Configuration

Installation shape comes from Helm values. Anything a person changes while running it lives in the console, so a policy edit is not a redeploy.

Identity and scale

Value	Default	What it does
`clusterName`	`""`	Names this installation in notifications and evidence. Never a hostname — nothing topological leaves the cluster.
`replicaCount`	`2`	Webhook replicas, spread by anti-affinity. One serves, two survive a node.
`scanner.replicas`	`1`	Scan workers. Raising this with a `ReadWriteOnce` cache is refused at install.
`image.repository`	`ghcr.io/attestkeep/attestkeep-k8s`	Point at your mirror for an air-gapped install.
`image.tag`	chart appVersion

Database

Value	Default	What it does
`postgresql.enabled`	`true`	Install a PostgreSQL alongside. Turn off to use your own.
`postgresql.persistence.size`	`20Gi`
`postgresql.auth.password`	`""`	Generated when empty.
`externalDsnExistingSecret.name`	`""`	Preferred for an external database.
`externalDsn`	`""`	A DSN inline. Avoid: it lands in your Helm release history and stays there.

Scanning

Value	Default	What it does
`scan.workers`	`2`	Concurrent scans per scanner pod.
`scan.timeout`	`10m`	Per scan.
`scan.rescanInterval`	`24h`	How often a known digest is re-evaluated against a refreshed database.
`scan.insecureRegistries`	`[]`	Registries served over plain HTTP. Must be named — silently downgrading a connection is not a decision a security tool makes for you.
`scan.cosignOffline`	`false`	Verify against the key and skip the transparency log. See air-gapped for what that costs.

Admission

See Admission — webhook.failurePolicy and webhook.coldImagePolicy are posture decisions rather than tuning, and they are explained there rather than listed here.

Observability

Metrics are exposed in Prometheus format on the operator's metrics port, and labelled series are created at zero on start-up so a dashboard is not empty until the first event. OTLP export is available and is always additional: if the collector is unreachable, nothing about scanning or admission changes.

The log level is a runtime control in the console, not a deployment setting. Turning up logging to diagnose something should not require a rollout.

What lives in the console instead

Policies, and the exceptions to them, with an owner and an expiry.
Notification destinations.
Users and single sign-on.
Log level.
Evidence packages.

The dividing line: a Helm value describes how the installation is shaped, and everything a person changes while operating it belongs where they can change it without a deploy.