Chapter 1. Helm Chart configuration reference

Key

Description

Type

Default

nameOverride

Lets you customize resource names. Can be used at the root level and upstream level.

string

"developer-hub"

global.auth

Enables service authentication within Backstage instance.

object

{"backend":{"enabled":true,"existingSecret":"","value":""}}

global.auth.backend

Backend service to service authentication.

object

{"enabled":true,"existingSecret":"","value":""}

global.auth.backend.enabled

Enables backend service to service authentication. Generates a secret value unless configured otherwise.

bool

true

global.auth.backend.existingSecret

Uses an existing secret.

string

""

global.auth.backend.value

Uses a specified value.

string

""

global.catalogIndex

Catalog index configuration for automatic plugin discovery. The install-dynamic-plugins.py script pulls this image if the CATALOG_INDEX_IMAGE environment variable is set. The dynamic-plugins.default.yaml file is extracted and written to dynamic-plugins-root volume mount.

object

{"image":{"registry":"registry.redhat.io","repository":"rhdh/plugin-catalog-index@sha256","tag":"<digest>"}}

global.catalogIndex.image.registry

Catalog index image registry.

string

“registry.redhat.io”

global.catalogIndex.image.repository

Catalog index image repository.

string

“rhdh/plugin-catalog-index@sha256”

global.catalogIndex.image.tag

Catalog index image tag or digest.

string

“<digest>”

global.clusterRouterBase

Shorthand for users who do not want to specify a custom hostname. Used only with the default upstream.backstage.appConfig value and with OpenShift Container Platform Route enabled.

string

"apps.example.com"

global.dynamic.includes

Array of yaml files listing dynamic plugins to include with those listed in the plugin field. Relative paths are resolved from the working directory of the initContainer that install the plugins.

list

["dynamic-plugins.default.yaml"]

global.dynamic.includes[0]

List of dynamic plugins included inside the RHDH container image.

string

"dynamic-plugins.default.yaml"

global.dynamic.plugins

List of dynamic plugins. Every plugin package can be defined as an OCI artifact, NPM or local package reference.

This list can potentially override the list of plugins in include files.

list

[]

global.host

Custom hostname shorthand that overrides global.clusterRouterBase, upstream.ingress.host, route.host, and url values in upstream.backstage.appConfig.

string

""

global.imagePullSecrets

Global Docker registry secret names as an array.

list

[]

global.imageRegistry

Global Docker image registry.

string

""

orchestrator.enabled

Enables orchestrator integration.

bool

false

orchestrator.plugins

List of orchestrator plugins and their configuration.

list

default list of orchestrator plugins to enable when orchestrator.enabled is set to true

orchestrator.serverlessLogicOperator.enabled

Enables serverlessLogicOperator configuration.

bool

true

orchestrator.sonataflowPlatform.createDBJobImage

Image for the container used by the create-db job.

string

"{{ .Values.upstream.postgresql.image.registry }}/{{ .Values.upstream.postgresql.image.repository }}:{{ .Values.upstream.postgresql.image.tag }}"

orchestrator.sonataflowPlatform.dataIndexImage

Image for the container used by the SonataFlow data index.

string

""

orchestrator.sonataflowPlatform.eventing.broker.name

Specifies which broker to integrate into SonataFlow event-driven workflows.

string

""

orchestrator.sonataflowPlatform.eventing.broker.namespace

Specifies the Kubernetes namespace that contains the broker resource to integrate into SonataFlow event-driven workflows.

string

""

orchestrator.sonataflowPlatform.externalDBHost

Host for the user-configured external database.

string

""

orchestrator.sonataflowPlatform.externalDBName

Name for the user-configured external database.

string

""

orchestrator.sonataflowPlatform.externalDBPort

Port for the user-configured external database.

string

""

orchestrator.sonataflowPlatform.externalDBsecretRef

Name for the user-created secret to connect an external database.

string

""

orchestrator.sonataflowPlatform.initContainerImage

Image for the init container used by the create-db job.

string

"{{ .Values.upstream.postgresql.image.registry }}/{{ .Values.upstream.postgresql.image.repository }}:{{ .Values.upstream.postgresql.image.tag }}"

orchestrator.sonataflowPlatform.jobServiceImage

Image for the container used by the SonataFlow jobs service.

string

""

orchestrator.sonataflowPlatform.monitoring.enabled

Controls if monitoring is enabled for SonataFlow when using the Orchestrator.

bool

true

orchestrator.sonataflowPlatform.resources.limits.cpu

Sets the maximum CPU allocation for SonataFlow’s build resources.

string

"500m"

orchestrator.sonataflowPlatform.resources.limits.memory

Sets the maximum memory allocation for SonataFlow’s build resources.

string

"1Gi"

orchestrator.sonataflowPlatform.resources.requests.cpu

Sets the minimum CPU allocation for SonataFlow’s build resources.

string

"250m"

orchestrator.sonataflowPlatform.resources.requests.memory

Sets the minimum memory allocation for SonataFlow’s build resources.

string

"64Mi"

route

OpenShift Route parameters.

object

{"annotations":{},"enabled":true,"host":"{{ .Values.global.host }}","path":"/","tls":{"caCertificate":"","certificate":"","destinationCACertificate":"","enabled":true,"insecureEdgeTerminationPolicy":"Redirect","key":"","termination":"edge"},"wildcardPolicy":"None"}

route.annotations

Route-specific annotations.

object

{}

route.enabled

Enables the creation of the route resource.

bool

true

route.host

Sets the host attribute to a custom value. If not set, the value is generated by OpenShift.

string

"{{ .Values.global.host }}"

route.path

Path that the router watches for to route traffic to the service.

string

"/"

route.tls

Route TLS parameters.

object

{"caCertificate":"","certificate":"","destinationCACertificate":"","enabled":true,"insecureEdgeTerminationPolicy":"Redirect","key":"","termination":"edge"}

route.tls.caCertificate

Optional value. Cert authority certificate contents.

string

""

route.tls.certificate

Certificate contents.

string

""

route.tls.destinationCACertificate

CA certificate contents of the final destination. Used by routers for health checks on the secure connection.

string

""

route.tls.enabled

Enable TLS configuration for the host defined with the route.host parameter.

bool

true

route.tls.insecureEdgeTerminationPolicy

Indicates the desired behavior for insecure connections to a route.

string

"Redirect"

route.tls.key

Key file contents.

string

""

route.tls.termination

Specifies TLS termination.

string

"edge"

route.wildcardPolicy

Wildcard policy for the route.

string

"None"

test

Tests pod parameters.

object

{"enabled":true,"image":{"registry":"quay.io","repository":"curl/curl","tag":"latest"},"injectTestNpmrcSecret":false}

test.enabled

Enables the test-connection pod used for testing the release using helm test.

bool

true

test.image.registry

Tests connection pod image registry.

string

"quay.io"

test.image.repository

Test connection pod image repository.

string

"curl/curl"

test.image.tag

Tests connection pod image tag.

string

"latest"

test.injectTestNpmrcSecret

Injects a fake dynamic plugins npmrc secret. Only relevant when test.enabled field is set to true.

bool

false

upstream

Upstream Backstage chart configuration.

object

OpenShift-compatible settings

upstream.backstage.extraVolumes[0]

Ephemeral volume that contains the dynamic plugins installed by the initContainer at start.

object

{"ephemeral":{"volumeClaimTemplate":{"spec":{"accessModes":["ReadWriteOnce"],"resources":{"requests":{"storage":"5Gi"}}}}},"name":"dynamic-plugins-root"}

upstream.backstage.extraVolumes[0].ephemeral.volumeClaimTemplate.spec.resources.requests.storage

Size of the ephemeral volume that contains the dynamic plugins.

string

"5Gi"

upstream.backstage.initContainers[0].image

Image used by the initContainer to install dynamic plugins into the dynamic-plugins-root volume mount.

string

value of ‘upstream.backstage.image’

upstream.backstage

Backstage parameters.

object

see below

upstream.backstage.affinity

Pod assignment affinity.

object

{}

upstream.backstage.annotations

Additional custom annotations for the Deployment resource.

object

{}

upstream.backstage.appConfig

Generates a ConfigMap and configures it in the Backstage pods.

object

{“auth”: {“providers”: {}}, “app”: {“baseUrl”: 'https://{{- include "rhdh.hostname" . }}'}, “backend”: {“baseUrl”: 'https://{{- include "rhdh.hostname" . }}', “cors”: {“origin”: 'https://{{- include "rhdh.hostname" . }}'}, “database”: {“connection”: {“password”: “${POSTGRESQL_ADMIN_PASSWORD}”, “user”: “postgres”}}, “auth”: {“externalAccess”: [{“type”: “legacy”, “options”: {“subject”: “legacy-default-config”, “secret”: “${BACKEND_SECRET}”}}]}}}

upstream.backstage.args

Backstage container command arguments.

list

[“--config”, “dynamic-plugins-root/app-config.dynamic-plugins.yaml”]

upstream.backstage.autoscaling

Autoscaling configuration.

object

{"enabled":false,"maxReplicas":100,"minReplicas":1,"targetCPUUtilizationPercentage":80}

upstream.backstage.command

Backstage container command.

list

[]

upstream.backstage.containerPorts

Deployment container ports.

object

{"backend":7007}

upstream.backstage.containerSecurityContext

Container security settings.

object

{“readOnlyRootFilesystem”: true, “allowPrivilegeEscalation”: false, “capabilities”: {“drop”: [“ALL”]}, “runAsNonRoot”: true, “seccompProfile”: {“type”: “RuntimeDefault”}}}

upstream.backstage.extraAppConfig

Extra app configuration files to inline into command arguments.

list

[]

upstream.backstage.extraContainers

Deployment sidecars.

list

[]

upstream.backstage.extraEnvVars

Backstage container environment variables.

list

[{“name”: “BACKEND_SECRET”, “valueFrom”: {“secretKeyRef”: {“key”: “backend-secret”, “name”: '{{ include "rhdh.backend-secret-name" $ }}'}}}, {“name”: “POSTGRESQL_ADMIN_PASSWORD”, “valueFrom”: {“secretKeyRef”: {“key”: “postgres-password”, “name”: '{{- include "rhdh.postgresql.secretName" . }}'}}]}]

upstream.backstage.extraEnvVarsCM

Backstage container environment variables from existing ConfigMaps.

list

[]

upstream.backstage.extraEnvVarsSecrets

Backstage container environment variables from existing secrets.

list

[]

upstream.backstage.extraPorts

Backstage container additional ports.

list

[{“name”: “http-metrics”, “port”: 9464, “targetPort”: 9464}]

upstream.backstage.extraVolumeMounts

Backstage container additional volume mounts.

list

[{“name”: “dynamic-plugins-root”, “mountPath”: “/opt/app-root/src/dynamic-plugins-root”}, {“name”: “extensions-catalog”, “mountPath”: “/extensions”}, {“name”: “temp”, “mountPath”: “/tmp”}]

upstream.backstage.extraVolumes

Backstage container additional volumes.

list

[{“name”: “dynamic-plugins-root”, “ephemeral”: {“volumeClaimTemplate”: {“spec”: {“accessModes”: [“ReadWriteOnce”], “resources”: {“requests”: {“storage”: “5Gi”}}}}}}]

upstream.backstage.hostAliases

Host Aliases for the pod.

list

[]

upstream.backstage.image.digest

Backstage image digest. Takes precedence over image tag.

string

""

upstream.backstage.image.pullPolicy

Specifies the image pull policy.

string

""

upstream.backstage.image.pullSecrets

Specifies an array of imagePullSecrets.

list

[]

upstream.backstage.image.registry

Backstage image registry.

string

"registry.redhat.io"

upstream.backstage.image.repository

Backstage image repository.

string

"rhdh/rhdh-hub-rhel9@sha256"

upstream.backstage.image.tag

Backstage image tag.

string

"digest"

upstream.backstage.initContainers

Backstage container init containers.

list

[]

upstream.backstage.installDir

Directory containing the backstage installation.

string

"/opt/app-root/src"

upstream.backstage.livenessProbe

Liveness probe.

object

{“failureThreshold”: 3, “httpGet”: {“path”: “/.backstage/health/v1/liveness”, “port”: “backend”, “scheme”: “HTTP”}, “periodSeconds”: 10, “successThreshold”: 1, “timeoutSeconds”: 4}

upstream.backstage.nodeSelector

Node labels for pod assignment.

object

{}

upstream.backstage.pdb

Pod disruption budget configuration.

object

{"create":false,"maxUnavailable":"","minAvailable":""}

upstream.backstage.podAnnotations

Annotations added to the backend deployment pods.

object

{“checksum/dynamic-plugins”: “{{- include "common.tplvalues.render" ( dict "value" .Values.global.dynamic "context" $)

upstream.backstage.podLabels

Labels added to the backend deployment pods.

object

{}

upstream.backstage.podSecurityContext

Pod security settings. They apply to all containers in the pod.

object

{}

upstream.backstage.readinessProbe

Readiness probe.

object

{“failureThreshold”: 3, “httpGet”: {“path”: “/.backstage/health/v1/readiness”, “port”: “backend”, “scheme”: “HTTP”}, “periodSeconds”: 10, “successThreshold”: 2, “timeoutSeconds”: 4}

upstream.backstage.replicas

Number of deployment replicas.

int

1

upstream.backstage.resources

Resource requests and limits.

object

{“resources”: {“requests”: {“cpu”: “250m”, “memory”: “1Gi”}, “limits”: {“cpu”: “1000m”, “memory”: “2.5Gi”, “ephemeral-storage”: “5Gi”}}}

upstream.backstage.revisionHistoryLimit

Defines the count of deployment revisions to be kept.

int

10

upstream.backstage.startupProbe

Startup probe.

object

{“httpGet”: {“path”: “/.backstage/health/v1/liveness”, “port”: “backend”, “scheme”: “HTTP”}, “initialDelaySeconds”: 30, “timeoutSeconds”: 4, “periodSeconds”: 20, “successThreshold”: 1, “failureThreshold”: 3}

upstream.backstage.tolerations

Node tolerations for server scheduling to nodes with taints.

list

[]

upstream.backstage.topologySpreadConstraints

Topology spread constraints for pod assignment.

list

[]

upstream.clusterDomain

Default Kubernetes cluster domain.

string

"cluster.local"

upstream.commonAnnotations

Annotations to add to all deployed objects.

object

{}

upstream.commonLabels

Labels to add to all deployed objects.

object

{}

upstream.diagnosticMode

Enables diagnostic mode in the deployment.

object

{"args":["infinity"],"command":["sleep"],"enabled":false}

upstream.diagnosticMode.args

Arguments to override all containers in the deployment.

list

["infinity"]

upstream.diagnosticMode.command

Command to override all containers in the deployment.

list

["sleep"]

upstream.diagnosticMode.enabled

Enables diagnostic mode.

bool

false

upstream.extraDeploy

Array of extra objects to deploy with the release.

list

[]

upstream.fullnameOverride

String to fully override common.names.fullname.

string

""

upstream.ingress

Ingress parameters.

object

{“host”: “{{ .Values.global.host }}”}

upstream.ingress.annotations

Additional annotations for the Ingress resource.

object

{}

upstream.ingress.className

Name of the IngressClass cluster resource that defines which controller implements the resource, such as nginx.

string

""

upstream.ingress.enabled

Enables the creation of the Ingress resource.

bool

false

upstream.ingress.extraHosts

List of additional hostnames to be covered with this Ingress record, such as CNAME.

list

[]

upstream.ingress.extraTls

The TLS configuration for additional hostnames to be covered with this Ingress record.

list

[]

upstream.ingress.host

Hostname to be used to expose the route to access the Backstage application, such as backstage.IP.nip.io.

string

"{{ .Values.global.host }}"

upstream.ingress.path

Path to be used to expose the full route to access the Backstage application, such as backstage.IP.nip.io.

string

"/"

upstream.ingress.tls

Ingress TLS parameters.

object

{"serviceMonitor": {"enabled": false, "path": "/metrics", "port": "http-metrics"}}

upstream.ingress.tls.enabled

Enables TLS configuration for the host defined at ingress.host parameter.

bool

false

upstream.ingress.tls.secretName

The name to which the TLS Secret is called.

string

""

upstream.kubeVersion

Overrides Kubernetes version.

string

""

upstream.metrics

Metrics configuration.

object

{"serviceMonitor": {"enabled": false, "path": "/metrics", "port": "http-metrics"}}

upstream.metrics.serviceMonitor

Prometheus Operator ServiceMonitor configuration.

object

{"enabled": false, "path": "/metrics", "port": "http-metrics"}

upstream.metrics.serviceMonitor.annotations

ServiceMonitor annotations.

object

{}

upstream.metrics.serviceMonitor.enabled

Creates a ServiceMonitor resource for Prometheus Operator.

bool

false

upstream.metrics.serviceMonitor.interval

ServiceMonitor scrape interval.

string

nil

upstream.metrics.serviceMonitor.labels

Additional ServiceMonitor labels.

object

{}

upstream.metrics.serviceMonitor.path

ServiceMonitor endpoint path.

string

"/metrics"

upstream.metrics.serviceMonitor.port

ServiceMonitor endpoint port.

string

"http-metrics"

upstream.nameOverride

String to partially override common.names.fullname.

string

"developer-hub"

upstream.networkPolicy.egressRules.customRules

Additional custom egress rules.

list

[]

upstream.networkPolicy.egressRules.denyConnectionsToExternal

Denies external connections.

bool

false

upstream.networkPolicy.enabled

Specifies if a NetworkPolicy is created.

bool

false

upstream.networkPolicy.ingressRules.customRules

Additional custom Ingress rules.

list

[]

upstream.networkPolicy.ingressRules.namespaceSelector

Namespace selector label allowed to access the Backstage instance.

object

{}

upstream.networkPolicy.ingressRules.podSelector

Pod selector label allowed to access the Backstage instance.

object

{}

upstream.postgresql

PostgreSQL chart configuration.

object

see below

upstream.postgresql.architecture

PostgreSQL architecture.

string

"standalone"

upstream.postgresql.auth

Authentication details of the PostgreSQL database.

object

{“secretKeys”: {“adminPasswordKey”: “postgres-password”, “userPasswordKey”: “password”}}

upstream.postgresql.auth.existingSecret

Name of existing secret used for PostgreSQL credentials.

string

""

upstream.postgresql.auth.password

Password created by custom user.

string

""

upstream.postgresql.auth.secretKeys

The secret keys PostgreSQL looks for to retrieve the relevant password.

object

{"adminPasswordKey":"admin-password","replicationPasswordKey":"replication-password","userPasswordKey":"user-password"}

upstream.postgresql.auth.secretKeys.adminPasswordKey

The key in the existing secret where PostgreSQL looks for the admin password.

string

"postgres-password"

upstream.postgresql.auth.secretKeys.replicationPasswordKey

The key in the existing secret where PostgreSQL looks for the replication password.

string

"replication-password"

upstream.postgresql.auth.secretKeys.userPasswordKey

The key in the existing secret where PostgreSQL looks for the user password.

string

"password"

upstream.postgresql.auth.username

Creates a name for a custom user.

string

"bn_backstage"

upstream.postgresql.enabled

Enables the PostgreSQL helm chart.

bool

true

upstream.postgresql.image

Changes default PostgreSQL image location.

object

{"registry":"registry.redhat.io","repository":"rhel9/postgresql-15@sha256"}

upstream.service

Service parameters.

object

see below

upstream.service.annotations

Additional custom annotations for Backstage service.

object

{}

upstream.service.clusterIP

Backstage service cluster IP.

string

""

upstream.service.externalTrafficPolicy

Backstage service external traffic policy.

string

"Cluster"

upstream.service.extraPorts

Extra ports to expose in the Backstage service. Typically used with the sidecar value.

list

[{"extraPorts": {"name": "http-metrics", "port": "9464", "targetPort": "9464"}}]

upstream.service.ipFamilies

IP families.

list

[]

upstream.service.ipFamilyPolicy

IP family policy.

string

""

upstream.service.loadBalancerIP

Backstage service Load Balancer IP.

string

""

upstream.service.loadBalancerSourceRanges

Load Balancer sources.

list

[]

upstream.service.nodePorts

Node port for the Backstage client connections.

object

{"backend":""}

upstream.service.ports

Backstage SVC port for client connections.

object

{"backend":7007,"name":"http-backend","targetPort":"backend"}

upstream.service.ports.name

Backstage SVC port name.

string

"http-backend"

upstream.service.ports.targetPort

Backstage SVC target port referencing receiving pod container port.

string

"backend"

upstream.service.sessionAffinity

Controls where client requests go: either the same pod or round-robin.

string

"None"

upstream.service.type

Kubernetes service type.

string

"ClusterIP"

upstream.serviceAccount

Service account configuration.

object

see below

upstream.serviceAccount.annotations

Additional custom annotations for the ServiceAccount.

object

{}

upstream.serviceAccount.automountServiceAccountToken

Auto-mounts the service account token in the pod.

bool

true

upstream.serviceAccount.create

Enable the creation of a ServiceAccount for Backstage pods.

bool

false

upstream.serviceAccount.labels

Additional custom labels for the ServiceAccount.

object

{}

upstream.serviceAccount.name

Name of the ServiceAccount to use.

string

""