web Helm chart

hiloop web console (app.hiloop.ai). Stateless SSR (TanStack Start) front end; one build serves hosted + onprem via runtime config. Becomes a subchart of the umbrella as more land. Source chart version 0.3.0. Published OCI artifacts use the immutable version from the deployment release record:

helm install web oci://<your-registry>/charts/web \
  --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}"

Values

Keys marked * are required. Defaults are the chart’s values.yaml; per-environment overlays (values-onprem.yaml, values-saas.yaml) and the deployment set the rest.

Key	Type	Default	Description
`affinity`	`object`	`{}`	Pod affinity/anti-affinity rules (passed through verbatim). Empty applies no affinity.
`bff`	`object`	—	Server-only Backend-for-Frontend config. Never exposed to the browser — these tell the SSR server how to reach the human IdP and the API. Injected at container start; empty by default so the same image runs on-prem with no WorkOS.
`bff.apiBaseUrl`	`string`	`""`	Base URL the BFF calls server-side (HILOOP_API_BASE_URL). Hosted deployments use the internal Envoy Gateway for both protected and deliberately public session/bootstrap routes, never the raw API ClusterIP; on-prem uses the customer’s API edge. Empty falls back to the app’s localhost dev default.
`bff.authProvider`	`string`	`""`	Human-IdP provider behind the seam (HILOOP_AUTH_PROVIDER). ‘workos’ for hosted; empty selects that same default. Whether a browser sign-in actually runs depends on the IdP credentials: a deployment carrying none serves no sign-in, and /login renders a page naming the API-key command instead of failing on credentials it was never given. Set ‘none’ to declare that posture outright.
`bff.gatewayBaseUrl`	`string`	`""`	Base URL for organization-scoped calls that must traverse ext_authz (HILOOP_GATEWAY_BASE_URL). Hosted uses the same internal Envoy Gateway authority as apiBaseUrl; route policy separates protected and public paths. Required while bff.identityLive is enabled (the default).
`bff.identityLive`	`boolean`	`true`	Serve identity (API keys, feedback intake) from the live control-plane API (HILOOP_IDENTITY_LIVE). On by default; requires gatewayBaseUrl. Set false only for an environment without this backend — the console then shows an explicit ‘not enabled’ state, never mock data.
`containerSecurityContext`	`object`	`{"allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "capabilities": {"drop": ["ALL"]}, "seccompProfile": {"type": "RuntimeDefault"}}`	Container-level securityContext applied to the web container (e.g. readOnlyRootFilesystem, dropped capabilities, seccompProfile). Passed through verbatim.
`disruptionClass`	`edge-critical` \| `data-path` \| `singleton-controller` \| `node-infra` \| `disposable`	`"edge-critical"`	Availability class this workload declares; the chart derives the PodDisruptionBudget, replica anti-affinity, rollout strategy, and scheduling priority from it. The console is the product’s serving surface, so it ships as edge-critical — keep the class and use disruptionOverrides for deliberate deviations.
`disruptionOverrides`	`object`	—	Explicit, justified deviations from the declared disruption class.
`disruptionOverrides.justification`	`string`	`""`	Reason for running below the class’s availability posture (e.g. a single-replica install on a one-node cluster). Non-empty allows the reduced posture and is stamped on the workload as the hiloop.ai/disruption-override annotation.
`env`	`string`	`""`	Deployment environment name (e.g. staging, production), stamped onto emitted telemetry as the deployment environment. Empty in local/on-prem defaults.
`global`	`object`	—	Settings shared across the chart and any subcharts (Helm global convention).
`global.imagePullSecrets`	`array`	`[]`	imagePullSecrets references (list of {name}) for private registries. Empty for hosted (Pod Identity / public-to-the-cluster ECR); on-prem sets it when the internal registry needs auth.
`global.imageRegistry`	`string`	`""`	Registry prefix prepended to image.repository. Empty pulls from the repository as-written (ECR for hosted); on-prem sets this to relocate every image to the customer’s internal registry with one knob.
`image`	`object`	—	Container image for the web SSR server.
`image.digest`	`string`	`""`	Image digest (sha256:…). When set it pins the image immutably and takes precedence over tag.
`image.pullPolicy`	`Always` \| `IfNotPresent` \| `Never`	`"IfNotPresent"`	Kubelet image pull policy.
`image.repository` *	`string`	`"ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/web"`	Image repository (without tag/digest). global.imageRegistry, when set, is prepended. (non-empty)
`image.tag`	`string`	`""`	Image tag. Empty falls back to the chart appVersion. Prefer digest for immutable deploys.
`nodeSelector`	`object`	`{}`	nodeSelector for Pod scheduling (passed through verbatim). Empty schedules anywhere.
`observability`	`object`	—	OTLP telemetry export for the SSR server. When disabled the server prints spans to the console instead of exporting; enable per hosted environment to export over OTLP.
`observability.enabled`	`boolean`	`false`	Inject OTEL env so the server exports spans over OTLP (gRPC).
`observability.otlpEndpoint`	`string`	`"http://otel-collector-agent.monitoring.svc.cluster.local:4317"`	OTEL_EXPORTER_OTLP_ENDPOINT the collector listens on (gRPC). (non-empty)
`observability.resourceAttributes`	`string`	`"service.namespace=hiloop"`	OTEL_RESOURCE_ATTRIBUTES (comma-separated key=value pairs).
`observability.serviceName`	`string`	`"web"`	OTEL_SERVICE_NAME for emitted spans. (non-empty)
`podSecurityContext`	`object`	`{"runAsNonRoot": true, "runAsUser": 65532, "fsGroup": 65532}`	Pod-level securityContext applied to the Pod spec (e.g. runAsNonRoot, runAsUser, fsGroup). Passed through verbatim.
`probes`	`object`	—	Readiness and liveness probe settings. Currently TCP probes on the HTTP port (an HTTP probe on ’/’ would hit auth and fail once the BFF auth layer lands).
`probes.enabled`	`boolean`	`true`	Whether to render readiness and liveness probes.
`probes.initialDelaySeconds`	`integer`	`5`	Seconds to wait after container start before the first probe. (min 0)
`probes.periodSeconds`	`integer`	`10`	Seconds between probe checks. (min 1)
`replicaCount`	`integer`	—	Override the pod count from the sizing preset. The frontend is stateless, so scale freely. Counts below the availability floor of the declared disruptionClass require disruptionOverrides.justification. (min 1)
`resources`	`object`	—	Override the container resource requests/limits from the sizing preset. Set this for full control (e.g. very large deployments).
`route`	`object`	—	External exposure via Gateway API (Envoy Gateway), not an Ingress. external-dns watches the HTTPRoute and mints the DNS record from route.hostname; TLS is the Gateway’s wildcard cert. Off by default so on-prem customers can front the app with their own gateway/ingress.
`route.enabled`	`boolean`	`false`	Whether to render an HTTPRoute exposing the app through the parent Gateway. Hosted: true; on-prem: false (customer fronts it themselves).
`route.hostname`	`string`	`""`	Public hostname for the HTTPRoute (e.g. app.hiloop.ai). Required when enabled; external-dns derives the DNS record from it.
`route.parentRef`	`object`	—	Reference to the Gateway listener this route attaches to.
`route.parentRef.name`	`string`	`"eg"`	Name of the parent Gateway. (non-empty)
`route.parentRef.namespace`	`string`	`"envoy-gateway-system"`	Namespace of the parent Gateway. (non-empty)
`route.parentRef.sectionName`	`string`	`"https"`	Gateway listener (section) to bind to, typically the HTTPS listener carrying the wildcard cert.
`route.requestTimeout`	`string`	`"45s"`	Per-request timeout for the console’s catch-all route (e.g. 45s), sized above the app server’s own upstream fetch bounds so an upstream failure surfaces through the app instead of the edge killing the page load first. (non-empty)
`service`	`object`	—	ClusterIP Service fronting the SSR Pods.
`service.port`	`integer`	`3000`	Service and container port for SSR HTTP. Also injected as the PORT env var the server listens on. (min 1, max 65535)
`service.type`	`ClusterIP` \| `NodePort` \| `LoadBalancer`	`"ClusterIP"`	Kubernetes Service type. Default ClusterIP; external traffic arrives via the Gateway API HTTPRoute, not the Service.
`serviceAccount`	`object`	—	ServiceAccount for the Pods.
`serviceAccount.annotations`	`object`	`{}`	Annotations on the ServiceAccount (e.g. cloud workload-identity bindings).
`serviceAccount.create`	`boolean`	`true`	Whether the chart creates the ServiceAccount. Set false to reuse an existing one.
`serviceAccount.name`	`string`	`""`	Name of the ServiceAccount. With create=true it overrides the generated name; with create=false it is REQUIRED and names the existing ServiceAccount to reuse, because the chart’s RoleBindings are rendered against it.
`sizing`	`string`	`""`	T-shirt size for this service: small \| medium \| large \| xlarge. Usually set once for the whole platform via the umbrella’s global.sizing; set here only to size this service differently. Empty inherits global.sizing (default medium).
`tolerations`	`array`	`[]`	Pod tolerations (passed through verbatim). Empty tolerates nothing extra.

​Values

Values