Core configuration options:
| Parameter | Description | Default | Required |
|---|---|---|---|
| agentConfig.accessKey | HM machine user access key | "" | Yes |
| agentConfig.projectID | HM project ID | "" | Yes |
| agentConfig.beaconServer.host | HM server hostname | "" | Yes |
| agentConfig.locationID | Agent location identifier | "standalone-k8s" | Yes |
| namespace | Kubernetes namespace | "upm-beacon" | No |
| image.repository | Beacon agent image | "" | Yes |
| image.tag | Beacon agent version | "" | Yes |
| otelImage.repository | OTEL collector image | "" | Yes (if OTEL enabled) |
| otelImage.tag | OTEL collector version | "" | Yes (if OTEL enabled) |
| additionalCharts.cert-manager.install | Enable cert-manager subchart | false | No |
| additionalCharts.opentelemetry-collector.install | Enable opentelemetry-collector subchart | false | No |
| additionalCharts.kube-state-metrics.install | Enable kube-state-metrics subchart | false | No |
| additionalCharts.prometheus-node-exporter.install | Enable prometheus-node-exporter subchart | false | No |
| opentelemetry-collector.image.repository | OTEL collector image repository | "" | Yes (if OTEL enabled) |
| opentelemetry-collector.image.tag | OTEL collector image tag | "" | Yes (if OTEL enabled) |
| agentConfig.metrics.kubeStateMetrics.endpoint | Custom kube-state-metrics scrape target (host:port). Leave empty to use the bundled subchart. Set this when using a pre-existing installation, for example, OpenShift's openshift-monitoring. | "" | No |
TLS configuration options
These options control how the agent trusts the Hybrid Manager (HM) beacon server certificate. By default (rootCAEnabled: true), the agent mounts a Certificate Authority (CA) secret and verifies HM using that certificate.
| Parameter | Description | Default | Required |
|---|---|---|---|
| rootCAEnabled | When true, mounts the CA secret and sets the agent's root_ca_path. Set to false to trust HM via the system CA pool (or skip verification) without mounting a CA secret. | true | No |
| rootCASecretName | Name of the secret holding the HM root CA (ca.crt). Must exist when rootCAEnabled is true. | beacon-server-ca | No |
| rootCA | PEM-encoded root CA. When set, the chart creates the CA secret for you instead of requiring a pre-existing one. | "" | No |
| agentConfig.beaconServer.rootCAPath | Path inside the pod where the CA certificate is mounted and read from. Only used when rootCAEnabled is true. | /etc/ssl/certs/ca-certificates.crt | No |
| agentConfig.beaconServer.tlsInsecureSkipVerify | When true, the agent skips TLS verification of the HM beacon server certificate. Typically paired with rootCAEnabled: false for testing. | false | No |
| agentConfig.beaconServer.plaintext | When true, the agent connects to HM without TLS. | false | No |
Note
When rootCAEnabled: false, you don't need to create the beacon-server-ca secret described in the requirements. The agent relies on the system CA pool (or skips verification when tlsInsecureSkipVerify: true), and the CA volume mount is not injected into the agent, OpenTelemetry (OTEL) collector, or CloudNativePG™ sidecar pods.