> ## Documentation Index > Fetch the complete documentation index at: https://docs.2501.ai/llms.txt > Use this file to discover all available pages before exploring further. # values.yaml > What an installation's values.yaml sets, and the secrets it names On Kubernetes and OpenShift, an installation is the chart plus your `values.yaml`, whether you apply it with `kubectl` or `oc`, Helm or ArgoCD: see [Kubernetes and OpenShift](https://docs.2501.ai/0.19/deployment/kubernetes.md). On Docker Swarm, the settings live in your `.env` instead ([Docker Swarm](https://docs.2501.ai/0.19/deployment/docker-swarm.md#write-your-env)), under the names this page gives in brackets. The secrets below are the same on every path. Your `values.yaml` holds only what differs from the chart's defaults, and no secret value: keep it in your Git repository. 2501 never keeps it; your 2501 SA helps you fill it. The chart checks it against its schema on every install, upgrade and render, and refuses a value it does not accept, or a render that misses a required one, with a message that names it. Start from the `values.example.yaml` of the Release: ```bash theme={null} cp values.example.yaml values.yaml helm show values ./2501-.tgz # the defaults ``` A render needs `target`, `global.imageRegistry`, `commandCenter.host` (in the `.env` on Docker Swarm), `commandCenter.tls.mode`, `database.managed` and `elasticsearch.mode`; every other value has a default or is optional. A new build that needs a new value says so in its Upgrade actions, and its render refuses a `values.yaml` without it. ## Settings | Setting | What it decides | | - | - | | `target` | `kubernetes`, `openshift` or `swarm`. | | `stackName` | The CLI's stack name, so an installation the CLI deployed is updated in place. Kubernetes: `ai-2501` by default, as the CLI's; the engine's and Command Center's Services are `-engine` and `-command-center`, and it must start with a letter. Docker Swarm: required, the stack (the CLI's is `2501` by default). | | `profile` | `production` (default) or `poc`. Production requires `database.sslmode: verify-full` for your own database. | | `connectivity` | `offline` refuses an LLM URL on a public service the site cannot reach. | | `global.imageRegistry` | Where you copied the images. Every image is pulled from here, by digest. | | `global.imagePullSecrets` | The registry login secret, if your registry needs one. The engine also pulls executor and hosted MCP server images with the first one. | | `global.imageTag` | Empty by default: every image is pulled by its digest. A tag such as `latest` pulls the engine, Command Center, executor-mcp and kerberos-worker images by that tag instead, so they can come from a newer build than your chart; the database and Elasticsearch keep their digests. Helm and `kubectl` only, not ArgoCD. See [Pull the images from 2501's registry](https://docs.2501.ai/0.19/deployment/pull-from-2501.md). | | `commandCenter.host` | The host name users, webhooks and sign-in callbacks reach Command Center on (`COMMAND_CENTER_HOST`), without a port. Sign-in works only in a browser that opens Command Center at exactly `https://`: another address fails with `INVALID_ORIGIN`. | | `commandCenter.tls` | `mode: secret` serves the certificate in `cc-tls` (`existingSecret` changes the name); `mode: upstream` leaves TLS to your load balancer. Docker Swarm requires `upstream`. | | `commandCenter.ingressClass` | The Ingress class, when the cluster's default is not the one to use. | | `commandCenter.expose.port` | Docker Swarm only: the port Command Center is published on, over HTTP (`COMMAND_CENTER_PORT`). | | `engine.tls.existingSecret` | Empty by default: the engine serves plain HTTP, reached only inside the cluster. A TLS secret, such as `engine-tls`: the engine serves HTTPS only, with its certificate, and Command Center trusts it. On Swarm, the secrets `.tls.crt` and `.tls.key`. See [HTTPS to the engine](https://docs.2501.ai/0.19/deployment/kubernetes.md#https-to-the-engine). | | `database` | `managed: true` runs the PostgreSQL 2501 provides, on the volume claim `postgres-pvc` of `size` (10Gi by default) under the role and database `2501`, as the CLI does, so a CLI installation's data is used in place. `managed: false` uses yours, from the secret `existingSecret` (`pg-connection-v1`), with `sslmode` `verify-full` or `require`; with `verify-full` and a certificate your own CA signs, put that CA in a ConfigMap (on Swarm, a config) holding `ca.crt` and name it in `caBundle`. The proxy's `caBundle` above is not used for the database. OpenShift needs your own. On Docker Swarm, `user` and `name` are the role and database (`2501` by default), and `existingVolume` names a Docker volume that already holds the data, such as the directory of a [CLI installation's](https://docs.2501.ai/0.19/deployment/migrate-from-cli.md) PostgreSQL, which the stack uses and never creates or deletes. | | `elasticsearch` | Where structured logs go, which the Command Center Debug page reads: `none`, `in-cluster` (provided by 2501, not on OpenShift), or `external` with `url` and, if it needs credentials, `existingSecret`. `environment` is the index prefix logs go under (`production` by default). On Kubernetes, `in-cluster` keeps its data on the volume claim `elasticsearch-pvc` of `size` (30Gi by default), as the CLI does, and serves plain HTTP inside the namespace, with the password in `elasticsearch-password-v1`. The first run turns the `enableElasticSearch` toggle on when the mode is not `none`, and never again: setting `none` later leaves it on, so switch it off as [Feature toggles](https://docs.2501.ai/0.19/deployment/operations.md#feature-toggles) shows. An external Elasticsearch whose certificate your own CA signs needs that CA in `caBundle`; `tlsInsecure: true` accepts any certificate instead, as the CLI's option did, but `caBundle` is preferred. | | `engine.extraEnv` | Engine settings the chart does not set, as variables, for example `MCP_HANDSHAKE_TIMEOUT_MS`. Each value is a string: quote a number, `MCP_HANDSHAKE_TIMEOUT_MS: "60000"`, or the chart refuses it with `got number, want string`. No secret value: this file lives in Git. A variable the chart sets is refused, with its name: change the value it comes from. | | `executors.namespace` | Kubernetes: another namespace for executor and hosted MCP server pods. Empty: the engine's namespace. | | `llm` | Optional: the first LLM provider and model (`LLM_*`), created on the first run only; `provider`, `baseUrl` and `model` go together. Left out, add the LLM in Command Center, which owns it afterwards. | | `identity` | Optional: the first tenant, its organizations and the first administrator's email (`TENANT_NAME`, `ORGANIZATIONS`, `ADMIN_EMAIL`), created on the first run only; left out, tenant and organization `Default` and administrator `admin@2501.ai`. `tenantId` (`TENANT_ID`) pins the tenant id your license is issued for. | | `features.satellites` | Turns satellite clusters on at the first run. | | `proxy` | `url` for outbound calls and `noProxy` for the hosts that bypass it. | | `caBundle` | A ConfigMap (on Swarm, a config) holding `ca.crt`, when your proxy or your services use a certificate from your own CA. | | `storageClass` | The storage class of the data volumes; empty uses the cluster's default. | | `sizing` | `preset` `small` (up to 50 hosts), `medium` (500) or `large`, and `logLevel` (`LOG_LEVEL`). | | `swarm` | Docker Swarm only: `dockerGid` (the group of `/var/run/docker.sock` on the managers, `stat -c %g /var/run/docker.sock`; `DOCKER_GID`) and extra `placement` constraints. | ## Secrets You create every secret yourself, once, in the namespace (or the Swarm). Helm prints the commands for your values. A tool such as External Secrets, Vault or Sealed Secrets can create them instead, under the names below. The commands are in [Kubernetes and OpenShift](https://docs.2501.ai/0.19/deployment/kubernetes.md#create-the-secrets) and [Docker Swarm](https://docs.2501.ai/0.19/deployment/docker-swarm.md#create-the-secrets). The names below are the defaults; `secrets.*` in `values.yaml` changes them. | Secret | Holds | Can it change? | | - | - | - | | `credential-key-v1` | The key stored credentials are encrypted with | Never: the credentials could no longer be read | | `engine-api-key-v1` | The key Command Center and the engine authenticate each other with | Never, without changing it everywhere it is used | | `auth-secret-v1` | The key user sessions are signed with | Changing it signs every user out | | `log-encryption-key-v1` | The key secure logs are encrypted with | Never: older logs could no longer be read | | `admin-password-v1` | The first administrator's password | Read on the first run only | | `llm-api-key-v1` | The LLM API key, with the LLM settings only | Read on the first run only; change it in Command Center afterwards. On Docker Swarm, create it even without an LLM, with any value | | `postgres-password-v1` | The password of the PostgreSQL 2501 provides | Never, once the database exists | | `pg-connection-v1` | `DATABASE_URL` and `DIRECT_URL` of your own database (`DIRECT_URL` bypasses any connection pooler) | When your database moves | | `elasticsearch-password-v1` | The password of the Elasticsearch 2501 provides | Never, once it holds data | | `engine-tls` | The engine's certificate and key, with `engine.tls.existingSecret` only | When you renew it | | `cc-tls` | Command Center's certificate, with `tls.mode: secret` | When you renew it | ## Outbound proxy Set `proxy.url` and both the engine and Command Center send their outbound calls through it: the engine for LLM providers, ticketing systems and [PAM systems](https://docs.2501.ai/0.19/configure/privileged-access.md), Command Center for the identity provider behind single sign-on. The services of the installation itself never go through it. `proxy.noProxy` lists more hosts that bypass it: exact host names, `.suffix` domains or literal IP addresses; CIDR ranges are ignored. The URL needs an explicit `http://` or `https://` scheme and no credentials in it. A proxy that re-signs TLS works once its CA is in `caBundle`. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.