pgAgroal Enterprise · Reference

Helm values

Every configurable value in the pgagroal-enterprise chart, grouped by area, with its type, default, and purpose. The chart deploys the operator (RBAC plus a hardened deployment) and, optionally, the fleet control plane; you create poolers by applying Pgagroal resources. To install the chart, see the install tutorial.

Defaults below are taken from the chart's values.yaml. Pin a released image tag (ideally by digest) in production — a moving :latest forces Always pulls. Supply DSN, tokens, and exporter credentials via Kubernetes Secrets, never in values.yaml.

Naming

Top-level overrides for generated resource names.

Key	Type	Default	Purpose
`nameOverride`	string	`""`	Override the chart name used in resource names.
`fullnameOverride`	string	`""`	Override the full release name used for generated resources.

RBAC and service account

The operator needs a ClusterRole and binding to reconcile Pgagroal resources across namespaces.

Key	Type	Default	Purpose
`rbac.create`	bool	true	Create the ClusterRole plus ClusterRoleBinding the operator needs.
`serviceAccount.create`	bool	true	Create the operator ServiceAccount.
`serviceAccount.name`	string	`""`	ServiceAccount name; defaults to the chart fullname when empty.
`serviceAccount.annotations`	map	`{}`	Annotations on the ServiceAccount (e.g. for cloud IAM role binding).

Operator

The operator deployment: image, replica count, optional management-plane tracing, resources, and scheduling.

Key	Type	Default	Purpose
`operator.replicas`	int	1	Number of operator replicas.
`operator.image.repository`	string	`ghcr.io/elevarq/pgagroal-enterprise-operator`	Operator container image repository.
`operator.image.tag`	string	`"0.1.0"`	Operator image tag; pin a released version in production.
`operator.image.pullPolicy`	string	`IfNotPresent`	Image pull policy for the operator.
`operator.otel`	bool	false	Enable management-plane tracing, configured via standard `OTEL_*` env vars.
`operator.env`	list	`[]`	`OTEL_*` environment for the exporter (used only when `operator.otel=true`); source credentials from a Secret.
`operator.nodeSelector`	map	`{}`	Node selector for the operator pod.
`operator.tolerations`	list	`[]`	Tolerations for the operator pod.
`operator.affinity`	map	`{}`	Affinity rules for the operator pod.

Operator resources

CPU and memory requests and limits for the operator container.

Key	Type	Default	Purpose
`operator.resources.requests.cpu`	string	`50m`	Requested CPU.
`operator.resources.requests.memory`	string	`64Mi`	Requested memory.
`operator.resources.limits.cpu`	string	`500m`	CPU limit.
`operator.resources.limits.memory`	string	`256Mi`	Memory limit.

Operator security context

The operator is hardened by default. These values are overridable but kept secure — an approach aligned with least-privilege readiness.

Key	Type	Default	Purpose
`operator.securityContext.allowPrivilegeEscalation`	bool	false	Block privilege escalation in the container.
`operator.securityContext.readOnlyRootFilesystem`	bool	true	Mount the container root filesystem read-only.
`operator.securityContext.capabilities.drop`	list	`["ALL"]`	Drop all Linux capabilities.
`operator.podSecurityContext.runAsNonRoot`	bool	true	Require the pod to run as a non-root user.
`operator.podSecurityContext.seccompProfile.type`	string	`RuntimeDefault`	Apply the runtime default seccomp profile.

Control plane (optional)

Off by default. When enabled, the chart deploys the fleet control plane alongside the operator. It needs a PostgreSQL DSN and operator tokens, which must be supplied through existing Secrets — never as plaintext in values.yaml.

Key	Type	Default	Purpose
`controlPlane.enabled`	bool	false	Deploy the fleet control plane alongside the operator.
`controlPlane.replicas`	int	1	Number of control-plane replicas.
`controlPlane.image.repository`	string	`ghcr.io/elevarq/pgagroal-enterprise`	Control-plane container image repository.
`controlPlane.image.tag`	string	`"0.1.0"`	Control-plane image tag; pin a released version in production.
`controlPlane.image.pullPolicy`	string	`IfNotPresent`	Image pull policy for the control plane.
`controlPlane.addr`	string	`":8443"`	Listen address for the control plane.
`controlPlane.otel`	bool	false	Enable control-plane tracing.
`controlPlane.env`	list	`[]`	Environment for the control plane; reference Secrets for the DSN and tokens.
`controlPlane.resources.requests.cpu`	string	`50m`	Requested CPU.
`controlPlane.resources.requests.memory`	string	`64Mi`	Requested memory.
`controlPlane.resources.limits.cpu`	string	`500m`	CPU limit.
`controlPlane.resources.limits.memory`	string	`256Mi`	Memory limit.

Minimal override example

Override only what differs from the defaults. The example below pins a released operator tag, turns on management-plane tracing, and enables the control plane with its DSN sourced from a Secret.

# values-prod.yaml
operator:
  replicas: 2
  image:
    tag: "0.1.0"
  otel: true
  env:
    - name: OTEL_EXPORTER_OTLP_ENDPOINT
      value: "http://otel-collector:4317"

controlPlane:
  enabled: true
  image:
    tag: "0.1.0"
  env:
    - name: PGAGROAL_CP_DSN
      valueFrom:
        secretKeyRef:
          name: cp-secrets
          key: dsn

Apply it at install or upgrade time:

helm upgrade --install pgagroal-enterprise charts/pgagroal-enterprise \
  --namespace pgagroal-system --create-namespace \
  -f values-prod.yaml

Next steps

Install with Helm — install the chart and create your first pooler.