Kubernetes values.yaml Reference
R2026bThe following tables describe all configurable properties in the
values.yaml file, organized by category.
Global Settings
| Property | Description | Default | Required |
|---|---|---|---|
global.debug | Enable debug-level logging for all services. | false | No |
global.image.registry | Container registry to pull images from. Leave empty to use locally loaded images. | (empty) | If using private registry |
global.image.pullPolicy | Kubernetes image pull policy. Values: IfNotPresent, Always, Never. | IfNotPresent | No |
global.image.pullSecrets | List of Kubernetes Secrets of type kubernetes.io/dockerconfigjson for registry authentication. | [] | If using private registry |
global.ingress.controllerName | Ingress controller type. | nginx | No |
global.ingress.annotations | Annotations applied to the Ingress resource. Use this to configure controller-specific behavior (for example, proxy body size limits). | {} | No |
global.ingress.host | Hostname for external access. Must be a DNS name — IP addresses are not accepted. | — | Yes |
global.ingress.url | Full Ingress URL including protocol. If not provided, defaults to https://<host>. | (derived from host) | No |
global.ingress.tls.enabled | Enable TLS on the Ingress. | false | No |
global.ingress.tls.secretName | Name of the Kubernetes TLS Secret containing the certificate and private key. | — | If TLS enabled |
global.volume.create | If true, the chart creates PVCs automatically using the specified StorageClass. | false | No |
global.volume.storageClassName | StorageClass for auto-created PVCs. Also triggers PVC creation if set (even when create is not explicitly true). | — | If create is true |
Image Settings
| Property | Description | Default | Required |
|---|---|---|---|
images.usermanager.tag | Image tag for all User Manager service images. | Use default value | No |
images.usermanager.dbImage | Image name for the User Manager database container. | (chart default) | No |
images.usermanager.serverImage | Image name for the User Manager server container. | (chart default) | No |
images.usermanager.authnzImage | Image name for the User Manager AuthNZ container. | (chart default) | No |
images.usermanager.uiImage | Image name for the User Manager web UI container. | (chart default) | No |
images.issuetracker.tag | Image tag for all Issue Tracker service images. | Use default value | No |
images.issuetracker.serverImage | Image name for the Issue Tracker server container. | (chart default) | No |
images.issuetracker.uiImage | Image name for the Issue Tracker web UI container. | (chart default) | No |
images.polyspaceAccess.tag | Image tag for all Polyspace Access service images. | Use default value | No |
images.polyspaceAccess.dbImage | Image name for the Polyspace Access database container. | (chart default) | No |
images.polyspaceAccess.etlImage | Image name for the Polyspace Access ETL container. | (chart default) | No |
images.polyspaceAccess.webServerImage | Image name for the Polyspace Access web server container. | (chart default) | No |
Volume Settings
| Property | Description | Default | Required |
|---|---|---|---|
volumes.usermanager.db.claimName | PVC name for the User Manager database data folder. | usermanager-db | If using internal DB |
volumes.usermanager.db.subPath | SubPath in the PVC to mount. Use when sharing a single PVC. | — | No |
volumes.polyspaceAccess.db.claimName | PVC name for the Polyspace Access database data folder. | polyspace-access-db | If using internal DB |
volumes.polyspaceAccess.db.subPath | SubPath in the PVC to mount. | — | No |
volumes.polyspaceAccess.etl.claimName.storage | PVC name for processed analysis results. | polyspace-access-storage | Yes |
volumes.polyspaceAccess.etl.claimName.invalid | PVC name for results that failed import. | polyspace-access-invalid | Yes |
volumes.polyspaceAccess.etl.claimName.working | PVC name for ETL temporary working folder. | polyspace-access-working | Yes |
volumes.polyspaceAccess.etl.claimName.upload | PVC name for uploaded results awaiting processing. | polyspace-access-upload | Yes |
volumes.polyspaceAccess.etl.subPath.* | SubPath values (storage, invalid, working, upload) for sharing a single PVC across ETL mounts. | — | No |
volumes.polyspaceAccess.webServer.claimName.tempUpload | PVC name for in-progress upload staging. | polyspace-access-temp-upload | Yes |
volumes.polyspaceAccess.webServer.claimName.download | PVC name for files prepared for user download. | polyspace-access-download | Yes |
volumes.polyspaceAccess.webServer.subPath.* | SubPath values (tempUpload, download) for sharing a single PVC across web server mounts. | — | No |
User Manager Settings
| Property | Description | Default | Required |
|---|---|---|---|
usermanager.db.external.enabled | Use an external PostgreSQL instance instead of the bundled database container. | false | No |
usermanager.db.external.host | Hostname or IP of the external PostgreSQL server. | — | If external enabled |
usermanager.db.external.port | Port of the external PostgreSQL server. | — | If external enabled |
usermanager.server.config.accessToken.expirationSec | Duration in seconds of the signed tokens issued to authenticated users. This value determines the session lifetime. When a user logs in, a license is checked out and the session refreshes periodically. If the browser closes unexpectedly, the license remains checked out until the session expires. A shorter duration causes more frequent license check-ins and check-outs. A longer duration might overestimate session time in license logs. | 86400 | No |
usermanager.server.config.db.username | PostgreSQL role for the User Manager database. | um | Yes |
usermanager.server.config.db.password | Password for the User Manager database role. | — | Yes |
usermanager.server.config.db.timeoutNanoSeconds | Database connection timeout in nanoseconds. | 20000000000 (20s) | No |
usermanager.server.config.db.sslEnabled | Require SSL for the database connection. Set to true for managed services (RDS, Azure). | false | No |
usermanager.server.config.adminIds | List of user IDs granted administrator privileges. | [admin] | Yes |
usermanager.server.config.adminInitialPassword | Initial password set for admin users on first deployment. | — | Yes |
usermanager.server.config.providers | Array of LDAP identity provider configurations. See the Identity Provider section for structure. | — | If using LDAP |
usermanager.server.config.apiKeys | Map of API keys for programmatic access. Each key maps to a principal (user ID). | — | No |
usermanager.server.config.saml.enabled | Enable SAML authentication. | false | No |
usermanager.server.config.saml.metadataUrl | URL of the identity provider's SAML metadata XML. | — | If SAML enabled |
usermanager.server.config.saml.relyingParty | Entity ID / Audience URI registered with the identity provider. | — | If SAML enabled |
usermanager.server.config.saml.binding | SAML binding method (HTTP-POST or HTTP-Redirect URN). | — | If SAML enabled |
usermanager.server.config.saml.corsDomain | Origin URL of the identity provider for CORS. | — | If SAML enabled |
usermanager.server.config.saml.user.id | SAML assertion attribute mapping to user ID. | uname | If SAML enabled |
usermanager.server.config.saml.user.displayName | SAML assertion attribute mapping to display name. | uname | If SAML enabled |
usermanager.server.config.saml.user.email | SAML assertion attribute mapping to email. | email | If SAML enabled |
usermanager.server.config.saml.user.image | SAML assertion attribute mapping to profile image. | image | No |
usermanager.server.authPrivateKey.secret.name | Name of the Kubernetes Secret containing the authentication private key (PEM). | auth-private-key | Yes |
usermanager.server.authPrivateKey.secret.key | Key in the Secret for the private key file. | auth-private-key.pem | Yes |
usermanager.server.tls.enabled | Enable TLS for the User Manager server (required for LDAPS or DB SSL with private CA). | false | No |
usermanager.server.tls.ca.secretName | Name of the Secret containing the CA certificate. | — | If TLS enabled |
usermanager.server.tls.ca.key | Key in the Secret for the CA certificate file. | — | If TLS enabled |
Polyspace Access Settings
| Property | Description | Default | Required |
|---|---|---|---|
polyspaceAccess.db.passwordString | Plaintext password for the prs_data database role. Used when installing with the internal database or when you do not want to use a Secret reference. | — | If not using passwordSecret |
polyspaceAccess.db.passwordSecret.name | Name of the Kubernetes Secret containing the database password. Preferred over passwordString. | — | If not using passwordString |
polyspaceAccess.db.passwordSecret.key | Key in the Secret that holds the password value. | — | If using passwordSecret |
polyspaceAccess.db.external.enabled | Use an external PostgreSQL instance instead of the bundled database container. | false | No |
polyspaceAccess.db.external.host | Hostname or IP of the external PostgreSQL server. | — | If external enabled |
polyspaceAccess.db.external.port | Port of the external PostgreSQL server. | — | If external enabled |
polyspaceAccess.db.external.passwordSecret.name | Name of the Secret containing the external database password. | — | If external enabled |
polyspaceAccess.db.external.passwordSecret.key | Key in the Secret for the external database password. | — | If external enabled |
polyspaceAccess.webServer.license.secretName | Name of the Kubernetes Secret containing the MathWorks license file. | mw-license | Yes |
polyspaceAccess.webServer.license.key | Key in the Secret for the license file. | license.lic | Yes |
Issue Tracker Settings
| Property | Description | Default | Required |
|---|---|---|---|
issuetracker.enabled | Deploy the Issue Tracker service. | false | No |
issuetracker.server.provider | Issue tracker provider. Values: none, jira, polarion, redmine. | none | If enabled |
issuetracker.server.configSecret.name | Name of a Secret containing the issue tracker configuration JSON. Takes precedence over inline config values. | — | No |
issuetracker.server.configSecret.key | Key in the Secret for the configuration JSON file. | — | If using configSecret |
issuetracker.server.config.url | Base URL of your issue tracker instance. | — | If enabled (inline config) |
issuetracker.server.config.jiraType | Jira deployment type. Values: server, cloud, dataCenter. | — | If provider is jira |
issuetracker.server.config.authnMethod | Authentication method for Jira. Values: cookie (server only), oauth1, oauth2 (cloud/dataCenter). | — | If provider is jira |
issuetracker.server.config.authnConfig.consumerKey | OAuth1 consumer key registered in Jira. | — | If authnMethod is oauth1 |
issuetracker.server.config.authnConfig.callbackBaseURL | OAuth1 callback URL base. | — | If authnMethod is oauth1 |
issuetracker.server.config.authnConfig.privateKeyPath | Path to the OAuth1 private key in the container. | — | If authnMethod is oauth1 |
issuetracker.server.config.authnConfig.clientId | OAuth2 client ID. | — | If authnMethod is oauth2 |
issuetracker.server.config.authnConfig.clientSecret | OAuth2 client secret. | — | If authnMethod is oauth2 |
issuetracker.server.config.authnConfig.redirectURL | OAuth2 redirect URL. | — | If authnMethod is oauth2 |
issuetracker.server.config.authnConfig.scopes | OAuth2 scopes (Jira Cloud only). | [] | If oauth2 + cloud |
issuetracker.server.config.authnConfig.siteURL | Jira Cloud site URL for OAuth2. | — | If oauth2 + cloud |
issuetracker.server.config.apiKey | API key for Polarion or Redmine authentication. | — | If provider is polarion or redmine |
Resource Requests and Limits
Each service component supports resources.requests and
resources.limits for CPU and memory. The following
table lists all resource keys and their defaults.
| Component | CPU Request | Memory Request | Memory Limit |
|---|---|---|---|
usermanager.db | 125m | 100Mi | 250Mi |
usermanager.authnz | 125m | 100Mi | 250Mi |
usermanager.server | 125m | 100Mi | 250Mi |
usermanager.ui | 125m | 100Mi | 250Mi |
issuetracker.server | 125m | 100Mi | 250Mi |
issuetracker.ui | 125m | 100Mi | 250Mi |
polyspaceAccess.db | 4 | 32Gi | 32Gi |
polyspaceAccess.etl | 4 | 32Gi | 32Gi |
polyspaceAccess.webServer | 4 | 32Gi | 32Gi |
Adjust the polyspaceAccess component limits based on
the number of concurrent users and the size of analysis results being
processed. The User Manager and Issue Tracker services are lightweight and
typically do not require adjustment.
See Also
Configure Polyspace Access on Kubernetes | Install Polyspace Access on Kubernetes
