Helm chart values

The operator's chart is published at oci://ghcr.io/kuberoot-dev/charts/kubepkg, versioned with kubepkg. These are its values and their defaults, taken from the chart itself:

charts/kubepkg/values.yaml

image:
  repository: ghcr.io/kuberoot-dev/kubepkg-operator
  # Defaults to the chart's appVersion.
  tag: ""
  pullPolicy: IfNotPresent

# How components are installed: helm (in-process, can roll back), werf
# (through Nelm, werf's deployment engine, can roll back), flux or argo.
backend: helm

# The helm and werf backends install whatever the packages' charts contain, CRDs and
# cluster roles included; Kubernetes only lets it grant permissions it holds,
# so it needs cluster-admin. The flux and argo backends hand charts to Flux or
# Argo CD and get by with the operator's own role; set this to false for them.
clusterAdmin: true

# API group the kubepkg types are served under.
apiGroup: kubepkg.dev

# namespace/name of a Secret whose values.yaml is layered under every
# component's values: platform-wide settings such as a domain or an issuer.
valuesSecret: ""

# Labels put on every namespace packages create.
namespaceLabels: {}

argo:
  namespace: argocd
  project: default

# Air-gapped clusters: an oci:// registry path that holds copies of every
# chart and package tree, made by kubepkg bundle import. The operator then
# fetches only from there; digests are verified as usual.
mirror: ""

# kubernetes.io/dockerconfigjson Secrets with credentials for the
# registries charts and package trees come from (helm and werf backends).
# A bare name is a Secret in the release namespace; namespace/name works
# too. They are read on every pull, so rotated credentials apply at once;
# one that does not exist is skipped with a warning.
registrySecrets: []

# Keep pods in package namespaces on the images their packages pin:
#   off      nothing happens
#   warn     tags the packages pin are rewritten to their digests; other
#            images run, with a warning
#   enforce  the same, and other images are refused; a namespace where
#            some package pins no images stays at warn
# The operator issues the webhook's certificate itself.
imagePolicy: "off"
# Namespaces the image policy never applies to, even when packages install
# there: the cluster and tools other than packages start pods in them. A
# namespace labelled kubepkg.dev/image-policy=off by an admin is left
# alone too.
imagePolicyExclude: [kube-system, kube-public, kube-node-lease]

# Registries the operator reaches over plain HTTP, host or host:port, e.g.
# a local registry; every other registry keeps TLS. A Repository can list
# more in spec.plainHTTPRegistries.
plainHTTPRegistries: []
# Deprecated: reaches every registry over plain HTTP, public ones included.
# Use plainHTTPRegistries.
plainHTTP: false

# Repositories to subscribe to, e.g. a distribution's own:
#   - name: main
#     url: https://packages.example.org/index.yaml
#     priority: 10
#     publicKeys:
#       - |
#         -----BEGIN PUBLIC KEY-----
#         ...
#         -----END PUBLIC KEY-----
#   or, for a repository with a root of trust (threshold signing, rotation):
#     trust:
#       rootThreshold: 2
#       rootKeys: [...]
repositories: []

replicas: 1

# Packages reconciled at once. With the helm and werf backends an install
# holds a worker until its components are ready, so one slow package must
# not keep the others, its dependents included, waiting.
packageWorkers: 4

# A failed install or upgrade is tried again on its own: first after
# backoff, then after twice as long each time, at most maxBackoff.
retry:
  backoff: 30s
  maxBackoff: 10m

metrics:
  # A Service in front of the operator's metrics endpoint.
  service: true
  # A Prometheus Operator ServiceMonitor scraping it.
  serviceMonitor:
    enabled: false
    interval: 30s
    labels: {}
  # Alerts: packages not ready, failed or rolled back upgrades, repositories
  # that cannot be loaded or have not changed for long, reconcile errors.
  prometheusRule:
    enabled: false
    labels: {}
    # How long a repository index may stay unchanged before it is stale.
    indexMaxAge: 168h
  # A Grafana dashboard in a ConfigMap, for Grafana's dashboard sidecar.
  dashboard:
    enabled: false
    labels:
      grafana_dashboard: "1"

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    memory: 1Gi

nodeSelector: {}
tolerations: []
affinity: {}

What the chart installs is described in Installing kubepkg. The chart refuses backend: helm or backend: werf together with clusterAdmin: false, because those backends could not install charts that create cluster roles.