cerbos
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# Default values for cerbos.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
5
# @schema
6
# type: [string,null]
7
# @schema
8
nameOverride: ""
9
# @schema
10
# type: [string,null]
11
# @schema
12
fullnameOverride: ""
13
# @schema
14
# type: [integer]
15
# default: 1
16
# @schema
17
# Number of Cerbos pods to run
18
replicaCount: 1
19
# @schema
20
# required: false
21
# @schema
22
# Container image details. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image.
23
image:
24
# @schema
25
# default: "ghcr.io.cerbos/cerbos"
26
# @schema
27
# Container image name without the tag.
28
repository: cgr.dev/scratch-images/test-tmp/cerbos
29
# @schema
30
# enum: [IfNotPresent, Always]
31
# default: ["IfNotPresent"]
32
# @schema
33
# Image pull policy.
34
pullPolicy: IfNotPresent
35
# @schema
36
# type: [string,null]
37
# @schema
38
# Image digest to use. Takes precedence over tag if specified.
39
digest: sha256:05a662eec64f14a15604570d34696ad841d03e4b5409ba65e53d3592410973f9
40
# @schema
41
# type: [string,null]
42
# @schema
43
# Image tag to use. Defaults to the chart appVersion.
44
tag: 0.55.0-r6
45
# @schema
46
# type: [array,null]
47
# items:
48
# type: object
49
# properties:
50
# name:
51
# type: string
52
# @schema
53
# Image pull secrets to use if pulling the image from a private container registry. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#containers.
54
imagePullSecrets: []
55
# @schema
56
# type: [array, null]
57
# items:
58
# type: object
59
# additionalProperties: true
60
# @schema
61
# Init containers to inject into the deployment. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#containers.
62
initContainers: []
63
# @schema
64
# required: false
65
# @schema
66
# Service account settings
67
serviceAccount:
68
# @schema
69
# default: true
70
# @schema
71
# Specifies whether a service account should be created.
72
create: true
73
# @schema
74
# type: [object, null]
75
# additionalProperties: true
76
# @schema
77
# Annotations to add to the service account. See https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/object-meta/#ObjectMeta.
78
annotations: {}
79
# @schema
80
# type: [string,null]
81
# @schema
82
# The name of the service account to use.
83
# If not set and create is true, a name is generated using the fullname template
84
name: ""
85
# @schema
86
# type: [object, null]
87
# additionalProperties: true
88
# @schema
89
# Annotations to add to the pod. See https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/object-meta/#ObjectMeta.
90
podAnnotations: {}
91
# @schema
92
# type: [object, null]
93
# additionalProperties: true
94
# @schema
95
# Labels to add to the pod. See https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/object-meta/#ObjectMeta.
96
podLabels: {}
97
# @schema
98
# type: [object, null]
99
# additionalProperties: true
100
# @schema
101
# Common labels to add to the resources. See https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/object-meta/#ObjectMeta.
102
commonLabels: {}
103
# @schema
104
# required: false
105
# @schema
106
# Annotations to add to the deployment. See https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/object-meta/#ObjectMeta.
107
deployment:
108
# @schema
109
# type: [object, null]
110
# additionalProperties: true
111
# @schema
112
annotations: {}
113
# @schema
114
# type: [object, null]
115
# additionalProperties: true
116
# @schema
117
# Security context for the whole pod. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1.
118
podSecurityContext: {}
119
# @schema
120
# type: [object, null]
121
# additionalProperties: true
122
# @schema
123
# Security context for the Cerbos container. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1.
124
securityContext: {}
125
# @schema
126
# type: [object, null]
127
# properties:
128
# limits:
129
# type: object
130
# requests:
131
# type: object
132
# additionalProperties: true
133
# @schema
134
# Resource limits for the pod. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources.
135
resources: {}
136
# limits:
137
# cpu: 100m
138
# memory: 128Mi
139
# requests:
140
# cpu: 100m
141
# memory: 128Mi
142
143
# @schema
144
# type: object
145
# properties:
146
# enabled:
147
# type: boolean
148
# default: false
149
# minReplicas:
150
# type: integer
151
# default: 1
152
# maxReplicas:
153
# type: integer
154
# default: 100
155
# targetCPUUtilizationPercentage:
156
# type: [integer, null]
157
# default: 80
158
# targetMemoryUtilizationPercentage:
159
# type: [integer, null]
160
# additionalProperties: true
161
# @schema
162
# Autoscaling configuration.
163
autoscaling:
164
enabled: false
165
minReplicas: 1
166
maxReplicas: 100
167
targetCPUUtilizationPercentage: 80
168
# @schema
169
# type: [object, null]
170
# additionalProperties: true
171
# @schema
172
# Node selector for the pod. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.
173
nodeSelector: {}
174
# @schema
175
# type: [array, null]
176
# items:
177
# type: object
178
# additionalProperties: true
179
# @schema
180
# Pod tolerations. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.
181
tolerations: []
182
# @schema
183
# type: [object, null]
184
# additionalProperties: true
185
# @schema
186
# Pod affinity rules. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.
187
affinity: {}
188
# @schema
189
# type: [array, null]
190
# items:
191
# type: object
192
# additionalProperties: true
193
# @schema
194
# Topology Spread Constraints rules. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.
195
topologySpreadConstraints: []
196
# @schema type:[array,null]
197
# - topologyKey: topology.kubernetes.io/zone
198
# maxSkew: 1
199
# whenUnsatisfiable: ScheduleAnyway
200
201
# @schema
202
# type: [array, null]
203
# items:
204
# type: object
205
# additionalProperties: true
206
# @schema
207
# Volumes to add to the pod. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes.
208
volumes: []
209
# @schema
210
# type: [array, null]
211
# items:
212
# type: object
213
# additionalProperties: true
214
# @schema
215
# Volume mounts to add to the Cerbos container. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1.
216
volumeMounts: []
217
# @schema
218
# type: [array, null]
219
# items:
220
# type: object
221
# properties:
222
# name:
223
# type: string
224
# value:
225
# type: string
226
# additionalProperties: true
227
# @schema
228
# Environment variables to add to the pod. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables.
229
env: [] # @schema type[array,null]
230
# @schema
231
# type: [array, null]
232
# items:
233
# type: object
234
# additionalProperties: true
235
# @schema
236
# Source environment variables from config maps or secrets. See https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables.
237
envFrom: []
238
# @schema
239
# type: object
240
# properties:
241
# certSpec:
242
# type: [object, null]
243
# @schema
244
# Spec of the cert-manager certificate to create for the Cerbos deployment.
245
# If certSpec is not empty, a cert-manager.io/v1/Certificate resource will be created with its spec populated with values from certSpec.
246
# The certSpec value must be a valid Certificate spec. This Helm chart does not provide any defaults or inject any values into it.
247
# If cerbos.tlsSecretName is defined, it takes precedence over the generated certificate.
248
certManager:
249
certSpec: {}
250
# @schema
251
# enum: [deployment,daemonset]
252
# default: deployment
253
# @schema
254
# Kubernetes workload type to use. Valid values are `deployment` or `daemonset`.
255
type: deployment
256
# @schema
257
# type: [string,null]
258
# @schema
259
# PriorityClassName to set on deployed pods
260
priorityClassName: ""
261
# @schema
262
# required: false
263
# @schema
264
# Cerbos service settings.
265
service:
266
# @schema
267
# enum: [ClusterIP, NodePort, LoadBalancer]
268
# default: ClusterIP
269
# @schema
270
# Service type
271
type: ClusterIP
272
# @schema
273
# default: 3592
274
# @schema
275
# Service HTTP port
276
httpPort: 3592
277
# @schema
278
# default: 3593
279
# @schema
280
# Service gRPC port
281
grpcPort: 3593
282
# @schema
283
# default: 13592
284
# @schema
285
# HTTP node port (if service type is NodePort)
286
httpNodePort: 13592
287
# @schema
288
# default: 13593
289
# @schema
290
# gRPC node port (if service type is NodePort)
291
grpcNodePort: 13593
292
# @schema
293
# type: [object, null]
294
# additionalProperties: true
295
# @schema
296
# Service annotations
297
annotations: {}
298
# @schema
299
# type: [string, null]
300
# @schema
301
# Service Cluster IP
302
clusterIP: null
303
# @schema
304
# type: [string, null]
305
# @schema
306
# LoadBalancer static IP
307
loadBalancerIP: null
308
# @schema
309
# type: [string, null]
310
# @schema
311
# Set the internalTrafficPolicy. If this is unset and .Values.type is set to daemonset, this will default to "Local"
312
internalTrafficPolicy: ""
313
# @schema
314
# enum: ["", PreferClose, PreferSameZone, PreferSameNode]
315
# @schema
316
# Set the trafficDistribution.
317
trafficDistribution: ""
318
# @schema
319
# required: false
320
# @schema
321
# Cerbos deployment settings.
322
cerbos:
323
# Port to expose the http service on.
324
httpPort: 3592
325
# Port to expose the gRPC service on.
326
grpcPort: 3593
327
# @schema
328
# type: [string, null]
329
# @schema
330
# Secret containing the TLS certificate.
331
# Leave empty to disable TLS.
332
# The secret must contain the following keys:
333
# - tls.crt: Required. Certificate file contents.
334
# - tls.key: Required. Private key for the certificate.
335
# - ca.crt: Optional. CA certificate to add to the trust pool.
336
tlsSecretName: ""
337
# Cerbos log level. Valid values are DEBUG, INFO, WARN and ERROR
338
logLevel: INFO
339
# Add Prometheus service discovery annotations to the pod.
340
prometheusPodAnnotationsEnabled: true
341
# @schema
342
# type: [object, null]
343
# additionalProperties: true
344
# @schema
345
# Cerbos config file contents.
346
# Some server settings like server.httpListenAddr, server.grpcListenAddr, server.tls will be overwritten by the chart based on values provided above.
347
config: {}
348
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.