Helm

Install and first-pool YAML are in Deploy. This page is the values that change behaviour. The chart is oci://registry-1.docker.io/zondax/kobe. Chart version, GitHub tag, and zondax/kobe-operator:vX.Y.Z stay in lockstep.

Release namespace is where the Deployment lives. operatorNamespace is where the operator watches CRs (ClusterPool, AccessPolicy, SandboxPool, …). Default watch namespace is kunobi-pool. Set both to the same namespace unless you have a reason not to.

helm upgrade --install kobe oci://registry-1.docker.io/zondax/kobe \
  --namespace kobe-system \
  --set operatorNamespace=kobe-system \
  --set replicas=2

Values that matter

Ingress

ingress:
  enabled: true
  className: nginx
  host: kobe.example.com
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  tls:
    enabled: true

ingress.host is required when ingress is enabled. TLS secret name defaults to <release>-tls.

Sandbox mode

disabled (default) serves no Sandbox API. managed installs the chart-pinned Agent Sandbox v1.0.0 runtime by image digest and publishes a retained BootstrapConfig for child k3s pools. external installs nothing; you must already run Agent Sandbox v1.0.0.

Child placement requires managed mode. For a release named kobe, the default BootstrapConfig reference is:

spec:
  bootstraps:
    - name: kobe-agent-sandbox-v1-0-0

When Sandbox mode is enabled, the chart creates a ledger namespace <release>-sandbox-ledger-<hash> with a ValidatingAdmissionPolicy (Lease mutations only from the operator ServiceAccount) and a Lease object quota (agentSandbox.reservationObjectLimit, default 4096, minimum 4). The namespace, policy, binding, and quota are retained on Helm uninstall. Do not delete them until every SandboxLease and reservation is verified absent. Requires Kubernetes 1.30+ with the ValidatingAdmissionPolicy and ResourceQuota admission plugins.

agentSandbox.irohRelay is public (n0 relays), disabled, or a comma-separated list of self-hosted relay URLs. Pools that request iroh transport are refused if relays are disabled.

Sandbox usage ceilings default to 0 (disabled). Measurements remain enabled. To enforce a ceiling, set a positive value on the operator:

For example, --set agentSandbox.streamDurationSeconds=14400 enables a four-hour connection ceiling. These settings apply to WebSocket and iroh. Lease expiry and access-policy settings still govern authorization. Invalid configuration prevents startup.

admissionBurst configures both Sandbox and cluster admission. Each has its own per-identity bucket on each operator replica.

Persistent terminal sessions also default to unlimited. Set KOBE_SESSION_MAX_SESSIONS in the SandboxPool container environment to enforce a session count. kobe-runner session metrics prints current session count and configuration for an exec-based Prometheus collector.

The operator exports kobe_sandbox_usage_limit (zero means disabled), kobe_sandbox_usage_observed (resource names specify units), and kobe_sandbox_usage_limit_exceeded_total. Live transfer volume is exported as kobe_sandbox_stream_bytes_total; stream activity/duration metrics remain available. Admission requests are counted by kobe_sandbox_admission_attempts_total. These metrics contain no lease IDs, identities, command text or output.

Unlimited output and larger stdin require the updated kobe-runner image. Existing sandboxes keep their image until replaced. Stdin and non-follow output responses are buffered in memory; removing usage ceilings does not remove available-memory, disk or Kubernetes object-size constraints.

Execution history reserves half of the 256 KiB annotation budget for access and teardown. This storage budget applies even when maxExecutionsPerLease is zero. Its exhaustion returns execution_limit_exhausted; logs and terminals remain available within their own access limits. Stop all older operator replicas before starting the updated operator; use a coordinated restart rather than a rolling upgrade across this format change. An older controller can quarantine a lease whose history a newer replica has compacted. Drain leases with compact histories before rolling back to an older operator.

Teardown authority

On Kubernetes 1.30+, teardownAuthority.separate=true runs teardown proof under a dedicated ServiceAccount. Helm installs two fail-closed ValidatingAdmissionPolicy boundaries: ordinary lifecycle code cannot forge or erase protected evidence, and it cannot replace the authority namespace or cluster-scoped RBAC. The default is single-process mode for older API servers.

Host reaper

On by default. A per-node DaemonSet unmounts and removes stale subtrees under hostReaper.leaseRoot (default /var/lib/kobe/leases/), gated by the operator-written kobe-live-instances ConfigMap. Disable it on clusters where no ClusterPool uses kubeletSharedMount.

hostReaper.cgroupCleanup.enabled is off by default. Nested privileged k3s members using cgroupfs can leak empty cgroup directories; turn this on only after the selected host-reaper image includes those flags.

PostgreSQL

Needed when k3s/k0s pools use backend.datastore. Prefer postgres.urlSecret so a password rotation reloads without restarting the operator. The account needs CREATEDB and CREATEROLE; a superuser is recommended. Connect to a single writable primary, not a load-balanced replica. PgBouncer session pooling is supported; transaction/statement pooling is not.

Clusters provisioned before per-cluster roles existed still hold the shared admin credential. Recycle datastore-backed pools after upgrading that change.

Full comments live in charts/kobe/values.yaml. Do not copy the entire file into GitOps; set the keys you need.