Helm Values Reference

Complete reference for the nbe-operator values.yaml organized by section. All values below are set at the top level of your values file.

How Helm Values Map to the CRD

The netboxEnterprise section of your values file maps directly to the NetBoxEnterprise custom resource. When you set netboxEnterprise.enabled: true, the chart creates a NetBoxEnterprise CR with the spec field populated from netboxEnterprise.spec.* in your values. For example:

# values.yaml                          # becomes this CRD spec:
netboxEnterprise:                       # apiVersion: netboxlabs.com/v1
  enabled: true                         # kind: NetBoxEnterprise
  spec:                                 # spec:
    netbox:                             #   netbox:
      replicas: 2                       #     replicas: 2
    postgresql:                         #   postgresql:
      storageSize: "20Gi"              #     storageSize: "20Gi"

This means you can use either helm install --values or kubectl apply to manage your deployment. See the CRD Reference for the full spec field documentation.

Global Configuration

Key	Type	Default	Description
`global.imagePullSecrets`	list	`[{name: netbox-enterprise-helm-registry}, {name: netbox-enterprise-registry}]`	Image pull secrets applied to all pods
`global.replicated`	object	`{}`	Replicated registry credentials (base64-encoded `dockerconfigjson`). Normally injected by the Replicated registry; leave empty for Helm-only installs.
`global.database.enabled`	bool	`true`	Enable internal PGO-managed PostgreSQL
`global.image.pullPolicy`	string	`IfNotPresent`	Default image pull policy
`global.image.images.diode_reconciler_pro`	object	proxied registry/repository	Image override for the Diode Reconciler Pro container
`global.image.images.nbe_utils`	object	proxied registry/repository	Image override for the nbe-utils container
`nameOverride`	string	`""`	Override the generated chart name portion of resource names
`fullnameOverride`	string	`""`	Override the full generated resource name prefix

Operator Configuration

Key	Type	Default	Description
`operator.enabled`	bool	`true`	Deploy the operator
`operator.image.registry`	string	`proxy.enterprise.netboxlabs.com/...`	Operator image registry
`operator.image.repository`	string	`netboxlabs/nbe-operator`	Operator image repository
`operator.image.tag`	string	`2.2-latest`	Operator image tag
`operator.image.pullPolicy`	string	`IfNotPresent`	Operator image pull policy
`operator.metricsPort`	int	`8080`	Port for metrics endpoint
`operator.healthPort`	int	`8081`	Port for health endpoints
`operator.metricsScrapeIntervalSecs`	int	`30`	Seconds between metrics scrape operations
`operator.telemetry.enabled`	bool	`false`	Opt in to aggregate usage reporting via the Replicated SDK. Reports no sensitive data.

The cluster DNS suffix is now configured in the NetBoxEnterprise CRD via spec.clusterDnsSuffix instead of a Helm value.

Operator Logging

Key	Type	Default	Description
`operator.logging.level`	string	`info`	Log level using RUST_LOG syntax (e.g., `info`, `debug`, `info,kube=warn`)
`operator.logging.format`	string	`auto`	Log format: `auto`, `json`, `compact`, `pretty`, `gcp`, `aws`, `otlp`
`operator.logging.otlp.endpoint`	string	Default: OTLP on port `4318`	OTLP exporter endpoint URL (when format is `otlp`)
`operator.logging.otlp.serviceName`	string	`nbe-operator`	Service name for OTLP traces

Operator Probes

Key	Type	Default	Description
`operator.livenessProbe.initialDelaySeconds`	int	`15`	Delay before liveness checks start
`operator.livenessProbe.periodSeconds`	int	`20`	Interval between liveness checks
`operator.readinessProbe.initialDelaySeconds`	int	`5`	Delay before readiness checks start
`operator.readinessProbe.periodSeconds`	int	`10`	Interval between readiness checks

Operator Environment

Key	Type	Default	Description
`operator.env`	list	`[]`	Additional environment variables
`operator.envFrom`	list	`[]`	Environment variable sources (ConfigMaps, Secrets)
`operator.config`	object	`{}`	Additional operator configuration

Service Account & RBAC

Key	Type	Default	Description
`serviceAccount.create`	bool	`true`	Create a ServiceAccount for the operator
`serviceAccount.annotations`	object	`{}`	Annotations for the ServiceAccount
`serviceAccount.name`	string	`""`	Override ServiceAccount name (auto-generated if empty)
`rbac.create`	bool	`true`	Create RBAC resources
`rbac.scope`	string	`cluster`	RBAC scope: `cluster` or `namespace`

Service

Key	Type	Default	Description
`service.enabled`	bool	`true`	Create a Service for the operator
`service.type`	string	`ClusterIP`	Service type
`service.metricsPort`	int	`8080`	Metrics port exposed by the Service
`service.annotations`	object	`{}`	Service annotations

Metrics

Key	Type	Default	Description
`metrics.enabled`	bool	`true`	Enable Prometheus discovery annotations on the operator pod
`metrics.podAnnotations`	bool	`true`	Add `prometheus.io/scrape`, `prometheus.io/port`, `prometheus.io/path` annotations

See Monitoring for details on application-level metrics.

ServiceMonitor

Key	Type	Default	Description
`serviceMonitor.enabled`	bool	`false`	Create a Prometheus Operator ServiceMonitor
`serviceMonitor.namespace`	string	`""`	Namespace for the ServiceMonitor (defaults to release namespace)
`serviceMonitor.labels`	object	`{}`	Additional labels for the ServiceMonitor
`serviceMonitor.annotations`	object	`{}`	Additional annotations
`serviceMonitor.interval`	string	`30s`	Scrape interval
`serviceMonitor.scrapeTimeout`	string	`10s`	Scrape timeout
`serviceMonitor.scheme`	string	`http`	HTTP scheme (`http` or `https`)
`serviceMonitor.tlsConfig`	object	`{}`	TLS config for scraping
`serviceMonitor.honorLabels`	bool	`true`	Honor labels from scraped metrics
`serviceMonitor.relabelings`	list	`[]`	Relabeling configurations
`serviceMonitor.metricRelabelings`	list	`[]`	Metric relabeling configurations
`serviceMonitor.targetLabels`	list	`[]`	Target labels for scraped metrics

Pod Configuration

Key	Type	Default	Description
`replicaCount`	int	`1`	Operator replica count
`podAnnotations`	object	`{}`	Additional pod annotations
`podLabels`	object	`{}`	Additional pod labels
`resources.requests.cpu`	string	`100m`	Operator CPU request
`resources.requests.memory`	string	`128Mi`	Operator memory request
`resources.limits.cpu`	string	`500m`	Operator CPU limit
`resources.limits.memory`	string	`512Mi`	Operator memory limit
`nodeSelector`	object	`{}`	Node selector constraints
`tolerations`	list	`[]`	Pod tolerations
`affinity`	object	`{}`	Pod affinity/anti-affinity rules
`volumes`	list	`[]`	Additional volumes
`volumeMounts`	list	`[]`	Additional volume mounts

Pod Security

Key	Type	Default	Description
`podSecurityContext.runAsNonRoot`	bool	`true`	Enforce non-root
`podSecurityContext.runAsUser`	int	`65532`	UID for operator process
`podSecurityContext.fsGroup`	int	`65532`	Filesystem group
`podSecurityContext.seccompProfile.type`	string	`RuntimeDefault`	Seccomp profile applied at the pod level
`securityContext.allowPrivilegeEscalation`	bool	`false`	Block privilege escalation
`securityContext.capabilities.drop`	list	`[ALL]`	Drop all capabilities
`securityContext.readOnlyRootFilesystem`	bool	`true`	Read-only root filesystem
`securityContext.seccompProfile.type`	string	`RuntimeDefault`	Seccomp profile applied at the container level

Dependency Toggles

Key	Type	Default	Description
`pgo.enabled`	bool	`true`	Install Crunchy Postgres Operator
`redis-operator.enabled`	bool	`true`	Install Redis Operator
`replicated.enabled`	bool	`true`	Install Replicated SDK
`gateway.enabled`	bool	`false`	Install the bundled Traefik gateway controller (Gateway API). Requires the `netbox-enterprise-crds-gateway` chart first -- see Prerequisites

Dependency Images

The chart pins proxied images for each operator dependency so the Replicated registry can mirror them for air-gapped installs. Override these only when running your own mirror.

Key	Type	Default	Description
`pgo.controllerImages`	object	proxied	Crunchy Postgres Operator controller image
`pgo.relatedImages`	object	proxied	Supported PostgreSQL and pgBackRest images PGO may deploy
`pgo.imagePullSecretNames`	list	`[netbox-enterprise-helm-registry, netbox-enterprise-registry]`	Pull secret names for PGO images
`pgo.customPodLabels`	object	`{netboxlabs.com/managed-by: netbox-operator}`	Labels added to PGO pods for Velero backup selection
`redis-operator.redisOperator.imageName`	string	proxied	Redis Operator image
`redis-operator.redisOperator.imagePullPolicy`	string	`IfNotPresent`	Redis Operator pull policy
`redis-operator.redisOperator.imagePullSecrets`	list	`[netbox-enterprise-helm-registry, netbox-enterprise-registry]`	Pull secrets for the Redis Operator image
`redis-operator.redisOperator.podLabels`	object	`{netboxlabs.com/managed-by: netbox-operator}`	Labels added to Redis Operator pods for Velero backup selection
`replicated.image`	object	`replicated/replicated-sdk:1.18.0` (proxied)	Replicated SDK image
`replicated.imagePullSecrets`	list	`[]`	Pull secrets for the Replicated SDK image
`replicated.commonLabels`	object	`{netboxlabs.com/managed-by: netbox-operator}`	Labels added to all Replicated SDK resources for Velero backup selection
`replicated.podLabels`	object	`{netboxlabs.com/managed-by: netbox-operator}`	Labels added to Replicated SDK pods for Velero backup selection
`gateway.image.registry`	string	proxied (`docker.io`)	Traefik gateway controller image registry
`gateway.image.repository`	string	`traefik`	Traefik gateway controller image repository
`gateway.commonLabels`	object	`{netboxlabs.com/managed-by: netbox-operator}`	Labels added to all Traefik resources for Velero backup selection

NetBoxEnterprise Configuration

The netboxEnterprise section controls the NetBoxEnterprise custom resource that the operator reconciles. See the dedicated configuration pages for each subsection:

Key	Type	Default	Description
`netboxEnterprise.enabled`	bool	`false`	Create a NetBoxEnterprise CR
`netboxEnterprise.name`	string	`netbox`	Name of the NetBoxEnterprise resource
`netboxEnterprise.annotations`	object	`{}`	Annotations merged with defaults
`netboxEnterprise.spec.suspend`	bool	`false`	Suspend reconciliation
`netboxEnterprise.spec.maintenanceMode`	bool	`false`	Enable maintenance mode
`netboxEnterprise.spec.labels`	object	`{app.kubernetes.io/managed-by: netbox-operator}`	Labels merged onto all managed resources
`netboxEnterprise.spec.imagePullSecrets`	list	`[]`	Pull secrets for private registries used by managed workloads

For the full spec reference, see the NetBoxEnterprise CRD documentation.

Quick Links

NetBox - netboxEnterprise.spec.netbox.* (app, worker, config)
PostgreSQL - netboxEnterprise.spec.postgresql.* (internal/external DB)
Redis - netboxEnterprise.spec.redis.* (internal/external cache)
Diode - netboxEnterprise.spec.diode.* (data ingestion pipeline)
Ingress & TLS - Networking and certificates
Monitoring - Metrics and ServiceMonitor

On this page