Skip to main content

Registry Server Helm values

Configure the Registry Server deployment with these Helm values.

This reference lists values declared in the chart's default values.yaml. Templates can also accept optional settings and inherited global values.

Chart: toolhive-registry-server. Chart version: 1.5.3. Source: values.yaml at v1.5.3.

Values​

replicaCount​

Type: int

Default: 1

Number of Registry Server pod replicas.

image.registryServerUrl​

Type: string

Default: "ghcr.io/stacklok/thv-registry-api:v1.5.3"

Registry Server container image reference, including the tag or digest.

image.pullPolicy​

Type: string

Default: "IfNotPresent"

Image pull policy for the Registry Server container.

imagePullSecrets​

Type: list

Default: []

References to Secrets in the release namespace used to pull private container images.

nameOverride​

Type: string

Default: ""

Override the chart name used in resource labels and generated names.

fullnameOverride​

Type: string

Default: ""

Override the generated name of the Deployment, Service, and related resources.

serviceAccount.create​

Type: bool

Default: true

Create the ServiceAccount named by serviceAccount.name. Set to false to use an existing ServiceAccount.

serviceAccount.annotations​

Type: object

Default: {}

Annotations on the ServiceAccount created by this chart.

serviceAccount.name​

Type: string

Default: "toolhive-registry-server"

ServiceAccount name used by the pods and RBAC bindings. When serviceAccount.create is false, this account must already exist in the release namespace.

podAnnotations​

Type: object

Default: {}

Additional annotations on Registry Server pods.

podLabels​

Type: object

Default: {}

Additional labels on Registry Server pods.

podSecurityContext​

Type: object

Default: {}

Kubernetes security context applied to Registry Server pods.

securityContext​

Type: object

Default value
allowPrivilegeEscalation: false
capabilities:
  drop:
    - ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65535
seccompProfile:
  type: RuntimeDefault

Kubernetes security context applied to the Registry Server container.

service.type​

Type: string

Default: "ClusterIP"

Kubernetes Service type. External Service types also expose the internal port when service.exposeInternalPort is true.

service.port​

Type: int

Default: 8080

Service port for the Registry Server API, forwarding to container port 8080.

service.exposeInternalPort​

Type: bool

Default: true

Publish the internal listener through the Service. This listener serves health checks and metrics without authentication, audit logging, or rate limiting. Set to false to omit it from the Service; Kubernetes probes still reach the container directly. With an externally accessible Service type, enabling this setting also exposes the internal listener externally.

service.internalPort​

Type: int

Default: 8081

Service port forwarding to the internal listener on container port 8081. Applies when service.exposeInternalPort is true. Changing this value changes the Service port; the container port stays at 8081 with the default listener settings.

service.annotations​

Type: object

Default: {}

Annotations on the Registry Server Service.

resources​

Type: object

Default: {"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}

CPU and memory requests and limits for the Registry Server container.

livenessProbe​

Type: object

Default: {"httpGet":{"path":"/health","port":"internal-http"},"initialDelaySeconds":30,"periodSeconds":10}

Kubernetes liveness probe for the Registry Server container.

readinessProbe​

Type: object

Default value
httpGet:
  path: /readiness
  port: internal-http
initialDelaySeconds: 5
periodSeconds: 5

Kubernetes readiness probe for the Registry Server container.

nodeSelector​

Type: object

Default: {}

Node labels that Registry Server pods require for scheduling.

tolerations​

Type: list

Default: []

Tolerations that allow Registry Server pods to be scheduled on tainted nodes.

affinity​

Type: object

Default: {}

Node and pod affinity rules for scheduling Registry Server pods.

initContainers​

Type: list

Default: []

Init container specifications run before the Registry Server container. Each init container defines its own volume mounts and can mount volumes declared in extraVolumes, for example to prepare a PostgreSQL password file.

config​

Type: object

Default value
auth:
  mode: anonymous
database:
  database: toolhive_registry
  host: ''
  port: 5432
  sslMode: require
  user: thv_user
registries:
  - name: default
    sources:
      - toolhive
sources:
  - git:
      branch: main
      path: pkg/catalog/toolhive/data/registry-upstream.json
      repository: https://github.com/stacklok/toolhive-catalog.git
    name: toolhive
    syncPolicy:
      interval: 30m

Registry Server configuration rendered into a Kubernetes ConfigMap. This block accepts application configuration fields beyond the defaults shown here. See Configuration for sources, registries, and sync policies, and Database for database settings. Supply passwords through Secret-backed environment variables rather than this block.

extraEnv​

Type: list

Default: []

Additional environment variables for the Registry Server container. Use valueFrom.secretKeyRef to supply passwords from Kubernetes Secrets.

extraEnvFrom​

Type: list

Default: []

ConfigMap or Secret references whose keys become environment variables in the Registry Server container.

extraVolumes​

Type: list

Default: []

Additional Kubernetes volumes available to the Registry Server pod. Mount them with extraVolumeMounts or an init container's volumeMounts.

extraVolumeMounts​

Type: list

Default: []

Additional volume mounts for the Registry Server container, referencing volumes declared in extraVolumes.

rbac​

Type: object

Default: {"allowedNamespaces":[],"scope":"cluster"}

Kubernetes role-based access control (RBAC) settings for watching ToolHive resources and Services.

rbac.scope​

Type: string

Default: "cluster"

Scope of permissions to watch ToolHive resources and Services. cluster creates a ClusterRoleBinding for all namespaces. namespace creates a RoleBinding in each namespace listed in rbac.allowedNamespaces and restricts the server's watches to those namespaces.

rbac.allowedNamespaces​

Type: list

Default: []

Namespaces to watch when rbac.scope is namespace. This list must be nonempty for namespace scope and empty for cluster scope.