api Helm chart

hiloop control-plane API. REST session surface (mint / refresh / logout / public JWKS). Source chart version 0.11.13. Published OCI artifacts use the immutable version from the deployment release record:

helm install api oci://<your-registry>/charts/api \
  --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}"

Values

Keys marked * are required. Defaults are the chart’s values.yaml; per-environment overlays (values-onprem.yaml, values-saas.yaml) and the deployment set the rest.

Key	Type	Default	Description
`affinity`	`object`	`{}`	Affinity/anti-affinity rules for pod scheduling.
`checkpointStore`	`object`	—	Memory-checkpoint durability receipts: on stop, the API arms the capture instruction and polls this store for the sandbox-restore node agent’s receipt before releasing compute. Must be the same base URL the sandbox-restore chart is configured with. Empty disables the memory-capture lane: every stop is a plain filesystem stop.
`checkpointStore.url`	`string`	`""`	Object-store base URL checkpoint receipts are published under. Credentials come from the pod’s ambient identity.
`containerSecurityContext`	`object`	`{"allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "capabilities": {"drop": ["ALL"]}, "seccompProfile": {"type": "RuntimeDefault"}}`	Container-level securityContext (read-only root FS, no privilege escalation, all caps dropped).
`database`	`object`	—	Identity-store DB connection. Every api surface is database-backed, so this is required.
`database.auth` *	`password` \| `iam`	`"password"`	Credential mechanism: password (static DSN Secret) or iam (RDS IAM SigV4 token).
`database.existingSecret` *	`string`	`"api-db"`	password auth: name of the Secret holding the DSN. (non-empty)
`database.secretKey` *	`string`	`"dsn"`	password auth: key within existingSecret holding the DSN. (non-empty)
`databaseMigration`	`object`	—	Blocking database bootstrap for disconnected installs. When enabled, Helm waits for one digest-pinned db-migrator Job to apply the embedded core and telemetry migrations before creating or updating API resources.
`databaseMigration.activeDeadlineSeconds` *	`integer`	`900`	Hard deadline for the blocking migration Job. Helm fails the release if the Job does not finish. (min 60, max 3600)
`databaseMigration.backoffLimit` *	`integer`	`3`	Pod retries for transient failures. Migration bootstrap and ledger operations are idempotent. (min 0, max 10)
`databaseMigration.credentials` *	`object`	—	Keys in one pre-created Secret holding the privileged bootstrap connection, migration-owner password, and application-role DSNs.
`databaseMigration.credentials.databaseKey` *	`string`	`"pg-database"`	Secret key containing an existing database used for the bootstrap connection. (non-empty)
`databaseMigration.credentials.existingSecret` *	`string`	`""`	Pre-created Secret read only by the one-shot migration Job. Required when enabled.
`databaseMigration.credentials.hostKey` *	`string`	`"pg-host"`	Secret key containing the PostgreSQL bootstrap host. (non-empty)
`databaseMigration.credentials.ownerPasswordKey` *	`string`	`"owner-password"`	Secret key containing the dedicated migration-owner password. (non-empty)
`databaseMigration.credentials.passwordKey` *	`string`	`"pg-password"`	Secret key containing the PostgreSQL bootstrap password. (non-empty)
`databaseMigration.credentials.portKey` *	`string`	`"pg-port"`	Secret key containing the PostgreSQL bootstrap port. (non-empty)
`databaseMigration.credentials.roleDsnsKey` *	`string`	`"role-dsns"`	Secret key containing comma-separated password DSNs for application roles to provision. (non-empty)
`databaseMigration.credentials.userKey` *	`string`	`"pg-user"`	Secret key containing the PostgreSQL bootstrap role. (non-empty)
`databaseMigration.enabled` *	`boolean`	`false`	Run the db-migrator as a blocking pre-install/pre-upgrade Helm Job. Leave disabled when an external deployment controller already orders migrations.
`databaseMigration.image` *	`object`	—	Immutable db-migrator image containing the exact migration source packaged with this release.
`databaseMigration.image.digest` *	`string`	`""`	Immutable lowercase sha256 digest. Required when the migration Job is enabled.
`databaseMigration.image.provenanceRevision` *	`string`	`""`	Signed Git source revision for the exact db-migrator digest. The disconnected bundle requires it to equal the packaged migration source revision.
`databaseMigration.image.pullPolicy` *	`Always` \| `IfNotPresent` \| `Never`	`"IfNotPresent"`	Kubelet pull policy for the db-migrator image.
`databaseMigration.image.repository` *	`string`	`"ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/db-migrator"`	db-migrator image repository. global.imageRegistry relocates its registry host for private mirrors. (non-empty)
`databaseMigration.image.tag` *	`string`	`""`	Optional display tag. The enabled migration Job always requires and runs the digest.
`databaseMigration.resources` *	`object`	`{"requests": {"cpu": "25m", "memory": "32Mi"}, "limits": {"memory": "128Mi"}}`	CPU and memory requests/limits for the one-shot db-migrator container.
`databaseMigration.tls` *	`object`	—	Certificate-verifying PostgreSQL TLS configuration for every bootstrap and migration connection.
`databaseMigration.tls.caExistingSecret` *	`string`	`""`	Immutable, version-named Secret containing the customer PostgreSQL CA bundle. Required when enabled.
`databaseMigration.tls.caKey` *	`string`	`"ca.crt"`	Secret key containing the PEM CA bundle. (non-empty)
`databaseMigration.tls.sslMode` *	`verify-ca` \| `verify-full`	`"verify-full"`	PostgreSQL TLS verification mode. verify-full also verifies the configured hostname.
`deviceVerificationBase`	`string`	`""`	Base URL of the web console activation page returned by the device authorization endpoint. Empty means this deployment serves no browser sign-in page, so device login is refused with guidance to use an API key instead; a deployment that advertises a console it does not serve issues codes nobody can approve. A non-empty value must be an absolute http(s) URL — it is handed to users verbatim as the address to visit.
`disruptionClass`	`edge-critical` \| `data-path` \| `singleton-controller` \| `node-infra` \| `disposable`	`"edge-critical"`	Availability class this workload declares; the chart derives the PodDisruptionBudget, replica anti-affinity, rollout strategy, and scheduling priority from it. The API serves the request path, so it ships as edge-critical — keep the class and use disruptionOverrides for deliberate deviations.
`disruptionOverrides`	`object`	—	Explicit, justified deviations from the declared disruption class.
`disruptionOverrides.justification`	`string`	`""`	Reason for running below the class’s availability posture (e.g. a single-replica install on a one-node cluster). Non-empty allows the reduced posture and is stamped on the workload as the hiloop.ai/disruption-override annotation.
`env`	`local` \| `test_e2e` \| `dev` \| `staging` \| `production` \| `onprem`	`"local"`	Deployment profile (HILOOP_ENV) selecting offline fakes vs. hosted real adapters.
`firstKey`	`object`	—	First API key bootstrap for direct/disconnected installs: a post-install hook Job mints the deployment’s first organization and an organization-scoped API key once, writing the key material only into the named Kubernetes Secret (fields: api-key, org-id) — never to stdout or logs. Re-runs never re-mint; rotation is an explicit operator step. Requires database.auth=password; IAM-auth installs disable it.
`firstKey.activeDeadlineSeconds` *	`integer`	`900`	Hard deadline for the blocking mint Job, retries included. Raise for air-gapped or slow-mirror registries. (min 60, max 3600)
`firstKey.enabled` *	`boolean`	`true`	Run the post-install mint Job. Hosted environments provision their first credentials through the deploy pipeline and disable this; the mint command additionally refuses hosted profiles.
`firstKey.existingSecret` *	`string`	`""`	Pre-created Secret carrying your own key material: set to skip generation entirely — no mint Job renders and the retrieval instructions point at this Secret instead. The material must correspond to a key record that already exists in the database; the chart does not create one for it.
`firstKey.ownerEmail` *	`string`	`""`	Email address of the human who administers this deployment. Required when enabled: they become the deployment’s owner and the minted key is scoped to their organization, so the install has an owner rather than an unroutable placeholder. Once an identity provider is configured, their first sign-in with this address resolves to this same owner. Changing it later does not move ownership: the mint fails closed, naming the provisioned address, rather than creating a second owner. Empty is rejected at render time; installs bringing their own key set existingSecret instead.
`firstKey.secretName` *	`string`	`"hiloop-first-api-key"`	Kubernetes Secret (in the release namespace) the minted key lands in. The only copy of the key — include it in your cluster backups. (non-empty)
`global`	`object`	—	Cross-chart settings shared by every image in the install.
`global.imagePullSecrets`	`array`	`[]`	Pull secrets applied to every pod for private/mirrored registries.
`global.imageRegistry`	`string`	`""`	Registry host that relocates every image at once (air-gapped mirrors). Empty = use the registry baked into image.repository.
`global.secretEgress.clusterIP` *	`string`	`""`	Deployment-owned stable IPv4 ClusterIP shared by the relay Service and capture attachment.
`global.secretEgress.enabled` *	`boolean`	`false`	Enable the complete proof-bound secret-egress capability: API release listener, capture attachment, relay data plane, and exact network admission.
`global.secretEgress.publicProfileOnly` *	`boolean`	`false`	Require proof-bound secret relay clients to carry the public sandbox network profile. Keep false only while upgrading existing clients to profile labels.
`image`	`object`	—	Container image for the API.
`image.digest`	`string`	`""`	Image digest (sha256:…); pinned in prod and preferred over tag when set.
`image.pullPolicy`	`Always` \| `IfNotPresent` \| `Never`	`"IfNotPresent"`	kubelet image pull policy.
`image.repository` *	`string`	`"ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/api"`	Image repository (registry/path) for the API container. (non-empty)
`image.tag`	`string`	`""`	Image tag; fallback when digest is unset. CI sets one of tag/digest.
`internalRoute`	`object`	—	East-west exposure of the REST surface via an internal (ClusterIP-only) Gateway listener, so in-cluster callers reach the same ext_authz edge without leaving the cluster. Default off.
`internalRoute.enabled`	`boolean`	`false`	Create the internal HTTPRoute(s) attaching the REST surface to the internal Gateway.
`internalRoute.hostname`	`string`	`""`	In-cluster Host header the internal listener matches (e.g. api.hiloop.internal); required when enabled. Not a public DNS name.
`internalRoute.parentRef`	`object`	—	Internal Gateway listener the HTTPRoute attaches to.
`internalRoute.parentRef.name`	`string`	`"eg-internal"`	Internal Gateway resource name. (non-empty)
`internalRoute.parentRef.namespace`	`string`	`"envoy-gateway-system"`	Namespace of the internal Gateway. (non-empty)
`internalRoute.parentRef.sectionName`	`string`	`"http"`	Internal Gateway listener (section) name to attach to. (non-empty)
`internalRoute.publicPathPrefixes`	`array`	`["/.well-known/", "/auth/login/", "/auth/device/", "/session/", "/v1/config"]`	Path prefixes served by a sibling internal route with NO SecurityPolicy so they stay reachable in-cluster (JWKS + the OAuth/RFC 8628 login bootstrap + the session lifecycle at /session/ — switch/refresh/memberships/logout) + the pre-credential /v1/config discovery document. Every path here authenticates on a body-carried token verified server-side (a WorkOS or refresh token), never on the edge bearer.
`networkPolicy`	`object`	—	Direct-service trust fence. The chart always renders an ingress NetworkPolicy restricting ClusterIP access to the API HTTP listener, because the API derives the caller’s organization from identity headers its edge stamps and cannot tell a forged one from a stamped one.
`networkPolicy.ingressFrom`	`array`	`[]`	Additional peers permitted to reach the API HTTP listener, beyond the Envoy data planes of the enabled routes and the authz JWKS caller. Deployments whose edge this chart does not manage (self-hosted installs behind the operator’s own ingress controller) must declare that edge here; the onprem profile fails to render while it is empty.
`nodeSelector`	`object`	`{}`	Node selector constraining pod scheduling to matching nodes.
`observability`	`object`	—	OTLP telemetry export configuration.
`observability.enabled`	`boolean`	`true`	Inject OTLP/RUST_LOG env so the binary exports telemetry.
`observability.otlpEndpoint`	`string`	`"http://otel-collector-agent.monitoring.svc.cluster.local:4317"`	OTEL_EXPORTER_OTLP_ENDPOINT the collector listens on (gRPC). (non-empty)
`observability.resourceAttributes`	`string`	`"service.namespace=hiloop"`	OTEL_RESOURCE_ATTRIBUTES (comma-separated key=value pairs).
`observability.rustLog`	`string`	`"info"`	RUST_LOG filter directive for log verbosity. (non-empty)
`observability.serviceName`	`string`	`"api"`	OTEL_SERVICE_NAME for emitted spans/metrics. (non-empty)
`onboarding`	`object`	—	First-login onboarding gate for creating a NEW workspace. Logins that join an existing organization (SSO or a verified email domain) and repeat logins are never gated.
`onboarding.allowlist`	`array`	`[]`	Identities allowed to create a new workspace in invite_only mode: exact emails (ada@example.com) and/or whole domains (example.com) (HILOOP_ONBOARDING_ALLOWLIST).
`onboarding.mode`	`open` \| `invite_only`	`"open"`	open lets any authenticated identity create a new workspace on first login; invite_only restricts it to the allowlist and denies everyone else with a request-access error (HILOOP_ONBOARDING_MODE). Flipping invite_only to open is a launch step: complete the terms-of-service acceptance review first.
`podSecurityContext`	`object`	`{"runAsNonRoot": true, "runAsUser": 65532, "fsGroup": 65532}`	Pod-level securityContext (runs non-root as the distroless uid 65532).
`probes`	`object`	—	Readiness/liveness probes (tcpSocket on the REST port, the api’s only listener).
`probes.enabled`	`boolean`	`true`	Set readiness and liveness probes on the container.
`probes.initialDelaySeconds`	`integer`	`5`	Delay before the first probe runs. (min 0)
`probes.periodSeconds`	`integer`	`10`	Interval between probes. (min 1)
`publicRateLimit`	`object`	—	Per-client-IP rate limits on pre-authentication routes. The bootstrap policy is optional; the proof-bound workload mint always retains a separate mandatory policy with no automatic retry. Counters are kept per gateway proxy replica, so the effective ceiling is up to the proxy replica count times the configured limit. Rendered only when route.enabled.
`publicRateLimit.enabled` *	`boolean`	`true`	Attach the per-client-IP rate limit to the public login/bootstrap route. The dedicated workload-mint rate limit remains enabled. Over-limit requests receive a plain 429 from the gateway.
`publicRateLimit.requestsPerMinute` *	`integer`	`60`	Requests per minute allowed per client IP on each pre-authentication rate policy, including workload token mint. Device-flow token polling at the advertised 5-second interval uses 12 requests per minute per flow, so the default of 60 accommodates several concurrent flows behind one shared egress IP. (min 1)
`quotas`	`object`	—	Per-organization product quota defaults enforced at the API boundary. Organization-specific overrides take precedence.
`quotas.rate` *	`object`	—	Per-organization token buckets for run starts.
`quotas.rate.mode` *	`off` \| `shadow` \| `enforce`	`"enforce"`	enforce rejects an over-rate request with rate_limited and Retry-After; shadow records the would-be rejection; off disables the buckets.
`quotas.rate.runStart` *		`{"perMinute": 60, "burst": 30}`	Run starts allowed per organization.
`quotas.sandbox` *	`object`	—	Default running and retained sandbox caps for an organization.
`quotas.sandbox.maxRunning` *	`integer`	`10`	Sandboxes one organization may run concurrently. (min 1)
`quotas.sandbox.maxTotal` *	`integer`	`50`	Running and stopped sandboxes one organization may retain. Must be at least maxRunning. (min 1)
`quotas.storage` *	`object`	—	Per-organization volume storage cap.
`quotas.storage.maxVolumeBytes` *	`integer`	`2199023255552`	Committed volume bytes allowed per organization. (min 1)
`quotas.storage.mode` *	`off` \| `shadow` \| `enforce`	`"enforce"`	enforce rejects a write over the organization byte limit; shadow records the would-be rejection; off disables the cap.
`replicaCount`	`integer`	—	Override the pod count from the sizing preset. The API is stateless, so run >1 for HA. Counts below the availability floor of the declared disruptionClass require disruptionOverrides.justification. (min 1)
`resources`	`object`	—	Override the container resource requests/limits from the sizing preset. Set this for full control (e.g. very large deployments).
`resources.limits`	`object`	—	Maximum CPU/memory the container may use.
`resources.requests`	`object`	—	Minimum CPU/memory reserved for scheduling.
`route`	`object`	—	North-south exposure of the REST surface via a Gateway API HTTPRoute on the shared Envoy Gateway.
`route.enabled`	`boolean`	`false`	Create the HTTPRoute(s) attaching the REST surface to the Gateway.
`route.hostname`	`string`	`""`	Public hostname for the route (e.g. api.staging.hiloop.ai); required when enabled.
`route.parentRef`	`object`	—	Gateway listener the HTTPRoute attaches to.
`route.parentRef.name`	`string`	`"eg"`	Gateway resource name. (non-empty)
`route.parentRef.namespace`	`string`	`"envoy-gateway-system"`	Namespace of the Gateway. (non-empty)
`route.parentRef.sectionName`	`string`	`"https"`	Gateway listener (section) name to attach to (e.g. https). (non-empty)
`route.publicPathPrefixes`	`array`	`["/.well-known/", "/auth/login/", "/auth/device/", "/session/", "/v1/config"]`	Path prefixes served by a sibling route with NO SecurityPolicy so they stay public (JWKS + the OAuth/RFC 8628 login bootstrap the credential-less CLI calls during login + the session lifecycle at /session/ — switch/refresh/memberships/logout) + the pre-credential /v1/config discovery document. Every path here authenticates on a body-carried token verified server-side (a WorkOS or refresh token), never on the edge bearer.
`route.requestTimeout`	`string`	`"30s"`	Per-request timeout for the REST-surface routes (the catch-all and the public bootstrap carve-out, on both gateways), e.g. 30s. Always set explicitly: without it the gateway applies its 15s default, below the clients’ own budgets. (non-empty)
`sandbox`	`object`	—	Deployment bindings for sandbox product classes.
`sandbox.defaultIdleTimeoutSeconds` *	`integer` \| `null`	`null`	Idle-stop duration applied when a create omits one. Null disables deployment-default idle stopping. (min 60, max 86400)
`sandbox.lifecycleEndpoint` *	`string` \| `null`	`null`	Internal agent-sandbox controller lifecycle endpoint used for activity and idle resume. Null leaves idle stopping unavailable.
`sandbox.modelGatewayEndpoint` *	`string`	`""`	Internal proof-authenticated model endpoint rendered into sandbox workloads. Empty leaves model access unavailable.
`sandbox.placement.nonPreemptible` *	`object`	—	Node-label binding for the non-preemptible placement class. An empty selector leaves the class unavailable.
`sandbox.placement.nonPreemptible.nodeSelector` *	`object`	`{}`	Kubernetes nodeSelector labels rendered on non-preemptible sandbox pods. An explicit karpenter.sh/capacity-type=spot binding is invalid.
`sandbox.sharedFilesystems` *	`object`	`{}`	Deployment registry of organization-scoped logical shared-filesystem ids to existing PersistentVolumeClaims in the sandbox namespace. Claims own backend credentials; callers receive no CSI coordinates or tokens. Guest targets are restricted to /workspace or below /mnt.
`sandboxWorkspace`	`object`	—	Filesystem provisioned for a sandbox created with the durable storage class: one PersistentVolumeClaim per sandbox, mounted at /workspace and reclaimed with the sandbox.
`sandboxWorkspace.durable`	`object`	—	Backing for the durable storage class.
`sandboxWorkspace.durable.capacityConfigurable` *	`boolean`	`true`	Whether the backing class honors requested capacities and online growth. Disable this for a fixed-geometry filesystem; creates must omit workspace_capacity_gib and grow is refused.
`sandboxWorkspace.durable.defaultCapacityGiB` *	`integer`	`50`	Whole-GiB capacity stamped when a durable create omits workspace_capacity_gib. (min 1)
`sandboxWorkspace.durable.maxCapacityGiB` *	`integer`	`16384`	Largest durable workspace capacity in whole GiB admitted for one sandbox. (min 1)
`sandboxWorkspace.durable.storageClass` *	`string`	`"durable"`	StorageClass provisioning durable sandbox workspaces. Must name a class whose provisioner keeps a workspace’s bytes across incarnations: a reattachable cloud block volume, or the workspace driver that hydrates the filesystem from an object store. Empty refuses the durable storage class at admission; it is never treated as “use the cluster default”. Empty it to withdraw durable sandboxes from a deployment whose cluster has no such class.
`secretRelease`	`object`	—	Dedicated mutual-TLS gRPC listener for proof-bound request-time secret release. Keep disabled unless the secret-egress data plane and capture carrier are installed together.
`secretRelease.client.namespaceSelector` *	`object`	`{}`	Namespace labels selecting the trusted secret-egress client.
`secretRelease.client.podSelector` *	`object`	`{}`	Pod labels selecting only the trusted secret-egress client.
`secretRelease.clientCAConfigMap` *	`string`	`""`	ConfigMap containing ca.crt for the trusted secret-egress client identity.
`secretRelease.clientUriSan` *	`string`	`""`	Exact URI SAN required from the secret-egress client certificate.
`secretRelease.port` *		`9192`	Dedicated internal gRPC port, fixed away from public HTTPS egress.
`secretRelease.relayCAConfigMap` *	`string`	`""`	Sandbox-namespace ConfigMap containing ca.crt for the secret-egress listener identity.
`secretRelease.relayServerName` *	`string`	`""`	Exact TLS server name required from the secret-egress listener.
`secretRelease.serverTLSSecret` *	`string`	`""`	Secret containing tls.crt and tls.key for the secret-release server identity.
`securityPolicy`	`object`	—	Edge authentication: attach authz ext_authz to protected API routes.
`securityPolicy.authz`	`object`	—	Reference to the authz HTTP ext_authz service and the exact authz workload allowed to fetch JWKS directly.
`securityPolicy.authz.namespace`	`string`	`""`	Namespace of the authz Service. Empty = release namespace.
`securityPolicy.authz.podSelector`	`object`	—	Exact authz workload identity allowed to reach the API HTTP listener directly for JWKS fetches. Read by the always-rendered trusted-ingress NetworkPolicy regardless of securityPolicy.enabled. The namespace is securityPolicy.authz.namespace (or the release namespace).
`securityPolicy.authz.podSelector.instance` *	`string`	`""`	Exact app.kubernetes.io/instance label of the authz pods. Empty resolves to the current Helm release; override when authz is a separate release.
`securityPolicy.authz.podSelector.name` *	`string`	`"authz"`	Exact app.kubernetes.io/name label of the authz pods. (non-empty)
`securityPolicy.authz.port`	`integer`	`8080`	HTTP ext_authz Check port on the authz Service. (min 1, max 65535)
`securityPolicy.authz.requestTimeout`	`string`	`"5s"`	Timeout for the edge’s ext_authz check call to the authz service (e.g. 5s). A hung authz fails the request promptly (fail-closed) instead of holding it for the route’s full request budget. (non-empty)
`securityPolicy.authz.service`	`string`	`""`	Rendered name of the authz chart’s Service (`\<authz's release name>-authz`). Empty is allowed only while securityPolicy.enabled is false; the template requires it otherwise, with the message that explains why a wrong name is invisible.
`securityPolicy.enabled`	`boolean`	`false`	Create the SecurityPolicy attaching authz ext_authz to the protected API routes. Enable only once authz is reachable and internal callers use an Envoy route, or protected routes fail closed.
`service`	`object`	—	Kubernetes Service exposing the API listener through protocol-typed ports.
`service.capturePort`	`integer`	`8081`	Service port typed as gRPC for proof-authenticated sandbox capture; targets the same application listener. (min 1, max 65535)
`service.httpPort`	`integer`	`8080`	REST session surface port (HILOOP_API_HTTP_ADDR). (min 1, max 65535)
`service.type`	`ClusterIP` \| `NodePort` \| `LoadBalancer`	`"ClusterIP"`	Service type for the API Service.
`serviceAccount`	`object`	—	ServiceAccount for the API pods.
`serviceAccount.annotations`	`object`	`{}`	Annotations on the ServiceAccount (e.g. EKS Pod Identity / IRSA).
`serviceAccount.create`	`boolean`	`true`	Create a ServiceAccount for the pods. When false, serviceAccount.name is required — the chart binds its Roles to that name.
`serviceAccount.name`	`string`	`""`	Name of the ServiceAccount. With create=true it overrides the generated name; with create=false it is REQUIRED and names the existing ServiceAccount to reuse, because the chart’s RoleBindings are rendered against it.
`serviceConfig`	`object`	—	Public discovery document values returned by GET /v1/config. Empty values inherit from existing chart inputs where possible.
`serviceConfig.loginUrl`	`string`	`""`	API URL used to start browser login. Empty derives from route.hostname when route.hostname is set.
`serviceConfig.telemetryEndpoint`	`string`	`""`	Client-visible telemetry gRPC endpoint. Empty omits it from the discovery document.
`session`	`object`	—	Session-token minting. issuer/audience must match the authz/gateway verifier.
`session.audience`	`string`	`"hiloop-api"`	aud claim minted into access tokens (HILOOP_SESSION_AUDIENCE). (non-empty)
`session.issuer`	`string`	—	iss claim minted into access tokens (HILOOP_SESSION_ISSUER). (non-empty)
`session.refreshTtlDays`	`integer`	`30`	Refresh-token lifetime in days (HILOOP_SESSION_REFRESH_TTL_DAYS) — how long a signed-in session persists between uses before a new login is required. Tokens rotate on use, so active sessions persist indefinitely. (min 1, max 65535)
`session.signingKeysSecret`	`string`	`""`	Secret carrying the Ed25519 signing keyset (hosted profiles). Empty = use the profile’s offline keyset.
`session.signingKeysSecretKey`	`string`	`"HILOOP_SECRET_SESSION_SIGNING_KEYS"`	Key within signingKeysSecret and the env var name the app reads the keyset from. (non-empty)
`session.ttlSecs`	`integer`	`600`	Access-token lifetime in seconds (HILOOP_SESSION_TTL_SECS). (min 1)
`shutdownDrainWindowSeconds`	`integer`	`5`	Rollout drain window (seconds). On SIGTERM the server keeps accepting new and in-flight requests for this long, so the fronting proxy removes the endpoint before the listeners stop accepting; it then finishes in-flight requests within the drain budget and exits cleanly. (min 0)
`sizing`	`string`	`""`	T-shirt size for this service: small \| medium \| large \| xlarge. Usually set once for the whole platform via the umbrella’s global.sizing; set here only to size this service differently. Empty inherits global.sizing (default medium).
`snapshotSeal`	`object`	—	Explicit filesystem snapshots (sandbox snapshot create). The API arms the seal instruction on the sandbox’s pod and polls this store for the sandbox-restore node agent’s workspace-seal receipt, which is what makes the snapshot restorable.
`snapshotSeal.storeUrl`	`string`	`""`	Object-store base URL workspace-seal receipts are published under (HILOOP_SNAPSHOT_SEAL_STORE_URL) — the same base URL the sandbox-restore chart is configured with. Credentials come from the pod’s ambient identity. The store is the capability: empty refuses an explicit snapshot at admission with a named unsupported_capability instead of admitting a row and waiting out a receipt it could not observe.
`telemetry`	`object`	—	Internal telemetry read surface. api hosts the TelemetryQueryService (/v1/telemetry/*) as a verbatim proxy and forwards each call to the internal telemetry gateway, which owns the query logic and organization enforcement.
`telemetry.gatewayAddr`	`string`	`"http://telemetry-gateway-telemetry-gateway:50051"`	gRPC address of the internal telemetry gateway the read surface is proxied to (HILOOP_TELEMETRY_GATEWAY_ADDR). The channel connects lazily, so api stays Ready when the gateway isn’t. (non-empty)
`telemetry.gatewayHttpAddr`	`string`	`"http://telemetry-gateway-telemetry-gateway:50052"`	HTTP base URL of the internal telemetry gateway’s safe-SQL query surface (/v1/query), reverse-proxied at the edge as /v1/telemetry/sql (HILOOP_TELEMETRY_GATEWAY_HTTP_ADDR). The untrusted-SQL path is kept off the gRPC wire contract; the typed gRPC /v1/telemetry/query is unaffected. (non-empty)
`telemetryTail`	`object`	—	Live-tail Server-Sent Events route (GET /v1/telemetry/tail). An unbounded event stream served by the REST surface with a stream-friendly timeout posture the unary catch-all route does not have.
`telemetryTail.enabled`	`boolean`	`false`	Create the live-tail streaming route (and its traffic policy) alongside the configured Gateway routes.
`telemetryTail.path`	`string`	`"/v1/telemetry/tail"`	Exact request path the streaming route matches; routed to the REST surface with the streaming timeout posture. (non-empty)
`telemetryTail.streamIdleTimeout`	`string`	`"120s"`	Duration a tail stream may sit idle before it is closed (e.g. 120s). Must exceed the stream heartbeat interval so a heartbeat keeps a quiet feed alive. (non-empty)
`telemetryViews`	`object`	—	The telemetry read routes served by the REST surface as a reverse-proxy to the gateway’s HTTP surface, at a timeout aligned to the query engine’s execution budget: the ad-hoc safe-SQL query (POST /v1/telemetry/sql — the untrusted-SQL path is kept off the gRPC wire contract), event-bound raw payload retrieval (GET /v1/telemetry/events/{event_id}/payloads/{digest}), and the run-events read (GET /v1/telemetry/runs/{run_id}/events). The typed data-view CRUD/run surface (/v1/telemetry/data-views) is served natively on the main route and stays off these routes. Protected by the same SecurityPolicy as the rest of the protected surface.
`telemetryViews.enabled`	`boolean`	`false`	Create the telemetry read routes alongside the configured Gateway routes.
`telemetryViews.payloadsRegex`	`string`	`"^/v1/telemetry/events/[^/]+/payloads/[^/]+$"`	Regex the payload-retrieval route matches (raw payload bytes by content digest); routed to the REST surface at the query-engine-aligned timeout. (non-empty)
`telemetryViews.requestTimeout`	`string`	`"35s"`	Per-request timeout for the telemetry read routes (e.g. 35s). Must exceed the telemetry query engine’s 30s execution budget so a long-running query returns the engine’s structured timeout error instead of an opaque gateway timeout. (non-empty)
`telemetryViews.runEventsRegex`	`string`	`"^/v1/telemetry/runs/[^/]+/events$"`	Regex the run-events route matches (one run’s event stream as canonical event JSON); routed to the REST surface at the query-engine-aligned timeout. (non-empty)
`telemetryViews.sqlPath`	`string`	`"/v1/telemetry/sql"`	Exact request path the ad-hoc raw safe-SQL route matches; routed to the REST surface at the query-engine-aligned timeout. (non-empty)
`tolerations`	`array`	`[]`	Tolerations allowing pods onto tainted nodes.
`volumes`	`object`	—	Volume content storage (the dedicated durable volumes bucket): backs the volume push flow. Uploads go directly to this store through short-lived pre-authorized URLs the API hands out, and published version manifests live here. Empty disables volume push (volume CRUD stays available).
`volumes.objectStoreUrl`	`string`	`""`	Object-store URL of the volumes bucket root, e.g. s3://<bucket>/. Credentials come from the pod’s ambient identity.
`workloadIdentity`	`object`	—	Workload cloud-federation issuer and its dedicated RS256 keyset.
`workloadIdentity.issuer` *	`string`	`""`	Exact HTTPS workload issuer when no public route is enabled; empty then fails rendering. Public-route deployments may leave it empty because the chart derives it from route.hostname, keeping discovery and signed tokens byte-identical to the retrieval prefix.
`workloadIdentity.signingKeysSecret`	`string`	`""`	Secret carrying the dedicated RSA signing keyset for hosted and on-premises profiles. Empty selects generated ephemeral keys only in local and test profiles.
`workloadIdentity.signingKeysSecretKey` *	`string`	`"HILOOP_SECRET_WORKLOAD_IDENTITY_SIGNING_KEYS"`	Key within signingKeysSecret containing the workload RSA keyset. The application reads it through its fixed secret-provider environment name. (non-empty)
`workloadIdentity.workloadNamespaces` *	`array`	`[]`	Kubernetes namespaces containing sandbox workload Pods whose projected proofs may authorize workload-identity minting. Empty disables minting; deployed sandbox capture and secret release use the sandbox runtime namespace independently.
`workloadIdentity.workloadServiceAccount` *	`string`	`"sandbox-workload"`	Exact dedicated Kubernetes ServiceAccount assigned to sandbox workload Pods in every admitted namespace.

​Values

Values