openfga
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
replicaCount: 3
2
minReadySeconds:
3
deploymentStrategy: {}
4
image:
5
repository: cgr.dev/chainguard-private/openfga
6
pullPolicy: Always
7
tag: 1.22.1-r0@sha256:ee94fa367f2628a735c06380ae32d6383178873bf864c0f10d4555d1b41782af
8
imagePullSecrets: []
9
nameOverride: ""
10
fullnameOverride: ""
11
# Specify additional labels to apply to OpenFGA resources
12
# Usage example:
13
# commonLabels:
14
# app.example.com/system: permissions
15
# app.example.com/domain: example
16
commonLabels: {}
17
serviceAccount:
18
# Specifies whether a service account should be created
19
create: true
20
# Annotations to add to the service account
21
annotations: {}
22
# The name of the service account to use.
23
# If not set and create is true, a name is generated using the fullname template
24
name: ""
25
annotations: {}
26
podAnnotations: {}
27
podExtraLabels: {}
28
extraEnvVars: []
29
extraVolumes: []
30
extraVolumeMounts: []
31
extraInitContainers: []
32
podSecurityContext: {}
33
# fsGroup: 2000
34
35
securityContext: {}
36
# capabilities:
37
# drop:
38
# - ALL
39
# readOnlyRootFilesystem: true
40
# runAsNonRoot: true
41
# runAsUser: 1000
42
43
initContainer:
44
repository: cgr.dev/chainguard-private/k8s-wait-for
45
tag: 2.0-r6@sha256:21ade3ec0e4b4e5448a0dd1c7b94971e0524290a8491b70abea7a4ffce9f037e
46
pullPolicy: IfNotPresent
47
## Configure extra options for OpenFGA containers' liveness, readiness and startup probes
48
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes
49
50
## @param livenessProbe.enabled Enable liveness probes on OpenFGA containers.
51
## @param livenessProbe.initialDelaySeconds Number of seconds after the container has started before liveness probes are initiated.
52
## @param livenessProbe.periodSeconds How often (in seconds) to perform the probe.
53
## @param livenessProbe.timeoutSeconds Number of seconds after which the probe times out.
54
## @param livenessProbe.failureThreshold Failure threshold for liveness probes.
55
## @param livenessProbe.successThreshold Success threshold for liveness probes.
56
##
57
livenessProbe:
58
enabled: true
59
initialDelaySeconds: 60
60
periodSeconds: 10
61
timeoutSeconds: 5
62
failureThreshold: 12
63
successThreshold: 1
64
## @param readinessProbe.enabled Enable readiness probes on OpenFGA containers.
65
## @param readinessProbe.initialDelaySeconds Number of seconds after the container has started before readiness probes are initiated.
66
## @param readinessProbe.periodSeconds How often (in seconds) to perform the probe.
67
## @param readinessProbe.timeoutSeconds Number of seconds after which the probe times out.
68
## @param readinessProbe.failureThreshold Failure threshold for readiness probes.
69
## @param readinessProbe.successThreshold Success threshold for readiness probes.
70
##
71
readinessProbe:
72
enabled: true
73
initialDelaySeconds: 5
74
periodSeconds: 10
75
timeoutSeconds: 5
76
failureThreshold: 6
77
successThreshold: 1
78
## @param startupProbe.enabled Enable startup probes on OpenFGA containers.
79
## @param startupProbe.initialDelaySeconds Number of seconds after the container has started before startup probes are initiated.
80
## @param startupProbe.periodSeconds How often (in seconds) to perform the probe.
81
## @param startupProbe.timeoutSeconds Number of seconds after which the probe times out.
82
## @param startupProbe.failureThreshold Failure threshold for startup probes.
83
## @param startupProbe.successThreshold Success threshold for startup probes.
84
##
85
startupProbe:
86
enabled: false
87
initialDelaySeconds: 60
88
periodSeconds: 10
89
timeoutSeconds: 5
90
failureThreshold: 30
91
successThreshold: 1
92
## @param customLivenessProbe Overrides the default liveness probe with a custom one.
93
##
94
customLivenessProbe: {}
95
## @param customReadinessProbe Overrides the default readiness probe with a custom one.
96
##
97
customReadinessProbe: {}
98
## @param customStartupProbe Overrides the default startup probe with a custom one.
99
##
100
customStartupProbe: {}
101
service:
102
annotations: {}
103
type: ClusterIP
104
port: 8080
105
telemetry:
106
trace:
107
enabled: false
108
otlp:
109
endpoint:
110
tls:
111
enabled: false
112
sampleRatio:
113
metrics:
114
## @param telemetry.metrics.enabled enable/disable prometheus metrics on the '/metrics' endpoint
115
##
116
enabled: true
117
serviceMonitor:
118
## @param telemetry.metrics.serviceMonitor.enabled enable/disable installation of serviceMonitor custom resource
119
##
120
enabled: false
121
## @param telemetry.metrics.serviceMonitor.additionalLabels additional labels to be added to the serviceMonitor resource
122
##
123
additionalLabels: {}
124
## @param telemetry.metrics.serviceMonitor.annotations annotations to be added to the serviceMonitor resource
125
##
126
annotations: {}
127
## @param telemetry.metrics.serviceMonitor.jobLabel the label to use to retrieve the job name from
128
##
129
jobLabel: "app.kubernetes.io/name"
130
## @param telemetry.metrics.serviceMonitor.namespace namespace where the serviceMonitor resource should be installed to
131
##
132
namespace: ""
133
## @param telemetry.metrics.serviceMonitor.namespaceSelector which namespaces should be scraped
134
##
135
## Default: scrape .Release.Namespace or namespaceOverride only
136
## To scrape all, use the following:
137
## namespaceSelector:
138
## any: true
139
##
140
namespaceSelector: {}
141
## @param telemetry.metrics.serviceMonitor.scrapeInterval prometheus scrape interval
142
##
143
scrapeInterval: 30s
144
## @param telemetry.metrics.serviceMonitor.scrapeTimeout prometheus scrape timeout
145
##
146
scrapeTimeout: 10s
147
## @param telemetry.metrics.serviceMonitor.targetLabels additional target labels to scrape
148
##
149
targetLabels: []
150
## @param telemetry.metrics.serviceMonitor.relabelings add job relabelings
151
##
152
relabelings: []
153
## @param telemetry.metrics.serviceMonitor.metricRelabelings add metric relabelings
154
##
155
metricRelabelings: []
156
## @param telemetry.metrics.addr the host:port address to serve the Metrics server on
157
addr: 0.0.0.0:2112
158
## @param telemetry.metrics.enableRPCHistograms enables prometheus histogram metrics for RPC latency distributions
159
enableRPCHistograms:
160
## @param telemetry.metrics.podAnnotations [object] Annotations for the Prometheus metrics on etcd pods
161
##
162
podAnnotations:
163
prometheus.io/scrape: "true"
164
prometheus.io/port: "{{ .Values.containerPorts.prometheus }}"
165
datastore:
166
metrics:
167
enabled: false
168
engine: memory
169
uri:
170
uriSecret:
171
username:
172
password:
173
existingSecret:
174
secretKeys:
175
uriKey:
176
usernameKey:
177
passwordKey:
178
maxCacheSize:
179
maxOpenConns:
180
maxIdleConns:
181
connMaxIdleTime:
182
connMaxLifetime:
183
secondary:
184
engine:
185
uri:
186
uriSecret:
187
username:
188
password:
189
existingSecret:
190
secretKeys:
191
uriKey:
192
usernameKey:
193
passwordKey:
194
applyMigrations: true
195
waitForMigrations: true
196
migrationType: job
197
migrations:
198
resources: {}
199
image:
200
repository: groundnuty/k8s-wait-for
201
pullPolicy: Always
202
tag: "v2.0"
203
## DEPRECATED: The bundled PostgreSQL and MySQL sub-charts use the Bitnami legacy
204
## archive repository which is no longer actively maintained or receiving security updates.
205
## They are provided for backwards compatibility only and will be removed in subsequent releases.
206
postgresql:
207
## @param postgresql.enabled enable the bitnami/postgresql subchart (DEPRECATED - uses unsupported legacy archive)
208
enabled: false
209
image:
210
registry: docker.io
211
repository: bitnamilegacy/postgresql
212
tag: 15.4.0-debian-11-r45
213
mysql:
214
## @param mysql.enabled enable the bitnami/mysql subchart (DEPRECATED - uses unsupported legacy archive)
215
enabled: false
216
image:
217
registry: docker.io
218
repository: bitnamilegacy/mysql
219
tag: 8.0.32-debian-11-r14
220
grpc:
221
addr: 0.0.0.0:8081
222
tls:
223
enabled: false
224
cert:
225
key:
226
ca:
227
http:
228
enabled: true
229
addr: 0.0.0.0:8080
230
tls:
231
enabled: false
232
cert:
233
key:
234
upstreamTimeout:
235
corsAllowedOrigins: ["*"]
236
corsAllowedHeaders: ["*"]
237
authn:
238
method:
239
preshared:
240
keys: []
241
keysSecret:
242
oidc:
243
audience:
244
issuer:
245
playground:
246
enabled: true
247
port: 3000
248
profiler:
249
enabled: false
250
addr: 0.0.0.0:3001
251
log:
252
level: info
253
format: json
254
timestampFormat: Unix
255
checkQueryCache:
256
enabled: false
257
limit:
258
ttl:
259
checkCache:
260
enabled: true
261
limit:
262
experimentals: []
263
maxTuplesPerWrite:
264
maxTypesPerAuthorizationModel:
265
maxAuthorizationModelSizeInBytes:
266
maxConcurrentReadsForCheck:
267
maxConcurrentReadsForListObjects:
268
maxConcurrentReadsForListUsers:
269
maxChecksPerBatchCheck:
270
maxConcurrentChecksPerBatchCheck:
271
changelogHorizonOffset:
272
resolveNodeLimit:
273
resolveNodeBreadthLimit:
274
listObjectsDeadline:
275
listObjectsMaxResults:
276
listUsersDeadline:
277
listUsersMaxResults:
278
requestTimeout:
279
requestDurationDatastoreQueryCountBuckets: [50, 200]
280
allowWriting1_0Models:
281
allowEvaluating1_0Models:
282
ingress:
283
enabled: false
284
className: ""
285
annotations: {}
286
# kubernetes.io/ingress.class: nginx
287
# kubernetes.io/tls-acme: "true"
288
hosts:
289
- host: chart-example.local
290
paths:
291
- path: /
292
pathType: ImplementationSpecific
293
# servicePort: 8080
294
tls: []
295
# - secretName: chart-example-tls
296
# hosts:
297
# - chart-example.local
298
resources: {}
299
lifecycle: {}
300
autoscaling:
301
enabled: false
302
minReplicas: 1
303
maxReplicas: 100
304
targetCPUUtilizationPercentage: 80
305
targetMemoryUtilizationPercentage: 80
306
nodeSelector: {}
307
tolerations: []
308
topologySpreadConstraints: []
309
affinity: {}
310
# @param sidecars Add additional sidecar containers to the pods
311
# Example:
312
# sidecars:
313
# - name: your-image-name
314
# image: your-image
315
# imagePullPolicy: Always
316
# ports:
317
# - name: portname
318
# containerPort: 1234
319
sidecars: []
320
migrate:
321
extraVolumes: []
322
extraVolumeMounts: []
323
extraInitContainers: []
324
sidecars: []
325
# -- Added to the migration Job and its pod. With the operator, helm.sh/* keys
326
# are dropped and the rest is forwarded (e.g. sidecar.istio.io/inject: "false").
327
annotations:
328
helm.sh/hook: "post-install, post-upgrade, post-rollback, post-delete"
329
helm.sh/hook-weight: "-5"
330
helm.sh/hook-delete-policy: "before-hook-creation"
331
# -- Added to the migration Job and its pod in both modes.
332
labels: {}
333
timeout:
334
testPodSpec: {}
335
testContainerSpec: {}
336
# -- Array of extra K8s manifests to deploy
337
## Note: Supports use of custom Helm templates
338
extraObjects: []
339
# -- Configuration for the openfga-operator subchart. When enabled, database
340
# migrations are run by the operator instead of the Helm hook Job.
341
# See charts/openfga-operator/values.yaml for all available options.
342
openfga-operator:
343
enabled: false
344
# migrationJob:
345
# backoffLimit: 3
346
# activeDeadlineSeconds: 0
347
# ttlSecondsAfterFinished: 300
348
# leaderElection:
349
# enabled: true
350
# watchNamespace: ""
351
# resources:
352
# requests:
353
# cpu: 10m
354
# memory: 64Mi
355
# limits:
356
# memory: 128Mi
357
# -- Settings for the migration Jobs the operator creates.
358
# Only used when openfga-operator.enabled is true.
359
migration:
360
# -- The operator runs a migration when the OpenFGA image or the datastore
361
# settings change. Set this to any new value to run it again when neither
362
# changed, e.g. after rotating a Secret to point at a different database.
363
trigger: ""
364
serviceAccount:
365
# -- Create a dedicated service account for migration Jobs. By default the
366
# Job runs as the OpenFGA service account, like the Helm hook Job does.
367
create: false
368
# -- Annotations to add to the migration service account.
369
# Use this to attach cloud IAM roles (e.g., eks.amazonaws.com/role-arn) for DDL permissions.
370
annotations: {}
371
# -- The name of the migration service account.
372
# If not set and create is true, defaults to {fullname}-migration.
373
name: ""
374
375
## Example: Deploy a PostgreSQL instance for dev/test using official Docker images.
376
## For production, use a managed database service or an operator like CloudnativePG.
377
## Configure the chart to use the secret:
378
## datastore:
379
## engine: postgres
380
## uriSecret: openfga-postgres-credentials # (PostgreSQL example)
381
## # or
382
## uriSecret: openfga-mysql-credentials # (MySQL example)
383
#
384
## PostgreSQL dev/test example:
385
# - apiVersion: v1
386
# kind: Secret
387
# metadata:
388
# name: openfga-postgres-credentials
389
# stringData:
390
# POSTGRES_USER: openfga
391
# POSTGRES_PASSWORD: changeme
392
# POSTGRES_DB: openfga
393
# uri: "postgres://openfga:changeme@openfga-postgres:5432/openfga?sslmode=disable"
394
# - apiVersion: apps/v1
395
# kind: Deployment
396
# metadata:
397
# name: openfga-postgres
398
# spec:
399
# replicas: 1
400
# selector:
401
# matchLabels:
402
# app: openfga-postgres
403
# template:
404
# metadata:
405
# labels:
406
# app: openfga-postgres
407
# spec:
408
# containers:
409
# - name: postgres
410
# image: postgres:17
411
# ports:
412
# - containerPort: 5432
413
# envFrom:
414
# - secretRef:
415
# name: openfga-postgres-credentials
416
# volumeMounts:
417
# - name: data
418
# mountPath: /var/lib/postgresql/data
419
# volumes:
420
# - name: data
421
# emptyDir: {}
422
# - apiVersion: v1
423
# kind: Service
424
# metadata:
425
# name: openfga-postgres
426
# spec:
427
# selector:
428
# app: openfga-postgres
429
# ports:
430
# - port: 5432
431
# targetPort: 5432
432
#
433
## MySQL dev/test example:
434
# - apiVersion: v1
435
# kind: Secret
436
# metadata:
437
# name: openfga-mysql-credentials
438
# stringData:
439
# MYSQL_ROOT_PASSWORD: changeme
440
# MYSQL_USER: openfga
441
# MYSQL_PASSWORD: changeme
442
# MYSQL_DATABASE: openfga
443
# uri: "openfga:changeme@tcp(openfga-mysql:3306)/openfga?parseTime=true"
444
# - apiVersion: apps/v1
445
# kind: Deployment
446
# metadata:
447
# name: openfga-mysql
448
# spec:
449
# replicas: 1
450
# selector:
451
# matchLabels:
452
# app: openfga-mysql
453
# template:
454
# metadata:
455
# labels:
456
# app: openfga-mysql
457
# spec:
458
# containers:
459
# - name: mysql
460
# image: mysql:8.4
461
# ports:
462
# - containerPort: 3306
463
# envFrom:
464
# - secretRef:
465
# name: openfga-mysql-credentials
466
# volumeMounts:
467
# - name: data
468
# mountPath: /var/lib/mysql
469
# volumes:
470
# - name: data
471
# emptyDir: {}
472
# - apiVersion: v1
473
# kind: Service
474
# metadata:
475
# name: openfga-mysql
476
# spec:
477
# selector:
478
# app: openfga-mysql
479
# ports:
480
# - port: 3306
481
# targetPort: 3306
482
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.