MAQPNADocs

Helm values

All 686 values of the MAQPNA Helm chart with defaults and descriptions, generated from values.yaml and values.schema.json.

Every value of the maqpna Helm chart, with its default and description, generated from the chart's values.yaml and values.schema.json. The chart version always equals the MAQPNA release version.

How to set values#

# one value
helm upgrade --install maqpna "oci://$REGISTRY/charts/maqpna" --version <version> \
  -n maqpna-system --create-namespace --set gateway.replicas=3
# a file (later files win)
helm upgrade --install maqpna "oci://$REGISTRY/charts/maqpna" --version <version> \
  -n maqpna-system -f values-production.yaml -f my-values.yaml
# what the chart will use
helm show values "oci://$REGISTRY/charts/maqpna" --version <version>

REGISTRY is the release registry listed on maqpna.com/download. maqpna install and maqpna upgrade take the same -f and --set flags and check the result with maqpna preflight first. The chart validates every value against values.schema.json; a wrong type or an unknown enum value fails the install before anything is applied.

Sections#

Key Section Values
nameOverride 1
fullnameOverride 1
customKeyBackends 1
image Images 5
imagePullSecrets Images 1
airgap Air-gapped / disconnected installation 3
sovereignty Sovereignty 15
compliance Compliance profiles (validation only; not legal advice) 3
attestation Remote attestation & key broker 50
state HA state backend 11
audit Audit ledger 23
dlp Data-loss prevention at the gateway 6
podSecurityContext Hardened defaults applied to every container / pod. Override per component 7
containerSecurityContext Hardened defaults applied to every container / pod. Override per component 9
secrets Shared secrets 2
operator Operator 55
license -- Commercial licence (P0-4, docs/business/pricing.md). The gateway and the 4
usageReporting -- Commercial licence (P0-4, docs/business/pricing.md). The gateway and the 3
gateway -- Commercial licence (P0-4, docs/business/pricing.md). The gateway and the 192
spire SPIRE workload registration 7
budgets Budgets 6
identity Identity broker 46
runtimeClasses RuntimeClasses for the three trust tiers. 25
trustTiers Sample TrustTiers (cluster-scoped, maqpna.com/v1alpha1). 16
networkPolicy Network isolation 20
serviceMonitor Prometheus Operator ServiceMonitor (operator, gateway and attestation /metrics) 4
examples Example MCP server (examples/mcp-echo) — a harmless upstream so the gateway 11
llamay llamay — a local-first inference engine as an in-cluster model 47
adminAuth Admin API authentication & approver identity (gateway /v1/*) 21
approvals Approvals: argument preview, four-eyes and notifications 9
delegation Delegated end-user identity 24
principalBinding Verified principal binding (ValidatingAdmissionPolicy on AgentSessions) 13
monitoring Monitoring: PrometheusRule (alerts) and Grafana dashboards (WP3 / N3). 34
guards Install guards and post-install tests (WP-D) 2
tests Install guards and post-install tests (WP-D) 9

nameOverride#

Key Type Default Description
nameOverride string "" Override the chart name used in resource names.

fullnameOverride#

Key Type Default Description
fullnameOverride string "" Override the full resource name prefix (defaults to -, collapsed to when the release name already contains the chart name).

customKeyBackends#

Key Type Default Description
customKeyBackends boolean false Set only when your MAQPNA images are custom builds that register a PKCS#11 or extra KMS backend (pkg/keys RegisterPKCS11 / RegisterKMS, or images built with -tags pkcs11). Release images sign with kms://aws|gcp|azure|vault|openbao/... and azurekv://... out of the box; pkcs11: signing URIs, other kms:// providers (ovh, stackit, ...) and any pkcs11:/kms:// sealing URI (gateway.captureArgs.keyURI) are refused at install time unless this is true.

image#

Images

Key Type Default Description
image object see below
image.registry string "<release-registry>" Registry + org prefix for all MAQPNA images. Ignored when airgap.imageRegistry is set.
image.tag string or number "" Image tag for all components. Defaults to .Chart.AppVersion when empty.
image.digests object {} Digest pins per image repository (sha256:...), e.g. {maqpna-gateway: "sha256:...", maqpna-operator: "sha256:..."}; a pinned image renders as /:@. The release's image-digests.txt lists every image's digest. Strongly recommended for production / sovereign deployments. (The former single image.digest is refused: one digest cannot pin eleven different images.)
image.pullPolicy string "IfNotPresent" One of: Always, IfNotPresent, Never.

imagePullSecrets#

Images

Key Type Default Description
imagePullSecrets array [] imagePullSecrets for all component pods, e.g. [{name: regcred}].

airgap#

Air-gapped / disconnected installation

Key Type Default Description
airgap object see below
airgap.enabled boolean false When true, the chart refuses to render references to public registries for MAQPNA images (they are rewritten to imageRegistry).
airgap.imageRegistry string "" Private registry that mirrors /* (see hack/airgap-bundle.sh), e.g. "registry.internal.example:5000/maqpna". Overrides image.registry.

sovereignty#

Sovereignty

Key Type Default Description
sovereignty object see below
sovereignty.enabled boolean true Render the SovereigntyPolicy default.
sovereignty.jurisdiction string "EU" Jurisdiction this installation operates under (e.g. "EU", "EU-DE", "CH").
sovereignty.allowedJurisdictions array [] Jurisdictions a TrustTier / session may declare. Empty = only jurisdiction.
sovereignty.allowedRegistries array [] Image registries agent sandboxes may pull from (prefix match). Empty = unrestricted (not recommended for sovereign deployments).
sovereignty.allowedEgressHosts array [] Hostnames the gateway may forward tool calls to (exact or *.suffix).
sovereignty.allowedEgressCIDRs array [] CIDRs the gateway may reach for upstream tools.
sovereignty.requireAttestationFor array ["confidential"] Isolation levels (gvisor | microvm | confidential) that require successful remote attestation before identities / secrets are released.
sovereignty.keyCustody string "file" Where the signing keys are held: file | pkcs11 | kms. A declaration for auditors (SovereigntyPolicy, pod annotation maqpna.com/key-custody); the components still read their keys from Secrets, which you sync from the HSM or KMS. It does not select a signing backend: no release image signs through PKCS#11 or a KMS (see customKeyBackends). One of: file, pkcs11, kms.
sovereignty.auditRetentionDays integer 365 Minimum audit-ledger retention the platform must guarantee (days).
sovereignty.enforcement string "enforce" enforce: reject non-compliant sessions. audit: admit, but record a violation event + audit record. One of: enforce, audit.
sovereignty.telemetryEndpoints array [] Customer-operated OTLP collectors the gateway may export traces to. Only used when gateway.tracing.enabled; the gateway's policy then carries telemetry {enabled: true, endpoints: [...]} and refuses any other collector. Each URL must also pass allowedEgressHosts/CIDRs. Vendor phone-home telemetry stays "off" (SovereigntyPolicy CRD).
sovereignty.region string "" Free-form region / residency label stamped on pods, e.g. "eu-central".
sovereignty.operator string "" Entity operating the platform (documented in pod annotations).
sovereignty.annotations object {} Extra annotations added to every pod (e.g. compliance tags).

compliance#

Compliance profiles (validation only; not legal advice)

Key Type Default Description
compliance object see below Regulatory profiles this installation claims (validation only, not legal advice).
compliance.profiles array []
compliance.timeSources array [] NTP servers the cluster nodes synchronise to (a declaration checked by the cert-in profile), e.g. ["samay1.nic.in", "samay2.nic.in", "time.nplindia.org"].

attestation#

Remote attestation & key broker

Key Type Default Description
attestation object see below
attestation.responseSigning object see below Sign attestation answers so the operator verifies them: Secret secretName holds key.pem (Ed25519 PKCS#8, attest) and pub.pem (operator).
attestation.responseSigning.enabled boolean false
attestation.responseSigning.secretName string ""
attestation.enabled boolean false
attestation.name string "maqpna-attest"
attestation.replicas integer 1 Must stay 1 with state.backend=file (the release store is a single-writer journal); >= 2 with state.backend=postgres.
attestation.pdb object see below PodDisruptionBudget, rendered when replicas > 1.
attestation.pdb.enabled boolean true
attestation.pdb.minAvailable integer 1
attestation.image object see below
attestation.image.repository string "maqpna-attest"
attestation.agentImage object see below Init-container image the operator injects into attested sandboxes.
attestation.agentImage.repository string "maqpna-attest-agent"
attestation.port integer 8082
attestation.verifier string "trustee" trustee (production): verify Confidential Containers Trustee attestation tokens. sample: DEV ONLY — accepts reports signed with a dev Ed25519 key; use values-dev.yaml. maqpna-attest is fail-closed: it refuses to start without the key material for the chosen verifier, and the chart refuses to render without it. One of: trustee, sample.
attestation.trusteeURL string "" Trustee attestation service base URL (required for verifier=trustee), e.g. https://kbs.attest.internal:8080
attestation.trusteeIssuer string "" Expected attestation-token issuer (optional).
attestation.trusteeJWKS object see below Trustee token-signing keys (JWKS JSON or PEM), required for verifier=trustee. Set exactly one source; mounted read-only at /etc/maqpna/attest-keys/ and passed as -trustee-jwks.
attestation.trusteeJWKS.existingSecret string ""
attestation.trusteeJWKS.existingConfigMap string ""
attestation.trusteeJWKS.key string "jwks.json"
attestation.trusteeJWKS.inline string "" Inline JWKS/PEM content; the chart creates a ConfigMap (public keys only).
attestation.sampleDevPublicKey object see below Ed25519 PEM public key of the dev signer, required for verifier=sample (DEV ONLY). Same source options as trusteeJWKS; passed as -sample-dev-pubkey.
attestation.sampleDevPublicKey.existingSecret string ""
attestation.sampleDevPublicKey.existingConfigMap string ""
attestation.sampleDevPublicKey.key string "pub.pem"
attestation.sampleDevPublicKey.inline string ""
attestation.referenceValues object see below Reference values rendered to /etc/maqpna/attest/reference-values.json. Fail-closed: an empty allowedMeasurements list rejects every report. allowedMeasurements: hex launch measurements of your Kata CoCo guest. Workload binding (required for snp/tdx unless allowLaunchMeasurementOnly): tdxRtmr: per-RTMR allowed values [[rtmr0..],[rtmr1..],[rtmr2..],[rtmr3..]], tdxMrConfigId / snpHostData: Kata init-data (policy) digests.
attestation.referenceValues.allowedMeasurements array []
attestation.referenceValues.tdxRtmr array []
attestation.referenceValues.tdxMrConfigId array []
attestation.referenceValues.snpHostData array []
attestation.referenceValues.allowLaunchMeasurementOnly boolean false
attestation.referenceValues.allowDebug boolean false
attestation.referenceValues.minSvn integer 0
attestation.referenceValues.teeTypes array ["snp", "tdx"]
attestation.extraArgs array []
attestation.extraEnv array []
attestation.automountServiceAccountToken boolean false
attestation.podLabels object {} Extra pod labels. AKS Entra Workload ID needs azure.workload.identity/use: "true" (docs: Cloud identity & keys).
attestation.serviceAccount object see below
attestation.serviceAccount.annotations object {} Cloud workload identity annotations on this component's ServiceAccount, e.g. eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/NAME (EKS IRSA) iam.gke.io/gcp-service-account: NAME@PROJECT.iam.gserviceaccount.com (GKE WIF, SA impersonation) azure.workload.identity/client-id: 00000000-0000-0000-0000-000000000000 (AKS Entra Workload ID) EKS Pod Identity needs no annotation (aws eks create-pod-identity-association). A ServiceAccount is created only when either map is set.
attestation.serviceAccount.labels object {} Extra ServiceAccount labels.
attestation.resources object see below
attestation.resources.requests object {"cpu": "50m", "memory": "32Mi"}
attestation.resources.limits object {"memory": "128Mi"}
attestation.nodeSelector object {}
attestation.tolerations array []
attestation.affinity object {}

state#

HA state backend

Key Type Default Description
state object see below
state.backend string "file" file | postgres One of: file, postgres.
state.postgres object see below
state.postgres.dsnSecret string "" Secret with the DSN (required for backend=postgres).
state.postgres.dsnSecretKey string "dsn"
state.postgres.schema string "maqpna" Schema holding MAQPNA's tables (created by idempotent migrations).
state.postgres.maxConns integer 10 Connection pool size per pod.
state.postgres.pollMillis integer 250 How often a replica pulls other replicas' changes (ms).
state.leader object see below Leader election of background jobs (WP2; postgres only): SIEM shipping per sink, WORM shipping, the tenant ledger feed and the memory/capture retention sweeps run on one replica at a time (a PostgreSQL advisory lock on one dedicated connection per pod).
state.leader.retryMillis integer 1000 How often a standby tries to take over and a leader verifies its lease (ms). Handover takes about this long after a clean shutdown, a few seconds after a crash.
state.counters string "" Rate-limit windows (tokensPerMinute, model-route requestsPerMinute): "shared" counts them cluster-wide in PostgreSQL (one UPSERT per limited call, fixed one-minute windows), "local" per replica. Empty = shared with postgres, local with file. One of: `,local,shared`.

audit#

Audit ledger

Key Type Default Description
audit object see below
audit.hmacCheckpoints boolean true Sign ledger checkpoints with an HMAC key from the tokens Secret.
audit.sink string "stdout" stdout (the gateway's "local" ledger only) | worm. worm: ship sealed ledger segments to a WORM object store (S3 Object Lock, GCS Bucket Lock, Azure immutable Blob). Passed to the gateway as MAQPNA_AUDIT_WORM_* environment variables. The gateway verifies at startup that the store enforces immutability and refuses to start when it does not (fail closed). One of: stdout, worm.
audit.worm object see below
audit.worm.provider string "s3" s3 (S3 Object Lock: AWS, MinIO, Ceph RGW, ...) | gcs (Bucket Lock or Object Retention Lock) | azure (version-level immutable Blob storage). One of: s3, gcs, azure.
audit.worm.endpoint string "" s3: e.g. https://s3.eu-central-1.amazonaws.com or https://minio.audit.svc:9000; gcs: empty = https://storage.googleapis.com; azure: https://.blob.core.windows.net.
audit.worm.bucket string "" S3/GCS bucket or Azure container. s3: created with Object Lock; gcs: a locked retention policy >= the retention, or Object Retention Lock; azure: version-level immutability support enabled.
audit.worm.region string ""
audit.worm.objectLockDays integer 365
audit.worm.intervalSeconds integer or null null Seconds between shipments of sealed segments (empty: gateway default 300).
audit.worm.credentials string "static" static: Secrets (s3: credentialsSecret; gcs/azure: tokenSecret or sasSecret). Keyless, from the gateway's cloud workload identity (MAQPNA_AUDIT_WORM_CREDENTIALS; no Secret): aws for s3 (EKS Pod Identity or IRSA, session token signed in), gcp for gcs (GKE Workload Identity Federation), azure for azure (AKS Entra Workload ID). Bind the identity with gateway.serviceAccount.annotations. One of: static, aws, gcp, azure.
audit.worm.credentialsSecret string "" s3 (credentials=static): Secret with keys access-key, secret-key and optionally session-token (temporary STS credentials).
audit.worm.tokenSecret string "" gcs / azure: Secret with key token holding an OAuth 2.0 bearer token (GCS scope devstorage.read_write; Azure https://storage.azure.com/.default), refreshed by you; the gateway re-reads it when it changes.
audit.worm.sasSecret string "" azure: Secret with key sas (a SAS query string with create/write permission), instead of tokenSecret.
audit.worm.allowUnlockedPolicy boolean false gcs: accept a retention policy that is not yet locked (test buckets only: an unlocked policy can be removed).
audit.worm.insecureSkipVerify boolean false Unsupported, must stay false: the gateway always verifies the endpoint's certificate (rendering fails when true).
audit.sinks array [] SIEM streaming: gateway auditSinks. Each sink ships ledger records at least once with a durable cursor on the audit volume (.sinks/.cursor). Every connection goes through the residency-checking dialer; with sovereignty.enabled the endpoint must use TLS and match sovereignty.allowedEgressHosts (checked here and, fail-closed, by the gateway). Fields: name, type (syslog|http|jsonl), address (tcp://|tls://host:port), url, path, format (json|rfc5424-json|cef|ocsf), batchSize, pollIntervalMillis, facility, sdId, serverName, plus: tlsSecret: Secret with ca.crt (and tls.crt/tls.key when mtls: true), mounted at /etc/maqpna/sinks//tls headersSecret: Secret with key headers ("Name: value" lines, e.g. "Authorization: Splunk ") Cloud-native types (docs/siem.md): sentinel (Azure Monitor Logs Ingestion API: url = data collection endpoint, dcrImmutableId, streamName), chronicle (Google SecOps: url = instance URL, chronicleMode logs|udm, logType), cloudwatch (CloudWatch Logs: region, logGroup, logStream; Security Lake via Firehose) and splunk-hec (url = HEC base URL, https:// unless loopback, index, source, sourceType). Extra fields: maxBatchBytes, deadLetterPath, deadLetterMaxBytes, plus tokenSecret: Secret with key token (Entra / Google OAuth bearer token, or the HEC token) awsCredentialsSecret: Secret with access-key, secret-key and optional session-token (cloudwatch) credentials: keyless workload identity of the gateway instead of a Secret: aws (cloudwatch), azure (sentinel) or gcp (chronicle); bind it with gateway.serviceAccount.annotations Records a collector rejects permanently go to .sinks/.deadletter.jsonl (bounded) instead of stalling the stream; auth/throttling/server errors are retried.
audit.checkpointSigning object see below Ed25519-signed checkpoints: JWS over the ledger head, public JWKS at GET /v1/audit/jwks and in evidence bundles; verify offline with maqpna audit verify FILE --jwks jwks.json. The key is customer-held: a Secret with key audit-signing.pem (PKCS#8 Ed25519, e.g. maqpna keygen). keyURI may instead name a non-exportable key: kms://aws|gcp|azure|vault|openbao/... or azurekv://... (ES256 or EdDSA, built into release images); pkcs11: needs images built with -tags pkcs11 (see customKeyBackends).
audit.checkpointSigning.enabled boolean false
audit.checkpointSigning.secretName string ""
audit.checkpointSigning.keyURI string ""
audit.checkpointSigning.intervalSeconds integer 60
audit.checkpointSigning.every integer 0 Also sign after this many records (0 = gateway default 1000).

dlp#

Data-loss prevention at the gateway

Key Type Default Description
dlp object see below
dlp.profiles object {} Named profiles (gateway config dlpProfiles). Keys: detectors (empty = default set), custom [{id, regex, secret}], requestAction, responseAction, onSecret, maxScanBytes, onOversize (unset: deny oversized content when the direction redacts/denies), streamCarryBytes, entropyMinLength, entropyThreshold.
dlp.defaultProfile string "" Profile for all traffic unless a more specific binding applies.
dlp.namespaces object {} namespace -> profile ("none" disables DLP).
dlp.servers object {} MCP server name -> profile (beats namespaces).
dlp.models object {} Model route -> profile (Agent.spec.model.dlpProfile beats this).

podSecurityContext#

Hardened defaults applied to every container / pod. Override per component

Key Type Default Description
podSecurityContext object see below
podSecurityContext.runAsNonRoot boolean true
podSecurityContext.runAsUser integer 65532
podSecurityContext.runAsGroup integer 65532
podSecurityContext.fsGroup integer 65532
podSecurityContext.seccompProfile object see below
podSecurityContext.seccompProfile.type string "RuntimeDefault"

containerSecurityContext#

Hardened defaults applied to every container / pod. Override per component

Key Type Default Description
containerSecurityContext object see below
containerSecurityContext.allowPrivilegeEscalation boolean false
containerSecurityContext.readOnlyRootFilesystem boolean true
containerSecurityContext.runAsNonRoot boolean true
containerSecurityContext.privileged boolean false
containerSecurityContext.capabilities object see below
containerSecurityContext.capabilities.drop array ["ALL"]
containerSecurityContext.seccompProfile object see below
containerSecurityContext.seccompProfile.type string "RuntimeDefault"

secrets#

Shared secrets

Key Type Default Description
secrets object see below
secrets.existingSecret string "" Name of an existing Secret with keys broker-token, admin-token and audit-hmac-key.

operator#

Operator

Key Type Default Description
operator object see below
operator.enabled boolean true
operator.name string "maqpna-operator"
operator.replicas integer 1
operator.image object see below
operator.image.repository string "maqpna-operator"
operator.sandboxApiVersion string "v1beta1" API version of upstream agent-sandbox the operator should target. (group agents.x-k8s.io / extensions.agents.x-k8s.io). v1beta1 = agent-sandbox v1.0.x.
operator.sandboxSnapshotApi string "" Upstream pod-snapshot API for AgentSessionSnapshot's SandboxSnapshot strategy, e.g. "podsnapshot.gke.io/v1" on GKE Agent Sandbox. Empty = CSI VolumeSnapshot of the session workspace only.
operator.tenantTrustDomainSuffix string "" Default Tenant trust domain is ..
operator.brokerUrl string "" Override --broker-url (defaults to the in-cluster identity Service).
operator.gatewayUrl string "" Override --gateway-url (defaults to the in-cluster gateway Service).
operator.gatewayNamespace string "" Override --gateway-namespace (defaults to the release namespace): only for split installs whose gateway, identity broker and attestation service run in that namespace (disable them in this release; rendering fails otherwise). Service URLs and the agent namespaces' NetworkPolicy follow it.
operator.warmPoolNamespace string "" Default namespace for tier SandboxWarmPools (--warmpool-namespace).
operator.watchSandboxes boolean true Watch upstream Sandbox/SandboxClaim/SandboxWarmPool objects (--watch-sandboxes); needs the agent-sandbox CRDs installed.
operator.defaultSessionTTL string "" Session TTL when neither the session nor a cap sets one (--default-session-ttl, e.g. 2h). Empty = operator default (1h).
operator.tokenTTL string "" Maximum lifetime of minted session tokens, refreshed at 80% (--token-ttl, e.g. 10m). Empty = operator default (15m).
operator.sessionWorkers integer 0 AgentSessions reconciled in parallel (--session-workers). 0 = operator default (8).
operator.kubeApi object see below Client-side rate limits towards the API server (--kube-api-qps, --kube-api-burst). 0 = operator defaults (50 / 100).
operator.kubeApi.qps number 0
operator.kubeApi.burst integer 0
operator.nodeCountInterval string "" Billable-node sampling interval (--node-count-interval, e.g. 5m; "0s" disables). Empty = operator default (1m).
operator.attestTsmHostPath string "" hostPath of configfs-tsm mounted into attest-agent containers at /sys/kernel/config/tsm (--attest-tsm-host-path; attestation only).
operator.pdb object see below PodDisruptionBudget, rendered only with replicas > 1 (a single replica with minAvailable 1 would block node drains).
operator.pdb.enabled boolean true
operator.pdb.minAvailable integer 1
operator.mcpServers object see below
operator.mcpServers.sharedNamespaces array [] Namespaces whose MCPServers may set shared: true (--mcpserver-shared-namespaces). Empty = any namespace.
operator.mcpServers.credentialResync string "1m" How often referenced credential Secrets (MCPServer auth and Agent model apiKeySecretRef) are re-read for rotation (--upstream-credential-resync).
operator.profiles object see below Sandbox profiles (Agent.spec.profile; F-19 browser, F-20 codeInterpreter). Images are pulled through image.registry (airgap friendly); set image to a full reference to override.
operator.profiles.browser object see below
operator.profiles.browser.repository string "maqpna-browser"
operator.profiles.browser.image string ""
operator.profiles.codeInterpreter object see below
operator.profiles.codeInterpreter.repository string "maqpna-code-interpreter"
operator.profiles.codeInterpreter.image string ""
operator.profiles.workspaceSize string "1Gi" Default session workspace PVC size (--workspace-size).
operator.extraArgs array [] Extra command-line args.
operator.extraEnv array []
operator.metrics object see below
operator.metrics.port integer 8080 Container port of the controller-runtime metrics endpoint.
operator.health object see below
operator.health.port integer 8081
operator.resources object see below
operator.resources.requests object {"cpu": "50m", "memory": "64Mi"}
operator.resources.limits object {"memory": "256Mi"}
operator.nodeSelector object {}
operator.tolerations array []
operator.affinity object {}
operator.podLabels object {} Extra pod labels (e.g. azure.workload.identity/use: "true").
operator.serviceAccount object see below
operator.serviceAccount.create boolean true
operator.serviceAccount.name string ""
operator.serviceAccount.annotations object {} e.g. eks.amazonaws.com/role-arn, iam.gke.io/gcp-service-account, azure.workload.identity/client-id (docs: Cloud identity & keys).
operator.serviceAccount.labels object {} Extra ServiceAccount labels.
operator.sandboxRunAsUID integer or null null UID/GID/fsGroup of agent sandbox pods (--sandbox-run-as-uid). Empty: 65532. -1: unset, so the platform assigns one (OpenShift restricted-v2 SCC; see values-openshift.yaml).

license#

-- Commercial licence (P0-4, docs/business/pricing.md). The gateway and the

Key Type Default Description
license object see below Commercial licence (P0-4, docs/business/pricing.md). The gateway and the operator mount this Secret (optional: a missing Secret or key means the Community edition) and re-read it every 30 s, so a new licence needs no restart. maqpna license install FILE -n <namespace> creates it and maqpna license status shows the evaluated state. A licence only switches paid features on: no licence state (none, invalid, grace, expired) ever blocks or degrades agent traffic.
license.secretRef object see below
license.secretRef.name string "maqpna-license" Secret name; empty: no licence is mounted (Community).
license.secretRef.key string "license" Data key holding the licence (compact JWS).

usageReporting#

-- Commercial licence (P0-4, docs/business/pricing.md). The gateway and the

Key Type Default Description
usageReporting object see below Sandbox usage reporting (P0-5, docs/business/implementation-plan.md): the operator reports each finished session's sandbox time to the gateway, which meters it (session cost, budgets) and appends it to the audit ledger (decision "usage", ext.kind sandbox_usage) so billing survives AgentSession garbage collection. Needs gateway.activity.enabled (its API client validates the operator's projected token with a TokenReview).
usageReporting.enabled boolean true
usageReporting.audience string "maqpna-sandbox-usage" Audience of the operator's projected ServiceAccount token.

gateway#

-- Commercial licence (P0-4, docs/business/pricing.md). The gateway and the

Key Type Default Description
gateway object see below
gateway.enabled boolean true
gateway.name string "maqpna-gateway" Keep this label value: the operator's per-session NetworkPolicies allow agent egress only to pods labelled app.kubernetes.io/name=maqpna-gateway.
gateway.replicas integer 1 1 with state.backend=file (each replica would keep its own approvals, revocations, taint and ledgers, G-09: the chart refuses > 1 unless guards.allowIndependentGatewayReplicas); >= 2 with state.backend=postgres.
gateway.image object see below
gateway.image.repository string "maqpna-gateway"
gateway.port integer 8080
gateway.service object see below
gateway.service.type string "ClusterIP"
gateway.service.nodePort null Only used when type is NodePort (kind maps 30080 -> host 8080).
gateway.service.annotations object {}
gateway.config object see below Contents of /etc/maqpna/gateway.json (decoded strictly — unknown keys are rejected by the gateway). The chart fills in, when left empty: policyFile -> /etc/maqpna/policies/policies.json auditPath -> /var/lib/maqpna/audit/ledger.jsonl identity.jwksURL -> in-cluster identity broker JWKS identity.publicKeyFiles -> [/var/run/maqpna-identity/pub.pem] when brokerPublicKeySecret is set upstreams.echo -> in-cluster mcp-echo when examples.mcpEcho.enabled upstreamsFile -> /etc/maqpna/upstreams/upstreams.json (MCPServer registry) upstreamCredentialsDir -> /var/run/maqpna-upstream-credentials tokenExchangeURL -> in-cluster identity broker /v1/exchange shutdownDelaySeconds -> 5 (SIGTERM: keep serving while /readyz fails; terminationGracePeriodSeconds follows it)
gateway.config.listen string "" Empty: ":". When set, its port must equal gateway.port (probes, Service and NetworkPolicies use gateway.port).
gateway.config.upstreams object {} MCP server name -> base URL. Agents call POST /mcp/ on the gateway. Deprecated in favour of MCPServer objects (per-namespace, hot-reloaded); static upstreams are the lowest-priority fallback.
gateway.config.policyFile string ""
gateway.config.auditPath string ""
gateway.config.identity object see below
gateway.config.identity.jwksURL string ""
gateway.config.identity.audience string "maqpna-gateway"
gateway.auditStorage object see below Audit ledger storage. emptyDir: ledger is lost when the pod is rescheduled (ship it with audit.sink=worm). persistent: the gateway is rendered as a StatefulSet with one PVC per replica.
gateway.auditStorage.persistent boolean false
gateway.auditStorage.size string "10Gi"
gateway.auditStorage.storageClassName string ""
gateway.policiesConfigMap string "maqpna-policies" Name of the policies ConfigMap (the operator compiles ToolPolicy objects into key policies.json). The chart creates it once and never overwrites the operator's content on upgrade.
gateway.modelsConfigMap string "maqpna-models" Name of the model-routes ConfigMap the operator writes (key models.json, one route per Agent model). Mounted optionally; the gateway hot-reloads it and serves /llm/{route}/v1/*.
gateway.upstreamsConfigMap string "maqpna-upstreams" MCPServer registry ConfigMap the operator writes (key upstreams.json, F-01). Mounted optionally; the gateway hot-reloads it.
gateway.upstreamCredentialsSecret string "maqpna-upstream-credentials" Upstream credential Secret the operator writes from the Secrets that MCPServers reference. Mounted only into the gateway.
gateway.revocationsConfigMap string "maqpna-revocations" Revocation list ConfigMap (kill switch, F-03). The operator renders AgentRevocation objects into key revocations.json; the chart creates it once with an empty list and keeps the operator's content on upgrade. The gateway reloads it every policyReloadSeconds and denies every call while it cannot read it (fail closed).
gateway.revocationMirror object see below Mirror break-glass revocations (POST /v1/revocations, maqpna kill) to AgentRevocation objects so every replica and the operator apply them. Uses the gateway ServiceAccount token (requires activity.enabled).
gateway.revocationMirror.enabled boolean true
gateway.budgetsConfigMap string "maqpna-budgets" Budgets ConfigMap the operator renders from Agent budgets / model token limits and BudgetPolicies (key budgets.json). Mounted optionally.
gateway.memoryConfigMap string "maqpna-memory" Session memory: MemoryStores rendered by the operator (key memory.json), served by the gateway's built-in MCP server "memory". With state.backend=postgres the memories are shared by all replicas (any replica serves and erases them); the data dir is only used with the file backend. The builtin backend stores data under the audit volume (/var/lib/maqpna/audit/memory): set auditStorage.persistent for durable, in-country memory.
gateway.tenantsConfigMap string "maqpna-tenants" Multi-tenant ISV mode: tenants rendered by the operator (key tenants.json); per-tenant ledgers go to /var/lib/maqpna/audit/tenants (with state.backend=postgres: shared chains, mirrored on every replica, so tenant ledger heads and verification agree on all of them).
gateway.budgetTimezone string "" IANA time zone of the day/month budget windows (empty = UTC), e.g. "Europe/Berlin".
gateway.activity object see below Stamp maqpna.com/last-activity on AgentSessions so the operator can suspend idle sessions. Needs the gateway ServiceAccount token (get/patch on agentsessions only, see gateway-rbac.yaml).
gateway.activity.enabled boolean true
gateway.approvalStorePath string "/var/lib/maqpna/audit/approvals.jsonl" Persist pending/decided approvals across restarts (file journal on the audit volume). Empty = in-memory.
gateway.auditFailurePolicy string "open" What happens when an audit record cannot be written. open: the call proceeds (logged + metric). closed: an "intent" record must be durable before any allowed call is forwarded, otherwise the call is refused and the replica reports not-ready (evidence over availability). One of: open, closed.
gateway.configSync object see below Read operator ConfigMaps (policies, revocations, models, upstreams, budgets, memory, tenants, a2a) directly from the Kubernetes API every pollMillis instead of waiting for the kubelet's 60–90 s volume refresh. Needed for the kill switch to take effect within seconds. Grants the gateway ServiceAccount get on exactly those ConfigMaps. Credential Secrets (maqpna-upstream-credentials, maqpna-model-credentials) are never read from the API: they stay volume-mounted, so rotations take the kubelet's refresh.
gateway.configSync.enabled boolean true
gateway.configSync.pollMillis integer 1000
gateway.pinStorePath string "/var/lib/maqpna/audit/toolpins.jsonl" Journal of observed MCP tool definitions (tool pinning learn mode, F-04). Empty = in-memory.
gateway.taintStorePath string "/var/lib/maqpna/audit/taint.jsonl" Journal of per-session taint labels so taint survives gateway restarts. Empty = in-memory.
gateway.tracing object see below OpenTelemetry traces (OTLP/HTTP JSON, GenAI + MCP semantic conventions). Off by default: the gateway then only propagates the caller's W3C trace context (and records its trace id in the audit ledger). Spans never contain prompt or argument contents. With sovereignty.enabled the endpoint must be listed in sovereignty.telemetryEndpoints.
gateway.tracing.enabled boolean false
gateway.tracing.endpoint string "" Collector base URL, e.g. http://otel-collector.observability.svc:4318
gateway.tracing.serviceName string "maqpna-gateway"
gateway.tracing.sampleRatio number 1.0 Ratio of root traces sampled (callers' sampled flag wins).
gateway.tracing.recordArgs boolean false Add maqpna.args_sha256 / maqpna.args_bytes (hash and size only).
gateway.tracing.recordUser boolean false Add enduser.id (the delegating user) to spans.
gateway.tracing.genAI object see below OTel GenAI semantic conventions (chat / execute_tool / invoke_agent spans, gen_ai.client.* metrics).
gateway.tracing.genAI.captureContent boolean false Opt in to gen_ai.input.messages / gen_ai.output.messages / gen_ai.tool.call.arguments. Content is always DLP-redacted first (every finding redacted; unscannable content dropped).
gateway.tracing.genAI.contentDlpProfile string "" dlpProfiles entry used to redact captured content ("" = the built-in profile with every detector).
gateway.tracing.genAI.maxContentBytes integer 16384 Per-attribute bound on captured content (bytes); larger content is dropped, not truncated.
gateway.tracing.genAI.emitLegacySystem boolean false Also emit gen_ai.system (the pre-1.37 name of gen_ai.provider.name) for older backends.
gateway.tracing.resourceAttributes object {}
gateway.tracing.headersSecret string "" Optional Secret with key headers ("Name: value" per line, e.g. collector auth), mounted at /var/run/maqpna-otel/headers.
gateway.web object see below Built-in maqpna-web MCP server: fetch(url) / search(q) at /mcp/maqpna-web, scope tools:maqpna-web, policy server maqpna-web. Every fetch is SSRF-guarded (private, link-local and metadata addresses refused), residency-checked, size/time/type limited, DLP-scanned and taints the session. Domain lists combine strictest-wins with Agent.spec.web: any deny wins; every non-empty allow list must match; with no allow list anywhere, defaultAllow decides. Zero values use the gateway defaults.
gateway.web.enabled boolean false
gateway.web.allowedDomains array []
gateway.web.deniedDomains array []
gateway.web.namespaces object {} Per-namespace lists: {team-a: {allowedDomains: [...], deniedDomains: [...]}}
gateway.web.defaultAllow boolean false
gateway.web.allowedPorts array [] Default [80, 443].
gateway.web.allowedCIDRs array [] Exceptions to the SSRF block list (e.g. an in-cluster docs mirror).
gateway.web.allowIPLiterals boolean false
gateway.web.maxBytes integer 0
gateway.web.timeoutSeconds integer 0
gateway.web.maxRedirects integer 0
gateway.web.contentTypes array []
gateway.web.respectRobots boolean false
gateway.web.userAgent string ""
gateway.web.taintLabels array [] Default [untrusted-input].
gateway.web.search object see below In-country search backend; none disables search(q).
gateway.web.search.backend string "none" One of: none, searxng, opensearch.
gateway.web.search.url string ""
gateway.web.search.index string "" OpenSearch only.
gateway.web.search.fields array []
gateway.web.search.urlField string ""
gateway.web.search.titleField string ""
gateway.web.search.snippetField string ""
gateway.web.search.authHeaderSecret string "" Optional Secret with key header (the Authorization header value).
gateway.web.search.caSecret string "" Optional Secret with key ca.crt for a private CA.
gateway.web.search.maxResults integer 0
gateway.exec object see below POST /v1/sessions/{id}/exec, proxied to the codeInterpreter sandbox's maqpna-exec; policy server maqpna-exec, audited by hash, DLP on outputs.
gateway.exec.enabled boolean false
gateway.exec.endpointTemplate string "" Default http://{session}.{namespace}.svc.cluster.local:8888
gateway.exec.maxTimeoutSeconds integer 0
gateway.exec.maxOutputBytes integer 0
gateway.exec.keySecret string "" Optional Secret with key key, sent as X-Maqpna-Exec-Key (the sandbox exec server must be given the same key).
gateway.egress object see below Egress proxy for browser sandboxes: CONNECT / absolute-form requests to the gateway port, authenticated with the session token, domain policy Agent.spec.browser.allowedDomains.
gateway.egress.enabled boolean false
gateway.liveView object see below Admin live view of browser sandboxes (noVNC, F-19).
gateway.liveView.enabled boolean false
gateway.liveView.endpointTemplate string "" Default http://{session}.{namespace}.svc.cluster.local:6080
gateway.evidence object see below Screenshot / recording evidence objects; shipped to the WORM bucket when audit.sink=worm, else stored under dir.
gateway.evidence.dir string ""
gateway.evidence.maxBytes integer 0
gateway.k8sOps object see below Governed AI cluster operations: the built-in maqpna-k8s MCP server at /mcp/maqpna-k8s (scope tools:maqpna-k8s, policy server maqpna-k8s). Narrow typed tools only (list/get/describe, pod logs, events, usage, explain_failure; scale, rollout restart, cordon/uncordon, delete pod) - no generic kubectl. Every API call impersonates a dedicated ServiceAccount whose RBAC is read-only unless writes.rbac is true; Secret data is never read. Writes are proposals (the YAML patch for a GitOps commit, audited, not applied) unless writes.mode is apply, and applied writes always wait for a human approval unless writes.approval is policy.
gateway.k8sOps.enabled boolean false
gateway.k8sOps.serviceAccountName string "" ServiceAccount the tools act as (default -k8s-ops).
gateway.k8sOps.namespaces array [] Namespaces the tools may read; empty = every namespace (a ClusterRoleBinding). With a list, RoleBindings per namespace.
gateway.k8sOps.allowClusterScoped boolean false Allow nodes, namespaces and persistentvolumes when namespaces is a list (always allowed when it is empty). Node writes (cordon/uncordon) need it too when writes.namespaces is a list.
gateway.k8sOps.secretsMetadata boolean false Grant list/get on Secrets (metadata only is requested; values are never returned). Off: Secret tools answer 403.
gateway.k8sOps.metrics boolean true Grant the metrics API (get_resource_usage).
gateway.k8sOps.maxLogLines integer 0
gateway.k8sOps.maxLogBytes integer 0
gateway.k8sOps.maxListItems integer 0
gateway.k8sOps.timeoutSeconds integer 0
gateway.k8sOps.writes object see below
gateway.k8sOps.writes.mode string "proposal" disabled | proposal (return the patch, apply nothing) | apply One of: disabled, proposal, apply.
gateway.k8sOps.writes.approval string "required" required (every applied write waits for a human, whatever a ToolPolicy says) | policy (ToolPolicy decides) One of: required, policy.
gateway.k8sOps.writes.rbac boolean false Bind the opt-in write Role (patch scale/workloads/nodes, delete pods) to the ServiceAccount. Needed for mode apply.
gateway.k8sOps.writes.namespaces array [] Restrict writes further (default: the read namespaces).
gateway.k8sOps.writes.maxReplicas integer 0
gateway.policyAdapters object see below External policy adapters. Cedar (ToolPolicy.spec.cedar) is compiled into the release images (build/Dockerfile GO_TAGS=cedar); an image built with GO_TAGS= denies Cedar policies (fail closed). Rego runs in an OPA sidecar queried over loopback (REST Data API); every decision is also evaluated there and the strictest wins. Fail closed (timeouts and errors deny).
gateway.policyAdapters.rego object see below
gateway.policyAdapters.rego.enabled boolean false
gateway.policyAdapters.rego.url string "" Data API URL (default: the sidecar's /v1/data/maqpna/authz/decision).
gateway.policyAdapters.rego.timeoutMs integer 250
gateway.policyAdapters.rego.enforcement string "enforce" enforce | dryRun (audited with ext.dryRun, never enforced). One of: enforce, dryRun.
gateway.policyAdapters.rego.sidecar object see below
gateway.policyAdapters.rego.sidecar.enabled boolean true
gateway.policyAdapters.rego.sidecar.image string "openpolicyagent/opa:1.4.2-static"
gateway.policyAdapters.rego.sidecar.port integer 8181
gateway.policyAdapters.rego.sidecar.policiesConfigMap string "" ConfigMap with *.rego files (package maqpna.authz), mounted at /policies.
gateway.policyAdapters.rego.sidecar.resources object see below
gateway.policyAdapters.rego.sidecar.resources.requests object {"cpu": "50m", "memory": "64Mi"}
gateway.policyAdapters.rego.sidecar.resources.limits object {"memory": "256Mi"}
gateway.captureArgs object see below Opt-in argument capture for maqpna replay: DLP-redacted tool-call arguments, AES-256-GCM encrypted with a customer-held key, stored on the audit volume keyed by the ledger's argsSha256. Off by default.
gateway.captureArgs.enabled boolean false
gateway.captureArgs.keySecret string "" Secret with key capture.key (32 random bytes, base64: openssl rand -base64 32). keyURI pkcs11:/kms:// needs a custom image with a backend (see customKeyBackends).
gateway.captureArgs.keyURI string ""
gateway.captureArgs.namespaces array [] Namespaces to capture (globs; empty = all).
gateway.captureArgs.retentionDays integer 30
gateway.captureArgs.dlpProfile string "" DLP profile used to redact (default: built-in, redacts every validated detector incl. secrets).
gateway.captureArgs.dir string "" Default: /var/lib/maqpna/audit/captures (persist with auditStorage.persistent).
gateway.modelRouting object {} Model routing: failureThreshold, cooldownSeconds, attemptTimeoutSeconds, probeIntervalSeconds, tierJurisdictions {tier: jurisdiction}, dataClassModels {class: [model globs]}. Fallback endpoints come from Agent.spec.model.fallbacks.
gateway.guards array [] Injection classifier guards, gateway guards[]: name, type (openai-moderation | llama-prompt-guard | lakera | bedrock-guardrail | http-json), url (in-country; residency-checked), model, on [toolResult, toolArgs, llmPrompt], threshold, label, action (taint | block), timeoutMs, failOpen, namespaces/servers/tools, apiKeySecret (Secret key api-key).
gateway.a2a object see below A2A v1.0 governance: agents call agents through POST /a2a// (JSON-RPC) or the HTTP+JSON binding, governed like tool calls (server "a2a/", tool "SendMessage" / "skill:"). Routes come from Agent.spec.a2a and A2APeer objects (operator ConfigMap, key a2a.json).
gateway.a2a.enabled boolean true
gateway.a2a.routesConfigMap string "maqpna-a2a"
gateway.a2a.cardSigningKeySecret string "" Secret with key card-signing.pem (Ed25519 PKCS#8): signs served Agent Cards (JWS over RFC 8785). Empty = unsigned cards.
gateway.a2a.publicURL string "" External gateway base URL used in served cards. Required by the gateway with a card signing key; the chart then defaults it to the in-cluster gateway Service URL. Without one, the request host.
gateway.a2a.publicCards boolean false Serve Agent Cards without a token (default: scope agents: needed).
gateway.a2a.maxDelegationDepth null Maximum delegation chain depth of callers (default 5).
gateway.txnTokens object see below Transaction Tokens: off | add (Txn-Token header next to the X-Maqpna-* identity headers) | replace (Txn-Token instead of the identity headers).
gateway.txnTokens.mode string "off" One of: off, add, replace.
gateway.txnTokens.signingKeySecret string "" Secret with key txn-signing.pem (Ed25519 PKCS#8). Give its public key to identity.txnTokenPublicKeySecret so agents can exchange Txn-Tokens for A2A delegation tokens.
gateway.txnTokens.audience string "" aud claim (trust domain); default identity.trustDomain.
gateway.txnTokens.ttlSeconds integer 60
gateway.tls object see below HTTPS and X.509-SVID client certificates. With svidMode optional|required, an SVID presented by an agent must equal its token subject (required: calls without one are rejected). Pair with spire.enabled so sandboxes receive matching SVIDs.
gateway.tls.enabled boolean false
gateway.tls.certSecret string "" kubernetes.io/tls Secret with the gateway's serving certificate.
gateway.tls.clientCAConfigMap string "" ConfigMap holding the SPIFFE trust bundle (PEM), e.g. SPIRE's bundle.
gateway.tls.clientCAKey string "bundle.crt"
gateway.tls.svidMode string "off" One of: off, optional, required.
gateway.tls.svidTrustDomains array [] Accepted SVID trust domains (empty = any in the bundle).
gateway.initialPolicies string "{\"policies\": []}\n" Initial policies.json (default-deny until ToolPolicies exist).
gateway.brokerPublicKeySecret string "" Optionally mount the broker public key (PEM) from a Secret in addition to JWKS fetching (e.g. for rotation overlap or JWKS-less setups). Secret key: pub.pem, mounted at /var/run/maqpna-identity/pub.pem.
gateway.extraArgs array []
gateway.extraEnv array []
gateway.automountServiceAccountToken boolean false Forced to true when activity.enabled (the token is only allowed to get/patch AgentSessions).
gateway.podLabels object {} Extra pod labels. AKS Entra Workload ID needs azure.workload.identity/use: "true" (docs: Cloud identity & keys).
gateway.serviceAccount object see below
gateway.serviceAccount.annotations object {} Cloud workload identity annotations on this component's ServiceAccount, e.g. eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/NAME (EKS IRSA) iam.gke.io/gcp-service-account: NAME@PROJECT.iam.gserviceaccount.com (GKE WIF, SA impersonation) azure.workload.identity/client-id: 00000000-0000-0000-0000-000000000000 (AKS Entra Workload ID) EKS Pod Identity needs no annotation (aws eks create-pod-identity-association).
gateway.serviceAccount.labels object {} Extra ServiceAccount labels.
gateway.secretsStoreCSI object see below Mount a Secrets Store CSI driver volume (SecretProviderClass in this namespace) read-only at mountPath. Point *File settings and _FILE env vars (extraEnv) at files below it, e.g. MAQPNA_ADMIN_TOKEN_FILE=/mnt/secrets-store/admin-token.
gateway.secretsStoreCSI.enabled boolean false
gateway.secretsStoreCSI.secretProviderClass string ""
gateway.secretsStoreCSI.mountPath string "/mnt/secrets-store"
gateway.cloudCredentials object see below Cloud credential settings (gateway.json cloudCredentials); empty values leave the standard cloud environment (AWS_, AZURE_, GOOGLE_APPLICATION_CREDENTIALS, GCE_METADATA_HOST) in charge. Rendered only when something is set.
gateway.cloudCredentials.aws object see below
gateway.cloudCredentials.aws.region string ""
gateway.cloudCredentials.aws.imds boolean false IMDSv2 fallback (the node's instance role): off by default.
gateway.cloudCredentials.aws.partitionDNSSuffix string "" Partition DNS suffix override, e.g. amazonaws.eu (aws-eusc).
gateway.cloudCredentials.aws.stsEndpoint string "" STS endpoint override (https://...), like AWS_ENDPOINT_URL_STS.
gateway.cloudCredentials.azure object see below
gateway.cloudCredentials.azure.managedIdentity boolean false IMDS managed identity (the node's identity): off by default.
gateway.cloudCredentials.azure.identityBinding boolean false AKS identity bindings token proxy (AZURE_KUBERNETES_TOKEN_PROXY).
gateway.cloudCredentials.gcp object see below
gateway.cloudCredentials.gcp.metadataHost string "" Metadata server host override (like GCE_METADATA_HOST).
gateway.pdb object see below PodDisruptionBudget, rendered only with replicas > 1 (one replica with minAvailable 1 would block node drains).
gateway.pdb.enabled boolean true
gateway.pdb.minAvailable integer 1
gateway.resources object see below
gateway.resources.requests object {"cpu": "100m", "memory": "64Mi"}
gateway.resources.limits object {"memory": "256Mi"}
gateway.nodeSelector object {}
gateway.tolerations array []
gateway.affinity object {}
gateway.topologySpreadConstraints array []

spire#

SPIRE workload registration

Key Type Default Description
spire object see below
spire.enabled boolean false
spire.clusterSPIFFEID object see below
spire.clusterSPIFFEID.create boolean true
spire.clusterSPIFFEID.className string ""
spire.clusterSPIFFEID.ttl string "" Upper bound of SVID lifetime, e.g. "1h".
spire.clusterSPIFFEID.namespaceSelector object {}

budgets#

Budgets

Key Type Default Description
budgets object see below
budgets.enabled boolean false
budgets.onExceed string "deny" deny | require_approval (tool calls held for a human; model calls are denied) | alert (log + metric only). One of: deny, require_approval, alert.
budgets.alertAtPercent array [80, 100] Emit budget.threshold alerts when spend crosses these percentages.
budgets.namespaces object {} Namespace limits; "" applies to namespaces without their own entry. e.g. {"": {perDayUSD: "50", perMonthUSD: "1000", maxConcurrentSessions: 20}}
budgets.users object {} User limits; "" applies to users without their own entry. e.g. {"": {perDayUSD: "25"}}

identity#

Identity broker

Key Type Default Description
identity object see below
identity.enabled boolean true
identity.name string "maqpna-identity"
identity.replicas integer 1 Must stay 1 with key.mode=generate (each pod would mint its own key).
identity.image object see below
identity.image.repository string "maqpna-identity"
identity.port integer 8081
identity.trustDomain string "maqpna.local" SPIFFE trust domain, e.g. "eu.prod.example.org".
identity.audience string "maqpna-gateway"
identity.exchange object see below RFC 8693 token exchange (POST /v1/exchange) allowlist, rendered to the broker's -exchange-config. Every MCPServer spec.auth.tokenExchange audience must be listed, or the exchange is refused (invalid_target). Map of audience -> {maxTTLSeconds, allowedScopes, provider, params}, e.g. audiences: https://api.example.com:
identity.exchange.audiences object {}
identity.txnTokenPublicKeySecret string "" Secret with key pub.pem: the gateway's Txn-Token public key (F-15/ F-28). Lets agents exchange a Txn-Token of an A2A call (subject) plus their own token (actor) for a delegation token with a nested act chain.
identity.key object see below
identity.key.mode string "generate" generate: broker creates the key at startup (-generate-key) on an emptyDir. Rotates on every restart. Dev / kind only. helm: chart generates an Ed25519 (PKCS#8 PEM) key into a Secret once (preserved on upgrade via lookup). existingSecret: you provide a Secret with key.pem (and optionally pub.pem) — e.g. synced from your HSM/KMS. Recommended for sovereign production. One of: generate, helm, existingSecret.
identity.key.existingSecret string ""
identity.tenants object see below Per-tenant signing keys: the broker reads the operator-rendered tenants ConfigMap and Secret maqpna-tenant-keys (both optional).
identity.tenants.enabled boolean true
identity.tenants.reload string "10s"
identity.bootstrap object see below Late binding of warm-pool (SandboxClaim) sessions: warm pods long-poll :/v1/bootstrap with their projected ServiceAccount token (this audience) and receive their session (env, task, token) once adopted. Needs a ServiceAccount with tokenreviews create; sandboxes get/watch; pods, sandboxclaims, agentsessions get; agentsessions/status patch (templates/identity-rbac.yaml). Warm-pool SandboxTemplates must mount the bootstrap volume (examples/sandbox-templates).
identity.bootstrap.enabled boolean true
identity.bootstrap.port integer 8083
identity.bootstrap.audience string "maqpna-bootstrap"
identity.extraArgs array []
identity.extraEnv array []
identity.automountServiceAccountToken boolean false Ignored (true) when bootstrap.enabled: the broker then needs API access.
identity.podLabels object {} Extra pod labels. AKS Entra Workload ID needs azure.workload.identity/use: "true" (docs: Cloud identity & keys).
identity.serviceAccount object see below
identity.serviceAccount.annotations object {} Cloud workload identity annotations on this component's ServiceAccount, e.g. eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/NAME (EKS IRSA) iam.gke.io/gcp-service-account: NAME@PROJECT.iam.gserviceaccount.com (GKE WIF, SA impersonation) azure.workload.identity/client-id: 00000000-0000-0000-0000-000000000000 (AKS Entra Workload ID) EKS Pod Identity needs no annotation (aws eks create-pod-identity-association). A ServiceAccount is created when bootstrap.enabled or either map is set.
identity.serviceAccount.labels object {} Extra ServiceAccount labels.
identity.secretsStoreCSI object see below Mount a Secrets Store CSI driver volume (SecretProviderClass in this namespace) read-only at mountPath. Point *File settings and _FILE env vars (extraEnv) at files below it, e.g. MAQPNA_ADMIN_TOKEN_FILE=/mnt/secrets-store/admin-token.
identity.secretsStoreCSI.enabled boolean false
identity.secretsStoreCSI.secretProviderClass string ""
identity.secretsStoreCSI.mountPath string "/mnt/secrets-store"
identity.federationKey string "" Federation signing key (MAQPNA_IDENTITY_FEDERATION_KEY): ES256 or RS256 key that signs the JWTs the broker presents to AWS STS, GCP STS and Entra for exchange providers aws-sts / gcp-sts / azure-entra (clouds do not accept EdDSA). Published in the broker JWKS. A key URI: kms://aws|gcp|azure|vault|openbao/..., azurekv://..., or file:///... Empty with federationKeySecret set: the mounted federation.pem.
identity.federationKeySecret string "" Secret with key federation.pem (PKCS#8 P-256 or RSA), mounted at /var/run/maqpna-federation-key.
identity.federationIssuer string "" https issuer URL of federation tokens (MAQPNA_IDENTITY_FEDERATION_ISSUER): where AWS, Google and Entra fetch /.well-known/openid-configuration and the federation JWKS. Route it to the broker (Ingress/HTTPRoute for those two paths only) or host both documents statically. Required with federationKey/federationKeySecret.
identity.pdb object see below PodDisruptionBudget, rendered only with replicas > 1 (one replica with minAvailable 1 would block node drains).
identity.pdb.enabled boolean true
identity.pdb.minAvailable integer 1
identity.resources object see below
identity.resources.requests object {"cpu": "50m", "memory": "32Mi"}
identity.resources.limits object {"memory": "128Mi"}
identity.nodeSelector object {}
identity.tolerations array []
identity.affinity object {} Empty: with replicas > 1 a preferred pod anti-affinity spreads the pods over nodes.
identity.topologySpreadConstraints array []

runtimeClasses#

RuntimeClasses for the three trust tiers.

Key Type Default Description
runtimeClasses object see below
runtimeClasses.gvisor object see below Tier-0: gVisor user-space kernel.
runtimeClasses.gvisor.enabled boolean true
runtimeClasses.gvisor.name string "gvisor"
runtimeClasses.gvisor.handler string "runsc"
runtimeClasses.gvisor.nodeSelector object {}
runtimeClasses.gvisor.overhead object {}
runtimeClasses.kataFc object see below Tier-1: Kata Containers + Firecracker microVM (needs /dev/kvm).
runtimeClasses.kataFc.enabled boolean true
runtimeClasses.kataFc.name string "kata-fc"
runtimeClasses.kataFc.handler string "kata-fc"
runtimeClasses.kataFc.nodeSelector object {}
runtimeClasses.kataFc.overhead object see below
runtimeClasses.kataFc.overhead.podFixed object see below
runtimeClasses.kataFc.overhead.podFixed.memory string "130Mi"
runtimeClasses.kataFc.overhead.podFixed.cpu string "250m"
runtimeClasses.kataQemuSnp object see below Tier-2: Confidential Containers (Kata CoCo, AMD SEV-SNP / Intel TDX).
runtimeClasses.kataQemuSnp.enabled boolean true
runtimeClasses.kataQemuSnp.name string "kata-qemu-snp"
runtimeClasses.kataQemuSnp.handler string "kata-qemu-snp"
runtimeClasses.kataQemuSnp.nodeSelector object {}
runtimeClasses.kataQemuSnp.overhead object see below
runtimeClasses.kataQemuSnp.overhead.podFixed object see below
runtimeClasses.kataQemuSnp.overhead.podFixed.memory string "2048Mi"
runtimeClasses.kataQemuSnp.overhead.podFixed.cpu string "1"

trustTiers#

Sample TrustTiers (cluster-scoped, maqpna.com/v1alpha1).

Key Type Default Description
trustTiers object see below
trustTiers.create boolean true
trustTiers.items array [{"name": "tier-0", "spec": {"runtimeClassName": "gvisor", "isolation": "gvisor"…
trustTiers.items.spec
trustTiers.items.spec.runtimeClassName
trustTiers.items.spec.isolation
trustTiers.items.spec.egress
trustTiers.items.spec
trustTiers.items.spec.runtimeClassName
trustTiers.items.spec.isolation
trustTiers.items.spec.egress
trustTiers.items.spec
trustTiers.items.spec.runtimeClassName
trustTiers.items.spec.isolation
trustTiers.items.spec.attestationRequired
trustTiers.items.spec.egress

networkPolicy#

Network isolation

Key Type Default Description
networkPolicy object see below
networkPolicy.agentNamespaces object see below Default-deny NetworkPolicy in each agent namespace: no ingress, egress only to DNS and to the MAQPNA gateway. Requires a CNI that enforces NetworkPolicy (Calico, Cilium, ...).
networkPolicy.agentNamespaces.enabled boolean true
networkPolicy.agentNamespaces.create boolean true Create these namespaces (with Pod Security labels) in addition to applying policies to them.
networkPolicy.agentNamespaces.names array ["maqpna-agents"]
networkPolicy.agentNamespaces.podSecurity object see below
networkPolicy.agentNamespaces.podSecurity.enforce string "baseline"
networkPolicy.agentNamespaces.podSecurity.warn string "restricted"
networkPolicy.agentNamespaces.podSecurity.audit string "restricted"
networkPolicy.agentNamespaces.extraEgress array [] Extra egress rules (NetworkPolicyEgressRule list) for agent namespaces.
networkPolicy.controlPlane object see below Ingress policies for the control plane (gateway, identity, operator).
networkPolicy.controlPlane.enabled boolean true
networkPolicy.controlPlane.gatewayAdminFrom array [] Peers (NetworkPolicyPeer list) allowed to reach the gateway's adminListen port (admin API, /metrics). Empty (default): the port is closed to every pod; use kubectl port-forward. Example: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: monitoring}}, podSelector: {matchLabels: {app.kubernetes.io/name: prometheus}}}]
networkPolicy.controlPlane.metricsFrom array [] Peers (NetworkPolicyPeer list) allowed to scrape /metrics of the operator, the attestation service and the gateway (its adminListen port when set, else its API port). Needed with serviceMonitor.enabled when Prometheus runs in another namespace: the control-plane policies otherwise admit only pods of this namespace. Example: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: monitoring}}, podSelector: {matchLabels: {app.kubernetes.io/name: prometheus}}}]
networkPolicy.fqdnEgress object see below Cloud-native FQDN egress policy for the gateway, the one component that calls tools, models, WORM and SIEM endpoints. It mirrors the gateway's allowlist (sovereignty.allowedEgressHosts / allowedEgressCIDRs, plus extraHosts) into the CNI, so the kernel blocks what the gateway would refuse (defence in depth). Agent sandboxes never egress directly (their default-deny policy only allows the gateway).
networkPolicy.fqdnEgress.enabled boolean false
networkPolicy.fqdnEgress.provider string "cilium" cilium: CiliumNetworkPolicy toFQDNs (AKS ACNS / Azure CNI powered by Cilium, RKE2 Cilium, any Cilium); gke: FQDNNetworkPolicy (Dataplane V2) + NetworkPolicy; eks: ApplicationNetworkPolicy domainNames (VPC CNI DNS-based policies / Auto Mode) + NetworkPolicy. One of: cilium, gke, eks.
networkPolicy.fqdnEgress.extraHosts array [] FQDNs (exact or .suffix) allowed in addition to sovereignty.allowedEgressHosts: model APIs, WORM / SIEM endpoints, the OIDC issuer. In-cluster names (.svc, *.cluster.local) are skipped.
networkPolicy.fqdnEgress.ports array [443] TCP ports allowed to those hosts.
networkPolicy.fqdnEgress.clusterCIDRs array [] CIDRs that stay reachable once gateway egress is isolated (gke/eks): the Kubernetes API endpoint (configSync / activity need it), private endpoints, a database outside the cluster. Pods of the cluster and DNS are always allowed.

serviceMonitor#

Prometheus Operator ServiceMonitor (operator, gateway and attestation /metrics)

Key Type Default Description
serviceMonitor object see below
serviceMonitor.enabled boolean false
serviceMonitor.interval string "30s"
serviceMonitor.labels object {}

examples#

Example MCP server (examples/mcp-echo) — a harmless upstream so the gateway

Key Type Default Description
examples object see below
examples.mcpEcho object see below
examples.mcpEcho.enabled boolean true
examples.mcpEcho.name string "maqpna-mcp-echo"
examples.mcpEcho.image object see below
examples.mcpEcho.image.repository string "mcp-echo"
examples.mcpEcho.port integer 8090
examples.mcpEcho.args array []
examples.mcpEcho.resources object see below
examples.mcpEcho.resources.requests object {"cpu": "10m", "memory": "16Mi"}
examples.mcpEcho.resources.limits object {"memory": "64Mi"}

llamay#

llamay — a local-first inference engine as an in-cluster model

Key Type Default Description
llamay object see below llamay inference engine as an in-cluster model provider (docs/integrations/llamay.md)
llamay.enabled boolean false
llamay.name string "maqpna-llamay"
llamay.image object see below
llamay.image.registry string "" Empty registry/repository = llamay's public release image (see docs/integrations/llamay.md): : (CPU, static, scratch) and :-cuda (profile cuda). Under airgap.imageRegistry the repository is pulled from the mirror.
llamay.image.repository string ""
llamay.image.tag string "0.4.5"
llamay.image.digest string ""
llamay.image.pullPolicy string "IfNotPresent" One of: Always, IfNotPresent, Never.
llamay.profile string "cpu" cpu (pure-Go engine, any node) or cuda (Dockerfile.cuda image, needs an NVIDIA device plugin; CUDA is loaded at runtime from the driver). One of: cpu, cuda.
llamay.gpu object see below
llamay.gpu.count integer 1
llamay.gpu.resourceName string "nvidia.com/gpu"
llamay.model string "" Model to serve (llamay serve -m): a GGUF path in the models volume, e.g. /models/qwen2.5-0.5b-instruct-q4_k_m.gguf, or a llamay store name.
llamay.port integer 8081
llamay.concurrency integer 2 Generations run at once (llamay -concurrency).
llamay.ctxMemBudget string "" KV memory resident per model before idle contexts spill to disk (llamay -ctx-mem-budget, e.g. 8G). Empty: keep every context in memory.
llamay.extraArgs array [] Extra llamay serve flags (e.g. ["-kv","vq8"]).
llamay.apiKey object see below
llamay.apiKey.existingSecret string "" Secret (key below) holding the llamay API key. Empty: the chart generates -maqpna-llamay-key and keeps it across upgrades.
llamay.apiKey.key string "api-key"
llamay.models object see below
llamay.models.persistence object see below
llamay.models.persistence.enabled boolean true
llamay.models.persistence.size string "20Gi"
llamay.models.persistence.storageClass string ""
llamay.models.persistence.accessModes array ["ReadWriteOnce"]
llamay.models.persistence.existingClaim string ""
llamay.models.pull string "" Pull the model at start with llamay pull (init container), e.g. hf:Qwen/Qwen2.5-0.5B-Instruct-GGUF/qwen2.5-0.5b-instruct-q4_k_m.gguf. Opens HTTPS egress for the llamay pod. Not available in llamay sovereign builds; use bundle instead when air-gapped.
llamay.models.bundle object see below Air-gapped model bundle: an image whose bundle.path holds a llamay store (blobs/ + manifests/) or GGUF files, copied into /models by an init container (the image needs /bin/sh and cp).
llamay.models.bundle.image string ""
llamay.models.bundle.path string "/bundle"
llamay.audit object see below
llamay.audit.persistence object see below llamay's hash-chained request audit (-audit, -audit-strict, -audit-sync): every request is recorded (counts, never content) and llamay stops serving if a record cannot be written.
llamay.audit.persistence.size string "5Gi"
llamay.audit.persistence.storageClass string ""
llamay.audit.persistence.accessModes array ["ReadWriteOnce"] ReadWriteMany is required for anchor.enabled (the gateway mounts the volume read-only).
llamay.audit.anchor object see below
llamay.audit.anchor.enabled boolean false Verify the chain from the gateway and anchor its head in the MAQPNA ledger (llamay/audit-anchor records; evidence packs carry them). Needs audit.persistence.accessModes [ReadWriteMany].
llamay.audit.anchor.intervalSeconds integer 60
llamay.audit.anchor.failClosed boolean true Take llamay out of model routing while its chain is unverified.
llamay.resources object see below
llamay.resources.requests object {"cpu": "1", "memory": "2Gi"}
llamay.resources.limits object {"memory": "8Gi"}
llamay.nodeSelector object {}
llamay.tolerations array []
llamay.affinity object {}

adminAuth#

Admin API authentication & approver identity (gateway /v1/*)

Key Type Default Description
adminAuth object see below
adminAuth.mode string "token" One of: token, oidc, both.
adminAuth.breakGlassToken object see below Inject MAQPNA_ADMIN_TOKEN into the gateway. Never injected in mode=oidc. In mode=both it is the break-glass credential.
adminAuth.breakGlassToken.enabled boolean true
adminAuth.oidc object see below
adminAuth.oidc.issuer string "" Exact "iss" of admin tokens; keys come from /.well-known/openid-configuration (fetched through the residency-checked egress dialer; add the IdP to allowedEgressHosts).
adminAuth.oidc.audience string "maqpna-admin"
adminAuth.oidc.jwksURL string ""
adminAuth.oidc.jwksRefreshSeconds integer 300
adminAuth.oidc.usernameClaim string "" Claim recorded as the approver (default preferred_username, then email, then sub).
adminAuth.oidc.groupsClaim string "groups"
adminAuth.oidc.clientID string "" Public OIDC client for the console's authorization-code + PKCE login.
adminAuth.oidc.scopes array []
adminAuth.oidc.caSecret string "" Secret with key ca.crt for a private IdP CA (mounted read-only).
adminAuth.roles object see below role -> groups (or "user:") granting it in every namespace. Roles: viewer, approver, auditor, admin, killswitch.
adminAuth.roles.viewer array ["maqpna-viewers"]
adminAuth.roles.approver array ["maqpna-approvers"]
adminAuth.roles.auditor array ["maqpna-auditors"]
adminAuth.roles.admin array ["maqpna-admins"]
adminAuth.roles.killswitch array ["maqpna-sre"]
adminAuth.namespaceRoles object {} namespace -> role -> groups, e.g. {team-a: {approver: [team-a-leads]}}.

approvals#

Approvals: argument preview, four-eyes and notifications

Key Type Default Description
approvals object see below
approvals.preview object see below What approvers see of the tool-call arguments: none | hash | redacted (obvious secrets masked) | full. Raw arguments are only stored in full.
approvals.preview.mode string "redacted"
approvals.preview.maxBytes integer 4096
approvals.quorum object {} Four-eyes: {default: {minApprovers, approverGroups}, rules: {"/": {minApprovers: 2, approverGroups: [...]}}}.
approvals.consoleURL string "" Console URL linked from notifications.
approvals.notifiers array [] gateway notifiers[] (webhook | slack | teams | matrix). Secret values are referenced by file under /etc/maqpna/notify/, e.g. {name: ops, type: webhook, url: "https://hooks.eu.internal/maqpna", hmacSecretFile: /etc/maqpna/notify/hmac}
approvals.notifierSecret string "" Secret mounted at /etc/maqpna/notify holding notifier secrets.
approvals.outboxPath string "/var/lib/maqpna/audit/notify-outbox.jsonl" Undelivered notifications survive restarts here (audit volume).

delegation#

Delegated end-user identity

Key Type Default Description
delegation object see below
delegation.resourceBaseURL string "" Public https base URL of the gateway. The canonical RFC 8707 resource of an MCP server is /mcp/; consent redirect URIs are /v1/connect//callback.
delegation.trustedIssuers array [] Customer IdPs whose access tokens external MCP clients may present (gateway identity.trustedIssuers), e.g. [{issuer: "https://idp.acme.eu/realms/dev", namespace: team-a, agent: ide, servers: ["github"], stepUpScopes: {"github/delete_*": ["tools:github:admin"]}}]
delegation.clientSecretsSecret string "" Secret mounted at /etc/maqpna/delegation-secrets holding OAuth client secrets referenced as clientSecretFile /etc/maqpna/delegation-secrets/.
delegation.tokenVault object see below
delegation.tokenVault.enabled boolean false
delegation.tokenVault.keySecret string "" Secret with key "kek": the customer-held AES-256 key (32 random bytes, e.g. head -c32 /dev/urandom) sealing refresh/access tokens.
delegation.tokenVault.storePath string "/var/lib/maqpna/audit/vault.jsonl" Vault journal (sealed tokens only); keep it on the audit volume.
delegation.tokenVault.publicBaseURL string "" Browser-facing base URL (default delegation.resourceBaseURL).
delegation.tokenVault.login object {} OIDC client authenticating users at consent: {issuer, clientID, clientSecretFile, usernameClaim, scopes}.
delegation.tokenVault.providers array [] Connectable providers (gateway tokenVault.providers), e.g. [{name: github, preset: github, clientID: Iv1.abc, clientSecretFile: /etc/maqpna/delegation-secrets/github, allowedServers: [api.githubcopilot.com]}] allowedServers (host globs) is required: perUser MCPServers on other hosts never receive the token (allowAnyServer: true opts out).
delegation.tokenVault.allowUnverifiedPrincipal boolean false Inject tokens only for verified principals unless true.
delegation.tokenVault.keepOnKillSwitch boolean false Do not revoke a user's tokens on a cluster-wide terminate revocation.
delegation.tokenVault.mirror boolean true Mirror ConnectedAccount status objects (needs gateway.activity.enabled).
delegation.ciba object see below
delegation.ciba.enabled boolean false
delegation.ciba.issuer string ""
delegation.ciba.clientID string ""
delegation.ciba.clientSecretFile string ""
delegation.ciba.userClaim string "" ID-token claim matched against the delegating user.
delegation.ciba.scopes array []
delegation.ciba.acrValues array []
delegation.ciba.requestedExpirySeconds integer 0
delegation.ciba.fallback string "approvers" approvers (F-08 approvers decide when CIBA is unavailable) | deny.

principalBinding#

Verified principal binding (ValidatingAdmissionPolicy on AgentSessions)

Key Type Default Description
principalBinding object see below
principalBinding.mode string "off" One of: off, requester, trustedCreators.
principalBinding.trustedCreatorGroups array [] Groups whose members may create sessions on behalf of anyone, e.g. "system:serviceaccounts:portal".
principalBinding.trustedCreatorUsers array [] Usernames that may, e.g. "system:serviceaccount:portal:backend".
principalBinding.usernamePrefix string "" Prefix your API server's OIDC authenticator adds to usernames/groups (--oidc-username-prefix / --oidc-groups-prefix), e.g. "oidc:".
principalBinding.groupsPrefix string ""
principalBinding.validationActions array ["Deny"] [Deny], or [Warn, Audit] for a dry run.
principalBinding.userOIDC object see below Optional: verify spec.userAssertionRef ID tokens in the operator.
principalBinding.userOIDC.issuer string ""
principalBinding.userOIDC.audience string ""
principalBinding.userOIDC.jwksURL string ""
principalBinding.userOIDC.usernameClaim string ""
principalBinding.userOIDC.groupsClaim string "groups"

monitoring#

Monitoring: PrometheusRule (alerts) and Grafana dashboards (WP3 / N3).

Key Type Default Description
monitoring object see below
monitoring.prometheusRule object see below
monitoring.prometheusRule.enabled boolean false Render a monitoring.coreos.com/v1 PrometheusRule (Prometheus Operator).
monitoring.prometheusRule.labels object {} Extra labels, e.g. the ruleSelector of your Prometheus (release: kube-prometheus-stack).
monitoring.prometheusRule.additionalAlertLabels object {} Labels added to every alert (e.g. team: platform).
monitoring.prometheusRule.runbookBaseURL string "https://docs.maqpna.com/operations/monitoring-and-alerts/" Base URL of the runbooks; each alert links #.
monitoring.prometheusRule.kubeStateMetrics boolean true Alerts that need kube-state-metrics (MaqpnaGatewayNotReady).
monitoring.prometheusRule.disabled array [] Disable individual alerts by name, e.g. [MaqpnaBudgetExceeded].
monitoring.prometheusRule.thresholds object see below
monitoring.prometheusRule.thresholds.sessionReadyWarmP90Seconds integer 5 Session start alert: p90 of maqpna_session_ready_seconds. The PRD 4.3 target for warm starts is 1 s, but warm-pool p90 measures 1.9-6.1 s (kind + gVisor, late binding, CI runners), so the alert fires at 5 s, well above normal; lower it once you have measured your own clusters.
monitoring.prometheusRule.thresholds.sessionReadyColdP90Seconds integer 5
monitoring.prometheusRule.thresholds.sessionReadyFor string "15m"
monitoring.prometheusRule.thresholds.sessionFailureRatio number 0.25 Share of ended sessions with outcome Failed.
monitoring.prometheusRule.thresholds.auditCommitP99Seconds number 0.05 p99 of a durable audit group commit.
monitoring.prometheusRule.thresholds.approvalsBacklog integer 50 Pending approvals for longer than approvalsBacklogFor.
monitoring.prometheusRule.thresholds.approvalsBacklogFor string "10m"
monitoring.prometheusRule.thresholds.revocationListUnavailableFor string "10s" Revocation list unreadable (gateway failing closed) for this long.
monitoring.prometheusRule.thresholds.revocationLagSeconds integer 10 Revocation propagation lag: age of the gateway's last successful configSync read of the revocations ConfigMap (maqpna_gateway_configsync_last_success_timestamp_seconds).
monitoring.prometheusRule.thresholds.revocationLagFor string "1m"
monitoring.prometheusRule.thresholds.denyRatio number 0.5 Share of tool calls denied by policy.
monitoring.prometheusRule.thresholds.upstreamErrorRatio number 0.05 Share of upstream MCP round trips that fail.
monitoring.prometheusRule.thresholds.reconcileErrorsPerSecond number 0.05 Operator reconcile errors per second (Conflict excluded).
monitoring.prometheusRule.thresholds.configMapBytes integer 819200 Rendered gateway ConfigMap size (Kubernetes limit: 1 MiB).
monitoring.prometheusRule.thresholds.tokenMintP99Seconds integer 1 p99 of identity broker token mints.
monitoring.prometheusRule.thresholds.auditSinkLag integer 1000 Ledger records not yet delivered to an audit sink (SIEM/WORM).
monitoring.prometheusRule.thresholds.attestFailureRatio number 0.1 Share of attestations that fail.
monitoring.prometheusRule.thresholds.licenseExpiryWarnDays integer 30 Licence expiry (maqpna_license_days_left): warning below licenseExpiryWarnDays, critical below licenseExpiryCriticalDays (and after expiry). Agent traffic is never affected; paid features turn off 30 days after expiry.
monitoring.prometheusRule.thresholds.licenseExpiryCriticalDays integer 7
monitoring.dashboards object see below
monitoring.dashboards.enabled boolean false Render ConfigMaps with the Sessions, Gateway and Evidence Grafana dashboards, labelled for the Grafana sidecar.
monitoring.dashboards.namespace string "" Namespace of the dashboard ConfigMaps (default: release namespace).
monitoring.dashboards.labels object see below Labels the Grafana sidecar selects on.
monitoring.dashboards.labels.grafana_dashboard string "1"
monitoring.dashboards.annotations object {} Annotations, e.g. grafana_folder: MAQPNA (sidecar folderAnnotation).

guards#

Install guards and post-install tests (WP-D)

Key Type Default Description
guards object see below
guards.allowIndependentGatewayReplicas boolean false Allow gateway.replicas > 1 with state.backend=file. Each replica then keeps independent approvals, break-glass revocations, session taint, budgets and audit ledgers: maqpna kill reaches one replica and approvals list shows part of the queue (CLI audit G-09). Use state.backend=postgres instead; this exists for load tests only.

tests#

Install guards and post-install tests (WP-D)

Key Type Default Description
tests object see below helm test <release> runs maqpna smoke in a pod (templates/tests/smoke.yaml): gateway /readyz and /version, identity JWKS, an unauthenticated MCP call is refused, the admin API answers and the audit chain verifies.
tests.enabled boolean true Render the test hook (only runs on helm test). With gateway.config.adminListen the gateway-version step is skipped.
tests.image object see below
tests.image.repository string "maqpna-cli" The maqpna CLI image (registry and tag follow image.*).
tests.args array [] Extra maqpna smoke arguments, e.g. ["--skip", "audit-verify"].
tests.timeout string "2m" Overall timeout of the smoke run.
tests.resources object see below
tests.resources.requests object {"cpu": "10m", "memory": "32Mi"}
tests.resources.limits object {"memory": "128Mi"}