values.yaml

On Kubernetes and OpenShift, an installation is the chart plus your values.yaml, whether you apply it with kubectl or oc, Helm or ArgoCD: see Kubernetes and OpenShift. On Docker Swarm, the settings live in your .env instead (Docker Swarm), under the names this page gives in brackets. The secrets below are the same on every path. Your values.yaml holds only what differs from the chart’s defaults, and no secret value: keep it in your Git repository. 2501 never keeps it; your 2501 SA helps you fill it. The chart checks it against its schema on every install, upgrade and render, and refuses a value it does not accept, or a render that misses a required one, with a message that names it. Start from the values.example.yaml of the Release:

cp values.example.yaml values.yaml
helm show values ./2501-<build>.tgz   # the defaults

A render needs target, global.imageRegistry, commandCenter.host (in the .env on Docker Swarm), commandCenter.tls.mode, database.managed and elasticsearch.mode; every other value has a default or is optional. A new build that needs a new value says so in its Upgrade actions, and its render refuses a values.yaml without it.

Settings

Setting	What it decides
`target`	`kubernetes`, `openshift` or `swarm`.
`stackName`	The CLI’s stack name, so an installation the CLI deployed is updated in place. Kubernetes: `ai-2501` by default, as the CLI’s; the engine’s and Command Center’s Services are `<stackName>-engine` and `<stackName>-command-center`, and it must start with a letter. Docker Swarm: required, the stack (the CLI’s is `2501` by default).
`profile`	`production` (default) or `poc`. Production requires `database.sslmode: verify-full` for your own database.
`connectivity`	`offline` refuses an LLM URL on a public service the site cannot reach.
`global.imageRegistry`	Where you copied the images. Every image is pulled from here, by digest.
`global.imagePullSecrets`	The registry login secret, if your registry needs one. The engine also pulls executor and hosted MCP server images with the first one.
`global.imageTag`	Empty by default: every image is pulled by its digest. A tag such as `latest` pulls the engine, Command Center, executor-mcp and kerberos-worker images by that tag instead, so they can come from a newer build than your chart; the database and Elasticsearch keep their digests. Helm and `kubectl` only, not ArgoCD. See Pull the images from 2501’s registry.
`commandCenter.host`	The host name users, webhooks and sign-in callbacks reach Command Center on (`COMMAND_CENTER_HOST`), without a port. Sign-in works only in a browser that opens Command Center at exactly `https://<commandCenter.host>`: another address fails with `INVALID_ORIGIN`.
`commandCenter.tls`	`mode: secret` serves the certificate in `cc-tls` (`existingSecret` changes the name); `mode: upstream` leaves TLS to your load balancer. Docker Swarm requires `upstream`.
`commandCenter.ingressClass`	The Ingress class, when the cluster’s default is not the one to use.
`commandCenter.expose.port`	Docker Swarm only: the port Command Center is published on, over HTTP (`COMMAND_CENTER_PORT`).
`engine.tls.existingSecret`	Empty by default: the engine serves plain HTTP, reached only inside the cluster. A TLS secret, such as `engine-tls`: the engine serves HTTPS only, with its certificate, and Command Center trusts it. On Swarm, the secrets `<name>.tls.crt` and `<name>.tls.key`. See HTTPS to the engine.
`database`	`managed: true` runs the PostgreSQL 2501 provides, on the volume claim `postgres-pvc` of `size` (10Gi by default) under the role and database `2501`, as the CLI does, so a CLI installation’s data is used in place. `managed: false` uses yours, from the secret `existingSecret` (`pg-connection-v1`), with `sslmode` `verify-full` or `require`; with `verify-full` and a certificate your own CA signs, put that CA in a ConfigMap (on Swarm, a config) holding `ca.crt` and name it in `caBundle`. The proxy’s `caBundle` above is not used for the database. OpenShift needs your own. On Docker Swarm, `user` and `name` are the role and database (`2501` by default), and `existingVolume` names a Docker volume that already holds the data, such as the directory of a CLI installation’s PostgreSQL, which the stack uses and never creates or deletes.
`elasticsearch`	Where structured logs go, which the Command Center Debug page reads: `none`, `in-cluster` (provided by 2501, not on OpenShift), or `external` with `url` and, if it needs credentials, `existingSecret`. `environment` is the index prefix logs go under (`production` by default). On Kubernetes, `in-cluster` keeps its data on the volume claim `elasticsearch-pvc` of `size` (30Gi by default), as the CLI does, and serves plain HTTP inside the namespace, with the password in `elasticsearch-password-v1`. The first run turns the `enableElasticSearch` toggle on when the mode is not `none`, and never again: setting `none` later leaves it on, so switch it off as Feature toggles shows. An external Elasticsearch whose certificate your own CA signs needs that CA in `caBundle`; `tlsInsecure: true` accepts any certificate instead, as the CLI’s option did, but `caBundle` is preferred.
`engine.extraEnv`	Engine settings the chart does not set, as variables, for example `MCP_HANDSHAKE_TIMEOUT_MS`. Each value is a string: quote a number, `MCP_HANDSHAKE_TIMEOUT_MS: "60000"`, or the chart refuses it with `got number, want string`. No secret value: this file lives in Git. A variable the chart sets is refused, with its name: change the value it comes from.
`executors.namespace`	Kubernetes: another namespace for executor and hosted MCP server pods. Empty: the engine’s namespace.
`llm`	Optional: the first LLM provider and model (`LLM_*`), created on the first run only; `provider`, `baseUrl` and `model` go together. Left out, add the LLM in Command Center, which owns it afterwards.
`identity`	Optional: the first tenant, its organizations and the first administrator’s email (`TENANT_NAME`, `ORGANIZATIONS`, `ADMIN_EMAIL`), created on the first run only; left out, tenant and organization `Default` and administrator `admin@2501.ai`. `tenantId` (`TENANT_ID`) pins the tenant id your license is issued for.
`features.satellites`	Turns satellite clusters on at the first run.
`proxy`	`url` for outbound calls and `noProxy` for the hosts that bypass it.
`caBundle`	A ConfigMap (on Swarm, a config) holding `ca.crt`, when your proxy or your services use a certificate from your own CA.
`storageClass`	The storage class of the data volumes; empty uses the cluster’s default.
`sizing`	`preset` `small` (up to 50 hosts), `medium` (500) or `large`, and `logLevel` (`LOG_LEVEL`).
`swarm`	Docker Swarm only: `dockerGid` (the group of `/var/run/docker.sock` on the managers, `stat -c %g /var/run/docker.sock`; `DOCKER_GID`) and extra `placement` constraints.

Secrets

You create every secret yourself, once, in the namespace (or the Swarm). Helm prints the commands for your values. A tool such as External Secrets, Vault or Sealed Secrets can create them instead, under the names below. The commands are in Kubernetes and OpenShift and Docker Swarm. The names below are the defaults; secrets.* in values.yaml changes them.

Secret	Holds	Can it change?
`credential-key-v1`	The key stored credentials are encrypted with	Never: the credentials could no longer be read
`engine-api-key-v1`	The key Command Center and the engine authenticate each other with	Never, without changing it everywhere it is used
`auth-secret-v1`	The key user sessions are signed with	Changing it signs every user out
`log-encryption-key-v1`	The key secure logs are encrypted with	Never: older logs could no longer be read
`admin-password-v1`	The first administrator’s password	Read on the first run only
`llm-api-key-v1`	The LLM API key, with the LLM settings only	Read on the first run only; change it in Command Center afterwards. On Docker Swarm, create it even without an LLM, with any value
`postgres-password-v1`	The password of the PostgreSQL 2501 provides	Never, once the database exists
`pg-connection-v1`	`DATABASE_URL` and `DIRECT_URL` of your own database (`DIRECT_URL` bypasses any connection pooler)	When your database moves
`elasticsearch-password-v1`	The password of the Elasticsearch 2501 provides	Never, once it holds data
`engine-tls`	The engine’s certificate and key, with `engine.tls.existingSecret` only	When you renew it
`cc-tls`	Command Center’s certificate, with `tls.mode: secret`	When you renew it

Outbound proxy

Set proxy.url and both the engine and Command Center send their outbound calls through it: the engine for LLM providers, ticketing systems and PAM systems, Command Center for the identity provider behind single sign-on. The services of the installation itself never go through it. proxy.noProxy lists more hosts that bypass it: exact host names, .suffix domains or literal IP addresses; CIDR ranges are ignored. The URL needs an explicit http:// or https:// scheme and no credentials in it. A proxy that re-signs TLS works once its CA is in caBundle.

API

Deploy

Configure

Settings

Secrets

Outbound proxy

​Settings

​Secrets

​Outbound proxy

Settings

Secrets

Outbound proxy