> ## Documentation Index > Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt > Use this file to discover all available pages before exploring further. # authz Helm chart > hiloop Envoy ext_authz authorization service — resolves API keys + session JWTs to organization/user identity headers hiloop Envoy ext\_authz authorization service — resolves API keys + session JWTs to organization/user identity headers. Source chart version `0.3.0`. Published OCI artifacts use the immutable version from the deployment release record: ```bash theme={null} helm install authz oci:///charts/authz \ --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}" ``` ## Values Keys marked `*` are required. Defaults are the chart's `values.yaml`; per-environment overlays (`values-onprem.yaml`, `values-saas.yaml`) and the deployment set the rest. | Key | Type | Default | Description | | ----------------------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `affinity` | `object` | `{}` | Pod affinity/anti-affinity scheduling rules. | | `containerSecurityContext` | `object` | `{"allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "capabilities": {"drop": ["ALL"]}, "seccompProfile": {"type": "RuntimeDefault"}}` | Container-level securityContext. Defaults drop all capabilities and use a read-only root filesystem (stateless service). | | `database` | `object` | — | Postgres connection for the least-privileged hiloop\_authz role. | | `database.auth` \* | `password` \| `iam` | `"password"` | Credential mechanism: 'password' (static DSN from a Secret, local/on-prem) or 'iam' (RDS IAM SigV4 token per connection, cloud). | | `database.existingSecret` \* | `string` | `"authz-db"` | password auth only: name of the Secret holding the Postgres DSN (populated by ESO from Secrets Manager). (non-empty) | | `database.secretKey` \* | `string` | `"dsn"` | password auth only: key within existingSecret whose value is the DSN (postgres\://hiloop\_authz:...\@host/db). (non-empty) | | `disruptionClass` | `edge-critical` \| `data-path` \| `singleton-controller` \| `node-infra` \| `disposable` | `"edge-critical"` | Availability class this workload declares; the chart derives the PodDisruptionBudget, replica anti-affinity, rollout strategy, and scheduling priority from it. authz fails closed on the request path, so it ships as edge-critical — keep the class and use disruptionOverrides for deliberate deviations. | | `disruptionOverrides` | `object` | — | Explicit, justified deviations from the declared disruption class. | | `disruptionOverrides.justification` | `string` | `""` | Reason for running below the class's availability posture (e.g. a single-replica install on a one-node cluster). Non-empty allows the reduced posture and is stamped on the workload as the hiloop.ai/disruption-override annotation. | | `env` | `local` \| `test_e2e` \| `dev` \| `staging` \| `production` \| `onprem` | `"local"` | Deployment profile (HILOOP\_ENV) selecting the database credential mechanism: offline profiles use the password DSN, cloud profiles use RDS IAM. | | `global` | `object` | — | Settings shared across every image in the chart, used by the common image helper. | | `global.imagePullSecrets` | `array` | `[]` | Secret references granting pull access to a private registry, e.g. \[\{ name: acme-registry-creds }]. | | `global.imageRegistry` | `string` | `""` | Registry host prefixed to every image (e.g. registry.internal.acme.corp). Empty = pull from the registry baked into image.repository. Air-gapped installs set this once to relocate all images. | | `image` | `object` | — | Container image coordinates for the authz ext\_authz gRPC service. | | `image.digest` | `string` | `""` | Image digest (sha256:...); pinned in prod and takes precedence over tag. | | `image.pullPolicy` | `Always` \| `IfNotPresent` \| `Never` | `"IfNotPresent"` | Kubelet image pull policy. | | `image.repository` \* | `string` | `"ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/authz"` | Image repository (without tag/digest), e.g. ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/authz. (non-empty) | | `image.tag` | `string` | `""` | Image tag; fallback when digest is unset. CI sets either tag or digest. | | `nodeSelector` | `object` | `{}` | Node label selector constraining pod scheduling. | | `observability` | `object` | — | Spans + derived metrics exported via OTLP (single shared init). On by default since authz is on the hot path. | | `observability.enabled` | `boolean` | `true` | Enable OTLP export. Disable (or repoint otlpEndpoint) for on-prem installs without a collector. | | `observability.otlpEndpoint` | `string` | `"http://otel-collector-agent.monitoring.svc.cluster.local:4317"` | OTLP gRPC collector endpoint (OTEL\_EXPORTER\_OTLP\_ENDPOINT). (non-empty) | | `observability.resourceAttributes` | `string` | `"service.namespace=hiloop"` | Extra OTEL\_RESOURCE\_ATTRIBUTES (comma-separated key=value pairs) attached to all telemetry. | | `observability.rustLog` | `string` | `"info"` | RUST\_LOG filter controlling log/span verbosity (e.g. info, debug). (non-empty) | | `observability.serviceName` | `string` | `"authz"` | OTEL\_SERVICE\_NAME reported for this service's telemetry. (non-empty) | | `podSecurityContext` | `object` | `{"runAsNonRoot": true, "runAsUser": 65532, "fsGroup": 65532}` | Pod-level securityContext. Defaults run as the distroless nonroot uid 65532; keep the pod non-root. | | `probes` | `object` | — | TCP readiness/liveness probes on the HTTP ext\_authz port. | | `probes.enabled` | `boolean` | `true` | Enable readiness and liveness probes. | | `probes.initialDelaySeconds` | `integer` | `5` | Seconds to wait after container start before the first probe. (min 0) | | `probes.periodSeconds` | `integer` | `10` | Seconds between probe attempts. (min 1) | | `replicaCount` | `integer` | — | Override the pod count from the sizing preset. authz is on every request's hot path and a SPOF for all auth, so run >1 for HA. Counts below the availability floor of the declared disruptionClass require disruptionOverrides.justification. (min 1) | | `resources` | `object` | — | Override the container resource requests/limits from the sizing preset. Set this for full control (e.g. very large deployments). | | `resources.limits` | `object` | — | Hard CPU/memory ceiling for the container. | | `resources.requests` | `object` | — | Minimum CPU/memory reserved for the container. | | `service` | `object` | — | Kubernetes Service exposing the ext\_authz gRPC endpoint. | | `service.port` | `integer` | `8080` | Port for the HTTP ext\_authz service (Envoy Gateway HTTPExtAuthService); also the container listen port. (min 1, max 65535) | | `service.type` | `ClusterIP` \| `NodePort` \| `LoadBalancer` | `"ClusterIP"` | Service type. ClusterIP is correct for an in-cluster ext\_authz backend. | | `serviceAccount` | `object` | — | ServiceAccount for the authz pods. | | `serviceAccount.annotations` | `object` | `{}` | Annotations on the ServiceAccount. SaaS uses these for EKS Pod Identity; on-prem usually leaves them empty. | | `serviceAccount.create` | `boolean` | `true` | Create the ServiceAccount. Set false to reuse an externally managed account. | | `serviceAccount.name` | `string` | `""` | Name of the ServiceAccount. With create=true it overrides the generated name; with create=false it is REQUIRED and names the existing ServiceAccount to reuse, because the chart's RoleBindings are rendered against it. | | `session` | `object` | — | Session-token (JWT) verification against a JWKS. Leave jwksUrl empty to disable session auth (API-key auth only); session tokens then fail closed. | | `session.audience` | `string` | `""` | Expected 'aud' claim. Required when jwksUrl is set. | | `session.issuer` | `string` | `""` | Expected 'iss' claim; an opaque logical issuer id, need not resolve in DNS. Required when jwksUrl is set. | | `session.jwksRefreshSecs` | `integer` | `300` | How often (seconds) to re-fetch the JWKS to pick up key rotation. (min 1) | | `session.jwksUrl` | `string` | `""` | URL of the JWKS used to verify session tokens. Empty disables session auth. | | `shutdownDrainWindowSeconds` | `integer` | `5` | Rollout drain window (seconds). On SIGTERM the server keeps accepting new and in-flight authorization checks for this long, so the fronting proxy removes the endpoint before the listener stops accepting; it then finishes in-flight checks and exits cleanly. (min 0) | | `sizing` | `string` | `""` | T-shirt size for this service: small \| medium \| large \| xlarge. Usually set once for the whole platform via the umbrella's global.sizing; set here only to size this service differently. Empty inherits global.sizing (default medium). | | `tolerations` | `array` | `[]` | Pod tolerations allowing scheduling onto tainted nodes. |