affinity | object | {"podAntiAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": [{"labelSelector": {"matchLabels": {"app.kubernetes.io/name": "agent-sandbox"}}, "topologyKey": "kubernetes.io/hostname"}]}} | Additional controller pod affinity rules; the default keeps the two replicas on separate nodes. |
containerSecurityContext | object | {"privileged": false, "allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "capabilities": {"drop": ["ALL"]}} | Controller container security context. |
controller | object | — | Controller-runtime behavior. Leader election, core-only mode, and auto-suspension support are fixed on; listeners are fixed at metrics 8080, health 8081, webhook 9443, and internal lifecycle 8090. |
controller.cacheLabelSelectors * | boolean | true | Restricts Pod and Service caches to controller-owned objects. |
controller.clusterDomain * | string | "cluster.local" | Kubernetes DNS cluster domain used for webhook certificates. (non-empty) |
controller.sandboxConcurrentWorkers * | integer | 100 | Maximum concurrent Sandbox reconciliations. (min 1, max 1000) |
controller.webhookServiceName * | string | "agent-sandbox-webhook-service" | Service name embedded in generated webhook certificates. |
enabled | boolean | — | Umbrella condition flag (the hiloop chart’s Chart.yaml condition agent-sandbox.enabled). Has no effect in a standalone install. |
fullnameOverride | string | "agent-sandbox-controller" | Full override for generated resource names. |
global | object | — | Values shared across Hiloop charts. |
global.imagePullSecrets | array | [] | Image pull secrets attached to controller pods. |
global.imageRegistry | string | "" | Registry prefix used to relocate the controller image. |
global.sizing | | "medium" | Shared controller size preset. |
image | object | — | Patched controller image identity. |
image.digest * | string | "" | Required immutable SHA-256 image digest. |
image.pullPolicy * | Always | IfNotPresent | Never | "IfNotPresent" | Kubernetes image pull policy. |
image.repository * | string | "ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/agent-sandbox-controller" | OCI repository containing the controller image. (non-empty) |
image.tag * | string | "" | Optional human-readable image tag; the digest remains authoritative. |
nameOverride | string | "" | Partial override for generated resource names. |
nodeSelector | object | {} | Node labels required by controller pods. |
podAnnotations | object | {} | Additional pod annotations. |
podLabels | object | {} | Additional controller pod labels. |
podSecurityContext | object | {"runAsNonRoot": true, "runAsUser": 65532, "runAsGroup": 65532, "fsGroup": 65532, "fsGroupChangePolicy": "OnRootMismatch", "seccompProfile": {"type": "RuntimeDefault"}} | Pod-level security context. |
rbac | object | — | Controller RBAC settings. |
rbac.create * | | true | Creates the least-privilege core Sandbox RBAC rules. |
replicaCount | integer | null | null | Explicit controller replica count; null uses the size preset. (min 1) |
resources | object | null | null | Explicit controller resource requests and limits; null uses the size preset. |
serviceAccount | object | — | Controller ServiceAccount settings. |
serviceAccount.annotations * | object | {} | Additional ServiceAccount annotations. |
serviceAccount.create * | | true | Creates the required controller ServiceAccount. |
sizing | | "" | Chart-local controller size preset; empty inherits global.sizing. |
terminationGracePeriodSeconds | integer | 30 | Grace period for leader handoff during termination. (min 1) |
tolerations | array | [] | Taints tolerated by controller pods. |