Configuration Reference

database

Parameter	Type	Default	Description
`database.affinity`	object	`{}`	Affinity rules. Pass-through, not strictly validated.
`database.coreSchema`	string	`"boltmcp_core"`	Schema holding the shared application tables. The ltree extension is namespaced here and the schema is owned by the migrate-core user; application roles have no dependency on public.
`database.host`	string	`""`	External database host (when internal.enabled=false)
`database.image.pullPolicy`	string	`"IfNotPresent"`	Image pull policy
`database.image.repository`	string	`"postgres"`	PostgreSQL image repository
`database.image.tag`	string	`"15-alpine"`	PostgreSQL image tag
`database.internal.enabled`	bool	`true`	Deploy internal PostgreSQL. Set false for external DB
`database.name`	string	`"boltmcp"`	Database name
`database.nodeSelector`	object	`{}`	Node selector
`database.persistence.accessModes`	array	`["ReadWriteOnce"]`	PVC access modes
`database.persistence.enabled`	bool	`true`	Enable persistent storage
`database.persistence.size`	string	`"10Gi"`	PVC size
`database.persistence.storageClass`	string	`""`	Storage class (falls back to global.storageClass)
`database.port`	int	`5432`	Database port
`database.resources`	object	`{}`	CPU/memory resource limits and requests. Pass-through, not strictly validated.
`database.superuser.username`	string	`"postgres"`	Superuser username (password lives in the database Secret as superuser-password)
`database.tolerations`	array	`[]`	Tolerations
`database.users.keycloak.schema`	string	`"boltmcp_keycloak"`	Keycloak schema name
`database.users.keycloak.username`	string	`"boltmcp_keycloak"`	Keycloak DB user (password: keycloak-password)
`database.users.mcpServer.username`	string	`"boltmcp_mcp_server"`	MCP Server DB user, read-only on the core schema plus read/write on specific tables (password: mcp-server-password)
`database.users.migrateCore.username`	string	`"boltmcp_migrate_core"`	Migration DB user — owns the core schema and is the only role that runs DDL/migrations (password: migrate-core-password)
`database.users.restApi.username`	string	`"boltmcp_rest_api"`	REST API DB user, read/write on the core schema (password: rest-api-password)
`database.users.vault.schema`	string	`"boltmcp_vault"`	Vault storage schema name
`database.users.vault.username`	string	`"boltmcp_vault"`	Vault storage DB user; owns the pre-created vault_kv_store table (password: vault-password)
`database.users.web.username`	string	`"boltmcp_web"`	Web app DB user, read/write on the core schema (password lives in the database Secret as web-password)

global

Parameter	Type	Default	Description
`global.domain`	string	`""`	Apex domain that hosts BoltMCP. Used to derive per-service hostnames as `web.<domain>`, `auth.<domain>`, `server.<domain>`, `inspector.<domain>`. Required unless every per-service URL/hostname override is set explicitly.
`global.hostAliases`	array	`[]`	hostAliases injected into every BoltMCP pod. Use when the public BoltMCP hostnames don't resolve from inside the cluster (split-horizon DNS, local installs) so in-cluster OIDC discovery can reach Keycloak.
`global.imagePullSecrets`	array	`[{"name":"boltmcp-pull-secret"}]`	Image pull secrets for private registries. Matches the Secret name created in cluster prep. Set to [] if your images come from a registry that doesn't require auth.
`global.imageRegistry`	string	`"europe-west2-docker.pkg.dev/boltmcp-platform/boltmcp-alpha/images"`	Default image registry for BoltMCP images
`global.storageClass`	string	`""`	Storage class for all BoltMCP persistent volumes. Empty uses the cluster default (fine on GKE/AKS). On EKS set it to a class you created. Overridable per-volume by database.persistence.storageClass.
`global.tls.enabled`	bool	`true`	Whether the public BoltMCP URLs are served over HTTPS. Declares the scheme the workloads advertise and expect — it does not provision TLS itself; certificates and termination remain the job of your ingress / load balancer (with the chart-managed Ingress, of cert-manager via ingress.annotations). Single source of the scheme for every derived URL (web/server/inspector/Keycloak base URLs, the OIDC issuer) and for whether the chart-managed Ingress carries a tls section. Set false only for evaluation installs served over plain HTTP. Explicit overrides such as web.baseUrl and keycloak.baseUrl always win, scheme included.

ingress

Optional chart-managed Ingress. Disabled by default: bring your own ingress / gateway / load balancer instead (see examples/ingress in the chart for a reference manifest).

Parameter	Type	Default	Description
`ingress.annotations`	object	`{}`	Annotations for the Ingress. Controller- and cert-manager-specific settings go here: on ingress-nginx you almost always want cert-manager.io/cluster-issuer for TLS certificates, and on plain-HTTP installs nginx.ingress.kubernetes.io/ssl-redirect: "false". The chart applies two ingress-nginx defaults you do not need to repeat: proxy-body-size: "10m", without which ingress-nginx's own 1m default rejects API spec uploads with 413 (10m matches the 10 MB request-body limit the BoltMCP REST API enforces itself, so raising it further has no effect), and proxy-buffer-size: "128k", required for Keycloak's large auth headers (the 4k default breaks login with "upstream sent too big header"). Setting either key here overrides the chart default; all other annotations you supply are merged alongside them.
`ingress.className`	string	`""`	IngressClass name (spec.ingressClassName). Empty omits the field so the cluster default class applies.
`ingress.enabled`	bool	`false`	Create a single Ingress routing the public BoltMCP hostnames (derived from global.domain / the per-service baseUrl overrides, so they can never drift from the URLs the services advertise) to the in-cluster services.
`ingress.tls.secretName`	string	`"boltmcp-tls"`	Name of the TLS Secret covering all BoltMCP hostnames (created by cert-manager when the cluster-issuer annotation is set). The Ingress carries a tls section only when global.tls.enabled is true.

keycloak

Parameter	Type	Default	Description
`keycloak.affinity`	object	`{}`	Affinity rules. Pass-through, not strictly validated.
`keycloak.baseUrl`	string	`""`	Base URL. If empty, defaults to `https://auth.<global.domain>` (http when global.tls.enabled is false). The OIDC issuer is `<baseUrl>/realms/boltmcp`
`keycloak.enabled`	bool	`true`	Enable Keycloak deployment
`keycloak.image.pullPolicy`	string	`"IfNotPresent"`	Image pull policy
`keycloak.image.repository`	string	`"quay.io/keycloak/keycloak"`	Keycloak image
`keycloak.image.tag`	string	`"26.7.0-1"`	Keycloak image tag
`keycloak.nodeSelector`	object	`{}`	Node selector
`keycloak.production.enabled`	bool	`true`	Run in production mode (start vs start-dev). Production mode works over plain HTTP behind a proxy (the chart sets the proxy-headers env); set false only for evaluation installs with no ingress / reverse proxy in front of Keycloak at all
`keycloak.reconcile.auth`	string	`"master"`	Which principal the reconcile Job authenticates as. master: the master-realm operator (master_admin, password from the auth Secret). client: the realm's own boltmcp-keycloak-reconcile service account (client credentials; secret under keycloak-reconcile-client-secret in the OIDC Secret; realm-scoped manage-clients, manage-realm and manage-users only), with the master password not mounted into the Job at all. client requires the realm to already hold that client, which is true for any realm installed or upgraded with this chart version or later. If the Job is refused in client mode (client missing, or its secret in Keycloak no longer matches the OIDC Secret after a rotation), set master for one upgrade so the Job creates the client or patches its secret, then switch back
`keycloak.reconcile.enabled`	bool	`true`	Reconcile the platform-owned realm resources (OIDC clients, the boltmcp:rest-api:access scope, the mcp:manage role) on every install and upgrade via a pre-upgrade/post-install hook Job driven by files/boltmcp-realm-reconcile.json. Declared fields are patched to match; scope attachments, mappers and scope mappings are only added to. Disable only if you manage these resources yourself and will apply upgrade changes by hand
`keycloak.resources`	object	`{}`	CPU/memory resource limits and requests. Pass-through, not strictly validated.
`keycloak.service.healthPort`	int	`9000`	Health check port
`keycloak.service.port`	int	`8080`	Service port
`keycloak.service.type`	string	`"ClusterIP"`	Service type
`keycloak.tolerations`	array	`[]`	Tolerations

mcpInspector

Parameter	Type	Default	Description
`mcpInspector.affinity`	object	`{}`	Affinity rules. Pass-through, not strictly validated.
`mcpInspector.baseUrl`	string	`""`	Base URL. If empty, defaults to `https://inspector.<global.domain>` (http when global.tls.enabled is false)
`mcpInspector.enabled`	bool	`true`	Enable MCP Inspector
`mcpInspector.image.pullPolicy`	string	`"IfNotPresent"`	Image pull policy
`mcpInspector.image.repository`	string	`"ghcr.io/modelcontextprotocol/inspector"`	Image repository
`mcpInspector.image.tag`	string	`"2.2.0"`	Image tag
`mcpInspector.nodeSelector`	object	`{}`	Node selector
`mcpInspector.resources`	object	`{}`	CPU/memory resource limits and requests. Pass-through, not strictly validated.
`mcpInspector.service.type`	string	`"ClusterIP"`	Service type
`mcpInspector.service.webPort`	int	`6274`	Web UI port
`mcpInspector.tolerations`	array	`[]`	Tolerations

mcpServer

Parameter	Type	Default	Description
`mcpServer.affinity`	object	`{}`	Affinity rules. Pass-through, not strictly validated.
`mcpServer.baseUrl`	string	`""`	Base URL. If empty, defaults to `https://server.<global.domain>` (http when global.tls.enabled is false)
`mcpServer.extraEnv`	array	`[]`	Additional environment variables
`mcpServer.image.pullPolicy`	string	`"IfNotPresent"`	Image pull policy
`mcpServer.image.repository`	string	`""`	Image repository (defaults to global.imageRegistry/boltmcp-mcp-server)
`mcpServer.image.tag`	string	`""`	Image tag (defaults to .Chart.AppVersion if empty)
`mcpServer.nodeSelector`	object	`{}`	Node selector
`mcpServer.replicaCount`	int	`1`	Number of replicas
`mcpServer.resources`	object	`{}`	CPU/memory resource limits and requests. Pass-through, not strictly validated.
`mcpServer.service.port`	int	`3001`	Service port
`mcpServer.service.type`	string	`"ClusterIP"`	Service type
`mcpServer.tolerations`	array	`[]`	Tolerations

migrations

Helm hook Job settings. coreMigrateImage is the image for the migrate-core Job only; backoffLimit and ttlSecondsAfterFinished apply to both hook Jobs (migrate-core and keycloak-reconcile).

Parameter	Type	Default	Description
`migrations.backoffLimit`	int	`3`	Retry limit for every hook Job (migrate-core and keycloak-reconcile)
`migrations.coreMigrateImage.repository`	string	`""`	Core schema migration image (defaults to global.imageRegistry/boltmcp-migrate-core)
`migrations.coreMigrateImage.tag`	string	`""`	Tag (inherits from web.image.tag)
`migrations.ttlSecondsAfterFinished`	int	`300`	Seconds a finished hook Job (migrate-core and keycloak-reconcile) is kept before Kubernetes deletes it

oidc

Parameter	Type	Default	Description
`oidc.adminUser.email`	string	`""`	Required. Email for the first user in the boltmcp Keycloak realm. Provisioned on first install via --import-realm (username boltmcp_admin, firstName Admin, emailVerified true, granted realm-management/realm-admin). Password lives in the auth Secret as boltmcp-admin-password.
`oidc.mcpServer.clientId`	string	`"boltmcp-mcp-server"`	MCP Server client ID (secret: mcp-server-client-secret)
`oidc.provider`	string	`"keycloak"`	OIDC provider type
`oidc.web.clientId`	string	`"boltmcp-web"`	Platform client ID (secret lives in the OIDC Secret as web-client-secret)

restApi

Parameter	Type	Default	Description
`restApi.affinity`	object	`{}`	Affinity rules. Pass-through, not strictly validated.
`restApi.extraEnv`	array	`[]`	Additional environment variables
`restApi.image.pullPolicy`	string	`"IfNotPresent"`	Image pull policy
`restApi.image.repository`	string	`""`	Image repository (defaults to global.imageRegistry/boltmcp-rest-api)
`restApi.image.tag`	string	`""`	Image tag (defaults to .Chart.AppVersion if empty)
`restApi.nodeSelector`	object	`{}`	Node selector
`restApi.replicaCount`	int	`1`	Number of replicas
`restApi.resources`	object	`{}`	CPU/memory resource limits and requests. Pass-through, not strictly validated.
`restApi.service.port`	int	`3003`	Service port
`restApi.service.type`	string	`"ClusterIP"`	Service type
`restApi.tolerations`	array	`[]`	Tolerations

secrets

Names of user-managed Kubernetes Secrets the chart reads. The chart never creates these.

Parameter	Type	Default	Description
`secrets.auth.name`	string	`""`	Name of the user-managed Secret holding auth tokens, the master-realm Keycloak admin password (keycloak-admin-password), the BoltMCP-realm first-user password (boltmcp-admin-password), the MCP Inspector token, and the MCP server's upstream-OAuth root secret (mcp-server-upstream-oauth-secret). If empty, defaults to `<release>-auth`.
`secrets.database.name`	string	`""`	Name of the user-managed Secret holding database passwords. If empty, defaults to `<release>-database`.
`secrets.oidc.name`	string	`""`	Name of the user-managed Secret holding OIDC client secrets. If empty, defaults to `<release>-oidc`.

vault

Parameter	Type	Default	Description
`vault.affinity`	object	`{}`	Affinity rules. Pass-through, not strictly validated.
`vault.enabled`	bool	`true`	Deploy the bundled Vault
`vault.image.pullPolicy`	string	`"IfNotPresent"`	Image pull policy
`vault.image.repository`	string	`"hashicorp/vault"`	Image repository
`vault.image.tag`	string	`"1.21.4"`	Image tag
`vault.kubernetesAuth.audience`	string	`"vault"`	Projected-token audience (must match the Vault role)
`vault.kubernetesAuth.authMountPath`	string	`"kubernetes"`	Mount path of Vault's Kubernetes auth method
`vault.kubernetesAuth.enabled`	bool	`true`	Wire boltmcp-rest-api to Vault via Kubernetes auth (ServiceAccount + projected token + env)
`vault.kubernetesAuth.kvMount`	string	`"secret"`	KV v2 secrets engine mount
`vault.kubernetesAuth.kvPathPrefix`	string	`"boltmcp/server-env-api-cred"`	Logical prefix the REST API stores secrets under
`vault.kubernetesAuth.mcpServer.policy`	string	`"boltmcp-mcp-server"`	Vault policy for the MCP Server's read-only access to the secret prefix
`vault.kubernetesAuth.mcpServer.role`	string	`"boltmcp-mcp-server"`	Vault role bound to the MCP Server ServiceAccount (the reader; shares the auth mount, KV mount/prefix, and audience)
`vault.kubernetesAuth.policy`	string	`"boltmcp-rest-api"`	Vault policy for the secret prefix
`vault.kubernetesAuth.role`	string	`"boltmcp-rest-api"`	Vault role bound to the REST API ServiceAccount
`vault.nodeSelector`	object	`{}`	Node selector
`vault.resources`	object	`{}`	CPU/memory resource limits and requests. Pass-through, not strictly validated.
`vault.seal.config`	object	`{}`	Key/value pairs rendered into the seal stanza (e.g. region, kms_key_id)
`vault.seal.extraEnv`	array	`[]`	Extra Vault container env for the seal (e.g. KMS credentials)
`vault.seal.type`	string	`""`	Seal type — "" is Shamir/manual unseal; awskms/gcpckms/azurekeyvault/transit enable auto-unseal
`vault.service.port`	int	`8200`	Service port
`vault.service.type`	string	`"ClusterIP"`	Service type
`vault.tolerations`	array	`[]`	Tolerations

web

Parameter	Type	Default	Description
`web.affinity`	object	`{}`	Affinity rules. Pass-through, not strictly validated.
`web.baseUrl`	string	`""`	Base URL. If empty, defaults to `https://web.<global.domain>` (http when global.tls.enabled is false)
`web.extraEnv`	array	`[]`	Additional environment variables
`web.image.pullPolicy`	string	`"IfNotPresent"`	Image pull policy
`web.image.repository`	string	`""`	Image repository (defaults to global.imageRegistry/boltmcp-web)
`web.image.tag`	string	`""`	Image tag (defaults to .Chart.AppVersion if empty)
`web.nodeSelector`	object	`{}`	Node selector
`web.replicaCount`	int	`1`	Number of replicas
`web.resources`	object	`{}`	CPU/memory resource limits and requests. Pass-through, not strictly validated.
`web.service.port`	int	`3000`	Service port
`web.service.type`	string	`"ClusterIP"`	Service type
`web.tolerations`	array	`[]`	Tolerations

Other values

Parameter	Type	Default	Description
`fullnameOverride`	string	`""`	Override the full release name
`nameOverride`	string	`""`	Override the release name
`podAnnotations`	object	`{}`	Pod annotations
`podSecurityContext`	object	`{}`	Pod security context

Configuration Reference

On this page