Helm values map

Helm value	Environment variable
`config.clusterName`	`CLUSTER_NAME`
`config.environment`	`ENVIRONMENT`
`config.watchNamespace`	`WATCH_NAMESPACE`
`config.environmentURL`	`ENVIRONMENT_URL`
`config.description`	`DESCRIPTION`
`config.logURLTemplate`	`LOG_URL_TEMPLATE`
`config.logURLTemplateEscape`	`LOG_URL_TEMPLATE_ESCAPE`
`config.logLevel`	`LOG_LEVEL`
`config.leaderElection`	`LEADER_ELECTION`
`config.githubBaseURL`	`GITHUB_BASE_URL`
`config.githubInstallationCacheTTL`	`GITHUB_INSTALLATION_CACHE_TTL`
`config.retry.maxAttempts`	`RETRY_MAX_ATTEMPTS`
`config.retry.initialBackoff`	`RETRY_INITIAL_BACKOFF`
`config.retry.maxBackoff`	`RETRY_MAX_BACKOFF`
(fixed by chart)	`DATABASE=/data/cache.db`
`github.existingSecret` / chart Secret	`GITHUB_APP_ID`, optional `GITHUB_INSTALLATION_ID`, key file
`github.allowInsecureValues`	(chart only) - allow inline `appId` / `installationId` / `privateKey` (Helm release Secret risk)
`commonLabels` / `podLabels`	(chart only) - extra labels on all resources / pod template only
`rbac.create`	(chart only) - emit RBAC
`networkPolicy.enabled`	(chart only) - emit NetworkPolicy
`networkPolicy.ingress.metricsFrom`	(chart only) - optional scrape peers
`networkPolicy.egress.allowDNS` / `allowHTTPS` / `allowKubeAPI` / `kubeAPIPorts` / `extraEgress`	(chart only)
`containerPorts.metrics` / `containerPorts.probes`	`METRICS_ADDR` / `PROBE_ADDR` listen ports (also NetworkPolicy ingress)
`serviceMonitor.enabled`	(chart only) - emit Prometheus Operator ServiceMonitor
`serviceMonitor.labels` / `interval` / `scrapeTimeout` / …	(chart only) - scrape tuning
`prometheusRule.enabled`	(chart only) - emit PrometheusRule alerts
`prometheusRule.labels` / thresholds / `runbookURL`	(chart only) - alert tuning

values.schema.json validates types and enums (e.g. config.logLevel) on helm install / upgrade / lint / template. Config and chart-managed Secret changes roll the Deployment via checksum/config and checksum/secret pod annotations.

When config.watchNamespace is set, the chart installs a namespaced Role in that namespace (plus a lease Role in the release namespace) instead of a ClusterRole. Flux objects and inventory workloads must share that namespace.

/metrics is unauthenticated HTTP. Pair serviceMonitor.enabled with networkPolicy + metricsFrom when the CNI enforces NetworkPolicy. See Metrics. Dashboard: Grafana. Alert triage: Runbook.

Full install examples: Install with Helm.

#Helm values map

Helm values map