hiloop Helm chart

hiloop platform umbrella. Composes the per-service application charts as file:// subcharts and propagates the shared global.session contract so the signer (api) and verifier (authz) can’t drift. Published alongside the standalone charts, not instead of them. Source chart version 0.4.18. Published OCI artifacts use the immutable version from the deployment release record:

helm install hiloop oci://<your-registry>/charts/hiloop \
  --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}"

Subcharts

The umbrella composes these application charts; per-service values nest under each chart’s name and are documented on its own page.

Subchart	Condition	Reference
`api`	`api.enabled`	api
`authz`	`authz.enabled`	authz
`telemetry-gateway`	`telemetry-gateway.enabled`	telemetry-gateway
`web`	`web.enabled`	web
`model-gateway`	`model-gateway.enabled`	model-gateway
`operator`	`operator.enabled`	operator
`sandbox-restore`	`sandbox-restore.enabled`	sandbox-restore
`sandbox-workspace`	`sandbox-workspace.enabled`	sandbox-workspace
`agent-sandbox`	`agent-sandbox.enabled`	agent-sandbox

Values

Keys marked * are required. Defaults are the chart’s values.yaml; per-environment overlays (values-onprem.yaml, values-saas.yaml) and the deployment set the rest.

Key	Type	Default	Description
`agent-sandbox`	`object`	—	Values for the agent-sandbox subchart (see its reference page). Set agent-sandbox.enabled: false to leave it out of an install. The Sandbox CRDs are never installed by Helm: apply them server-side (kubectl apply —server-side) before install and before every upgrade.
`agent-sandbox.enabled`	`boolean`	`true`	Install the agent-sandbox subchart (Chart.yaml condition agent-sandbox.enabled).
`api`	`object`	—	Values for the api subchart (see its reference page). Set api.enabled: false to leave it out of an install.
`api.enabled`	`boolean`	`true`	Install the api subchart (Chart.yaml condition api.enabled).
`authz`	`object`	—	Values for the authz subchart (see its reference page). Set authz.enabled: false to leave it out of an install.
`authz.enabled`	`boolean`	`true`	Install the authz subchart (Chart.yaml condition authz.enabled).
`cniEnforcementGate`	`object`	—	Pre-install proof that the cluster’s CNI enforces NetworkPolicy rather than merely accepting the objects. Every trust fence the platform installs is a NetworkPolicy, so a CNI without enforcement leaves them present and inert. The gate has no enable flag by design.
`cniEnforcementGate.image` *	`object`	—	Image the gate’s target and probe pods run. It needs only a shell and python3. Air-gapped installations mirror this repository path, or relocate every chart image at once with global.imageRegistry.
`cniEnforcementGate.image.digest` *	`string`	`"sha256:7942e2a958a238057cdf3304cba7e75f4056d15f75112b8d8e7c1d21a17f2d6c"`	Immutable image digest. Required: the gate must not change underneath an install.
`cniEnforcementGate.image.pullPolicy` *	`Always` \| `IfNotPresent` \| `Never`	`"IfNotPresent"`	Kubernetes image pull policy.
`cniEnforcementGate.image.repository` *	`string`	`"public.ecr.aws/amazonlinux/amazonlinux"`	Repository path for the gate image. (non-empty)
`global`	`object`	—	Cross-chart settings merged into every subchart’s values.
`global.imagePullSecrets`	`array`	`[]`	Pull secrets applied to every pod for private/mirrored registries.
`global.imageRegistry`	`string`	`""`	Registry host that relocates every subchart’s image at once (air-gapped mirrors). Empty = use the registry baked into each image.repository.
`global.secretEgress`	`object`	—	Single capability contract shared by the secret-egress data plane, API release listener, capture attachment, and exact network admission.
`global.secretEgress.clusterIP` *	`string`	`""`	Deployment-owned stable IPv4 address from the cluster Service CIDR. Required only when secret egress is enabled.
`global.secretEgress.enabled` *	`boolean`	`false`	Install and enable the complete proof-bound secret-egress capability.
`global.secretEgress.publicProfileOnly` *	`boolean`	`false`	Require proof-bound secret relay clients to carry the public sandbox network profile. Keep false only while upgrading existing clients to profile labels.
`global.session`	`object`	—	The single shared signer+verifier session contract: api (signer) and authz (verifier) both read these keys, so issuer/audience can’t drift.
`global.session.apiHttpPort`	`integer`	`8080`	The api chart’s REST surface port (service.httpPort) used to derive the JWKS URL. (min 1, max 65535)
`global.session.apiServiceName`	`string`	`""`	Rendered name of the api subchart’s Service for JWKS derivation. Empty ⇒ <release>-api.
`global.session.audience`	`string`	`""`	aud claim shared by signer and verifier, e.g. hiloop-api.
`global.session.issuer`	`string`	`""`	iss claim shared by signer and verifier, e.g. https://auth.hiloop.ai (a logical identifier, not a reachable host).
`global.session.jwksUrl`	`string`	`""`	Explicit JWKS URL for the verifier. Empty ⇒ authz derives the in-cluster api Service URL from apiServiceName + apiHttpPort.
`global.sizing`	`small` \| `medium` \| `large` \| `xlarge`	`"medium"`	One knob to size the whole platform — each service maps it to its own tuned replicas + resources. medium (the default) matches the previous fixed footprint. Override a single service with <service>.sizing, or <service>.resources / <service>.replicaCount for full control.
`model-gateway`	`object`	—	Values for the model-gateway subchart (see its reference page). Set model-gateway.enabled: false to leave it out of an install.
`model-gateway.enabled`	`boolean`	`true`	Install the model-gateway subchart (Chart.yaml condition model-gateway.enabled).
`operator`	`object`	—	Values for the operator subchart (see its reference page). Set operator.enabled: false to leave it out of an install.
`operator.enabled`	`boolean`	`true`	Install the operator subchart (Chart.yaml condition operator.enabled).
`platformObservability`	`object`	—	The local platform-health OpenTelemetry Collector. Its support exporter accepts only the fixed service, metric, and field contract; customer workload and product telemetry are never exported.
`platformObservability.enabled` *	`boolean`	`false`	Install the on-premises platform Collector. The on-premises values profile enables it; hosted environments supply their own collector.
`platformObservability.image` *	`object`	—	Immutable OpenTelemetry Collector Kubernetes distribution. Its component inventory contains the platform pipeline’s OTLP, filtering, transformation, span-metrics, and persistent-queue components and contains no Datadog exporter. Air-gapped installations mirror this repository path under global.imageRegistry.
`platformObservability.image.digest` *	`string`	`"sha256:7003434ed1a0e80a0a58eef89786c455a876ca8bc5165c1da5d39c6441cf6fe8"`	Immutable multi-architecture image digest.
`platformObservability.image.pullPolicy` *	`Always` \| `IfNotPresent` \| `Never`	`"IfNotPresent"`	Kubernetes image pull policy.
`platformObservability.image.repository` *	`string`	`"ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-k8s"`	Fixed repository path for the Datadog-free Collector Kubernetes distribution; global.imageRegistry relocates it into a private mirror.
`platformObservability.image.version` *	`string`	`"0.154.0"`	Collector version reported in platform-health telemetry.
`platformObservability.localOtlpEndpoint` *	`string`	`"http://greptimedb-standalone.monitoring.svc.cluster.local:4000/v1/otlp"`	OTLP/HTTP ingest endpoint for the deployment’s local GreptimeDB backend.
`platformObservability.namespace` *	`string`	`"monitoring"`	Pre-existing monitoring namespace for the Collector and its customer-owned support key Secret.
`platformObservability.persistence` *	`object`	—	Persistent sending-queue storage used during backend or network outages.
`platformObservability.persistence.size` *	`string`	`"20Gi"`	Requested capacity for each Collector queue PVC.
`platformObservability.persistence.storageClass` *	`string`	`""`	StorageClass for each Collector queue PVC. Empty uses the cluster default.
`platformObservability.replicaCount` *	`integer`	`3`	Number of stateful Collector gateway replicas. (min 1)
`platformObservability.resources` *	`object`	`{"requests": {"cpu": "100m", "memory": "256Mi"}, "limits": {"memory": "1Gi"}}`	Collector CPU and memory requests and limits.
`priorityClasses`	`object`	—	Cluster-scoped scheduling PriorityClasses the service charts reference (hiloop-datapath for the serving/data-path tier, hiloop-controller for singleton controllers). Rendered once by the umbrella.
`priorityClasses.create`	`boolean`	`true`	Render the hiloop-datapath and hiloop-controller PriorityClass objects. Disable only when another release in the cluster already owns them.
`sandbox-restore`	`object`	—	Values for the sandbox-restore subchart (see its reference page). Set sandbox-restore.enabled: false to leave it out of an install.
`sandbox-restore.enabled`	`boolean`	`true`	Install the sandbox-restore subchart (Chart.yaml condition sandbox-restore.enabled).
`sandbox-workspace`	`object`	—	Values for the sandbox-workspace subchart (see its reference page). Set sandbox-workspace.enabled: false to leave it out of an install.
`sandbox-workspace.enabled`	`boolean`	`true`	Install the sandbox-workspace subchart (Chart.yaml condition sandbox-workspace.enabled).
`supportTelemetry`	`object`	—	Allowlisted platform-health metrics sent to hiloop support. Span-derived calls and duration provide component request and error aggregates for api, authz, db-migrator, mint-internal-key, model-gateway, telemetry-gateway, and web; Collector send, enqueue, refusal, drop, queue, and uptime metrics provide health for otel-collector-agent, otel-collector-cluster, and otel-collector-gateway. The wire contract contains metric name, description, unit, type, timestamp, and aggregate value; resource attributes service.name, service.version, and deployment.environment.name; and data-point attributes span.kind, status.code, exporter, receiver, processor, pipeline, signal, and transport. The only metric names are traces.span.metrics.calls, traces.span.metrics.duration, otelcol_exporter_send_failed_spans, otelcol_exporter_send_failed_metric_points, otelcol_exporter_send_failed_log_records, otelcol_exporter_queue_capacity, otelcol_exporter_queue_size, otelcol_exporter_enqueue_failed_spans, otelcol_exporter_enqueue_failed_metric_points, otelcol_exporter_enqueue_failed_log_records, otelcol_receiver_refused_spans, otelcol_receiver_refused_metric_points, otelcol_receiver_refused_log_records, otelcol_processor_dropped_spans, otelcol_processor_dropped_metric_points, otelcol_processor_dropped_log_records, and otelcol_process_uptime. Logs, traces, workload events, request bodies, payloads, organization identifiers, run identifiers, lineage, and fork attributes are never exported.
`supportTelemetry.customerSupportKey` *	`object`	—	Customer-provided authentication key. Create this Secret in the platformObservability namespace before installing the supported on-premises posture; the key value never enters Helm values.
`supportTelemetry.customerSupportKey.existingSecret` *	`string`	`"hiloop-support-telemetry"`	Name of the customer-owned Secret containing the support key. (non-empty)
`supportTelemetry.customerSupportKey.key` *	`string`	`"api-key"`	Key within existingSecret that contains the support key value. (non-empty)
`supportTelemetry.enabled` *	`boolean`	`true`	Send the fixed platform-health metrics allowlist to hiloop support. Defaults to true for supported on-premises installations. Set false for air-gapped on-premises; this removes the external endpoint, exporter, pipeline, and support-key projection from the rendered Collector.
`supportTelemetry.endpoint` *	`string`	`"https://telemetry.hiloop.ai"`	Fixed hiloop support OTLP/HTTP ingest endpoint. It is omitted from the rendered Collector when enabled is false.
`telemetry-gateway`	`object`	—	Values for the telemetry-gateway subchart (see its reference page). Set telemetry-gateway.enabled: false to leave it out of an install.
`telemetry-gateway.enabled`	`boolean`	`true`	Install the telemetry-gateway subchart (Chart.yaml condition telemetry-gateway.enabled).
`web`	`object`	—	Values for the web subchart (see its reference page). Set web.enabled: false to leave it out of an install.
`web.enabled`	`boolean`	`true`	Install the web subchart (Chart.yaml condition web.enabled).

​Subcharts

​Values

Subcharts

Values