Configuration Reference

Complete reference for all values.yaml parameters.

---

Global

Parameter	Type	Default	Description
global.labels	map	{}	Labels added to every managed resource
global.annotations	map	{}	Annotations added to every managed resource

---

Tools namespace

A shared namespace for cluster-wide tooling (operators, controllers, etc.).

Parameter	Type	Default	Description
tools.create	bool	true	Create the tools namespace
tools.namespace	string	"k8s-tools"	Name of the tools namespace
tools.labels	map	{}	Extra labels
tools.annotations	map	{}	Extra annotations

---

Tenants

Each entry in tenants[] provisions a full set of resources for one team.

Parameter	Type	Required	Description
tenants[].name	string	yes	Tenant name — becomes the namespace name
tenants[].labels	map	no	Extra labels on the namespace
tenants[].annotations	map	no	Extra annotations on the namespace
tenants[].resourceQuota	object	no	Per-tenant quota (overrides resourceQuota.default)
tenants[].limitRange	object	no	Per-tenant LimitRange (overrides limitRange.default)
tenants[].rbac.subjects	list	no	Additional RBAC subjects (users, groups, service accounts)
tenants[].networkPolicy.enabled	bool	no	Per-tenant override for networkPolicy.enabled

Per-tenant RBAC subjects

tenants:
  - name: team-alpha
    rbac:
      subjects:
        - kind: Group
          name: team-alpha-admins
          apiGroup: rbac.authorization.k8s.io
        - kind: User
          name: [email protected]
          apiGroup: rbac.authorization.k8s.io

kind must be one of User, Group, or ServiceAccount. These are appended to the default ServiceAccount binding.

Per-tenant resource quota override

tenants:
  - name: data-platform
    resourceQuota:
      requests.cpu: "8"
      limits.cpu: "16"
      requests.memory: 16Gi
      limits.memory: 32Gi
      pods: "50"

Per-tenant NetworkPolicy toggle

tenants:
  - name: internal-tools
    networkPolicy:
      enabled: false   # disable isolation for this tenant only

---

RBAC

Parameter	Type	Default	Description
rbac.create	bool	true	Create a Role + RoleBinding in each tenant namespace
rbac.serviceAccountName	string	"default"	ServiceAccount bound in every tenant namespace
rbac.defaultRules	list	see values.yaml	RBAC rules granted in each tenant namespace

---

ResourceQuota

Parameter	Type	Default	Description
resourceQuota.enabled	bool	true	Create a ResourceQuota in each tenant namespace
resourceQuota.default	object	see below	Hard quota applied to all tenants unless overridden

Default quota:

resourceQuota:
  default:
    requests.cpu: "2"
    requests.memory: 4Gi
    limits.cpu: "4"
    limits.memory: 8Gi
    persistentvolumeclaims: "5"
    pods: "20"
    services: "5"
    secrets: "20"
    configmaps: "20"

---

LimitRange

Parameter	Type	Default	Description
limitRange.enabled	bool	true	Create a LimitRange in each tenant namespace
limitRange.default	object	see below	Default container limits applied to all tenants unless overridden

Default LimitRange:

limitRange:
  default:
    type: Container
    default:
      cpu: 300m
      memory: 256Mi
    defaultRequest:
      cpu: 100m
      memory: 128Mi
    max:
      cpu: "1"
      memory: 2Gi
    min:
      cpu: 50m
      memory: 64Mi

---

NetworkPolicy

Parameter	Type	Default	Description
networkPolicy.enabled	bool	true	Create an isolation policy in each tenant namespace
networkPolicy.vpcCidr	string	"10.0.0.0/8"	VPC/VNet CIDR for ALB/load-balancer ingress and internal service egress
networkPolicy.allowInternetEgress	bool	false	Allow pods to make outbound HTTPS/HTTP calls to the public internet

vpcCidr per cloud

Cloud	How to find your CIDR
EKS	aws ec2 describe-vpcs --query 'Vpcs[*].CidrBlock'
AKS	az network vnet list --query '[*].addressSpace.addressPrefixes'
GKE	gcloud compute networks subnets list

What the NetworkPolicy allows

By default each tenant gets:

• Ingress: same-namespace pods, kube-system (DNS/CNI), VPC CIDR (load balancer health checks)
• Egress: DNS on port 53, VPC CIDR on ports 5432 (PostgreSQL), 3306 (MySQL), 6379 (Redis), 9092 (Kafka)
• Blocked: all other cross-namespace and internet traffic

Set allowInternetEgress: true to additionally allow outbound port 443/80 to 0.0.0.0/0.