Helm chart values

Reference for the values exposed by the vantage-operator and vantage-selfhosted Helm charts.

Vantage 3.0 self-hosted ships as two Helm charts: vantage-operator (the controller that watches the Vantage custom resource) and vantage-selfhosted (the chart that creates the Vantage resource and supporting manifests in your chosen install namespace). This page is the values reference for both.

For field-level CRD details, see API reference. For an install-time procedure, choose Azure or Self-Managed Kubernetes.

Install matching versions of vantage-operator and vantage-selfhosted. The current self-managed procedure uses version 0.70.13 for both charts.

vantage-operator

Installed once per cluster, into a namespace of your choice. The operator reconciles the Vantage installation defined by the Vantage custom resource.

Install exactly one instance per cluster. The chart uses cluster-scoped, non-templated resource names (manager-role ClusterRole, manager-rolebinding ClusterRoleBinding, controller-manager ServiceAccount). A second install into the same cluster (even in a different namespace) collides on these resources. See Known Limitations.

Top-level stanzas

• nameOverride / fullnameOverride: partially or fully override the generated resource name prefix.
• manager: the operator Deployment: replicas, image, container args (leader election is enabled by default), env (pod name and namespace via the downward API), imagePullSecrets, pod and container security contexts (non-root, no privilege escalation, read-only root filesystem), resources, and scheduling (affinity, nodeSelector, tolerations).
• rbacHelpers: optional admin/editor/viewer ClusterRoles for working with the vantage.abbyy.com CRDs. Disabled by default.
• crd: CRD lifecycle: install the CRDs with the chart (enable) and keep them on uninstall (keep).
• metrics: the RBAC-protected /metrics endpoint.
• certManager: cert-manager integration for webhook and metrics endpoint certificates. Disabled by default.
• prometheus: a Prometheus ServiceMonitor for the metrics endpoint. Requires the prometheus-operator in the cluster. Disabled by default.

Notable values

Defaults reflect the chart’s generated values.yaml for this release. The chart itself is canonical; see Inspecting available values.

Value	Purpose
manager.replicas	Operator replica count. Default 1.
manager.image.repository / tag / pullPolicy	Operator container image. pullPolicy defaults to IfNotPresent.
manager.imagePullSecrets	Pull secrets for the operator image when your registry requires authentication, for example --set "manager.imagePullSecrets[0].name=my-pull-secret". Default []. Not needed on AKS when AcrPull is granted to the kubelet identity. See Image pull access.
manager.args	Container arguments. Default [--leader-elect] (leader election enabled).
manager.resources	CPU/memory requests and limits. Defaults: requests 10m CPU / 64Mi memory, limits 500m CPU / 128Mi memory.
manager.affinity / manager.nodeSelector / manager.tolerations	Standard Kubernetes scheduling controls for the operator pod. Empty by default.
rbacHelpers.enable	Install convenience admin/editor/viewer roles for the vantage.abbyy.com CRDs. Default false.
crd.enable	Install the CRDs with the chart. Default true.
crd.keep	Keep the CRDs (and the Vantage resources they define) in the cluster when the chart is uninstalled. Default true.
metrics.enable / metrics.port	Expose the RBAC-protected /metrics endpoint. Defaults true / 8443.
certManager.enable	Use cert-manager for webhook and metrics endpoint certificates. Default false.
prometheus.enable	Create a Prometheus ServiceMonitor for the metrics endpoint. Requires the prometheus-operator in the cluster. Default false.

The operator chart does not accept any Vantage-application configuration. Application configuration lives entirely on the Vantage custom resource, which is created by the vantage-selfhosted chart.

vantage-selfhosted

Installed once per Vantage instance, into a namespace of your choice. This chart contains the Vantage custom resource, a ConfigMap containing the Vantage workloads data with its associated RBAC, and the Vantage-related CRDs and roles sourced from ABBYY’s upstream infrastructure repository.

Most values map directly to fields on the Vantage custom resource. See the API reference for the field-level contract.

Top-level stanzas

• operator: pointer to the operator install (namespace and controllerManagerServiceAccount). The chart uses these values to bind the operator’s Secret-reader ClusterRole in the Vantage release namespace.
• ingress: built-in Istio ingress wiring. Set enabled: false when supplying another ingress controller.
• vantage: the Vantage.spec payload: databaseProvider, dnsRecord, mailFrom, platformAdminEmail, secrets, vantageVersion, workloads, idReadingEnabled, keda, ociMigration, reportingEnabled, serviceAccountName, smtp, storage, techcore.
• observability: chart-rendered Prometheus ServiceMonitor configuration. This is a top-level stanza, not a Vantage.spec field.

Required values

Value	Maps to	Notes
operator.namespace	N/A	Where you installed vantage-operator.
operator.controllerManagerServiceAccount	N/A	Operator controller ServiceAccount to bind to the Secret-reader ClusterRole in this Vantage release namespace. Change it only when the operator installation uses a non-default name.
ingress.tls.secretName	N/A	Required when the built-in Istio ingress is enabled. Name of the existing kubernetes.io/tls Secret in the Istio external ingress gateway namespace. Not used when ingress.enabled is false.
vantage.dnsRecord	Vantage.spec.dnsRecord	DNS hostname Vantage is reachable at.
vantage.mailFrom	Vantage.spec.mailFrom	Sender for outbound mail.
vantage.platformAdminEmail	Vantage.spec.platformAdminEmail	Initial platform admin.
vantage.secrets.azure or vantage.secrets.kubernetes	Vantage.spec.secrets	Exactly one secrets provider is required. See Secrets and Key Vault.
vantage.workloads.configMap / metadataTemplateKey / secretsKey / workloadsKey	Vantage.spec.workloads	Points at the ConfigMap containing the workloads data. The chart itself ships and creates this ConfigMap.

Optional values

Value	Purpose
ingress.enabled	Enable the chart’s built-in ingress. Set false when using Traefik or another customer-managed ingress controller. Default true.
vantage.databaseProvider	Database engine for Vantage services. Accepted values: SqlServer (default) or PostgreSQL; case-sensitive.
vantage.secrets.azure.identityMode	One of workloadIdentity (default), podIdentity, vmManagedIdentity. See Secrets and Key Vault.
vantage.secrets.azure.userAssignedIdentityID	Client ID of the UAMI to use when identityMode is vmManagedIdentity.
vantage.secrets.azure.objects	Map of secret alias → {objectName, objectType, objectVersion} for Key Vault objects whose names don’t match the alias.
vantage.secrets.kubernetes	Use pre-existing Kubernetes Secret resources instead of Azure Key Vault. Optional objects mapping overrides default secret names.
vantage.smtp.host / port / login / password	Outbound SMTP. Used only when set; SendGrid is the default. Maps to Vantage.spec.smtp.
vantage.serviceAccountName	Default ServiceAccount for Vantage workloads. Maps to Vantage.spec.serviceAccountName. Default default. To pull images with a pull Secret, add the Secret to this ServiceAccount’s imagePullSecrets. See Azure image pull access or self-managed registry access.
vantage.storage.custom.storageClass / size	Use a Kubernetes StorageClass-backed backend instead of Azure Blob. Maps to Vantage.spec.storage.custom.
vantage.idReadingEnabled	Toggle ID reading features. Default false.
vantage.reportingEnabled	Toggle SQL Server reporting features. Default false. Must remain false with PostgreSQL.
vantage.ociMigration.enabled	Run the OCI migration job. Default true.
vantage.ociMigration.serviceAccountName	ServiceAccount the OCI migration job runs under. Maps to Vantage.spec.ociMigration.serviceAccountName. To pull the job image with a pull secret, add the secret to this ServiceAccount’s imagePullSecrets.
vantage.ociMigration.sources[]	Source registries to copy artifacts from. Set sources[0].host and sources[0].repository to the ABBYY-supplied source registry; obtain the values from your ABBYY account team. Set sources[].credentialsRef.name to a Secret holding registry credentials; this is the alternative to a migration job ServiceAccount for pull configuration.
vantage.ociMigration.destination.host / repository	Destination registry that artifacts are copied into.
vantage.keda.enabled	Configures whether KEDA is used for autoscaling Vantage workloads. The current Vantage workload charts require KEDA 2.17.x. See Autoscaling with KEDA.
observability.prometheus.namespace	Namespace containing Prometheus. Default observability. Some Vantage autoscalers require the prometheus-operated Service in this namespace.
observability.prometheus.serviceMonitor.create	Create the ServiceMonitor that scrapes Vantage /metrics-text endpoints. Default false.
observability.prometheus.serviceMonitor.selectorMatchLabels	Labels required for your Prometheus instance to select the Vantage ServiceMonitor. Default {}.
vantage.techcore.versions	TechCore engine version(s).
vantage.techcore.nnTrainingWorkers.enabled / gpu	Neural-network training workers.

Inspecting available values

The vantage-operator chart, including its values.yaml, is generated by the Kubebuilder Helm plugin; the vantage-selfhosted chart’s templates are hand-maintained. In both cases the published chart is the canonical reference for what a given version accepts. The tables on this page summarize a tested snapshot; when this page and the chart disagree, trust the chart:

# vantage-operator
helm show values $charts_uri/vantage-operator --version $operator_version

# vantage-selfhosted
helm show values $chart_uri/vantage-selfhosted --version $selfhosted_version

$charts_uri, $chart_uri, and the version variables follow the conventions in Install variables.

To inspect the rendered manifests before applying:

helm template $release_name $chart_uri/vantage-selfhosted \
  --version $selfhosted_version \
  --namespace $install_namespace \
  -f my-values.yaml

Operator vs Vantage configuration

Configuration splits along a clear line:

Concern	Lives on	Rationale
Operator runtime (replicas, image, pull secrets, scheduling, CRD lifecycle, metrics)	vantage-operator Helm values	Cluster-admin operational settings.
Vantage application (secrets, SMTP, workloads, storage, techcore)	vantage-selfhosted Helm values → Vantage.spec	The CRD is the API contract; the chart is just the way you author it.

TechCore worker deployment

The vantage-selfhosted chart applies a Vantage custom resource; the operator then deploys a subset of the TechCore worker charts based on spec.techcore.*. The selection happens in the operator, but the matrix below is the contract; use it to predict which workers will run for a given configuration.

Naming convention

Worker charts are named vtc-{version}-worker-{name}, where {version} comes from spec.techcore.version and {previousVersion} from spec.techcore.previousVersion. The version numbers are pure name prefixes; they have no semantic meaning to the operator. The set of available workers comes from the workloads ConfigMap that ABBYY publishes with each release.

Two deployment passes

Pass	When it runs	Charts considered
Current version	Always	vtc-{version}-worker*
Previous version	When spec.techcore.keepPreviousVersion: true	vtc-{previousVersion}-worker*

Setting keepPreviousVersion: true keeps the previous TechCore version’s workers running alongside the new ones, which is useful for staged TechCore upgrades. The CRD requires previousVersion to be set when this flag is true.

Inclusion matrix: current version pass

Chart pattern	Included when
worker-id-reading	Never (excluded in all configurations)
nn-extraction-training	nnTrainingWorkers.enabled: true and nnTrainingWorkers.gpu: false
nn-extraction-training-gpu	nnTrainingWorkers.enabled: true and nnTrainingWorkers.gpu: true
nn-nlp-model-train	nnTrainingWorkers.enabled: true and nnTrainingWorkers.gpu: false
nn-nlp-model-train-gpu	nnTrainingWorkers.enabled: true and nnTrainingWorkers.gpu: true
All other workers	Always

Inclusion matrix: previous version pass

Only runs when spec.techcore.keepPreviousVersion: true.

Chart pattern	Included when
worker-id-reading	Never
nn-extraction-training* (CPU and GPU)	Never (NN training only runs on the current version)
nn-nlp-model-train* (CPU and GPU)	Never (NN training only runs on the current version)
All other workers	Always

ID reading is a platform-level concern, not a TechCore concern. The flag that controls it is spec.idReadingEnabled, which lives outside spec.techcore. See the Vantage.spec reference.

The matrix only decides inclusion within whatever workers exist in the workloads ConfigMap for the selected version. Charts that are not present in the workloads for that version are simply unavailable to deploy. For example, worker-ocr-join only ships in vtc-2’s workload set today, so even with keepPreviousVersion: true and previousVersion: 2, it deploys only as vtc-2-worker-ocr-join.

What’s next

API reference

Field-by-field reference for the Vantage custom resource.

Install on Azure

The procedural install that uses these charts.

Self-Managed Kubernetes

Install with customer-managed ingress, mesh, secrets, storage, and data services.