Helm reference

• Chart: pacto-operator
• Chart version: 6.4.1
• App version: 6.4.1

Values are generated from charts/pacto-operator/values.yaml. Descriptions come from the chart's # -- value annotations.

Key	Default	Description
affinity	{}	Affinity rules for the controller pod
controller.enableMetricsObservation	false	Observe the metrics capability (ServiceMonitor, PodMonitor, annotation or named-port discovery plus an active scrape). Also grants read access to ServiceMonitors and PodMonitors. Off by default; when off, metrics read unsupported.
controller.enableProbing	false	Actively probe in-cluster endpoints: the health capability over HTTP and the wire protocol of each present interface. Off by default; when off, health uses passive readiness-probe and EndpointSlice signals only and interface protocols read unverified.
controller.kernelEvidence.callerIgnoreNamespaces	null	Extra namespaces whose host-network pods are taken not to call workloads. The node agent cannot tell a host-network pod's calls from the node's own, so any such pod makes a Service's caller coverage partial, except in kube-system, kube-public, kube-node-lease and the node agent's namespace. The default lists the Flannel and Calico namespaces. Keep only namespaces that exist on your cluster and that you control: anyone who can create a listed namespace can call your services from a host-network pod there unseen.
controller.kernelEvidence.enabled	false	Merge the node agent's kernel observations (NodeRuntimeObservation objects) into interface and dependency evidence. Needs the node agent running; off by default, so evidence comes from the Kubernetes API only. Kernel evidence is on whenever this OR nodeAgent.enabled is true: a managed agent whose observations nobody merges would be pure cost. Set this alone only for an agent you run yourself.
controller.kernelEvidence.namespace	""	Namespace the node agent publishes to. Empty uses nodeAgent.namespace.
controller.kernelEvidence.staleness	""	How old a node's heartbeat may be before its evidence reads stale. Empty uses three times the node agent's publish interval. Accepts a Go duration (e.g. "2m").
controller.stabilizationWindow	""	Stabilization window: how long a sustained NEGATIVE observation must persist before it converts to a confirmed violation (a transient blip reads Unknown meanwhile). Empty string uses the controller default (2m). Accepts a Go duration (e.g. "30s", "5m").
controller.watchNamespace	""	Restrict the controller's observation scope to a single namespace. Empty string (default) means cluster-wide: the controller watches all namespaces. The dashboard inherits this scope automatically.
crds.install	true	Install and upgrade the CRDs with the chart, the delivery CRDs too when delivery.enabled. They are kept on helm uninstall. Only one release in a cluster can own them: every other release, for example one per watched namespace, sets false. Set false to manage them yourself, for example from a separate GitOps source; the operator and delivery need them before they start
dashboard.auth.oidc.caBundle.configMap	""	A ConfigMap in the operator namespace holding the PEM certificates of the CAs that sign the issuer's certificate (corporate or self-signed), trusted on top of the image's public roots
dashboard.auth.oidc.caBundle.key	ca.crt	The key of the bundle in that ConfigMap or Secret
dashboard.auth.oidc.caBundle.secret	""	A Secret in the operator namespace holding that bundle, instead of a ConfigMap
dashboard.auth.oidc.clientID	""	The dashboard's client id at the issuer
dashboard.auth.oidc.clientSecretRef.key	client-secret	Key of the client secret in that Secret
dashboard.auth.oidc.clientSecretRef.name	""	Secret in the operator namespace holding the client secret (passed by secretKeyRef)
dashboard.auth.oidc.displayName	""	The identity provider's name on the sign-in button, as in "Sign in with Keycloak" (empty: "Sign in with OIDC")
dashboard.auth.oidc.extraScopes	[]	Scopes asked for beyond openid, profile and groups (for example a cross-client audience scope)
dashboard.auth.oidc.groupsClaim	""	ID token claim the API server takes the groups from; must match its claimMappings.groups (empty: groups)
dashboard.auth.oidc.groupsPrefix	""	Prefix the API server puts before every group; must match its claimMappings.groups.prefix
dashboard.auth.oidc.internalIssuerURL	""	Where the dashboard reaches the issuer when it differs from issuerURL, the address browsers use (for example an in-cluster Service). Discovery, tokens and keys are read there; ID tokens must still name issuerURL
dashboard.auth.oidc.issuerURL	""	OpenID Connect issuer URL people sign in with (empty: no sign-in)
dashboard.auth.oidc.redirectURL	""	The dashboard's /auth/callback URL as browsers reach it
dashboard.auth.oidc.usernameClaim	""	ID token claim the API server takes the username from; must match its claimMappings.username (empty: sub)
dashboard.auth.oidc.usernamePrefix	""	Prefix the API server puts before the username; must match its claimMappings.username.prefix (empty: the issuer URL and #, none for the email claim; - for none)
dashboard.auth.session.idleTimeout	""	A session without a request for this long ends, as a Go duration such as 30m (empty: 1h). The ID token renews with the refresh token in between
dashboard.auth.session.maxAge	""	A session ends this long after sign-in, renewed or not, as a Go duration such as 8h (empty: 12h)
dashboard.auth.tokenLogin.enabled	false	Let people sign in by pasting a Kubernetes bearer token, for a cluster whose API server trusts no identity provider. The token stays in the server-side session and every request runs with it; a token session never decides on a held change
dashboard.delivery.miraURL	""	Mira's address, to link the health-check citations in delivery views
dashboard.delivery.namespace	""	Namespace where Pacto delivery runs. The dashboard reads the identity policy it publishes there (agent, break-glass and human groups, team prefix), so it is never configured twice (empty: delivery.namespace when delivery.enabled, else pacto-delivery)
dashboard.delivery.trust.configMap	""	A ConfigMap in the operator namespace holding the trust config the dashboard verifies delivery records with (the recorder's PEM public key or a YAML trust config), so History verifies signed records. Empty: History shows records unverified
dashboard.delivery.trust.key	trust.yaml	The key of the trust config in that ConfigMap
dashboard.enabled	true	Enable the operator-managed dashboard deployment. The dashboard image is controlled by the operator and derived from the bundled Pacto library version. It is not user-configurable.
dashboard.httpRoute.enabled	false	Enable Gateway API HTTPRoute for the dashboard
dashboard.httpRoute.hostnames	[]	Hostnames for the HTTPRoute
dashboard.httpRoute.parentRefs	[]	Parent gateway references
dashboard.httpRoute.rules	[]	HTTPRoute rules. When empty, a single catch-all rule is generated that routes all traffic to the chart-managed dashboard Service on dashboard.service.port.
dashboard.ingress.annotations	{}	Ingress annotations
dashboard.ingress.className	""	Ingress class name
dashboard.ingress.enabled	false	Enable Ingress for the dashboard
dashboard.ingress.hosts	null	Ingress hosts
dashboard.ingress.tls	[]	Ingress TLS configuration
dashboard.observation.sources	[]	Offline OTLP/JSON trace exports to mount read-only into the dashboard, so its Operational Graph can reconcile declared dependencies against observed ones. Each entry is one named data source: name is its stable Data Source identity (a DNS-1123 label). Reordering this list keeps every name, and each name must be unique across all the dashboard's data sources (the live cluster, OCI, the disk cache, local bundles, an Evidence Server). file is the trace file's name directly inside that source's mount, as a single path segment, so mount a claim whose export sits at the top of its own directory. Exactly one of existingClaim (an existing PVC, for real exports) or configMap (small static exports only, ~1 MiB cap) supplies it. Pacto reads only the declared files, through a root that blocks symlinks out of the mount, and never writes to them or scans the mount. Whoever owns that storage produces and rotates the exports. This configures OFFLINE input only: Pacto ships no OTLP receiver and no trace collector. The optional node agent observes sockets with eBPF and handles no traces.
dashboard.ociSecrets	[]	List of Secret names for OCI registry credentials. Supports Opaque (keys: registry + token, or registry + username + password) and kubernetes.io/dockerconfigjson secrets. When set, credentials from all secrets are merged; later secrets override earlier ones for the same registry.
dashboard.resources.limits.memory	512Mi	Memory limit for the dashboard container. The earlier default of 128Mi was OOMKilled while monitoring several OCI repositories and CRs at once; raise it further if the dashboard tracks a large fleet.
dashboard.resources.requests.cpu	50m	CPU request for the dashboard container
dashboard.resources.requests.memory	128Mi	Memory request for the dashboard container
dashboard.service.nodePort	""	Node port (only used when type is NodePort)
dashboard.service.port	3000	Dashboard service port
dashboard.service.type	ClusterIP	Dashboard exposure Service type (ClusterIP, NodePort, LoadBalancer). The operator manages an internal ClusterIP Service (pacto-dashboard) for pod-to-pod communication. This chart-managed Service provides configurable external access and serves as the backend for Ingress/HTTPRoute resources. Selects dashboard pods via operator-defined labels.
delivery.admissionPolicies.gitopsUsers	null	Users besides break-glass that may create or delete an OCIRepository, Kustomization or Application labelled delivery.pacto.trianalab.io/apply-ref: the GitOps controllers that apply them. Deleting one and creating it again is an edit, so a namespace editor may do neither. The namespace controller and the garbage collector are always allowed.
delivery.admissionPolicies.skipCapabilityCheck	false	Skip the chart's Kubernetes 1.30 and ValidatingAdmissionPolicy API check (for helm lint or a helm template without --api-versions). The policies still render.
delivery.affinity	{}	Affinity for the promoter pod
delivery.argocd.enabled	false	Let Stages name an Argo CD Application as their applier (spec.applyRef.kind: Application). Grants the promoter patch on argoproj.io Applications (it only sets spec.source.targetRevision, and the pointer admission policy holds it to that) and read access to the agent, approver and recorder roles. Off by default.
delivery.createNamespace	true	Create delivery.namespace. Set false to create it yourself first, for example to put the recorder key Secret in it before the install
delivery.enabled	false	Install Pacto delivery: the promoter, its CRDs (Stage, Operation, Approval), roles and admission policies
delivery.gates.caBundle.configMap	""	A ConfigMap in delivery.namespace holding the PEM certificates of the CAs that sign your in-cluster providers' https certificates, so they need no allowPlainHTTP. The promoter trusts them on top of the image's public roots. Empty trusts the public roots only.
delivery.gates.caBundle.key	ca.crt	The key in that ConfigMap
delivery.gates.providers	[]	Health gate providers a Stage may name in spec.gates.verify.checks[].provider, each {name, type, url} with type mira (Mira's query API), http (any tool behind the plug-in format) or eval (a runner for the check suites a version ships, named by checks[].suite). The URL is operator configuration: a Stage only names a provider and an agent names nothing. pacto.contract and pacto.runtime are built in. The URL must be https: a verdict ends up in a signed record, so an answer forged in transit could get a Pass signed. Plain http works only on loopback, or with allowPlainHTTP: true on a test cluster. An eval provider also needs signers: the runners whose signed answers it trusts, each {name, publicKey} or {name, identity, issuer, trustedRoot}. An answer no signer signed is Unknown, and the verdict names the runner that signed it. Each provider's name and type (never its URL or signers) is also published in the identity policy ConfigMap, so pacto delivery plan and the dashboard predict an eval check's hold as the promoter does.
delivery.identities.agentGroups	null	Groups whose members are agents. Agents may propose, never approve or unfreeze. Service accounts other than the promoter are always agents.
delivery.identities.allowEmptyHumanGroups	false	Render with humanGroups empty anyway. Then an identity left out of every agent group counts as a person, and one that completes a pacto-approve login (a public client, so a bot with stored credentials can) may approve.
delivery.identities.breakGlassGroups	null	Groups that may raise an override and edit an OCIRepository's spec.ref.digest directly
delivery.identities.humanGroups	[]	When set, only members of these groups count as people. Anyone in none of them is an agent, so an agent identity nobody enrolled in an agent group still cannot approve. Empty classifies by agentGroups alone, which the chart refuses unless allowEmptyHumanGroups is set.
delivery.identities.requireOwnerTeam	true	A held question whose service and consumers declare no owner team is answered by nobody, and only break-glass can override. Set false to let any person answer it, as before.
delivery.identities.teamGroupPrefix	""	Only members of the teams a held question names may answer it. A contract owner team T is the identity-provider group T, or once this prefix is set only this prefix followed by T (for example acme:). A system: group is never a team.
delivery.image.digest	""	Pins the image by digest (sha256:...), appended to the tag as tag@digest so the runtime pulls exactly that image whatever the tag resolves to later
delivery.image.pullPolicy	IfNotPresent	Image pull policy
delivery.image.registry	""	Promoter and recorder image registry (defaults to global.imageRegistry)
delivery.image.repository	trianalab/pacto/delivery	Promoter and recorder image repository (the pacto-delivery image)
delivery.image.tag	""	Overrides the image tag (default is the chart appVersion)
delivery.imagePullSecrets	[]	Image pull secrets of the promoter and the recorder, after global.imagePullSecrets
delivery.insecureRegistries	[]	Registry hosts (host:port) the promoter and the recorder reach over plain HTTP. An OCIRepository with spec.insecure: true is read over HTTP anyway.
delivery.metrics.enabled	true	Expose the promoter's metrics (plain HTTP, port 8080) through a Service. The recorder's come with delivery.recorder.monitoring
delivery.metrics.serviceMonitor.enabled	false	Create a Prometheus Operator ServiceMonitor for that Service
delivery.metrics.serviceMonitor.interval	""	Scrape interval (empty uses Prometheus' default)
delivery.metrics.serviceMonitor.scrapeTimeout	""	Scrape timeout (empty uses Prometheus' default)
delivery.namespace	pacto-delivery	Dedicated namespace the promoter and the recorder run in. The chart creates it; it must not be the release or node agent namespace (the operator can create Deployments, DaemonSets and Secrets there).
delivery.nodeSelector	{}	Node selector for the promoter pod
delivery.podAnnotations	{}	Annotations to add to the promoter and recorder pods
delivery.podLabels	{}	Labels to add to the promoter and recorder pods
delivery.podSecurityContext	{}	Pod securityContext of the promoter and the recorder (defaults to global.podSecurityContext)
delivery.promoter.authFreshness	""	How old a person's login may be when their approval is given, as a Go duration such as 15m; an older one is ignored, so deciding needs a fresh sign-in. Empty or a zero duration (0, 0s): any signed-in person decides with the session they have. Every Stage publishes it in status.authFreshness
delivery.promoter.leaderElect	true	Elect one active promoter
delivery.promoter.poll	3s	How often an operation waiting on Flux, Pacto or a person is looked at (a Go duration)
delivery.promoter.registryCredentials.secretName	""	A kubernetes.io/dockerconfigjson Secret with read access to the contract and deploy repositories, for a private registry. Without it the promoter reads only public ones.
delivery.promoter.resync	1m	How often a Stage is looked at when nothing it watches changed (a Go duration). A change to its operations, upstream Stage, OCIRepositories, Kustomizations or Application wakes it at once
delivery.promoter.upstreamTrust	""	The recorder keys of other clusters, as a trust config in YAML (keys per stream glob). A Stage with candidates.upstreamRecords promotes only on records one of these keys signed for that stream; without it such a Stage is not Ready. Public keys only.
delivery.promoter.workers	4	How many operations and Stages the promoter reconciles at once, so one slow health provider does not hold up the rest
delivery.recorder.cdeventsSink	""	A URL the recorder POSTs a CDEvent (CloudEvents, structured mode) to for every record, best effort. Empty sends none.
delivery.recorder.enabled	false	Run the recorder, which writes a signed record of every concluded operation to the registry as OCI referrers. Off by default. When on, the promoter leaves the record finalizer to it. The registry must support the OCI Referrers API natively (GHCR and released distribution do not).
delivery.recorder.extraEnv	[]	Extra environment for the recorder (for example the credentials a KMS client reads)
delivery.recorder.leaderElect	true	Elect one active recorder
delivery.recorder.monitoring.enabled	false	Scrape the recorder's metrics and alert when records fall behind: a metrics Service, a ServiceMonitor and a PrometheusRule. Needs the Prometheus Operator CRDs.
delivery.recorder.operationTTL	168h	Keep a recorded operation this long after it concluded, then delete it: its record holds what happened. The operation a Stage runs is never deleted. 0s keeps them all (a Go duration).
delivery.recorder.poll	30s	How long a registry or signer failure backs off (a Go duration)
delivery.recorder.registryCredentials.secretName	""	A kubernetes.io/dockerconfigjson Secret with push access to the streams, apply and contract repositories. Only the recorder mounts it.
delivery.recorder.resources.limits.memory	256Mi	Memory limit of the recorder
delivery.recorder.resources.requests.cpu	50m	CPU request of the recorder. Signing and pushing a record is the costly part.
delivery.recorder.resources.requests.memory	64Mi	Memory request of the recorder
delivery.recorder.serviceAccount.annotations	{}	Annotations to add to the recorder's ServiceAccount (workload identity for KMS or keyless)
delivery.recorder.serviceAccount.create	true	Create a ServiceAccount for the recorder
delivery.recorder.serviceAccount.name	""	Name override (defaults to <fullname>-delivery-recorder)
delivery.recorder.signing.allowOperatorReadableKey	false	Say yes to an Ed25519 key in a Secret. The operator reads every Secret in the cluster, so it can read this key too and the recorder is not its only holder. The chart refuses ed25519.secretName unless this is true. Prefer KMS or keyless signing
delivery.recorder.signing.ed25519.generate	false	Generate that Secret at install, with a new Ed25519 key kept across upgrades (for evaluation)
delivery.recorder.signing.ed25519.key	key.pem	The key in that Secret
delivery.recorder.signing.ed25519.secretName	""	A Secret holding a PKCS#8 PEM Ed25519 private key (for kind and tests)
delivery.recorder.signing.keyless.enabled	false	Sign keyless with a Fulcio certificate for the recorder's workload identity, presented as a projected service account token for the sigstore audience. Rekor upload is off; a timestamp authority dates each signature.
delivery.recorder.signing.keyless.fulcioURL	""	The Fulcio that issues the certificate
delivery.recorder.signing.keyless.identity	""	The certificate identity keyless signing produces
delivery.recorder.signing.keyless.issuer	""	The OIDC issuer keyless signing uses
delivery.recorder.signing.keyless.timestampURL	""	The timestamp authority whose signed time a short-lived certificate verifies at
delivery.recorder.signing.keyless.trustedRoot	""	The Sigstore trusted root (trusted_root.json) naming that Fulcio and timestamp authority. Required with keyless: without it a self-signed certificate could name the recorder's identity.
delivery.recorder.signing.kms	""	A KMS key URI (awskms://, gcpkms://, azurekms://, hashivault://). The default image includes every provider; an image built with --build-arg GO_TAGS= has none, and one built with GO_TAGS=kms_aws (or kms_gcp, kms_azure, kms_hashivault) has only that one
delivery.recorder.streamsRepository	""	Repository (host/path) that holds one anchor per Stage stream. Required when enabled.
delivery.recorder.trust	""	Other keys whose records the recorder accepts, as a trust config in YAML (keys: [{publicKey: <PEM>, streams: ["*/prod/*"]}]): list the old key here while you rotate to a new one, and set untilSeq and untilRecord on a leaked key to revoke it after the last record it signed. The recorder's own key is always trusted. A record no listed key signed is skipped as untrusted.
delivery.replicaCount	1	Number of promoter replicas. Only the elected leader acts.
delivery.resources.limits.memory	256Mi	Memory limit of the promoter
delivery.resources.requests.cpu	100m	CPU request of the promoter. It looks at every waiting operation once per promoter.poll, so raise it with the number of Stages.
delivery.resources.requests.memory	128Mi	Memory request of the promoter
delivery.securityContext	{}	Container securityContext of the promoter and the recorder (defaults to global.securityContext)
delivery.serviceAccount.annotations	{}	Annotations to add to the ServiceAccount
delivery.serviceAccount.create	true	Create a ServiceAccount for the promoter
delivery.serviceAccount.name	""	Name override (defaults to <fullname>-delivery)
delivery.tolerations	[]	Tolerations for the promoter pod
dex.enabled	false	Install Dex from its official chart as the dashboard's OpenID Connect issuer. The chart then generates the dashboard's client secret into the Secret dashboard.auth.oidc.clientSecretRef.name names, with the keys client-secret, admin-password and admin-password-hash, and keeps it across upgrades. Its values are the upstream chart's
evidence.enabled	false	Enable the operator-managed Evidence Server deployment. Disabled by default. When enabled the operator reconciles a SEPARATE Evidence Server Deployment and an internal Service; the image is the same runtime image as the dashboard and is not user-configurable. The Evidence Server is single- writer, so its replica count is fixed at one.
evidence.httpRoute.enabled	false	Enable Gateway API HTTPRoute for the Evidence Server.
evidence.httpRoute.hostnames	[]	Hostnames for the HTTPRoute.
evidence.httpRoute.parentRefs	[]	Parent gateway references.
evidence.httpRoute.rules	[]	HTTPRoute rules. When empty, a single catch-all rule routes to the chart-managed evidence Service on evidence.service.port.
evidence.ingress.annotations	{}	Ingress annotations.
evidence.ingress.className	""	Ingress class name.
evidence.ingress.enabled	false	Enable Ingress for the Evidence Server.
evidence.ingress.hosts	null	Ingress hosts.
evidence.ingress.tls	[]	Ingress TLS configuration.
evidence.registry.credentialsSecret	""	Optional name of an EXISTING kubernetes.io/dockerconfigjson Secret with credentials for that registry, mounted read-only. The chart never creates it and never renders its contents. Empty means anonymous or in-cluster access.
evidence.registry.subjects	[]	Required when evidence is enabled: the exact, immutable contract revisions evidence may be reported against, each an oci://<repo>@sha256:<digest> reference. The registry holding them is the durable evidence store: every accepted record is published as an OCI 1.1 referrer of one of these manifests, so the chart installs nothing durable in the cluster. A mutable tag is rejected, because moving it onto another manifest would change what the stored evidence reports on. That registry must serve the native OCI 1.1 Referrers API. GHCR and CNCF distribution (registry:2, registry:3) lack it, and the Evidence Server stays permanently not-ready against them.
evidence.resources.limits.memory	256Mi	Memory limit for the Evidence Server container. It verifies and forwards one envelope at a time and stores nothing locally, so this is sized for a single writer.
evidence.resources.requests.cpu	25m	CPU request for the Evidence Server container
evidence.resources.requests.memory	64Mi	Memory request for the Evidence Server container
evidence.service.nodePort	""	Node port (only used when type is NodePort).
evidence.service.port	8686	Evidence service port.
evidence.service.type	ClusterIP	Evidence exposure Service type (ClusterIP, NodePort, LoadBalancer). The operator manages an internal ClusterIP Service (pacto-evidence) for in-cluster access; this chart-managed Service provides optional external access and backs any Ingress/HTTPRoute.
evidence.trust.existingSecret	""	Name of an existing Secret of trusted producer public keys, mounted read-only. Signature verification is mandatory, so this is required when evidence is enabled.
fullnameOverride	""	Override the full release name
global.commonLabels	{}	Labels added to every object the chart renders
global.imagePullSecrets	[]	Image pull secrets for every pod the chart runs, before each component's own
global.imageRegistry	ghcr.io	Registry of every image the chart runs (the controller, the delivery promoter and the recorder), unless an image sets its own registry. Set it empty to give each repository as a whole reference.
global.podSecurityContext.runAsNonRoot	true	Run pod as non-root
global.podSecurityContext.seccompProfile.type	RuntimeDefault	Seccomp profile type
global.securityContext.allowPrivilegeEscalation	false	Disallow privilege escalation
global.securityContext.capabilities.drop	null	Drop all capabilities
global.securityContext.readOnlyRootFilesystem	true	Read-only root filesystem
global.securityContext.runAsNonRoot	true	Run as non-root
global.securityContext.runAsUser	65532	Run as UID 65532 (nonroot in distroless)
image.digest	""	Pins the image by digest (sha256:...), appended to the tag as tag@digest so the runtime pulls exactly that image whatever the tag resolves to later
image.pullPolicy	IfNotPresent	Image pull policy
image.registry	""	Controller image registry (defaults to global.imageRegistry)
image.repository	trianalab/pacto/operator	Controller image repository
image.tag	""	Overrides the image tag (default is the chart appVersion)
imagePullSecrets	[]	Image pull secrets of the controller pod, after global.imagePullSecrets. The managed node agent gets them too
insecureRegistries	[]	Registry hosts (host:port) to reach over plain HTTP, for a controlled in-cluster registry. Scoped per host, so every other registry stays HTTPS-only. The controller, the managed dashboard and the managed Evidence Server all inherit it, because each one resolves contract refs itself.
leaderElection.enabled	true	Enable leader election for HA deployments
metrics.enabled	true	Enable the metrics endpoint
metrics.secure	true	Serve metrics over HTTPS
metrics.service.port	8443	Metrics service port
metrics.serviceMonitor.enabled	false	Create a Prometheus ServiceMonitor
metrics.serviceMonitor.interval	""	Scrape interval
metrics.serviceMonitor.scrapeTimeout	""	Scrape timeout
nameOverride	""	Override the chart name
nodeAgent.enabled	false	Deploy the node agent DaemonSet. Off by default.
nodeAgent.namespace	pacto-node-agent	Dedicated namespace the agents run and publish in. The chart creates it and labels it privileged for Pod Security; it must not be the release namespace and must not exist outside this release.
nodeAgent.publishInterval	30s	How often each agent publishes its node's observation. A Go duration; kernel evidence reads stale after three intervals unless controller.kernelEvidence.staleness says otherwise.
nodeAgent.resources.limits.cpu	200m	CPU limit for the node agent container
nodeAgent.resources.limits.memory	256Mi	Memory limit for the node agent container. The agent caps the pods and connections it tracks, and the kernel ring buffer is charged here.
nodeAgent.resources.requests.cpu	50m	CPU request for the node agent container
nodeAgent.resources.requests.memory	64Mi	Memory request for the node agent container
nodeSelector	{}	Node selector for the controller pod
podAnnotations	{}	Annotations to add to the controller pod
podLabels	{}	Labels to add to the controller pod
podSecurityContext	{}	Pod securityContext of the controller (defaults to global.podSecurityContext)
replicaCount	1	Number of controller replicas
resources.limits.memory	256Mi	Memory limit of the controller. It caches every Deployment, StatefulSet, ReplicaSet, Job, CronJob and Service it targets.
resources.requests.cpu	100m	CPU request of the controller
resources.requests.memory	128Mi	Memory request of the controller
securityContext	{}	Container securityContext of the controller (defaults to global.securityContext)
serviceAccount.annotations	{}	Annotations to add to the ServiceAccount
serviceAccount.automount	true	Automount API credentials
serviceAccount.create	true	Create a ServiceAccount for the controller
serviceAccount.name	""	Name override (defaults to fullname)
tolerations	[]	Tolerations for the controller pod
zot.enabled	false	Install zot from its official chart as an in-cluster OCI registry with native referrers. Its values are the upstream chart's