Helm Chart Reference

This page documents all configurable values for the Feldera Enterprise Helm chart. See the Helm guide for installation instructions.

Required Values

Version

Key	Description
`felderaVersion`	Feldera image tag to deploy

Feldera License

Feldera Enterprise requires a valid account ID and license key. Contact learnmore@feldera.com to obtain one. Users may supply either the felderaAccountId and felderaLicenseKey or provide the cloudSecretRef that contains account-id and license-key data keys.

Key	Description
`felderaAccountId`	Feldera Account ID
`felderaLicenseKey`	Feldera License Key
`cloudSecretRef`	Name of an existing Kubernetes secret containing `account-id` and `license-key` data keys. When set, `felderaAccountId` and `felderaLicenseKey` are ignored.

Image Configuration

Key	Default	Description
`felderaImageRepository`	`"public.ecr.aws/feldera"`	Image registry for Feldera components.
`imagePullPolicy`	`"IfNotPresent"`	Kubernetes image pull policy for all Feldera images.
`imagePullSecret`	`null`	Name of the Kubernetes secret for pulling images. Leave `null` for public registries.

Database

Feldera uses PostgreSQL for persistent state. By default the chart deploys its own PostgreSQL instance.

Key	Default	Description
`postgresExternal`	`false`	Set to `true` to connect to an existing external PostgreSQL instance instead of deploying one.
`felderaDatabaseSecretRef`	`""`	Secret name for database credentials. When `postgresExternal` is `false`, the secret must have `.user` and `.password` keys. When `true`, it must have a `.connection_url` key. The insecure default secret `<release-name>-db-insecure-secret` is provided for testing only — do not use in production.
`postgresVersion`	`"16.0"`	PostgreSQL image tag (only used when `postgresExternal` is `false`).
`postgresImageRepository`	`"postgres"`	PostgreSQL image repository.
`postgresImagePullPolicy`	`"IfNotPresent"`	Image pull policy for PostgreSQL.
`postgresPort`	`5431`	Port of the internal PostgreSQL service.

External PostgreSQL TLS

When postgresExternal is true, TLS can be configured for the database connection. If postgresTlsConfigMapRef is not set, the system CA bundle is used.

Key	Default	Description
`postgresTlsConfigMapRef`	(unset)	Name of a ConfigMap containing the PostgreSQL CA certificate, mounted at `/config/`. Create with: `kubectl create configmap postgres-pem -n feldera --from-file=postgresql-ca.pem=postgresql-ca.pem`
`postgresTlsCertificateFile`	`"postgresql-ca.pem"`	Filename of the CA certificate within the ConfigMap.
`postgresTlsHostnameVerify`	`true`	Set to `false` to disable hostname verification for the TLS connection.

Kubernetes Runner

The Kubernetes runner manages pipeline pod lifecycle.

Key	Default	Description
`kubernetesRunner.enablePerPipelineNamespace`	`false`	When `true`, pipelines can run in their own namespaces (requires `ClusterRole`/`ClusterRoleBinding`). When `false`, pipelines run in the same namespace as Feldera.
`kubernetesRunner.enablePipelineResize`	`false`	Experimental. Allow changing the CPU and memory of a running single-host pipeline without a restart. Requires Kubernetes 1.34 or later. See resizing a running pipeline.
`kubernetesRunner.allowCustomPipelineTemplate`	`false`	Experimental. Allow pipelines to reference a ConfigMap containing a custom StatefulSet YAML template. The template format may change incompatibly across Feldera upgrades.
`kubernetesRunner.pipelineStatefulSetLabels`	`[]`	Labels added to pipeline StatefulSet `metadata.labels`. Format: `["key=value"]`.
`kubernetesRunner.pipelineStatefulSetPodLabels`	`[]`	Labels added to pipeline StatefulSet `spec.template.metadata.labels`. Format: `["key=value"]`.

Pipeline Resource Limits

These values set cluster-wide bounds for pipeline resource requests. See pipeline configuration for per-pipeline resource settings.

Key	Default	Description
`kubernetesRunner.lowerLimitMemoryMegabyte`	`100`	Minimum allowed memory (MB) for a pipeline pod. Also the default minimum if none is specified in pipeline resources.
`kubernetesRunner.upperLimitMemoryMegabyte`	`32000`	Maximum allowed memory (MB) for a pipeline pod. Also the default maximum if none is specified.
`kubernetesRunner.defaultStorageMegabyte`	`30000`	Default persistent storage volume size (MB) per pipeline if not specified in pipeline resources.
`kubernetesRunner.upperLimitStorageMegabyte`	`128000`	Maximum allowed persistent storage volume size (MB) per pipeline. The API refuses a larger `storage_min` or `storage_max`. See storage limits.
`kubernetesRunner.lowerLimitEphemeralStorageMegabyte`	`500`	Minimum ephemeral storage (MB) for a pipeline pod. Must be large enough to hold the pipeline executable. Also the default.
`kubernetesRunner.upperLimitEphemeralStorageMegabyte`	`2000`	Maximum ephemeral storage (MB) for a pipeline pod.

Pipeline Storage Class

Key	Default	Description
`kubernetesRunner.storageClassName`	`null`	Storage class for pipeline persistent volumes. `null` uses the cluster default.
`kubernetesRunner.enableStorageClassNamesSupported`	`false`	When `true`, only storage classes listed in `storageClassNamesSupported` can be used.
`kubernetesRunner.storageClassNamesSupported`	`[]`	Allowlist of permitted storage class names. Only effective when `enableStorageClassNamesSupported` is `true`. The API refuses other names.

Pipeline Volume Attributes Class

Requires Kubernetes 1.34 or later and a CSI driver that supports volume attributes classes.

Key	Default	Description
`kubernetesRunner.volumeAttributesClassName`	`null`	Volume attributes class for pipeline persistent volumes that do not set `resources.volume_attributes_class`. `null` sets none.
`kubernetesRunner.enableVolumeAttributesClassNamesSupported`	`false`	When `true`, only volume attributes classes listed in `volumeAttributesClassNamesSupported` can be used.
`kubernetesRunner.volumeAttributesClassNamesSupported`	`[]`	Allowlist of permitted volume attributes class names. Only effective when `enableVolumeAttributesClassNamesSupported` is `true`. The API refuses other names.

Connector Kubernetes Secrets

Controls which Kubernetes secrets can be mounted in connectors via secret references.

Key	Default	Description
`kubernetesRunner.connectorKubernetesSecrets.enableAllowlist`	`false`	When `true`, only secrets listed in `allowlist` can be referenced in connector configuration. When `false`, any secret in the namespace can be referenced.
`kubernetesRunner.connectorKubernetesSecrets.allowlist`	`[]`	List of Kubernetes secret names that connectors are permitted to reference.

Compiler

Key	Default	Description
`compilerPvcStorageSize`	`20Gi`	Size of the persistent volume used by the compiler server for build artifacts.
`compilationProfile`	`"optimized"`	Default compilation profile. `"optimized"` produces faster pipelines at the cost of longer compile times. See pipeline configuration for available profiles.
`compilerServer.cargo.config`	`null`	Experimental. Cargo configuration for pipeline builds, in `config.toml` format. See the private cargo registry guide. The values may change incompatibly across Feldera upgrades.
`compilerServer.serviceAccountAnnotations`	`[]`	Experimental. Annotations on the ServiceAccount the chart creates, as `key`/`value` pairs. Gives the compiler pods a cloud identity, such as an IRSA role.

Parallel Compilation

Parallel compilation runs multiple compiler server replicas to reduce total compile time. See the parallel compilation guide for additional details.

Key	Default	Description
`parallelCompilation.enabled`	`false`	Enable multiple compiler server replicas. When `false`, only one replica is used regardless of `replicas`.
`parallelCompilation.replicas`	`1`	Number of compiler server pods when parallel compilation is enabled.

sccache (Optional)

When running multiple compiler replicas, sccache allows them to share compiled artifacts via an S3-compatible backend.

Key	Default	Description
`parallelCompilation.sccache.enabled`	`false`	Enable sccache for sharing compilation artifacts between compiler pods.
`parallelCompilation.sccache.s3.bucket`	`"sccache-bucket"`	S3 bucket name for the sccache backend.
`parallelCompilation.sccache.s3.region`	`"us-east-1"`	AWS region of the S3 bucket.
`parallelCompilation.sccache.s3.keyPrefix`	`"sccache"`	Key prefix for cache objects in the bucket.
`parallelCompilation.sccache.s3.useSSL`	`false`	Use HTTPS/TLS for S3 connections.
`parallelCompilation.sccache.s3.endpoint`	(unset)	Custom S3-compatible server endpoint (e.g., `minio.svc.cluster.local:9000`). Omit for AWS S3.
`parallelCompilation.sccache.s3.existingSecret`	(unset)	Name of a Kubernetes secret with `access_key_id` and `secret_access_key` keys. Omit if using IRSA.
`parallelCompilation.sccache.s3.serverSideEncryption`	(unset)	Enable server-side encryption with S3-managed keys (SSE-S3).
`parallelCompilation.sccache.s3.serverSideEncryptionAwsKms`	(unset)	Enable SSE-KMS with the AWS-managed key (`aws/s3`). Requires sccache 0.17 or newer.
`parallelCompilation.sccache.s3.serverSideEncryptionKmsKeyId`	(unset)	Enable SSE-KMS with a customer-managed KMS key, given as its ARN. Takes precedence over the two settings above. Requires sccache 0.17 or newer, and `kms:GenerateDataKey` plus `kms:Decrypt` on the key.

Authentication

When auth.enabled is true, the API server requires OIDC authentication. See the guides for AWS Cognito, Okta, or generic OIDC providers.

Key	Default	Description
`auth.enabled`	`false`	Enable authentication for the API server.
`auth.provider`	`"aws-cognito"`	OIDC provider type. Set the appropriate value based on your supported authentication provider
`auth.clientId`	`""`	OIDC application client ID.
`auth.issuer`	`""`	OIDC issuer URL.
`auth.cognitoLoginUrl`	`""`	Cognito hosted UI login URL (Cognito only).
`auth.cognitoLogoutUrl`	`""`	Cognito hosted UI logout URL (Cognito only).

Authorization

Tenant-based authorization for the API server. Requires auth.enabled: true.

Key	Default	Description
`authorization.individualTenant`	`null` (→ `true`)	Each authenticated user gets their own tenant.
`authorization.issuerTenant`	`null` (→ `false`)	Assign tenants based on the OIDC token issuer.
`authorization.authorizedGroups`	`null` (→ `[]`)	List of OIDC `groups` claim values. A user must belong to at least one group to be authorized. Empty list allows all authenticated users.
`authorization.authAudience`	`null` (→ `"feldera-api"`)	Expected audience claim in authentication tokens.

API Server

Key	Default	Description
`allowedOrigins`	`null`	List of allowed CORS origins. `null` permits all origins. Example: `["https://app.example.com"]`.
`posthogTelemetryKey`	`null`	PostHog API key for usage telemetry. No data is collected when `null`.
`FELDERA_HTTP_BASE_PATH` (set through `controlPlane.env`)	`""`	URL path prefix the API and web console are served under, for example `/feldera`, when an ingress mounts Feldera on a subpath. See serving Feldera under a URL subpath.

Demos

Key	Default	Description
`demos.showDefault`	`true`	Show the built-in demo pipelines in the UI.
`demos.configMapRef`	`null`	Name of a ConfigMap containing custom demo files (mounted at `/etc/demos`). Custom demos are shown before the defaults.

Pipeline

Default settings applied to all pipeline pods.

Key	Default	Description
`pipeline.serviceAccountName`	`null`	Default Kubernetes service account for pipeline pods. Typically used for IRSA-based cloud authentication.
`pipeline.allowedServiceAccountNames`	`[]`	Service accounts a pipeline may select with `resources.service_account_name`. A pipeline that selects any other fails to start. List only accounts without Kubernetes API permissions; the chart refuses its own control-plane service accounts.
`pipeline.env`	`null`	List of environment variables injected into all pipeline pods.
`pipeline.allowEnv`	`true`	Allow pipelines to set environment variables with `env` in their runtime configuration. A pipeline that sets them fails to start when this is `false`.
`pipeline.allowRustUdfs`	`true`	Allow pipelines to have Rust UDFs (`udf_rust` and `udf_toml`), which compile to native code. When `false`, the API server refuses pipelines with Rust UDFs, and existing ones fail to compile and to start. Set it to `false` unless pipeline authors are trusted.
`pipeline.extraVolumes`	`null`	List of extra volumes added to all pipeline pods, after the built-in ones. Chart v0.366.0 and later. See Extra volumes.
`pipeline.extraVolumeMounts`	`null`	List of extra volume mounts added to the pipeline container, after the built-in ones. Chart v0.366.0 and later. See Extra volumes.
`pipeline.allowInitContainers`	`true`	Allow pipelines to specify init containers (e.g., sidecars) via runtime configuration. See sidecar containers.
`pipeline.allowProfiling`	`false`	Grant the `PERFMON` and `IPC_LOCK` capabilities to pipeline containers, enabling performance profiling. Node kernel settings may also be required, see Visualizing profiles.
`pipeline.terminationGracePeriodSeconds`	`60`	Seconds a pipeline has to write a checkpoint when Kubernetes evicts its pod or drains its node. See Writing checkpoints.
`pipeline.deniedConnectors`	`[]`	Connectors that pipelines may not use, by their `transport.name` (for example `file_input`). A pipeline that uses one fails to start.

Extra volumes

pipeline.extraVolumes and pipeline.extraVolumeMounts are available in chart v0.366.0 and later. Older charts ignore them.

They are added to the chart's default pipeline template only. A pipeline that uses a custom template through pipeline_template_configmap must add these volumes and mounts to that template itself.

For example, to give each pipeline pod a projected service account token for workload identity federation:

pipeline:
  serviceAccountName: feldera-pipeline
  extraVolumes:
    - name: databricks-token
      projected:
        sources:
          - serviceAccountToken:
              path: token
              audience: my-databricks-federation-audience
              expirationSeconds: 3600
  extraVolumeMounts:
    - name: databricks-token
      mountPath: /var/run/secrets/databricks
      readOnly: true

The chart fails the install if:

Check	Rejected values
Volume name is reserved	`config-volume`, `container-status`, `https-config`, `public-ca-config`, `secret-<n>`, any name that ends in `-storage`
Mount names a volume that is not in `pipeline.extraVolumes`	Any other name
Mount path is reserved	Exactly `/pipeline-config`, `/status`, `/https-config`, `/public-ca-config` or `/pipeline-storage`, and `/etc/feldera-secrets` or any path under it

Only the exact paths in the table are checked, except for /etc/feldera-secrets. Do not mount below the other reserved paths either (for example /pipeline-storage/data), because the mount hides that part of the pipeline's own files.

The runner builds each pipeline pod from a template that includes these two values. The same placeholders are documented for custom templates on PipelineTemplateConfig in the REST API reference. It does a plain text replace of the placeholders below over the whole template, so they are replaced anywhere in pipeline.extraVolumes and pipeline.extraVolumeMounts too. There is no way to escape them: do not use any of these names in braces as literal text. Other text in braces, for example {foo}, is not changed.

Placeholder	Replaced with
`{id}`	`pipeline-<pipeline UUID>`, the name of the pipeline's StatefulSet
`{name}`	The pipeline name as a quoted JSON string. Do not use it in `pipeline.extraVolumes` or `pipeline.extraVolumeMounts`, see below.
`{namespace}`	The namespace of the pipeline pod
`{deployment_id}`	The UUID of this deployment of the pipeline
`{pipeline_storage_path}`	`/pipeline-storage`
`{storage_class_name}`	The storage class as a quoted string, or empty if none is set. Do not use it in `pipeline.extraVolumes` or `pipeline.extraVolumeMounts`, see below.
`{hosts}`	The number of hosts the pipeline runs on
`{multihost}`	`yes` or `no`
`{pipeline_executor_image}`	The pipeline executor image
`{binary_ref}`	The URL of the program binary
`{program_info_ref}`	The URL of the program info
`{deployment_initial}`	The initial runtime status of the pipeline
`{bootstrap_policy}`	The bootstrap policy, or `none`
`{silent_bootstrap}`	`yes` or `no`
`{concurrent_bootstrap}`	`yes` or `no`

{name} and {storage_class_name} do not work in pipeline.extraVolumes or pipeline.extraVolumeMounts. The runner inserts them with their own quotes. Helm writes a quoted "{name}" as '{name}', so the value becomes '"my-pipeline"' and keeps the quotes. Without quotes, YAML reads {name} as a map. Use {id} to name per-pipeline objects instead.

Control Plane

Settings applied to API server, Kubernetes runner, and compiler server pods.

Key	Default	Description
`controlPlane.env`	`null`	List of environment variables injected into all control-plane pods (API server, runner, compiler).
`controlPlane.deploymentTimeAnnotation`	`true`	Add a `deployment-time` annotation to StatefulSets/Deployments to force a rollout on every `helm upgrade`. Set to `false` to avoid forced rollouts.

Resources

Resource requests and optional limits for each control-plane component. Requests are reservations — allocated resources are unavailable to other pods. Limits cap maximum usage.

The defaults require a cluster minimum of 14 CPU and 22,000 MiB of memory for the control plane alone; additional capacity is needed for pipeline pods.

Component	CPU Request	Memory Request
`resources.postgres`	`"2"`	`"2000Mi"`
`resources.apiServer`	`"2"`	`"2000Mi"`
`resources.compilerServer`	`"8"`	`"16000Mi"`
`resources.kubernetesRunner`	`"2"`	`"2000Mi"`

Each component accepts optional limits:

resources:
  compilerServer:
    requests:
      cpu: "8"
      memory: "16000Mi"
    limits:
      cpu: "16"
      memory: "32000Mi"

resources.postgres is only used when postgresExternal is false.

Scheduling

Apply node selectors, tolerations, affinity rules, labels, and annotations to control-plane or pipeline pods. controlPlane applies to the database, API server, compiler server, and runner.

Node Selectors

nodeSelectors:
  controlPlane:
    - key: "kubernetes.io/arch"
      value: "amd64"
  pipeline:
    - key: "node-type"
      value: "compute"

Tolerations

tolerations:
  controlPlane:
    - effect: NoSchedule
      key: "dedicated"
      operator: Equal
      value: "feldera"
  pipeline:
    - effect: NoExecute
      key: "spot"
      operator: Exists

Affinity

affinity:
  controlPlane: null   # Any valid Kubernetes affinity object
  pipeline: null

Labels & Annotations

labels:
  controlPlane:
    - key: "team"
      value: "data-platform"
  pipeline:
    - key: "team"
      value: "data-platform"

annotations:
  controlPlane: []
  pipeline: []

HTTPS / TLS

Configure HTTPS for all Feldera components. See the HTTPS guide for certificate generation and setup.

Key	Default	Description
`httpsSecretRef`	`null`	Name of a TLS secret (`kubectl create secret tls ...`) containing `tls.crt` and `tls.key`. When set, HTTPS is enabled for the API server, runner, compiler, and all pipelines.
`caSecretRef`	`null`	Name of a TLS secret with a private CA certificate chain and key. The runner signs a certificate for each pipeline with it. Required for multihost pipelines and for `mtls.enabled`. See private CA.
`mtls.enabled`	`false`	Callers of the compiler, runner, pipeline and coordinator servers present client certificates. A pipeline may only download its own binary and program info, and may not call the runner or another pipeline. Requires `httpsSecretRef`, `caSecretRef` and cert-manager. See client certificates.
`mtls.extraClientUris`	`[]`	URI SANs of external clients, such as sidecars, that pipelines and their coordinators admit like the control plane. Each must match exactly and lie outside `urn:feldera:`. Requires `mtls.enabled`. See external clients.

Networking

Key	Default	Description
`ipFamilyPolicy`	`null`	IP family policy for all Feldera services. One of `SingleStack`, `PreferDualStack`, `RequireDualStack`. Set to `"PreferDualStack"` to enable IPv6.
`enableIPv6`	`false`	Enable IPv6 support.
`enableStatefulSetServiceName`	`true`	Specify `serviceName` for StatefulSets. Disable only if required by your cluster configuration.

Logging

Key	Default	Description
`logJson`	`false`	Emit structured JSON logs from all Feldera components.

Miscellaneous

Key	Default	Description
`unstableFeatures`	`[]`	List of unstable feature flags to enable. Possible values: `"testing"`, `"runtime_version"`, `"rust_compiler_full_cleanup"`. Do not also set `FELDERA_UNSTABLE_FEATURES` in `controlPlane.env`.
`felderaSentryEnabled`	`false`	Send crash reports and logs to Feldera's Sentry installation.
`cloudApiEndpoint`	`"https://cloud1.feldera.com"`	Feldera cloud API endpoint used for license verification and runner telemetry.
`disableClusterMonitorResources`	`false`	Whether to disable cluster monitoring of its own (Kubernetes) resources.

Required Values​

Version​

Feldera License​

Image Configuration​

Database​

External PostgreSQL TLS​

Kubernetes Runner​

Pipeline Resource Limits​

Pipeline Storage Class​

Pipeline Volume Attributes Class​

Connector Kubernetes Secrets​

Compiler​

Parallel Compilation​

sccache (Optional)​

Authentication​

Authorization​

API Server​

Demos​

Pipeline​

Extra volumes​

Control Plane​

Resources​

Scheduling​

Node Selectors​

Tolerations​

Affinity​

Labels & Annotations​

HTTPS / TLS​

Networking​

Logging​

Miscellaneous​