Shared Helm Values

These values are available in all three Edge Delta Helm charts: edgedelta/edgedelta (node agent), edgedelta/edgedelta-gateway, and edgedelta/edgedelta-coordinator.

For chart-specific values, see:

• Node Agent Values
• Gateway Values
• Coordinator Values

Authentication

Use either apiKey or secretApiKey.value, not both.

For production, store the pipeline ID in a secrets management tool. See Continuous Deployment.

Example:

helm upgrade edgedelta edgedelta/edgedelta -i \
  --set secretApiKey.value=<pipeline-id> \
  -n edgedelta --create-namespace

Environment Variables

These top-level Helm values map to environment variables injected into agent containers.

Leave a value empty ("") to accept the chart’s default behavior.

Custom Tags

Variable: edCustomTags

Custom tags are pipe (|) delimited key:value pairs attached to all outgoing data from Edge Delta agents.

Example:

--set edCustomTags="cluster:prod_us_west_2|provider:aws|region:us_west_2"

Verify by checking the ED_CUSTOM_TAGS environment variable on the pod:

kubectl describe pod <pod-name> -n edgedelta

Tag Override

Image

Example:

--set image.pullPolicy=Always

RBAC

Starting with agent version v2.12.0, ClusterRole RBAC rules are defined in values.yaml rather than being hardcoded in chart templates.

rbac.scope

Variable: rbac.scope (default: cluster)

Requires agent version v2.24.0 or higher.

Selects whether the chart creates cluster-scoped or namespace-scoped RBAC.

A Role cannot grant access to cluster-scoped resources, so node-level metrics and cluster-wide discovery are not available with namespace scope. The target allocator keeps its own cluster-scoped RBAC when targetAllocator.enabled is true, since it discovers scrape targets across the cluster.

rbac:
  scope: namespace

clusterRoleRules

Variable: clusterRoleRules

Defines the complete set of ClusterRole rules for the Edge Delta service account. See the full default rule set in the chart values.yaml.

Replacing clusterRoleRules overrides the entire default rule set. To add permissions for custom resources, use additionalClusterRoleRules instead.

Example — minimal baseline:

clusterRoleRules:
  - apiGroups: [""]
    resources: ["namespaces", "pods", "pods/log", "events", "nodes", "nodes/metrics", "services", "endpoints"]
    verbs: ["get", "watch", "list"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

additionalClusterRoleRules

Variable: additionalClusterRoleRules (default: [])

Appends extra ClusterRole rules without modifying the base rules.

Example — grant access to ArgoCD CRDs:

additionalClusterRoleRules:
  - apiGroups: ["argoproj.io"]
    resources: ["applications", "appprojects"]
    verbs: ["get", "list", "watch"]

See Kubernetes Event Source — Custom Resource Permissions for a walkthrough.

roleRules

Variable: roleRules

Requires agent version v2.24.0 or higher.

Defines the Role rules used when rbac.scope is namespace. It is ignored when the scope is cluster.

rbac:
  scope: namespace
roleRules:
  - apiGroups: [""]
    resources: ["namespaces", "pods", "pods/log", "events", "services", "endpoints"]
    verbs: ["get", "watch", "list"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

resourceNames

Requires agent version v2.24.0 or higher.

Rules in clusterRoleRules, additionalClusterRoleRules, and roleRules accept an optional resourceNames list that restricts a rule to specific named resources.

additionalClusterRoleRules:
  - apiGroups: ["argoproj.io"]
    resources: ["appprojects"]
    resourceNames: ["default"]
    verbs: ["get"]

Pod Security

Configure pod security policies, Security Context Constraints (SCC) for OpenShift, SELinux labels, and AppArmor profiles.

Example:

podSecurity:
  securityContextConstraints:
    create: true
  privileged: true
  seLinuxContext:
    type: MustRunAs
    seLinuxOptions:
      type: spc_t

Service Account

Networking

Example:

--set httpProxy="http://corp-proxy:8080" \
--set httpsProxy="http://corp-proxy:8443" \
--set noProxy="169.254.169.254,10.0.0.0/8,.svc.cluster.local"

See Proxy Configuration for detailed guidance.

Network Policy

Example — Cilium egress policy:

networkPolicy:
  enabled: true
  type: cilium
  cilium:
    dnsSelector:
      toEndpoints:
        - matchLabels:
            k8s-app: kube-dns
    customEndpoints:
      toFQDNs:
        - matchName: api.edgedelta.com
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP

Resources

See Reducing Agent Resource Consumption for optimization strategies.

Scheduling

Health Probes and Disruption Budgets

Requires agent version v2.24.0 or higher.

Each workload accepts probes, container lifecycle hooks, and a termination grace period, and most also accept a pod disruption budget. The values live under the key for that workload, which differs per chart:

The daemonset and the processor deployment read the same deployment key, so a probe set there applies to both.

The daemonset has no pod disruption budget, since it runs one pod per node. The coordinator chart accepts probes, lifecycle hooks, and a termination grace period, but no pod disruption budget.

When podDisruptionBudget.enabled is true, set exactly one of minAvailable or maxUnavailable. Setting both, or neither, fails the render with an error naming the workload.

Example:

deployment:
  livenessProbe:
    httpGet:
      path: /healthz
      port: 6062
    initialDelaySeconds: 30
    periodSeconds: 10
  lifecycle:
    preStop:
      exec:
        command: ["/bin/sh", "-c", "sleep 15"]
  terminationGracePeriodSeconds: 30

compactorProps:
  podDisruptionBudget:
    enabled: true
    minAvailable: 1

Monitoring Ports

Watcher Sidecar

Miscellaneous

Deprecated Values

Viewing Default Values

To view all default values for any chart:

helm repo update
helm show values edgedelta/edgedelta
helm show values edgedelta/edgedelta-gateway
helm show values edgedelta/edgedelta-coordinator