Helm Chart Values
When installing Precept into Kubernetes with Helm, override the chart values below. For a local preview-style stack, start from deploy/helm/precept-server/values-local.yaml.
Precept-specific values
| Value | type | required | default | notes |
|---|---|---|---|---|
nameOverride | string | no | "" | Set to server so the release <name> produces a Service named <name>-server. |
initDb.enabled | boolean | no | false | Run the init-db Job (post-install hook) to create the app user and database. |
initDb.image | string | no | postgres:17-alpine | Image for the init-db Job (includes psql). |
credentials.create | boolean | no | false | Create a Secret with POSTGRES_*, connection URLs, and credentials.env. |
credentials.existingSecret | string | no | "" | Use an existing Secret instead of credentials.create. Must include DATABASE_URL, PRECEPT_STORAGE_CONNECTION, and POSTGRES_* keys. |
credentials.postgresPassword | string | when create | "" | Application database password. |
credentials.env | object | no | {} | Shared variables (PRECEPT_HTTP_BASE_URL, PRECEPT_TASK_QUEUE, OTEL_*, …) injected into the server from the credentials Secret. |
database.host | string | when external | "" | Postgres host for init-db; defaults to the bundled subchart service when postgresql.enabled. |
database.sslMode | string | no | require | Appended to DATABASE_URL / PRECEPT_STORAGE_CONNECTION. Use disable for local bundled Postgres. |
postgresql.enabled | boolean | no | false | Bundled PostgreSQL (local dev substitute for an external shared host). |
worker.enabled | boolean | no | true | Deploy worker with node dist/temporal/worker.mjs. |
migrate.noCheckOrder | boolean | no | true | Pass --no-check-order to node-pg-migrate. |
temporal.enabled | boolean | no | false | Bundled Temporal stack (Elasticsearch + auto-setup). Enabled in values-local.yaml; cloud previews use a shared frontend instead. |
localDev.enabled | boolean | no | false | Mount localDev.secretsJwe as /config/secrets.jwe.json (local clusters only). |
server.env | object | no | {} | Extra server environment variables (e.g. PRECEPT_MODULE_PATHS, Auth0 settings). |
worker.env | object | no | {} | Extra worker environment variables. |
resources | object | no | requests: 100m/256Mi, limits: 1000m/512Mi | CPU and memory requests/limits for the server pod. Override per environment as needed. |
worker.resources | object | no | requests: 250m/512Mi, limits: 2000m/1Gi | CPU and memory requests/limits for the worker pod. Higher defaults reflect Temporal workflow execution and DuckDB ingestion workloads. |
securityContext | object | no | runAsNonRoot: true, runAsUser: 1001, allowPrivilegeEscalation: false | Container-level security context applied to both the server and worker pods. The image runs as system user precept (UID 1001); Kubernetes enforces this independently at admission. |
startupProbe | object | no | failureThreshold: 30, periodSeconds: 10 | Startup probe on GET /health. Gives the pod up to 5 minutes to become healthy before liveness kicks in, preventing premature restarts during slow starts. |
podDisruptionBudget.enabled | boolean | no | true | Create a PodDisruptionBudget for the server deployment. |
podDisruptionBudget.minAvailable | integer | no | 1 | Minimum server pods that must remain available during node drains or rolling updates. |
worker.podDisruptionBudget.enabled | boolean | no | true | Create a PodDisruptionBudget for the worker deployment. |
worker.podDisruptionBudget.minAvailable | integer | no | 1 | Minimum worker pods that must remain available during disruptions. |
autoscaling.enabled | boolean | no | false | Enable HPA for the server deployment. Requires the Kubernetes Metrics Server to be installed on the cluster. Disabled by default — opt in explicitly. |
autoscaling.minReplicas | integer | no | 1 | Minimum server replicas. |
autoscaling.maxReplicas | integer | no | 5 | Maximum server replicas. Override upward for high-traffic deployments. |
autoscaling.targetCPUUtilizationPercentage | integer | no | 70 | Scale out when average CPU across server pods exceeds this percentage. |
autoscaling.targetMemoryUtilizationPercentage | integer | no | 80 | Scale out when average memory across server pods exceeds this percentage. Acts as a leading signal before GC pressure degrades response times. |
autoscaling.behavior | object | no | scale-down 5 min window, scale-up 2 pods/min | HPA scaling behaviour. Default prevents flapping after short traffic spikes by requiring 5 minutes of sustained low utilisation before scaling in. |
networkPolicy.enabled | boolean | no | false | Create NetworkPolicy resources for the server and worker pods. Requires a CNI plugin that enforces NetworkPolicy (e.g. Calico, Cilium). Has no effect on clusters using Flannel or other non-enforcing CNIs. |
networkPolicy.ingressNamespaces | list | no | [] | Namespaces allowed to reach the server on port 8080 (e.g. ingress-nginx). When empty, all sources are permitted. Same-namespace pods are always allowed. |
image.tag | string | no | chart appVersion | Image tag for ghcr.io/precept-sh/server. values-local.yaml uses latest. |
imagePullSecrets | list | no | [] | Required for private GHCR pulls; values-local.yaml uses ghcr-credentials. |
Published chart defaults
sh
helm show values deploy/helm/precept-server
# or
helm show values oci://ghcr.io/precept-sh/helm/precept-server