All parameters can be set in your values-prod.yaml file.
BoltMCP reads passwords from three user-managed Kubernetes Secrets — the chart never creates them. See Cluster Prep → Application Secrets for the full key list and supported approaches. Only the Secret names are configurable through values (see the Secrets section below); the keys within each Secret are fixed.
Name of the user-managed Secret holding database passwords
secrets.oidc.name
string
<release>-oidc
Name of the user-managed Secret holding OIDC client secrets
secrets.auth.name
string
<release>-auth
Name of the user-managed Secret holding auth tokens, the master-realm Keycloak admin password (keycloak-admin-password), the BoltMCP-realm first-user password (boltmcp-admin-password), the MCP Inspector token, and the optional OpenAI key
Apex domain that hosts BoltMCP. Used to derive per-service hostnames as web.<domain>, auth.<domain>, playground.<domain>, server.<domain>, inspector.<domain>. Required unless every per-service URL/hostname override is set explicitly (see below).
Image pull secrets for private registries. Matches the Secret name created in Cluster Prep → Image Pull Secret. Set to [] if your images come from a registry that doesn't require auth.
global.storageClass
string
""
Storage class for persistent volumes (empty uses cluster default)
nameOverride
string
""
Override the release name
fullnameOverride
string
""
Override the full release name
The chart does not create an Ingress. It emits the public URLs above to the workloads as env vars and expects you to provision your own ingress / gateway / load balancer that terminates TLS and routes those hostnames to the BoltMCP services. See Ingress & TLS for a reference setup, or charts/boltmcp/examples/ingress in the chart for copy-pasteable manifests.
OIDC issuer URL. If empty, defaults to https://<keycloak.hostname>/realms/boltmcp
oidc.web.clientId
string
boltmcp-web
Platform client ID (secret lives in the OIDC Secret as web-client-secret)
oidc.mcpServer.clientId
string
boltmcp-mcp-server
MCP Server client ID (secret: mcp-server-client-secret)
oidc.mcpClient.clientId
string
boltmcp-mcp-client
MCP Client (Playground) client ID (secret: mcp-client-client-secret)
oidc.adminUser.email
string
""
Required. Email for the first user in the boltmcp Keycloak realm. Provisioned on first install via --import-realm (username boltmcp_admin, firstName Admin, emailVerified true, granted realm-management/realm-admin). Password lives in the auth Secret as boltmcp-admin-password.