authz Helm chart

hiloop Envoy ext_authz authorization service — resolves API keys + session JWTs to organization/user identity headers. Source chart version 0.3.0. Published OCI artifacts use the immutable version from the deployment release record:

helm install authz oci://<your-registry>/charts/authz \
  --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}"

Values

Keys marked * are required. Defaults are the chart’s values.yaml; per-environment overlays (values-onprem.yaml, values-saas.yaml) and the deployment set the rest.

Key	Type	Default	Description
`affinity`	`object`	`{}`	Pod affinity/anti-affinity scheduling rules.
`containerSecurityContext`	`object`	`{"allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "capabilities": {"drop": ["ALL"]}, "seccompProfile": {"type": "RuntimeDefault"}}`	Container-level securityContext. Defaults drop all capabilities and use a read-only root filesystem (stateless service).
`database`	`object`	—	Postgres connection for the least-privileged hiloop_authz role.
`database.auth` *	`password` \| `iam`	`"password"`	Credential mechanism: ‘password’ (static DSN from a Secret, local/on-prem) or ‘iam’ (RDS IAM SigV4 token per connection, cloud).
`database.existingSecret` *	`string`	`"authz-db"`	password auth only: name of the Secret holding the Postgres DSN (populated by ESO from Secrets Manager). (non-empty)
`database.secretKey` *	`string`	`"dsn"`	password auth only: key within existingSecret whose value is the DSN (postgres://hiloop_authz:…@host/db). (non-empty)
`disruptionClass`	`edge-critical` \| `data-path` \| `singleton-controller` \| `node-infra` \| `disposable`	`"edge-critical"`	Availability class this workload declares; the chart derives the PodDisruptionBudget, replica anti-affinity, rollout strategy, and scheduling priority from it. authz fails closed on the request path, so it ships as edge-critical — keep the class and use disruptionOverrides for deliberate deviations.
`disruptionOverrides`	`object`	—	Explicit, justified deviations from the declared disruption class.
`disruptionOverrides.justification`	`string`	`""`	Reason for running below the class’s availability posture (e.g. a single-replica install on a one-node cluster). Non-empty allows the reduced posture and is stamped on the workload as the hiloop.ai/disruption-override annotation.
`env`	`local` \| `test_e2e` \| `dev` \| `staging` \| `production` \| `onprem`	`"local"`	Deployment profile (HILOOP_ENV) selecting the database credential mechanism: offline profiles use the password DSN, cloud profiles use RDS IAM.
`global`	`object`	—	Settings shared across every image in the chart, used by the common image helper.
`global.imagePullSecrets`	`array`	`[]`	Secret references granting pull access to a private registry, e.g. [{ name: acme-registry-creds }].
`global.imageRegistry`	`string`	`""`	Registry host prefixed to every image (e.g. registry.internal.acme.corp). Empty = pull from the registry baked into image.repository. Air-gapped installs set this once to relocate all images.
`image`	`object`	—	Container image coordinates for the authz ext_authz gRPC service.
`image.digest`	`string`	`""`	Image digest (sha256:…); pinned in prod and takes precedence over tag.
`image.pullPolicy`	`Always` \| `IfNotPresent` \| `Never`	`"IfNotPresent"`	Kubelet image pull policy.
`image.repository` *	`string`	`"ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/authz"`	Image repository (without tag/digest), e.g. ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/authz. (non-empty)
`image.tag`	`string`	`""`	Image tag; fallback when digest is unset. CI sets either tag or digest.
`nodeSelector`	`object`	`{}`	Node label selector constraining pod scheduling.
`observability`	`object`	—	Spans + derived metrics exported via OTLP (single shared init). On by default since authz is on the hot path.
`observability.enabled`	`boolean`	`true`	Enable OTLP export. Disable (or repoint otlpEndpoint) for on-prem installs without a collector.
`observability.otlpEndpoint`	`string`	`"http://otel-collector-agent.monitoring.svc.cluster.local:4317"`	OTLP gRPC collector endpoint (OTEL_EXPORTER_OTLP_ENDPOINT). (non-empty)
`observability.resourceAttributes`	`string`	`"service.namespace=hiloop"`	Extra OTEL_RESOURCE_ATTRIBUTES (comma-separated key=value pairs) attached to all telemetry.
`observability.rustLog`	`string`	`"info"`	RUST_LOG filter controlling log/span verbosity (e.g. info, debug). (non-empty)
`observability.serviceName`	`string`	`"authz"`	OTEL_SERVICE_NAME reported for this service’s telemetry. (non-empty)
`podSecurityContext`	`object`	`{"runAsNonRoot": true, "runAsUser": 65532, "fsGroup": 65532}`	Pod-level securityContext. Defaults run as the distroless nonroot uid 65532; keep the pod non-root.
`probes`	`object`	—	TCP readiness/liveness probes on the HTTP ext_authz port.
`probes.enabled`	`boolean`	`true`	Enable readiness and liveness probes.
`probes.initialDelaySeconds`	`integer`	`5`	Seconds to wait after container start before the first probe. (min 0)
`probes.periodSeconds`	`integer`	`10`	Seconds between probe attempts. (min 1)
`replicaCount`	`integer`	—	Override the pod count from the sizing preset. authz is on every request’s hot path and a SPOF for all auth, so run >1 for HA. Counts below the availability floor of the declared disruptionClass require disruptionOverrides.justification. (min 1)
`resources`	`object`	—	Override the container resource requests/limits from the sizing preset. Set this for full control (e.g. very large deployments).
`resources.limits`	`object`	—	Hard CPU/memory ceiling for the container.
`resources.requests`	`object`	—	Minimum CPU/memory reserved for the container.
`service`	`object`	—	Kubernetes Service exposing the ext_authz gRPC endpoint.
`service.port`	`integer`	`8080`	Port for the HTTP ext_authz service (Envoy Gateway HTTPExtAuthService); also the container listen port. (min 1, max 65535)
`service.type`	`ClusterIP` \| `NodePort` \| `LoadBalancer`	`"ClusterIP"`	Service type. ClusterIP is correct for an in-cluster ext_authz backend.
`serviceAccount`	`object`	—	ServiceAccount for the authz pods.
`serviceAccount.annotations`	`object`	`{}`	Annotations on the ServiceAccount. SaaS uses these for EKS Pod Identity; on-prem usually leaves them empty.
`serviceAccount.create`	`boolean`	`true`	Create the ServiceAccount. Set false to reuse an externally managed account.
`serviceAccount.name`	`string`	`""`	Name of the ServiceAccount. With create=true it overrides the generated name; with create=false it is REQUIRED and names the existing ServiceAccount to reuse, because the chart’s RoleBindings are rendered against it.
`session`	`object`	—	Session-token (JWT) verification against a JWKS. Leave jwksUrl empty to disable session auth (API-key auth only); session tokens then fail closed.
`session.audience`	`string`	`""`	Expected ‘aud’ claim. Required when jwksUrl is set.
`session.issuer`	`string`	`""`	Expected ‘iss’ claim; an opaque logical issuer id, need not resolve in DNS. Required when jwksUrl is set.
`session.jwksRefreshSecs`	`integer`	`300`	How often (seconds) to re-fetch the JWKS to pick up key rotation. (min 1)
`session.jwksUrl`	`string`	`""`	URL of the JWKS used to verify session tokens. Empty disables session auth.
`shutdownDrainWindowSeconds`	`integer`	`5`	Rollout drain window (seconds). On SIGTERM the server keeps accepting new and in-flight authorization checks for this long, so the fronting proxy removes the endpoint before the listener stops accepting; it then finishes in-flight checks and exits cleanly. (min 0)
`sizing`	`string`	`""`	T-shirt size for this service: small \| medium \| large \| xlarge. Usually set once for the whole platform via the umbrella’s global.sizing; set here only to size this service differently. Empty inherits global.sizing (default medium).
`tolerations`	`array`	`[]`	Pod tolerations allowing scheduling onto tainted nodes.

​Values

Values