Chart Structure
The Hexr Helm chart is a umbrella chart with subcharts:hexr-runtime/
├── Chart.yaml
├── values.yaml
├── values-saas.yaml # Hexr Cloud overrides
├── templates/
│ ├── auto-registrar/
│ ├── cred-injector/
│ ├── dashboard/
│ ├── gateway/
│ ├── vault/
│ ├── sandbox/
│ ├── otel-collector/
│ └── valkey/
└── charts/
├── spire/ # SPIRE subchart
└── cloud-api/ # Cloud API subchart
Key Values
Global
| Value | Default | Description |
|---|---|---|
global.trustDomain | demo.hexr.dev | SPIFFE trust domain |
global.registry | us-central1-docker.pkg.dev/hexr-cloud-prod/hexr-images | Container registry |
global.namespace | hexr-system | Platform namespace |
SPIRE
| Value | Default | Description |
|---|---|---|
spire.server.trustDomain | demo.hexr.dev | Trust domain |
spire.server.ca.ttl | 24h | CA certificate TTL |
spire.agent.socketPath | /run/spire/sockets/agent.sock | Workload API socket |
spire.oidc.enabled | false | Enable OIDC Discovery provider |
spire.oidc.hostname | — | OIDC hostname (e.g., oidc.hexr.cloud) |
Auto-Registrar
| Value | Default | Description |
|---|---|---|
autoRegistrar.image.tag | v0.2.2 | Image tag |
autoRegistrar.watchNamespaces | "" | Namespaces to watch (empty = all) |
autoRegistrar.logLevel | info | Log level |
Credential Injector
| Value | Default | Description |
|---|---|---|
credentialInjector.image.tag | v0.4.2 | Image tag |
credentialInjector.aws.roleArn | — | AWS IAM role ARN |
credentialInjector.gcp.workloadIdentityProvider | — | GCP WIF provider |
credentialInjector.azure.tenantId | — | Azure AD tenant ID |
credentialInjector.cache.l1TTL | 900 | L1 cache TTL (seconds) |
credentialInjector.cache.l2TTL | 3600 | L2 cache TTL (seconds) |
Vault
| Value | Default | Description |
|---|---|---|
hexr-vault.vault.image.tag | v0.1.1 | Image tag |
hexr-vault.vault.postgres.url | — | PostgreSQL connection string |
hexr-vault.vault.encryptionKey | — | AES-256 master key |
Gateway
| Value | Default | Description |
|---|---|---|
gateway.image.tag | v0.4.1 | Image tag |
gateway.maxToolTimeout | 30s | Maximum tool execution timeout |
Dashboard
| Value | Default | Description |
|---|---|---|
dashboard.image.tag | v0.3.11 | Image tag |
dashboard.ingress.enabled | false | Enable Ingress |
dashboard.ingress.host | — | Dashboard hostname |
Observability
| Value | Default | Description |
|---|---|---|
otelCollector.enabled | true | Enable OTel Collector |
prometheus.enabled | true | Enable Prometheus |
grafana.enabled | true | Enable Grafana |
Upgrade Command
DB_PASS=$(gcloud secrets versions access latest --secret=hexr-db-password --project=hexr-cloud-prod)
helm upgrade hexr-runtime . -n hexr-system \
-f values-saas.yaml \
--set attestor.database.postgres.external.password="$DB_PASS" \
--set "hexr-vault.vault.postgres.url=postgresql://hexr:${DB_PASS}@10.60.0.3:5432/hexr_vault?sslmode=disable" \
--set "cloud-api.cloudApi.database.url=postgresql://hexr:${DB_PASS}@10.60.0.3:5432/hexr_metering?sslmode=disable" \
--server-side=false --timeout 10m
Always use
-f values-saas.yaml with --set for secrets. Never use --reuse-values.