charts

obot

A Helm chart for Obot

Requirements

Repository	Name	Version
	substrate	0.1.0

Installation

To install the chart with the release name obot:

helm repo add obot https://charts.obot.ai
helm install obot obot/obot

Note

This chart defaults to the open source version of Obot. If you want to use the enterprise version of Obot instead, set image.repository to ghcr.io/obot-platform/obot-enterprise. To install this version, you must create an imagePullSecret and configure that in the chart.

Values

Key	Type	Default	Description
additionalLabels	object	{}
affinity	object	{}	Configure affinity rules for pod scheduling
config.AWS_REGION	string	""	An AWS region, used to access AWS KMS
config.KINM_DB_CONNECTIONS	string	"5"	Advanced - the number of connections in the database pool for kinm, both open and idle connections
config.KINM_DB_DISABLE_NOTIFY	string	"false"	Advanced - disables kinm’s use of PostgreSQL LISTEN/NOTIFY, so replicas learn about each other’s writes by polling
config.KINM_DB_MAX_CONNECTIONS	string	"5"	Advanced - the number of open connections in the database pool for kinm, overrides KINM_DB_CONNECTIONS
config.KINM_DB_MAX_CONNECTION_LIFETIME_SECONDS	string	"180"	Advanced - the maximum lifetime of a connection in the database pool for kinm in seconds
config.KINM_DB_MAX_IDLE_CONNECTIONS	string	"2"	Advanced - the number of idle connections in the database pool for kinm, overrides KINM_DB_CONNECTIONS
config.KINM_DB_NOTIFY_DEBOUNCE_MILLISECONDS	string	"1000"	Advanced - how often change notifications may wake the watches on one table in kinm, in milliseconds
config.KINM_DB_WATCH_POLL_SECONDS	string	"120"	Advanced - how long a kinm watch waits before listing again when nothing has woken it, in seconds, while the change listener is connected
config.NAH_THREADINESS	string	"10000"	Advanced - sets the number of concurrent threads that can run in the Obot controller
config.OBOT_AUTH_PROVIDER_POSTGRES_CONNECTION_LIFETIME_SECONDS	string	"180"	Advanced - the maximum lifetime of a connection in the database pool for the auth provider in seconds
config.OBOT_AUTH_PROVIDER_POSTGRES_MAX_CONNECTIONS	string	"5"	Advanced - the maximum number of connections in the database pool for the auth provider
config.OBOT_AUTH_PROVIDER_POSTGRES_MAX_IDLE_CONNECTIONS	string	"2"	Advanced - the maximum number of idle connections in the database pool for the auth provider
config.OBOT_GCP_KMS_KEY_URI	string	""	The URI of a Google Cloud KMS key, used for encryption
config.OBOT_SERVER_AUDIT_LOGS_COMPRESS_FILE	bool	true	Whether to compress audit log files
config.OBOT_SERVER_AUDIT_LOGS_MODE	string	"off"	Configures the storage backend for audit logs in Obot. Can be ‘off’, ‘disk’, or ‘s3’
config.OBOT_SERVER_AUDIT_LOGS_STORE_S3BUCKET	string	""	The name of the S3 bucket to store audit logs in. Only used if config.OBOT_SERVER_AUDIT_LOGS_MODE is ‘s3’
config.OBOT_SERVER_AUDIT_LOGS_STORE_S3ENDPOINT	string	""	If config.OBOT_SERVER_AUDIT_LOGS_MODE is ‘s3’ and you are not using AWS S3, this needs to be set to the S3 api endpoint of your provider.
config.OBOT_SERVER_AUDIT_LOGS_USE_PATH_STYLE	bool	false	Whether to use path style for S3
config.OBOT_SERVER_AUTHENTICATED_RATE_LIMIT	string	""	Rate limit for authenticated non-admin requests in requests per second. Tracked by user ID. Admin users are exempt. Defaults to 200.
config.OBOT_SERVER_AUTH_ADMIN_EMAILS	string	""	A comma separated list of email addresses that will have the Admin role in Obot.
config.OBOT_SERVER_AUTH_OWNER_EMAILS	string	""	A comma separated list of email addresses that will have the Owner role in Obot.
config.OBOT_SERVER_DAILY_USER_INPUT_TOKEN_LIMIT	string	""	Daily input token limit per user in the LLM gateway’s “Daily token limit” budget, which the gateway puts on every profile when it first starts. Only used then; after that, edit each profile’s budget under LLM Gateway > Profiles. Set to a negative value to leave out this limit. Defaults to 10000000.
config.OBOT_SERVER_DAILY_USER_OUTPUT_TOKEN_LIMIT	string	""	Daily output token limit per user in the LLM gateway’s “Daily token limit” budget, which the gateway puts on every profile when it first starts. Only used then. Set to a negative value to leave out this limit. Defaults to 100000.
config.OBOT_SERVER_DISABLE_UPDATE_CHECK	string	""	Disable the Obot server update check. Defaults to false.
config.OBOT_SERVER_DISALLOW_LINK_LOCAL_MCP	string	""	Disallow MCP servers that resolve to link-local addresses. Defaults to true.
config.OBOT_SERVER_DISALLOW_LOCALHOST_MCP	string	""	Disallow MCP servers that try to connect to localhost. Defaults to true.
config.OBOT_SERVER_DISALLOW_PRIVATE_IPMCP	string	""	Disallow MCP servers that resolve to private IP addresses. Defaults to true.
config.OBOT_SERVER_EGRESS_AUDIT_LOG_RETENTION_DAYS	int	90
config.OBOT_SERVER_ENABLE_AUTHENTICATION	bool	false	Enables authentication for Obot
config.OBOT_SERVER_ENABLE_REGISTRY_AUTH	bool	false	Enables authentication for the MCP registry API. When false (default), registry is accessible without authentication and returns only default catalog items with wildcard access control rules.
config.OBOT_SERVER_ENCRYPTION_CONFIG_FILE	string	""	The path to a file containing the encryption configuration. Only used if config.OBOT_SERVER_ENCRYPTION_PROVIDER is ‘custom’
config.OBOT_SERVER_ENCRYPTION_PROVIDER	string	""	Configures an encryption provider for credentials in Obot
config.OBOT_SERVER_FORCE_DYNAMIC_CLIENT	bool	false	Force Dynamic Client Registration when Obot authenticates to remote MCP servers, even when the authorization server supports Client ID Metadata Documents. Defaults to false.
config.OBOT_SERVER_HIDE_K8S_DETAILS	bool	false	Hide Kubernetes configuration details such as the Server Scheduling page from the UI. Defaults to false.
config.OBOT_SERVER_HOSTNAME	string	""	The hostname of your Obot instance, including protocol
config.OBOT_SERVER_LOCAL_AUTH_INITIAL_OWNER_EMAIL	string	""	Provisions this email as the initial owner through the built-in local auth provider. Requires secret.OBOT_SERVER_LOCAL_AUTH_INITIAL_OWNER_SETUP_TOKEN.
config.OBOT_SERVER_LOCAL_AUTH_INITIAL_OWNER_SETUP_TOKEN_EXPIRATION_HOURS	string	"168"	How long the initial owner setup link remains valid. The link can be reopened until password setup completes.
config.OBOT_SERVER_MCPAUDIT_LOGS_PERSIST_BATCH_SIZE	string	""	The batch size to use when persisting MCP audit logs to the database. Defaults to 1000
config.OBOT_SERVER_MCPAUDIT_LOG_PERSIST_INTERVAL_SECONDS	string	""	The interval in seconds to persist MCP audit logs to the database. Defaults to 5 seconds.
config.OBOT_SERVER_MCPBASE_IMAGE	string	""	Deploy MCP servers in the cluster using this base image.
config.OBOT_SERVER_MCPCLUSTER_DOMAIN	string	""	The cluster domain to use for MCP services. Defaults to cluster.local. Only matters if the above image is set.
config.OBOT_SERVER_MCPDEFAULT_DENY_ALL_EGRESS	string	""	Default new MCP servers to allow all egress or deny all egress when a network policy provider is configured. Set to false to default to allow all egress, or true to default to deny all egress. Defaults to false.
config.OBOT_SERVER_MCPHTTPWEBHOOK_BASE_IMAGE	string	""	Deploy MCP HTTP webhook servers in the cluster using this base image.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_NAME	string	""	Helm chart name for the network policy provider chart. Setting this enables network policy integration.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_PATH	string	""	Local filesystem path to the network policy provider chart. Setting this enables network policy integration.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_REPO	string	""	Helm repository URL for the network policy provider chart. Used when config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_NAME is set.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_VERSION	string	""	Helm chart version for the network policy provider chart.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_VALUES	string	""	YAML or JSON values blob merged into the network policy provider chart values.
config.OBOT_SERVER_MCPOAUTH_CLIENT_EXPIRATION	string	""	The expiration time for dynamically registered MCP OAuth clients. Must be a valid duration string and may include days, hours, or minutes. Defaults to 30d.
config.OBOT_SERVER_MCPOAUTH_CLIENT_NATIVE_EXCEPTIONS	string	""	A comma-separated list of additional Client ID Metadata Document URLs that default to the native application type when application_type is omitted.
config.OBOT_SERVER_MCPRUNTIME_BACKEND	string	"kubernetes"	The runtime backend to use for MCP servers. Can be ‘docker’ or ‘kubernetes’. Defaults to ‘docker’. Setting this to ‘kubernetes’ will also create the necessary service account, role and rolebinding.
config.OBOT_SERVER_MCPSECRET_BINDING_ALLOWED_LABEL	string	""	Kubernetes Secret label key required for admin UI secret-binding lookup and runtime secret-binding resolution. Empty uses the server default: obot.obot.ai/allow-secret-binding.
config.OBOT_SERVER_MCPSERVER_SEARCH_IMAGE	string	""	The container image to use for the MCP server search functionality.
config.OBOT_SERVER_MDM_ASSET_SOURCE	string	""	URL to the MDM assets tar archive.
config.OBOT_SERVER_MODEL_PROXY_URL	string	"https://model-service.obot.ai"	MCP Tester model proxy used when no model provider is configured. Set to an empty string to disable; omission uses the hosted service.
config.OBOT_SERVER_MULTI_USER_IDLE_SERVER_SHUTDOWN_HOURS	string	""	The interval in hours to check for idle multi-user MCP servers and shut them down. Set to -1 to disable. Defaults to 168.
config.OBOT_SERVER_SINGLE_USER_IDLE_SERVER_SHUTDOWN_HOURS	string	""	The interval in hours to check for idle single-user MCP servers and shut them down. Set to -1 to disable. Defaults to 24.
config.OBOT_SERVER_SUBSTRATE_NAMESPACE	string	"obot-agents"	Namespace for environment worker pools.
config.OBOT_SERVER_SUBSTRATE_RUNNER_IMAGE	string	""	Override the built-in digest-pinned Claude runner image for new environments (repository@sha256:…); empty uses the Obot default.
config.OBOT_SERVER_SUBSTRATE_SNAPSHOT_LOCATION	string	""	Required cluster-wide snapshot bucket URI (s3:// or gs://) when Claude Environments is enabled.
config.OBOT_SERVER_SUBSTRATE_WORKER_IMAGE	string	""	Default worker image; empty derives it from substrate.image.repository and the bundled Substrate version.
config.OBOT_SERVER_UNAUTHENTICATED_RATE_LIMIT	string	""	Rate limit for unauthenticated requests in requests per second. Tracked by source IP address. Defaults to 100.
deploymentStrategy	object	{}	Configures the complete Kubernetes deployment strategy. When empty, updateStrategy is used.
dev.useEmbeddedDb	bool	false	For development/testing use only, enables the use of an postgres database embedded in the obot container. Do not use in production.
extraVolumeMounts	list	[]	A list of additional volume mounts to create
extraVolumes	list	[]	A list of additional volumes to create
image.pullPolicy	string	"IfNotPresent"	Kubernetes image pullPolicy to use for Obot
image.repository	string	"ghcr.io/obot-platform/obot"	The name of the docker repository for Obot. ghcr.io/obot-platform/obot for open-source or ghcr.io/obot-platform/obot-enterprise for enterprise. Please note that for enterprise you will need to set an imagePullSecret
image.tag	string	""	The docker tag to pull for obot. If blank, will default to the chart appVersion
imagePullSecrets	list	[]	Kubernetes secrets used to pull the Obot server image. For private MCP server images, see mcpImagePullSecrets below. Expects a list of secret objects imagePullSecrets:[{"name": "fooBar"}]
ingress.annotations	object	{}	Configure annotations to add to the ingress object
ingress.className	string	nil	Configures a preexisting ingress class to use.
ingress.enabled	bool	false	Enables ingress creation for Obot.
ingress.extraPaths	list	[]	Define complete path objects, will be inserted before regular paths. Can be useful for things like ALB Ingress Controller actions
ingress.hosts	list	[]	List of hostnames to configure the ingress with. Required when ingress.enabled is true.
ingress.paths[0].path	string	"/"
ingress.paths[0].pathType	string	"Prefix"
ingress.tls	list	[]	List of secrets used to configure TLS for the ingress.
mcpImagePullSecrets	list	[]	Configuration for creating image pull secrets for MCP containers. Each entry should contain registry credentials that will be used to create Kubernetes secrets. If you set .Values.secret.existingSecret, you must define OBOT_SERVER_MCPIMAGE_PULL_SECRETS to use these
mcpNamespace.annotations.”argocd.argoproj.io/sync-wave”	string	"-1"
mcpNamespace.name	string	""	The namespace in which to deploy the MCP servers. Defaults to -mcp
mcpNamespace.networkPolicy	object	{"dnsNamespace":"kube-system","enabled":true}	Network policy configuration for the MCP namespace
mcpNamespace.networkPolicy.dnsNamespace	string	"kube-system"	The namespace where DNS pods are running. Default is kube-system. Adjust if your cluster uses a different namespace for DNS services.
mcpNamespace.networkPolicy.enabled	bool	true	Enable network policy to restrict traffic to/from MCP servers. Default is true, and is recommended for production deployments.
mcpNamespace.podSecurity	object	{"audit":"restricted","auditVersion":"latest","enabled":true,"enforce":"restricted","enforceVersion":"latest","warn":"restricted","warnVersion":"latest"}	Pod Security Admission configuration for the MCP namespace.
mcpNamespace.podSecurity.audit	string	"restricted"	Pod Security Standards level to audit (privileged, baseline, or restricted). Default is restricted.
mcpNamespace.podSecurity.auditVersion	string	"latest"	Kubernetes version for the audit policy. Default is latest.
mcpNamespace.podSecurity.enabled	bool	true	Enable Pod Security Admission labels on the MCP namespace. Default is true.
mcpNamespace.podSecurity.enforce	string	"restricted"	Pod Security Standards level to enforce (privileged, baseline, or restricted). Default is restricted.
mcpNamespace.podSecurity.enforceVersion	string	"latest"	Kubernetes version for the enforce policy. Default is latest.
mcpNamespace.podSecurity.warn	string	"restricted"	Pod Security Standards level to warn about (privileged, baseline, or restricted). Default is restricted.
mcpNamespace.podSecurity.warnVersion	string	"latest"	Kubernetes version for the warn policy. Default is latest.
mcpNamespace.resourceQuota	object	{}	Define requests and limits for total resources available in the mcp namespace.
mcpServerDefaults	object	{"affinity":{},"maxCPULimit":"","maxCPURequest":"","maxMemoryLimit":"","maxMemoryRequest":"","resources":{},"runtimeClassName":"","tolerations":[]}	Default Kubernetes configuration for all deployed MCP server pods
mcpServerDefaults.affinity	object	{}	Affinity rules for MCP server pods (YAML format) When set via Helm, these settings cannot be updated through the API
mcpServerDefaults.maxCPULimit	string	""	Maximum CPU limit allowed for MCP server pods
mcpServerDefaults.maxCPURequest	string	""	Maximum CPU request allowed for MCP server pods Also caps the built-in default CPU request when no explicit default is configured.
mcpServerDefaults.maxMemoryLimit	string	""	Maximum memory limit allowed for MCP server pods
mcpServerDefaults.maxMemoryRequest	string	""	Maximum memory request allowed for MCP server pods Also caps the built-in default memory request when no explicit default is configured.
mcpServerDefaults.resources	object	{}	Resource requests and limits for MCP server pods When set via Helm, these settings cannot be updated through the API
mcpServerDefaults.runtimeClassName	string	""	RuntimeClass name for MCP server pods This allows running MCP servers with specific container runtimes (e.g., gVisor, Kata)
mcpServerDefaults.tolerations	list	[]	Tolerations for MCP server pods (YAML list format) When set via Helm, these settings cannot be updated through the API
nodeSelector	object	{}	Configure node selector for pod assignment
persistence.accessModes	list	["ReadWriteOnce"]	Persistent Volume access modes. ReadWriteOnce is appropriate for replicaCount=1.
persistence.enabled	bool	true	Enables persistence using a PVC mounted at /data. With dev.useEmbeddedDb, the built-in Postgres lives on this volume, including the LLM gateway’s database and its encryption key. With an external secret.OBOT_SERVER_DSN, the gateway keeps its state in Postgres, so it doesn’t depend on this volume.
persistence.existingClaim	string	""
persistence.path	string	"/data"	The path the volume will be mounted
persistence.size	string	"8Gi"	Persistent Volume size
persistence.storageClass	string	""	Persistent Volume storage class If defined, storageClassName: If set to "-", storageClassName: "", which disables dynamic provisioning If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner
podAnnotations	object	{}	Extra pod annotations to add.
podDisruptionBudget	object	{"annotations":{},"enabled":false,"maxUnavailable":"","minAvailable":1}	PodDisruptionBudget configuration for Obot pods. Only enable this with replicaCount >= 2. With a single replica, minAvailable: 1 permanently blocks node drains, since the one pod can never be evicted.
podDisruptionBudget.annotations	object	{}	Annotations to add to the PodDisruptionBudget.
podDisruptionBudget.enabled	bool	false	Enables creation of a PodDisruptionBudget. Disabled by default.
podDisruptionBudget.maxUnavailable	string	""	Maximum number of Obot pods that may be unavailable during voluntary disruptions. Set this instead of minAvailable.
podDisruptionBudget.minAvailable	int	1	Minimum number of Obot pods that must remain available during voluntary disruptions. Ignored when maxUnavailable is set.
replicaCount	int	1	The number of Obot server instances to run. When greater than one, the chart configures replicas to peer tunnel connections through the Obot Service.
resources	object	{}	Resource requests and limits to use for Obot
runtimeClassName	string	""	RuntimeClass name for Obot server pods. This allows running Obot with specific container runtimes (e.g., gVisor, Kata).
secret.ANTHROPIC_API_KEY	string	""	An Anthropic API key. At startup, Obot configures the LLM gateway’s anthropic provider with it, and updates the provider’s key when the value changes.
secret.AWS_ACCESS_KEY_ID	string	""	An AWS access key with permissions for AWS KMS, used for encryption
secret.AWS_SECRET_ACCESS_KEY	string	""	An AWS secret access key with permissions for AWS KMS, used for encryption
secret.GITHUB_AUTH_TOKEN	string	""	A GitHub PAT, used to authenticate catalog and tool pulls to avoid GitHub rate limiting
secret.OBOT_BOOTSTRAP_TOKEN	string	""	Sets a bootstrap token. If the chart is managing the Secret, one will be autogenerated (and preserved across upgrades) when this is left empty.
secret.OBOT_SERVER_DSN	string	""	The DSN for your database. For example: postgres://:@/
secret.OBOT_SERVER_ENCRYPTION_KEY	string	""	The key to use for encryption. Only used if config.OBOT_SERVER_ENCRYPTION_PROVIDER is ‘custom’. A key can be generated with openssl rand -base64 32
secret.OBOT_SERVER_LICENSE_KEY	string	""	A license key for Obot Enterprise. If set here, it cannot be set in the UI.
secret.OBOT_SERVER_LOCAL_AUTH_INITIAL_OWNER_SETUP_TOKEN	string	""	Randomly generated, high-entropy secret used by the initial owner’s setup link (for example, openssl rand -hex 32). Set with config.OBOT_SERVER_LOCAL_AUTH_INITIAL_OWNER_EMAIL. It is never stored in plaintext by Obot.
secret.OBOT_SERVER_OTEL_BEARER_TOKEN	string	""	The bearer token for authentication with OpenTelemetry
secret.OPENAI_API_KEY	string	""	An OpenAI API key. At startup, Obot configures the LLM gateway’s openai provider with it, and updates the provider’s key when the value changes. You can also add providers under LLM Gateway > Providers.
secret.existingSecret	string	""	The name of an existing Secret to use instead of creating one. It only needs to contain the sensitive keys configured below; non-sensitive chart-derived configuration is still supplied by the chart ConfigMap.
service.annotations	object	{}	Extra annotations to add to service object
service.port	int	80	Port for the Kubernetes service to expose
service.spec	object	{}	Any extra fields to add to the service object spec
service.type	string	"ClusterIP"	Type of Kubernetes service to create
serviceAccount.annotations	object	{}
serviceAccount.create	bool	true
serviceAccount.name	string	""
substrate.apiServer.replicas	int	2
substrate.enabled	bool	false
substrate.image.repository	string	"ghcr.io/obot-platform/substrate"
substrate.imagePullSecrets	list	[]
substrate.postgres.dsn	string	""
substrate.postgres.role	string	""
substrate.storage.backend	string	"s3"
substrate.storage.credentials	object	{}
substrate.storage.env.AWS_REGION	string	"us-east-1"
substrate.storage.existingSecret	string	""
substrate.worker.nodeSelector.”kubernetes.io/os”	string	"linux"
substrate.worker.tolerations	list	[]
tolerations	list	[]	Configure tolerations for pod scheduling
topologySpreadConstraints	object	{}	Configurable topologySpreadConstraints for Obot pods
tunnelPeer.existingSecret	string	""	An existing Secret containing OBOT_SERVER_TUNNEL_PEER_TOKEN. Use this or token for stable GitOps rendering. The chart creates and preserves a token when both are empty.
tunnelPeer.token	string	""	The shared peer token stored in the chart-managed Secret. Set this to a stable secret value when manifests are rendered without live-cluster lookup (for example, with a GitOps renderer).
updateStrategy	string	"RollingUpdate"	Configures what update strategy to use for the deployment (Recreate or RollingUpdate)

Updating this repo

This repo will be updated automatically whenever there is a release of Obot (and by extension, the helm chart). The GitHub Actions that control this can be found here.

You can manually update the documentation in this readme using helm-docs. If you have both the charts and obot repos checked out in the same folder, you can use this command:

helm-docs -c ../obot/chart -o '../../charts/README.md' --template-files '../../charts/README.md.gotmpl'

The template for the readme is ./README.md.gotmpl