> ## Documentation Index
> Fetch the complete documentation index at: https://keyring.docs.composio.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Helm values reference

> Reference for every value exposed by the Keyring Helm chart.

The chart source is `deploy/helm/keyring`. Runtime-owned environment variables are represented under `runtime`; general Kubernetes customization follows standard chart patterns.

Set `image.repository=composiohq/keyring` and `image.tag=alpha` as shown in the
[Kubernetes deployment guide](/deployment/kubernetes).

## Image and rollout

| Value                           | Default            | Meaning                                     |
| ------------------------------- | ------------------ | ------------------------------------------- |
| `replicaCount`                  | `2`                | Pod count when autoscaling is disabled      |
| `revisionHistoryLimit`          | `3`                | ReplicaSets retained for rollback           |
| `terminationGracePeriodSeconds` | `30`               | Graceful shutdown window                    |
| `image.repository`              | `keyring`          | Container image repository                  |
| `image.tag`                     | Chart `appVersion` | Image tag; set explicitly in production     |
| `image.pullPolicy`              | `IfNotPresent`     | Kubernetes image pull policy                |
| `imagePullSecrets`              | `[]`               | Registry credential Secret references       |
| `nameOverride`                  | `""`               | Override chart resource base name           |
| `fullnameOverride`              | `""`               | Override the complete release resource name |

## Runtime values

Each scalar has a companion `*ValueFrom` object for a Kubernetes `valueFrom` source. For example, `authAudienceValueFrom` replaces literal `authAudience`.

| Value                               | Default       | Environment variable                |
| ----------------------------------- | ------------- | ----------------------------------- |
| `runtime.appEnv`                    | `production`  | `APP_ENV`                           |
| `runtime.authAudience`              | `""`          | `AUTH_AUDIENCE`                     |
| `runtime.authClockToleranceSeconds` | `5`           | `AUTH_CLOCK_TOLERANCE_SECONDS`      |
| `runtime.authIssuer`                | `""`          | `AUTH_ISSUER`                       |
| `runtime.authJwtAlgorithms`         | `RS256`       | `AUTH_JWT_ALGORITHMS`               |
| `runtime.authJwksUrl`               | `""`          | `AUTH_JWKS_URL`                     |
| `runtime.host`                      | `0.0.0.0`     | `HOST`                              |
| `runtime.port`                      | `7464`        | `PORT` and Service/probe target     |
| `runtime.otelCollectorUrl`          | `""`          | `OTEL_COLLECTOR_URL` when non-empty |
| `runtime.auditDurability`           | `best_effort` | `AUDIT_DURABILITY`                  |
| `runtime.encryptionConfig`          | `""`          | Inline `ENCRYPTION_CONFIG`          |

The chart always sets `RUNTIME=node`. `runtime.portValueFrom` is rejected because the Service and probes need the port at render time.

<Warning>
  The chart default `auditDurability: best_effort` is an installation convenience, not the
  recommended production setting. Configure a collector and use `required`.
</Warning>

## Encryption config file

| Value                                    | Default       | Meaning                                                                   |
| ---------------------------------------- | ------------- | ------------------------------------------------------------------------- |
| `runtime.encryptionConfigFile.enabled`   | `false`       | Mount configuration at `/etc/keyring` and point `ENCRYPTION_CONFIG` to it |
| `runtime.encryptionConfigFile.secret`    | `""`          | Kubernetes Secret containing the file                                     |
| `runtime.encryptionConfigFile.configMap` | `""`          | ConfigMap containing the file; use only when it contains no secret data   |
| `runtime.encryptionConfigFile.key`       | `config.yaml` | Secret/ConfigMap key and mounted filename                                 |

When file mode is enabled, exactly one usable Secret or ConfigMap source must be provided. A Secret takes precedence if both names are set; configure only one to keep intent clear.

## Additional environment

| Value      | Default | Meaning                                                                                                                    |
| ---------- | ------- | -------------------------------------------------------------------------------------------------------------------------- |
| `extraEnv` | `[]`    | Additional container environment entries, including `LOG_LEVEL`, `OTEL_COLLECTOR_HEADERS`, and provider identity variables |
| `envFrom`  | `[]`    | Standard Kubernetes bulk environment sources                                                                               |

`extraEnv` cannot redefine chart-owned runtime variables. Use the matching `runtime.*` value or `*ValueFrom` field instead.

## Service account and pod metadata

| Value                        | Default   | Meaning                                      |
| ---------------------------- | --------- | -------------------------------------------- |
| `serviceAccount.create`      | `true`    | Create a dedicated ServiceAccount            |
| `serviceAccount.name`        | Generated | Use or create this ServiceAccount name       |
| `serviceAccount.automount`   | `false`   | Automount the standard service-account token |
| `serviceAccount.annotations` | `{}`      | Workload identity and operator annotations   |
| `podAnnotations`             | `{}`      | Pod-template annotations                     |
| `podLabels`                  | `{}`      | Additional pod labels                        |

Set `serviceAccount.automount: true` only when a configured auth method needs the standard token, such as Vault Kubernetes auth. EKS Pod Identity does not require it.

## Security contexts and scheduling

| Value                | Default                                                        | Meaning                        |
| -------------------- | -------------------------------------------------------------- | ------------------------------ |
| `podSecurityContext` | Non-root UID/GID 10001, `RuntimeDefault` seccomp               | Pod-level identity and seccomp |
| `securityContext`    | No escalation, drop all capabilities, read-only root, non-root | Container hardening            |
| `resources.requests` | `25m` CPU, `64Mi` memory                                       | Scheduler request              |
| `resources.limits`   | `256Mi` memory                                                 | Container limit; CPU is unset  |
| `nodeSelector`       | `{}`                                                           | Node label selection           |
| `tolerations`        | `[]`                                                           | Taint tolerations              |
| `affinity`           | `{}`                                                           | Pod/node affinity rules        |

## Service and ingress

| Value                 | Default         | Meaning                      |
| --------------------- | --------------- | ---------------------------- |
| `service.type`        | `ClusterIP`     | Kubernetes Service type      |
| `service.port`        | `80`            | Service-facing port          |
| `ingress.enabled`     | `false`         | Create an Ingress            |
| `ingress.className`   | `""`            | Ingress controller class     |
| `ingress.annotations` | `{}`            | Controller-specific settings |
| `ingress.hosts`       | `keyring.local` | Host/path rules              |
| `ingress.tls`         | `[]`            | TLS Secret and host entries  |

Terminate TLS at the Ingress or an upstream private load balancer. Do not expose a production Keyring endpoint over plaintext HTTP.

## Probes and autoscaling

| Value                                           | Default                           | Meaning                                       |
| ----------------------------------------------- | --------------------------------- | --------------------------------------------- |
| `startupProbe`                                  | `/healthz`, every 2s, 30 failures | Up to 60 seconds for process startup          |
| `livenessProbe`                                 | `/healthz`, every 10s             | Restarts a stuck process                      |
| `readinessProbe`                                | `/readyz`, every 5s               | Removes an unready pod from Service endpoints |
| `autoscaling.enabled`                           | `false`                           | Create a HorizontalPodAutoscaler              |
| `autoscaling.minReplicas`                       | `2`                               | HPA minimum                                   |
| `autoscaling.maxReplicas`                       | `10`                              | HPA maximum                                   |
| `autoscaling.targetCPUUtilizationPercentage`    | `80`                              | CPU target                                    |
| `autoscaling.targetMemoryUtilizationPercentage` | `null`                            | Optional memory target                        |

The current health routes report process liveness/readiness; they do not perform a KMS, JWKS, manifest, or collector round trip. Use authenticated synthetic operations when dependency readiness must be monitored.