional: omitted installs the newest version, `all` every catalog version, and a list only those version numbers. An unknown id or version fails the render. Ignored in other modes. |
| ingress | object | `{…}` | Ingress configuration |
| ingress.gateway | object | `{…}` | Kubernetes Gateway API (`gateway.networking.k8s.io/v1`) configuration |
| ingress.gateway.annotations | object | `{}` | Additional Gateway annotations (e.g. `cert-manager.io/cluster-issuer` to have cert-manager issue the certificate referenced by `ingress.tls.secretName`) |
| ingress.gateway.certificateRef.createReferenceGrant | bool | `false` | Create a ReferenceGrant in `certificateRef.namespace` allowing the Gateway to use the secret |
| ingress.gateway.certificateRef.namespace | string | `""` | Namespace of the `ingress.tls.secretName` secret, if not the release namespace |
| ingress.gateway.create | bool | `true` | Whether to create the Gateway. Set to false to attach the HTTPRoute to an existing Gateway through `parentRefs`. |
| ingress.gateway.gatewayClassName | string | `""` | GatewayClass that will implement the Gateway (required when creating the Gateway) |
| ingress.gateway.infrastructure | object | `{}` | Gateway `spec.infrastructure` (labels, annotations and parametersRef propagated to the resources the implementation creates, such as the load balancer Service) |
| ingress.gateway.labels | object | `{}` | Additional Gateway labels |
| ingress.gateway.listeners.controllerSuppliedTls | bool | `false` | When `ingress.tls.enabled` is false, use an HTTPS listener without `certificateRefs` (in place of an HTTP listener) for implementations that supply the certificate themselves. Requires `tlsOptions`. |
| ingress.gateway.listeners.httpPort | int | `80` | Port of the HTTP listener |
| ingress.gateway.listeners.httpRedirect | bool | `false` | Add an HTTP listener that redirects to HTTPS (when the Gateway has an HTTPS listener) |
| ingress.gateway.listeners.httpsPort | int | `443` | Port of the HTTPS listener |
| ingress.gateway.listeners.tlsOptions | object | `{}` | `tls.options` of the HTTPS listener (implementation-specific) |
| ingress.gateway.meshIntegrated | bool | `false` | Set to true if the GatewayClass implementation participates in the Istio mesh (e.g. Istio's own Gateway API implementation), allowing STRICT mTLS when `mesh.istio.enabled` is true |
| ingress.gateway.name | string | `"vantage-gateway"` | Name of the Gateway to create |
| ingress.gateway.parentRefs | list | `[]` | Listeners of an existing Gateway to attach the HTTPRoute to, used when `create` is false. The Gateway's `allowedRoutes` must admit routes from the release namespace. |
| ingress.gateway.regexCatchAll | bool | `false` | Render the `/` catch-all route as a RegularExpression match (`/.*`) in place of a PathPrefix match. Set to true for implementations that rank every PathPrefix match above RegularExpression matches (e.g. Istio), where a `/` prefix would shadow the regex routes. |
| ingress.gateway.route.annotations | object | `{}` | Additional HTTPRoute annotations |
| ingress.gateway.route.labels | object | `{}` | Additional HTTPRoute labels |
| ingress.gateway.route.timeouts | object | `{"request":"0s"}` | `timeouts` for HTTPRoute rules. Requires the `HTTPRouteRequestTimeout` feature. Set to `{}` to leave the implementation default. |
| ingress.istio | object | `{…}` | Istio ingress configuration |
| ingress.istio.gateway.annotations | object | `{}` | Additional gateway annotations |
| ingress.istio.gateway.labels | object | `{}` | Additional gateway labels |
| ingress.istio.internalDNSResolution.enabled | bool | `false` | indicates whether we should set up resources in Istio so that calls within the mesh    to the vantage cluster FQDN are routed back through the ingress gateway    (set this to true if `vantage.DNSRecord` does not actually have a public DNS record).    (requires [DNS Proxying](https://istio.io/latest/docs/ops/configuration/traffic-management/dns-proxy)) |
| ingress.kubernetes | object | `{…}` | Native Kubernetes Ingress configuration |
| ingress.kubernetes.annotations | object | `{}` | Additional ingress annotations |
| ingress.kubernetes.ingressClassName | string | `""` | Defines which ingress controller will implement the resource |
| ingress.kubernetes.labels | object | `{}` | Additional ingress labels |
| ingress.kubernetes.nginx | bool | `false` | Set to true if using an ingress class not named "nginx" that implements nginx features (e.g. AKS web app routing) |
| ingress.tls.enabled | bool | `true` | Whether the ingress terminates TLS with a Kubernetes secret. Set to false when the ingress controller supplies the certificate out of band (e.g. an ACM certificate attached to the AWS ALB IngressClassParams). |
| ingress.type | string | `"istio"` | Ingress implementation. One of `native`, `gateway`, `kubernetes`, or `istio`. `native` means if Gateway APIs are available, they will be used; otherwise, the frozen Kubernetes Ingress API will be used. |
| mesh | object | `{…}` | Service mesh configuration |
| mesh.istio.enabled | bool | `true` | Set to `true` to deploy recommended Istio mesh config. |
| observability | object | `{…}` | Observability configuration |
| observability.prometheus | object | `{…}` | Prometheus observability configuration |
| observability.prometheus.namespace | string | `"observability"` | Namespace in which Prometheus instance is installed |
| observability.prometheus.serviceMonitor | object | `{…}` | Prometheus ServiceMonitor configuration |
| observability.prometheus.serviceMonitor.create | bool | `false` | whether to create a Prometheus ServiceMonitor to scrape Vantage application metrics |
| observability.prometheus.serviceMonitor.interval | string | `15s`, or `60s` when `vantage.minimalInstall` is true | how often Prometheus scrapes Vantage application metrics. KEDA's Prometheus scalers read these metrics, so this also bounds how quickly workers can react to queued work. If not set, the default value depends on `vantage.minimalInstall`: `60s` when true; `15s` otherwise. |
| observability.prometheus.serviceMonitor.selectorMatchLabels | object | `{}` | any labels required by Prometheus to register a ServiceMonitor (should match your `Prometheus` CR's `spec.serviceMonitorSelector.matchLabels`) |
| operator.controllerManagerServiceAccount | string | `"vantage-operator-controller-manager"` | |
| operator.namespace | string | `"vantage-operator-system"` | |
| serviceAccounts | object | `{…}` | ServiceAccounts used by Vantage workloads. Each section is optional: set `create: true` to have this chart create the ServiceAccount (in the release namespace) and wire it into the corresponding part of the Vantage CR, set only `vantage.serviceAccountName` / `vantage.ociMigration.serviceAccountName` to reference a ServiceAccount that already exists, or set neither and the corresponding pods run as the namespace's `default` ServiceAccount. Individual workloads will run as the `vantage` ServiceAccount unless specifically configured in `workloads`. |
| serviceAccounts.annotations | object | `{}` | Annotations added to every ServiceAccount this chart creates. Annotations set on an individual ServiceAccount take precedence. |
| serviceAccounts.imagePullSecrets | list | `[]` | Image pull secrets attached to every ServiceAccount this chart creates, in addition to those set on an individual ServiceAccount |
| serviceAccounts.labels | object | `{}` | Labels added to every ServiceAccount this chart creates. Labels set on an individual ServiceAccount take precedence. |
| serviceAccounts.ociMigration | object | `{…}` | ServiceAccount for the OCI migration job (`vantage.ociMigration.serviceAccountName`) |
| serviceAccounts.ociMigration.annotations | object | `{}` | Additional annotations (e.g. `azure.workload.identity/client-id`) |
| serviceAccounts.ociMigration.create | bool | `false` | Whether to create the ServiceAccount |
| serviceAccounts.ociMigration.imagePullSecrets | list | `[]` | Image pull secrets attached to the ServiceAccount |
| serviceAccounts.ociMigration.labels | object | `{}` | Additional labels |
| serviceAccounts.ociMigration.name | string | `""` | Name of the ServiceAccount to create. Defaults to `<release name>-oci-migration`. |
| serviceAccounts.vantage | object | `{…}` | ServiceAccount for the Vantage application workloads (`vantage.serviceAccountName`) |
| serviceAccounts.vantage.annotations | object | `{}` | Additional annotations (e.g. `azure.workload.identity/client-id`) |
| serviceAccounts.vantage.create | bool | `false` | Whether to create the ServiceAccount |
| serviceAccounts.vantage.imagePullSecrets | list | `[]` | Image pull secrets attached to the ServiceAccount |
| serviceAccounts.vantage.labels | object | `{}` | Additional labels |
| serviceAccounts.vantage.name | string | `""` | Name of the ServiceAccount to create. Defaults to the release name. |
| serviceAccounts.workloads | object | `{}` | ServiceAccounts for individual workloads, overriding the `vantage` ServiceAccount, keyed by chart name and then workload kind (`migrator`, `deployment` or `statefulSet`). Each entry supports `create` (default `true`), `name` (default `<chart name without -helm>-<kind>`; required when `create` is `false`), `labels`, `annotations`, `imagePullSecrets` and `roles`. Workloads may share a ServiceAccount by using the same name; entries that create a shared ServiceAccount must configure it identically. Each ServiceAccount is bound to `roles` (default `migration-writer` and `serviceversion-reader` for migrators, `migration-reader` and `serviceversion-reader` otherwise). |
| vantage | object | `{…}` | Vantage CR spec - these values are passed directly to the Vantage custom resource |
| vantage.databaseProvider | string | `"SqlServer"` | Database engine used by all Vantage services. One of "SqlServer" or "PostgreSQL". Case-sensitive: the value is passed straight to each service's `*Database__Provider` and must match the runtime DataProvider name exactly ("PostgreSQL", not "Postgresql"/"PostgreSql"). |
| vantage.debug | bool | `false` | Whether to deploy Vantage workloads in debug mode |
| vantage.dnsRecord | string | `""` | DNS record for the Vantage installation |
| vantage.keda | object | `{…}` | KEDA configuration |
| vantage.keda.enabled | bool | `false` | Whether to use KEDA for autoscaling |
| vantage.mailFrom | string | `""` | Email address used as sender for outgoing emails |
| vantage.minimalInstall | bool | `false` | Whether to deploy Vantage workloads with minimal resource configurations. Pair it with `defaultSkills.mode: minimal` (or `custom`); the full skill set on a minimal install only warns. |
| vantage.ociMigration | object | `{…}` | OCI migration configuration (optional, omit or set enabled: false to skip) |
| vantage.ociMigration.concurrency | int | `5` | Number of artifacts to copy in parallel |
| vantage.ociMigration.destination | object | `{…}` | Destination container registry (customer's registry for mirrored images) |
| vantage.ociMigration.destination.host | string | `"abbyy.com"` | Registry hostname |
| vantage.ociMigration.destination.password | string | `""` | Password for authentication (use credentialsRef for production) |
| vantage.ociMigration.destination.username | string | `""` | Username for authentication (use credentialsRef for production) |
| vantage.ociMigration.enabled | bool | `true` | Enable OCI migration |
| vantage.ociMigration.sources | list | `[…]` | Source registry where Vantage images are pulled from |
| vantage.ociMigration.sources\[0] | object | `{…}` | Registry hostname |
| vantage.ociMigration.sources\[0].password | string | `""` | Password for authentication (use credentialsRef for production) |
| vantage.ociMigration.sources\[0].username | string | `""` | Username for authentication (use credentialsRef for production) |
| vantage.platformAdminEmail | string | `""` | Email address of the platform administrator |
| vantage.reverseProxy | bool | `false` | Whether to configure Vantage to run behind a reverse proxy that terminates TLS. |
| vantage.secrets | object | `{}` | Secrets configuration (exactly one provider must be set: kubernetes or azure). |
| vantage.techcore | object | `{…}` | TechCore processing engine configuration |
| vantage.techcore.nnTrainingWorkers | object | `{…}` | Neural network training workers configuration |
| vantage.techcore.nnTrainingWorkers.enabled | bool | `false` | Enable neural network training workers |
| vantage.techcore.nnTrainingWorkers.gpu | bool | `false` | Enable GPU acceleration for training workers |
| vantage.techcore.versions | list | `[3,4]` | TechCore versions to deploy (available versions are 2, 3, 4). |
| vantage.updatePolicy | object | `{…}` | Update policy for Vantage upgrades |
| vantage.updatePolicy.manual | object | `{}` | Manual upgrades only (install a new operator Helm chart version to upgrade) |
| vantage.vantageVersion | string | `""` | Version of Vantage to install |
| vantage.workloads | object | `{…}` | Workloads ConfigMap configuration |
| vantage.workloads.additionalMetadataKey | string | `"additional-metadata.yml"` | Additional workloads metadata key |
| vantage.workloads.configMap | string | `"vantage-workloads"` | ConfigMap name (if `workloadsConfigMap.create` is true (which is the default), this value will be used as a prefix for the created ConfigMap's name.) |
| vantage.workloads.metadataTemplateKey | string | `"workloads-metadata.yml.gotmpl"` | Workloads metadata template key |
| vantage.workloads.secretsKey | string | `"workloads-secrets.yml.gotmpl"` | Workloads secrets key |
| vantage.workloads.workloadsKey | string | `"workloads.yml"` | Workloads key |
| workloadsConfigMap.additionalMetadata | object | `{}` | Advanced workload configuration. This object will be merged with the rendered workloads metadata. |
| workloadsConfigMap.create | bool | `true` | Whether to create the ConfigMap containing data about charts and images required to install vantage. When this option is `true`, deploying a new chart version will update the Vantage custom resource itself, effectively updating Vantage in-place (works under both `helm install`/`helm upgrade` and GitOps tools that render with `helm template`, e.g. ArgoCD/Flux). |