> ## Documentation Index > Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt > Use this file to discover all available pages before exploring further. # hiloop Helm chart > hiloop platform umbrella hiloop platform umbrella. Composes the per-service application charts as file:// subcharts and propagates the shared global.session contract so the signer (api) and verifier (authz) can't drift. Published alongside the standalone charts, not instead of them. Source chart version `0.4.18`. Published OCI artifacts use the immutable version from the deployment release record: ```bash theme={null} helm install hiloop oci:///charts/hiloop \ --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}" ``` ## Subcharts The umbrella composes these application charts; per-service values nest under each chart's name and are documented on its own page. | Subchart | Condition | Reference | | ------------------- | --------------------------- | ------------------------------------------------------ | | `api` | `api.enabled` | [api](/reference/helm/api) | | `authz` | `authz.enabled` | [authz](/reference/helm/authz) | | `telemetry-gateway` | `telemetry-gateway.enabled` | [telemetry-gateway](/reference/helm/telemetry-gateway) | | `web` | `web.enabled` | [web](/reference/helm/web) | | `model-gateway` | `model-gateway.enabled` | [model-gateway](/reference/helm/model-gateway) | | `operator` | `operator.enabled` | [operator](/reference/helm/operator) | | `sandbox-restore` | `sandbox-restore.enabled` | [sandbox-restore](/reference/helm/sandbox-restore) | | `sandbox-workspace` | `sandbox-workspace.enabled` | [sandbox-workspace](/reference/helm/sandbox-workspace) | | `agent-sandbox` | `agent-sandbox.enabled` | [agent-sandbox](/reference/helm/agent-sandbox) | ## Values Keys marked `*` are required. Defaults are the chart's `values.yaml`; per-environment overlays (`values-onprem.yaml`, `values-saas.yaml`) and the deployment set the rest. | Key | Type | Default | Description | | ------------------------------------------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `agent-sandbox` | `object` | — | Values for the agent-sandbox subchart (see its reference page). Set agent-sandbox.enabled: false to leave it out of an install. The Sandbox CRDs are never installed by Helm: apply them server-side (kubectl apply --server-side) before install and before every upgrade. | | `agent-sandbox.enabled` | `boolean` | `true` | Install the agent-sandbox subchart (Chart.yaml condition agent-sandbox.enabled). | | `api` | `object` | — | Values for the api subchart (see its reference page). Set api.enabled: false to leave it out of an install. | | `api.enabled` | `boolean` | `true` | Install the api subchart (Chart.yaml condition api.enabled). | | `authz` | `object` | — | Values for the authz subchart (see its reference page). Set authz.enabled: false to leave it out of an install. | | `authz.enabled` | `boolean` | `true` | Install the authz subchart (Chart.yaml condition authz.enabled). | | `cniEnforcementGate` | `object` | — | Pre-install proof that the cluster's CNI enforces NetworkPolicy rather than merely accepting the objects. Every trust fence the platform installs is a NetworkPolicy, so a CNI without enforcement leaves them present and inert. The gate has no enable flag by design. | | `cniEnforcementGate.image` \* | `object` | — | Image the gate's target and probe pods run. It needs only a shell and python3. Air-gapped installations mirror this repository path, or relocate every chart image at once with global.imageRegistry. | | `cniEnforcementGate.image.digest` \* | `string` | `"sha256:7942e2a958a238057cdf3304cba7e75f4056d15f75112b8d8e7c1d21a17f2d6c"` | Immutable image digest. Required: the gate must not change underneath an install. | | `cniEnforcementGate.image.pullPolicy` \* | `Always` \| `IfNotPresent` \| `Never` | `"IfNotPresent"` | Kubernetes image pull policy. | | `cniEnforcementGate.image.repository` \* | `string` | `"public.ecr.aws/amazonlinux/amazonlinux"` | Repository path for the gate image. (non-empty) | | `global` | `object` | — | Cross-chart settings merged into every subchart's values. | | `global.imagePullSecrets` | `array` | `[]` | Pull secrets applied to every pod for private/mirrored registries. | | `global.imageRegistry` | `string` | `""` | Registry host that relocates every subchart's image at once (air-gapped mirrors). Empty = use the registry baked into each image.repository. | | `global.secretEgress` | `object` | — | Single capability contract shared by the secret-egress data plane, API release listener, capture attachment, and exact network admission. | | `global.secretEgress.clusterIP` \* | `string` | `""` | Deployment-owned stable IPv4 address from the cluster Service CIDR. Required only when secret egress is enabled. | | `global.secretEgress.enabled` \* | `boolean` | `false` | Install and enable the complete proof-bound secret-egress capability. | | `global.secretEgress.publicProfileOnly` \* | `boolean` | `false` | Require proof-bound secret relay clients to carry the public sandbox network profile. Keep false only while upgrading existing clients to profile labels. | | `global.session` | `object` | — | The single shared signer+verifier session contract: api (signer) and authz (verifier) both read these keys, so issuer/audience can't drift. | | `global.session.apiHttpPort` | `integer` | `8080` | The api chart's REST surface port (service.httpPort) used to derive the JWKS URL. (min 1, max 65535) | | `global.session.apiServiceName` | `string` | `""` | Rendered name of the api subchart's Service for JWKS derivation. Empty ⇒ \-api. | | `global.session.audience` | `string` | `""` | aud claim shared by signer and verifier, e.g. hiloop-api. | | `global.session.issuer` | `string` | `""` | iss claim shared by signer and verifier, e.g. [https://auth.hiloop.ai](https://auth.hiloop.ai) (a logical identifier, not a reachable host). | | `global.session.jwksUrl` | `string` | `""` | Explicit JWKS URL for the verifier. Empty ⇒ authz derives the in-cluster api Service URL from apiServiceName + apiHttpPort. | | `global.sizing` | `small` \| `medium` \| `large` \| `xlarge` | `"medium"` | One knob to size the whole platform — each service maps it to its own tuned replicas + resources. medium (the default) matches the previous fixed footprint. Override a single service with \.sizing, or \.resources / \.replicaCount for full control. | | `model-gateway` | `object` | — | Values for the model-gateway subchart (see its reference page). Set model-gateway.enabled: false to leave it out of an install. | | `model-gateway.enabled` | `boolean` | `true` | Install the model-gateway subchart (Chart.yaml condition model-gateway.enabled). | | `operator` | `object` | — | Values for the operator subchart (see its reference page). Set operator.enabled: false to leave it out of an install. | | `operator.enabled` | `boolean` | `true` | Install the operator subchart (Chart.yaml condition operator.enabled). | | `platformObservability` | `object` | — | The local platform-health OpenTelemetry Collector. Its support exporter accepts only the fixed service, metric, and field contract; customer workload and product telemetry are never exported. | | `platformObservability.enabled` \* | `boolean` | `false` | Install the on-premises platform Collector. The on-premises values profile enables it; hosted environments supply their own collector. | | `platformObservability.image` \* | `object` | — | Immutable OpenTelemetry Collector Kubernetes distribution. Its component inventory contains the platform pipeline's OTLP, filtering, transformation, span-metrics, and persistent-queue components and contains no Datadog exporter. Air-gapped installations mirror this repository path under global.imageRegistry. | | `platformObservability.image.digest` \* | `string` | `"sha256:7003434ed1a0e80a0a58eef89786c455a876ca8bc5165c1da5d39c6441cf6fe8"` | Immutable multi-architecture image digest. | | `platformObservability.image.pullPolicy` \* | `Always` \| `IfNotPresent` \| `Never` | `"IfNotPresent"` | Kubernetes image pull policy. | | `platformObservability.image.repository` \* | `string` | `"ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-k8s"` | Fixed repository path for the Datadog-free Collector Kubernetes distribution; global.imageRegistry relocates it into a private mirror. | | `platformObservability.image.version` \* | `string` | `"0.154.0"` | Collector version reported in platform-health telemetry. | | `platformObservability.localOtlpEndpoint` \* | `string` | `"http://greptimedb-standalone.monitoring.svc.cluster.local:4000/v1/otlp"` | OTLP/HTTP ingest endpoint for the deployment's local GreptimeDB backend. | | `platformObservability.namespace` \* | `string` | `"monitoring"` | Pre-existing monitoring namespace for the Collector and its customer-owned support key Secret. | | `platformObservability.persistence` \* | `object` | — | Persistent sending-queue storage used during backend or network outages. | | `platformObservability.persistence.size` \* | `string` | `"20Gi"` | Requested capacity for each Collector queue PVC. | | `platformObservability.persistence.storageClass` \* | `string` | `""` | StorageClass for each Collector queue PVC. Empty uses the cluster default. | | `platformObservability.replicaCount` \* | `integer` | `3` | Number of stateful Collector gateway replicas. (min 1) | | `platformObservability.resources` \* | `object` | `{"requests": {"cpu": "100m", "memory": "256Mi"}, "limits": {"memory": "1Gi"}}` | Collector CPU and memory requests and limits. | | `priorityClasses` | `object` | — | Cluster-scoped scheduling PriorityClasses the service charts reference (hiloop-datapath for the serving/data-path tier, hiloop-controller for singleton controllers). Rendered once by the umbrella. | | `priorityClasses.create` | `boolean` | `true` | Render the hiloop-datapath and hiloop-controller PriorityClass objects. Disable only when another release in the cluster already owns them. | | `sandbox-restore` | `object` | — | Values for the sandbox-restore subchart (see its reference page). Set sandbox-restore.enabled: false to leave it out of an install. | | `sandbox-restore.enabled` | `boolean` | `true` | Install the sandbox-restore subchart (Chart.yaml condition sandbox-restore.enabled). | | `sandbox-workspace` | `object` | — | Values for the sandbox-workspace subchart (see its reference page). Set sandbox-workspace.enabled: false to leave it out of an install. | | `sandbox-workspace.enabled` | `boolean` | `true` | Install the sandbox-workspace subchart (Chart.yaml condition sandbox-workspace.enabled). | | `supportTelemetry` | `object` | — | Allowlisted platform-health metrics sent to hiloop support. Span-derived calls and duration provide component request and error aggregates for api, authz, db-migrator, mint-internal-key, model-gateway, telemetry-gateway, and web; Collector send, enqueue, refusal, drop, queue, and uptime metrics provide health for otel-collector-agent, otel-collector-cluster, and otel-collector-gateway. The wire contract contains metric name, description, unit, type, timestamp, and aggregate value; resource attributes service.name, service.version, and deployment.environment.name; and data-point attributes span.kind, status.code, exporter, receiver, processor, pipeline, signal, and transport. The only metric names are traces.span.metrics.calls, traces.span.metrics.duration, otelcol\_exporter\_send\_failed\_spans, otelcol\_exporter\_send\_failed\_metric\_points, otelcol\_exporter\_send\_failed\_log\_records, otelcol\_exporter\_queue\_capacity, otelcol\_exporter\_queue\_size, otelcol\_exporter\_enqueue\_failed\_spans, otelcol\_exporter\_enqueue\_failed\_metric\_points, otelcol\_exporter\_enqueue\_failed\_log\_records, otelcol\_receiver\_refused\_spans, otelcol\_receiver\_refused\_metric\_points, otelcol\_receiver\_refused\_log\_records, otelcol\_processor\_dropped\_spans, otelcol\_processor\_dropped\_metric\_points, otelcol\_processor\_dropped\_log\_records, and otelcol\_process\_uptime. Logs, traces, workload events, request bodies, payloads, organization identifiers, run identifiers, lineage, and fork attributes are never exported. | | `supportTelemetry.customerSupportKey` \* | `object` | — | Customer-provided authentication key. Create this Secret in the platformObservability namespace before installing the supported on-premises posture; the key value never enters Helm values. | | `supportTelemetry.customerSupportKey.existingSecret` \* | `string` | `"hiloop-support-telemetry"` | Name of the customer-owned Secret containing the support key. (non-empty) | | `supportTelemetry.customerSupportKey.key` \* | `string` | `"api-key"` | Key within existingSecret that contains the support key value. (non-empty) | | `supportTelemetry.enabled` \* | `boolean` | `true` | Send the fixed platform-health metrics allowlist to hiloop support. Defaults to true for supported on-premises installations. Set false for air-gapped on-premises; this removes the external endpoint, exporter, pipeline, and support-key projection from the rendered Collector. | | `supportTelemetry.endpoint` \* | `string` | `"https://telemetry.hiloop.ai"` | Fixed hiloop support OTLP/HTTP ingest endpoint. It is omitted from the rendered Collector when enabled is false. | | `telemetry-gateway` | `object` | — | Values for the telemetry-gateway subchart (see its reference page). Set telemetry-gateway.enabled: false to leave it out of an install. | | `telemetry-gateway.enabled` | `boolean` | `true` | Install the telemetry-gateway subchart (Chart.yaml condition telemetry-gateway.enabled). | | `web` | `object` | — | Values for the web subchart (see its reference page). Set web.enabled: false to leave it out of an install. | | `web.enabled` | `boolean` | `true` | Install the web subchart (Chart.yaml condition web.enabled). |