charts

obot

A Helm chart for Obot

Installation

To install the chart with the release name obot:

helm repo add obot https://charts.obot.ai
helm install obot obot/obot

Note

This chart defaults to the open source version of Obot. If you want to use the enterprise version of Obot instead, set image.repository to ghcr.io/obot-platform/obot-enterprise. To install this version, you must create an imagePullSecret and configure that in the chart.

Values

Key	Type	Default	Description
additionalLabels	object	{}
affinity	object	{}	Configure affinity rules for pod scheduling
config.AWS_REGION	string	""	An AWS region, used to access AWS KMS
config.KINM_DB_CONNECTIONS	string	"5"	Advanced - the number of connections in the database pool for kinm, both open and idle connections
config.KINM_DB_MAX_CONNECTIONS	string	"5"	Advanced - the number of open connections in the database pool for kinm, overrides KINM_DB_CONNECTIONS
config.KINM_DB_MAX_CONNECTION_LIFETIME_SECONDS	string	"180"	Advanced - the maximum lifetime of a connection in the database pool for kinm in seconds
config.KINM_DB_MAX_IDLE_CONNECTIONS	string	"2"	Advanced - the number of idle connections in the database pool for kinm, overrides KINM_DB_CONNECTIONS
config.NAH_THREADINESS	string	"10000"	Advanced - sets the number of concurrent threads that can run in the Obot controller
config.OBOT_ARTIFACT_AZURE_CLIENT_ID	string	""	Azure client ID for published workflow storage when using explicit Azure credentials.
config.OBOT_ARTIFACT_AZURE_STORAGE_ACCOUNT	string	""	Azure storage account name for published workflow storage.
config.OBOT_ARTIFACT_AZURE_TENANT_ID	string	""	Azure tenant ID for published workflow storage when using explicit Azure credentials.
config.OBOT_ARTIFACT_S3_ENDPOINT	string	""	Endpoint URL for published workflow storage when using ‘custom’ S3-compatible storage.
config.OBOT_ARTIFACT_S3_REGION	string	""	Region for published workflow storage when using ‘s3’ or ‘custom’.
config.OBOT_ARTIFACT_STORAGE_BUCKET	string	""	Bucket or container name for published workflow storage.
config.OBOT_ARTIFACT_STORAGE_PROVIDER	string	""	Storage provider for published workflows. Can be ‘s3’, ‘gcs’, ‘azure’, or ‘custom’. If unset, local disk storage is used.
config.OBOT_AUTH_PROVIDER_POSTGRES_CONNECTION_LIFETIME_SECONDS	string	"180"	Advanced - the maximum lifetime of a connection in the database pool for the auth provider in seconds
config.OBOT_AUTH_PROVIDER_POSTGRES_MAX_CONNECTIONS	string	"5"	Advanced - the maximum number of connections in the database pool for the auth provider
config.OBOT_AUTH_PROVIDER_POSTGRES_MAX_IDLE_CONNECTIONS	string	"2"	Advanced - the maximum number of idle connections in the database pool for the auth provider
config.OBOT_ENABLE_AGENTS	string	""	Controls Obot Agent features. Leave empty (default) to disable agents for new deployments while grandfathering in (keeping enabled) existing deployments that already have agents. Set to “true” to force-enable, or “false” to force-disable, regardless of grandfathering.
config.OBOT_GCP_KMS_KEY_URI	string	""	The URI of a Google Cloud KMS key, used for encryption
config.OBOT_SERVER_AUDIT_LOGS_COMPRESS_FILE	bool	true	Whether to compress audit log files
config.OBOT_SERVER_AUDIT_LOGS_MODE	string	"off"	Configures the storage backend for audit logs in Obot. Can be ‘off’, ‘disk’, or ‘s3’
config.OBOT_SERVER_AUDIT_LOGS_STORE_S3BUCKET	string	""	The name of the S3 bucket to store audit logs in. Only used if config.OBOT_SERVER_AUDIT_LOGS_MODE is ‘s3’
config.OBOT_SERVER_AUDIT_LOGS_STORE_S3ENDPOINT	string	""	If config.OBOT_SERVER_AUDIT_LOGS_MODE is ‘s3’ and you are not using AWS S3, this needs to be set to the S3 api endpoint of your provider.
config.OBOT_SERVER_AUDIT_LOGS_USE_PATH_STYLE	bool	false	Whether to use path style for S3
config.OBOT_SERVER_AUTHENTICATED_RATE_LIMIT	string	""	Rate limit for authenticated non-admin requests in requests per second. Tracked by user ID. Admin users are exempt. Defaults to 200.
config.OBOT_SERVER_AUTH_ADMIN_EMAILS	string	""	A comma separated list of email addresses that will have the Admin role in Obot.
config.OBOT_SERVER_AUTH_OWNER_EMAILS	string	""	A comma separated list of email addresses that will have the Owner role in Obot.
config.OBOT_SERVER_DAILY_USER_INPUT_TOKEN_LIMIT	string	""	The maximum number of prompt/input tokens allowed per user per day. Set to a negative value to disable this limit. Defaults to 10000000.
config.OBOT_SERVER_DAILY_USER_OUTPUT_TOKEN_LIMIT	string	""	The maximum number of completion/output tokens allowed per user per day. Set to a negative value to disable this limit. Defaults to 100000.
config.OBOT_SERVER_DISABLE_UPDATE_CHECK	string	""	Disable the Obot server update check. Defaults to false.
config.OBOT_SERVER_DISALLOW_LINK_LOCAL_MCP	string	""	Disallow MCP servers that resolve to link-local addresses. Defaults to true.
config.OBOT_SERVER_DISALLOW_LOCALHOST_MCP	string	""	Disallow MCP servers that try to connect to localhost. Defaults to true.
config.OBOT_SERVER_DISALLOW_PRIVATE_IPMCP	string	""	Disallow MCP servers that resolve to private IP addresses. Defaults to true.
config.OBOT_SERVER_ENABLE_AUTHENTICATION	bool	false	Enables authentication for Obot
config.OBOT_SERVER_ENABLE_REGISTRY_AUTH	bool	false	Enables authentication for the MCP registry API. When false (default), registry is accessible without authentication and returns only default catalog items with wildcard access control rules.
config.OBOT_SERVER_ENCRYPTION_CONFIG_FILE	string	""	The path to a file containing the encryption configuration. Only used if config.OBOT_SERVER_ENCRYPTION_PROVIDER is ‘custom’
config.OBOT_SERVER_ENCRYPTION_PROVIDER	string	""	Configures an encryption provider for credentials in Obot
config.OBOT_SERVER_HIDE_K8S_DETAILS	bool	false	Hide Kubernetes configuration details such as the Server Scheduling page from the UI. Defaults to false.
config.OBOT_SERVER_HOSTNAME	string	""	The hostname of your Obot instance, including protocol
config.OBOT_SERVER_IDLE_AGENT_SHUTDOWN_HOURS	string	""	The interval in hours to check for idle agents and shut them down. Set to -1 to disable. Defaults to 72.
config.OBOT_SERVER_MCPAUDIT_LOGS_PERSIST_BATCH_SIZE	string	""	The batch size to use when persisting MCP audit logs to the database. Defaults to 1000
config.OBOT_SERVER_MCPAUDIT_LOG_PERSIST_INTERVAL_SECONDS	string	""	The interval in seconds to persist MCP audit logs to the database. Defaults to 5 seconds.
config.OBOT_SERVER_MCPBASE_IMAGE	string	""	Deploy MCP servers in the cluster using this base image.
config.OBOT_SERVER_MCPCLUSTER_DOMAIN	string	""	The cluster domain to use for MCP services. Defaults to cluster.local. Only matters if the above image is set.
config.OBOT_SERVER_MCPDEFAULT_DENY_ALL_EGRESS	string	""	Default new MCP servers to allow all egress or deny all egress when a network policy provider is configured. Set to false to default to allow all egress, or true to default to deny all egress. Defaults to false.
config.OBOT_SERVER_MCPHTTPWEBHOOK_BASE_IMAGE	string	""	Deploy MCP HTTP webhook servers in the cluster using this base image.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_NAME	string	""	Helm chart name for the network policy provider chart. Setting this enables network policy integration.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_PATH	string	""	Local filesystem path to the network policy provider chart. Setting this enables network policy integration.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_REPO	string	""	Helm repository URL for the network policy provider chart. Used when config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_NAME is set.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_VERSION	string	""	Helm chart version for the network policy provider chart.
config.OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_VALUES	string	""	YAML or JSON values blob merged into the network policy provider chart values.
config.OBOT_SERVER_MCPOAUTH_CLIENT_EXPIRATION	string	""	The expiration time for dynamically registered MCP OAuth clients. Must be a valid duration string and may include days, hours, or minutes. Defaults to 30d.
config.OBOT_SERVER_MCPRUNTIME_BACKEND	string	"kubernetes"	The runtime backend to use for MCP servers. Can be ‘docker’ or ‘kubernetes’. Defaults to ‘docker’. Setting this to ‘kubernetes’ will also create the necessary service account, role and rolebinding.
config.OBOT_SERVER_MCPSECRET_BINDING_ALLOWED_LABEL	string	""	Kubernetes Secret label key required for admin UI secret-binding lookup and runtime secret-binding resolution. Empty uses the server default: obot.obot.ai/allow-secret-binding.
config.OBOT_SERVER_MCPSERVER_SEARCH_IMAGE	string	""	The container image to use for the MCP server search functionality.
config.OBOT_SERVER_MDM_ASSET_SOURCE	string	""	URL to the MDM assets tar archive.
config.OBOT_SERVER_MULTI_USER_IDLE_SERVER_SHUTDOWN_HOURS	string	""	The interval in hours to check for idle multi-user MCP servers and shut them down. Set to -1 to disable. Defaults to 168.
config.OBOT_SERVER_NANOBOT_AGENT_IMAGE	string	""	Container image for the Nanobot agent MCP server.
config.OBOT_SERVER_SINGLE_USER_IDLE_SERVER_SHUTDOWN_HOURS	string	""	The interval in hours to check for idle single-user MCP servers and shut them down. Set to -1 to disable. Defaults to 24.
config.OBOT_SERVER_UNAUTHENTICATED_RATE_LIMIT	string	""	Rate limit for unauthenticated requests in requests per second. Tracked by source IP address. Defaults to 100.
dev.useEmbeddedDb	bool	false	For development/testing use only, enables the use of an postgres database embedded in the obot container. Do not use in production.
extraVolumeMounts	list	[]	A list of additional volume mounts to create
extraVolumes	list	[]	A list of additional volumes to create
image.pullPolicy	string	"IfNotPresent"	Kubernetes image pullPolicy to use for Obot
image.repository	string	"ghcr.io/obot-platform/obot"	The name of the docker repository for Obot. ghcr.io/obot-platform/obot for open-source or ghcr.io/obot-platform/obot-enterprise for enterprise. Please note that for enterprise you will need to set an imagePullSecret
image.tag	string	""	The docker tag to pull for obot. If blank, will default to the chart appVersion
imagePullSecrets	list	[]	Kubernetes secrets used to pull the Obot server image. For private MCP server images, see mcpImagePullSecrets below. Expects a list of secret objects imagePullSecrets:[{"name": "fooBar"}]
ingress.annotations	object	{}	Configure annotations to add to the ingress object
ingress.className	string	nil	Configures a preexisting ingress class to use.
ingress.enabled	bool	false	Enables ingress creation for Obot.
ingress.extraPaths	list	[]	Define complete path objects, will be inserted before regular paths. Can be useful for things like ALB Ingress Controller actions
ingress.hosts	list	[]	List of hostnames to configure the ingress with. Required when ingress.enabled is true.
ingress.paths[0].path	string	"/"
ingress.paths[0].pathType	string	"Prefix"
ingress.tls	list	[]	List of secrets used to configure TLS for the ingress.
mcpImagePullSecrets	list	[]	Configuration for creating image pull secrets for MCP containers. Each entry should contain registry credentials that will be used to create Kubernetes secrets. If you set .Values.secret.existingSecret, you must define OBOT_SERVER_MCPIMAGE_PULL_SECRETS to use these
mcpNamespace.annotations.”argocd.argoproj.io/sync-wave”	string	"-1"
mcpNamespace.name	string	""	The namespace in which to deploy the MCP servers. Defaults to -mcp
mcpNamespace.networkPolicy	object	{"dnsNamespace":"kube-system","enabled":true}	Network policy configuration for the MCP namespace
mcpNamespace.networkPolicy.dnsNamespace	string	"kube-system"	The namespace where DNS pods are running. Default is kube-system. Adjust if your cluster uses a different namespace for DNS services.
mcpNamespace.networkPolicy.enabled	bool	true	Enable network policy to restrict traffic to/from MCP servers. Default is true, and is recommended for production deployments.
mcpNamespace.podSecurity	object	{"audit":"restricted","auditVersion":"latest","enabled":true,"enforce":"restricted","enforceVersion":"latest","warn":"restricted","warnVersion":"latest"}	Pod Security Admission configuration for the MCP namespace
mcpNamespace.podSecurity.audit	string	"restricted"	Pod Security Standards level to audit (privileged, baseline, or restricted). Default is restricted.
mcpNamespace.podSecurity.auditVersion	string	"latest"	Kubernetes version for the audit policy. Default is latest.
mcpNamespace.podSecurity.enabled	bool	true	Enable Pod Security Admission labels on the MCP namespace. Default is true.
mcpNamespace.podSecurity.enforce	string	"restricted"	Pod Security Standards level to enforce (privileged, baseline, or restricted). Default is restricted.
mcpNamespace.podSecurity.enforceVersion	string	"latest"	Kubernetes version for the enforce policy. Default is latest.
mcpNamespace.podSecurity.warn	string	"restricted"	Pod Security Standards level to warn about (privileged, baseline, or restricted). Default is restricted.
mcpNamespace.podSecurity.warnVersion	string	"latest"	Kubernetes version for the warn policy. Default is latest.
mcpNamespace.resourceQuota	object	{}	Define requests and limits for total resources available in the mcp namespace.
mcpServerDefaults	object	{"affinity":{},"maxCPULimit":"","maxCPURequest":"","maxMemoryLimit":"","maxMemoryRequest":"","nanobotWorkspaceSize":"","resources":{},"runtimeClassName":"","storageClassName":"","tolerations":[]}	Default Kubernetes configuration for all deployed MCP server pods
mcpServerDefaults.affinity	object	{}	Affinity rules for MCP server pods (YAML format) When set via Helm, these settings cannot be updated through the API
mcpServerDefaults.maxCPULimit	string	""	Maximum CPU limit allowed for MCP server pods
mcpServerDefaults.maxCPURequest	string	""	Maximum CPU request allowed for MCP server pods Also caps the built-in default CPU request when no explicit default is configured.
mcpServerDefaults.maxMemoryLimit	string	""	Maximum memory limit allowed for MCP server pods
mcpServerDefaults.maxMemoryRequest	string	""	Maximum memory request allowed for MCP server pods Also caps the built-in default memory request when no explicit default is configured.
mcpServerDefaults.nanobotWorkspaceSize	string	""	Size for nanobot workspace volumes (e.g., 1Gi)
mcpServerDefaults.resources	object	{}	Resource requests and limits for MCP server pods When set via Helm, these settings cannot be updated through the API
mcpServerDefaults.runtimeClassName	string	""	RuntimeClass name for MCP server pods This allows running MCP servers with specific container runtimes (e.g., gVisor, Kata)
mcpServerDefaults.storageClassName	string	""	StorageClass name for nanobot workspace volumes
mcpServerDefaults.tolerations	list	[]	Tolerations for MCP server pods (YAML list format) When set via Helm, these settings cannot be updated through the API
nodeSelector	object	{}	Configure node selector for pod assignment
persistence.accessModes	list	["ReadWriteOnce"]	Persistent Volume access modes. ReadWriteOnce is appropriate for replicaCount=1. ReadWriteMany is required for multi-replica deployments that rely on local artifact storage instead of object storage.
persistence.enabled	bool	true	Enables persistence using a PVC mounted at /data. This also persists local published workflow artifacts when OBOT_ARTIFACT_STORAGE_PROVIDER is unset, because those files are stored under /data/.local/share/obot/published-artifacts.
persistence.existingClaim	string	""
persistence.path	string	"/data"	The path the volume will be mounted
persistence.size	string	"8Gi"	Persistent Volume size
persistence.storageClass	string	""	Persistent Volume storage class If defined, storageClassName: If set to "-", storageClassName: "", which disables dynamic provisioning If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner
podAnnotations	object	{}	Extra pod annotations to add.
podDisruptionBudget	object	{"annotations":{},"enabled":false,"maxUnavailable":"","minAvailable":1}	PodDisruptionBudget configuration for Obot pods. Only enable this with replicaCount >= 2. With a single replica, minAvailable: 1 permanently blocks node drains, since the one pod can never be evicted.
podDisruptionBudget.annotations	object	{}	Annotations to add to the PodDisruptionBudget.
podDisruptionBudget.enabled	bool	false	Enables creation of a PodDisruptionBudget. Disabled by default.
podDisruptionBudget.maxUnavailable	string	""	Maximum number of Obot pods that may be unavailable during voluntary disruptions. Set this instead of minAvailable.
podDisruptionBudget.minAvailable	int	1	Minimum number of Obot pods that must remain available during voluntary disruptions. Ignored when maxUnavailable is set.
replicaCount	int	1	The number of Obot server instances to run
resources	object	{}	Resource requests and limits to use for Obot
runtimeClassName	string	""	RuntimeClass name for Obot server pods. This allows running Obot with specific container runtimes (e.g., gVisor, Kata).
secret.ANTHROPIC_API_KEY	string	""	An Anthropic API Key used to configure access to Anthropic models, which can be used as the default in Obot.
secret.AWS_ACCESS_KEY_ID	string	""	An AWS access key with permissions for AWS KMS, used for encryption
secret.AWS_SECRET_ACCESS_KEY	string	""	An AWS secret access key with permissions for AWS KMS, used for encryption
secret.GITHUB_AUTH_TOKEN	string	""	A GitHub PAT, used to authenticate catalog and tool pulls to avoid GitHub rate limiting
secret.OBOT_ARTIFACT_AZURE_CLIENT_SECRET	string	""	Azure client secret for published workflow storage when using explicit Azure credentials.
secret.OBOT_ARTIFACT_GCS_SERVICE_ACCOUNT_JSON	string	""	Inline GCS service account JSON for published workflow storage. If empty, Application Default Credentials are used.
secret.OBOT_ARTIFACT_S3_ACCESS_KEY_ID	string	""	Access key ID for published workflow storage when explicit S3-compatible credentials are required.
secret.OBOT_ARTIFACT_S3_SECRET_ACCESS_KEY	string	""	Secret access key for published workflow storage when explicit S3-compatible credentials are required.
secret.OBOT_BOOTSTRAP_TOKEN	string	""	Sets a bootstrap token. If the chart is managing the Secret, one will be autogenerated (and preserved across upgrades) when this is left empty.
secret.OBOT_SERVER_DSN	string	""	The DSN for your database. For example: postgres://:@/
secret.OBOT_SERVER_ENCRYPTION_KEY	string	""	The key to use for encryption. Only used if config.OBOT_SERVER_ENCRYPTION_PROVIDER is ‘custom’. A key can be generated with openssl rand -base64 32
secret.OBOT_SERVER_LICENSE_KEY	string	""	A license key for Obot Enterprise. If set here, it cannot be set in the UI.
secret.OBOT_SERVER_OTEL_BEARER_TOKEN	string	""	The bearer token for authentication with OpenTelemetry
secret.OPENAI_API_KEY	string	""	An OpenAI API Key used to configure access to OpenAI models, which are the default in Obot.
secret.existingSecret	string	""	The name of an existing Secret to use instead of creating one. It only needs to contain the sensitive keys configured below; non-sensitive chart-derived configuration is still supplied by the chart ConfigMap.
service.annotations	object	{}	Extra annotations to add to service object
service.port	int	80	Port for the Kubernetes service to expose
service.spec	object	{}	Any extra fields to add to the service object spec
service.type	string	"ClusterIP"	Type of Kubernetes service to create
serviceAccount.annotations	object	{}
serviceAccount.create	bool	true
serviceAccount.name	string	""
tolerations	list	[]	Configure tolerations for pod scheduling
topologySpreadConstraints	object	{}	Configurable topologySpreadConstraints for Obot pods
updateStrategy	string	"RollingUpdate"	Configures what update strategy to use for the deployment (Recreate or RollingUpdate)

Updating this repo

This repo will be updated automatically whenever there is a release of Obot (and by extension, the helm chart). The GitHub Actions that control this can be found here.

You can manually update the documentation in this readme using helm-docs. If you have both the charts and obot repos checked out in the same folder, you can use this command:

helm-docs -c ../obot/chart -o '../../charts/README.md' --template-files '../../charts/README.md.gotmpl'

The template for the readme is ./README.md.gotmpl