openfga
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
replicaCount: 3
2
minReadySeconds:
3
deploymentStrategy: {}
4
image:
5
repository: cgr.dev/chainguard-private/openfga
6
pullPolicy: Always
7
tag: 1.22.1-r0@sha256:ee94fa367f2628a735c06380ae32d6383178873bf864c0f10d4555d1b41782af
8
imagePullSecrets: []
9
nameOverride: ""
10
fullnameOverride: ""
11
# Specify additional labels to apply to OpenFGA resources
12
# Usage example:
13
# commonLabels:
14
# app.example.com/system: permissions
15
# app.example.com/domain: example
16
commonLabels: {}
17
serviceAccount:
18
# Specifies whether a service account should be created
19
create: true
20
# Annotations to add to the service account
21
annotations: {}
22
# The name of the service account to use.
23
# If not set and create is true, a name is generated using the fullname template
24
name: ""
25
annotations: {}
26
podAnnotations: {}
27
podExtraLabels: {}
28
extraEnvVars: []
29
extraVolumes: []
30
extraVolumeMounts: []
31
extraInitContainers: []
32
podSecurityContext: {}
33
# fsGroup: 2000
34
35
securityContext: {}
36
# capabilities:
37
# drop:
38
# - ALL
39
# readOnlyRootFilesystem: true
40
# runAsNonRoot: true
41
# runAsUser: 1000
42
43
initContainer:
44
repository: cgr.dev/chainguard-private/k8s-wait-for
45
tag: 2.0-r6@sha256:6fed18302ea131ea06a10585da8e1c1ae2ae48bf3012962544ee969503326946
46
pullPolicy: IfNotPresent
47
## Configure extra options for OpenFGA containers' liveness, readiness and startup probes
48
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes
49
50
## @param livenessProbe.enabled Enable liveness probes on OpenFGA containers.
51
## @param livenessProbe.initialDelaySeconds Number of seconds after the container has started before liveness probes are initiated.
52
## @param livenessProbe.periodSeconds How often (in seconds) to perform the probe.
53
## @param livenessProbe.timeoutSeconds Number of seconds after which the probe times out.
54
## @param livenessProbe.failureThreshold Failure threshold for liveness probes.
55
## @param livenessProbe.successThreshold Success threshold for liveness probes.
56
##
57
livenessProbe:
58
enabled: true
59
initialDelaySeconds: 60
60
periodSeconds: 10
61
timeoutSeconds: 5
62
failureThreshold: 12
63
successThreshold: 1
64
## @param readinessProbe.enabled Enable readiness probes on OpenFGA containers.
65
## @param readinessProbe.initialDelaySeconds Number of seconds after the container has started before readiness probes are initiated.
66
## @param readinessProbe.periodSeconds How often (in seconds) to perform the probe.
67
## @param readinessProbe.timeoutSeconds Number of seconds after which the probe times out.
68
## @param readinessProbe.failureThreshold Failure threshold for readiness probes.
69
## @param readinessProbe.successThreshold Success threshold for readiness probes.
70
##
71
readinessProbe:
72
enabled: true
73
initialDelaySeconds: 5
74
periodSeconds: 10
75
timeoutSeconds: 5
76
failureThreshold: 6
77
successThreshold: 1
78
## @param startupProbe.enabled Enable startup probes on OpenFGA containers.
79
## @param startupProbe.initialDelaySeconds Number of seconds after the container has started before startup probes are initiated.
80
## @param startupProbe.periodSeconds How often (in seconds) to perform the probe.
81
## @param startupProbe.timeoutSeconds Number of seconds after which the probe times out.
82
## @param startupProbe.failureThreshold Failure threshold for startup probes.
83
## @param startupProbe.successThreshold Success threshold for startup probes.
84
##
85
startupProbe:
86
enabled: false
87
initialDelaySeconds: 60
88
periodSeconds: 10
89
timeoutSeconds: 5
90
failureThreshold: 30
91
successThreshold: 1
92
## @param customLivenessProbe Overrides the default liveness probe with a custom one.
93
##
94
customLivenessProbe: {}
95
## @param customReadinessProbe Overrides the default readiness probe with a custom one.
96
##
97
customReadinessProbe: {}
98
## @param customStartupProbe Overrides the default startup probe with a custom one.
99
##
100
customStartupProbe: {}
101
service:
102
annotations: {}
103
type: ClusterIP
104
port: 8080
105
telemetry:
106
trace:
107
enabled: false
108
otlp:
109
endpoint:
110
tls:
111
enabled: false
112
sampleRatio:
113
metrics:
114
## @param telemetry.metrics.enabled enable/disable prometheus metrics on the '/metrics' endpoint
115
##
116
enabled: true
117
serviceMonitor:
118
## @param telemetry.metrics.serviceMonitor.enabled enable/disable installation of serviceMonitor custom resource
119
##
120
enabled: false
121
## @param telemetry.metrics.serviceMonitor.additionalLabels additional labels to be added to the serviceMonitor resource
122
##
123
additionalLabels: {}
124
## @param telemetry.metrics.serviceMonitor.annotations annotations to be added to the serviceMonitor resource
125
##
126
annotations: {}
127
## @param telemetry.metrics.serviceMonitor.jobLabel the label to use to retrieve the job name from
128
##
129
jobLabel: "app.kubernetes.io/name"
130
## @param telemetry.metrics.serviceMonitor.namespace namespace where the serviceMonitor resource should be installed to
131
##
132
namespace: ""
133
## @param telemetry.metrics.serviceMonitor.namespaceSelector which namespaces should be scraped
134
##
135
## Default: scrape .Release.Namespace or namespaceOverride only
136
## To scrape all, use the following:
137
## namespaceSelector:
138
## any: true
139
##
140
namespaceSelector: {}
141
## @param telemetry.metrics.serviceMonitor.scrapeInterval prometheus scrape interval
142
##
143
scrapeInterval: 30s
144
## @param telemetry.metrics.serviceMonitor.scrapeTimeout prometheus scrape timeout
145
##
146
scrapeTimeout: 10s
147
## @param telemetry.metrics.serviceMonitor.targetLabels additional target labels to scrape
148
##
149
targetLabels: []
150
## @param telemetry.metrics.serviceMonitor.relabelings add job relabelings
151
##
152
relabelings: []
153
## @param telemetry.metrics.serviceMonitor.metricRelabelings add metric relabelings
154
##
155
metricRelabelings: []
156
## @param telemetry.metrics.addr the host:port address to serve the Metrics server on
157
addr: 0.0.0.0:2112
158
## @param telemetry.metrics.enableRPCHistograms enables prometheus histogram metrics for RPC latency distributions
159
enableRPCHistograms:
160
## @param telemetry.metrics.podAnnotations [object] Annotations for the Prometheus metrics on etcd pods
161
##
162
podAnnotations:
163
prometheus.io/scrape: "true"
164
prometheus.io/port: "{{ .Values.containerPorts.prometheus }}"
165
datastore:
166
metrics:
167
enabled: false
168
engine: memory
169
uri:
170
uriSecret:
171
username:
172
password:
173
existingSecret:
174
secretKeys:
175
uriKey:
176
usernameKey:
177
passwordKey:
178
maxCacheSize:
179
maxOpenConns:
180
maxIdleConns:
181
connMaxIdleTime:
182
connMaxLifetime:
183
secondary:
184
engine:
185
uri:
186
uriSecret:
187
username:
188
password:
189
existingSecret:
190
secretKeys:
191
uriKey:
192
usernameKey:
193
passwordKey:
194
applyMigrations: true
195
waitForMigrations: true
196
migrationType: job
197
migrations:
198
resources: {}
199
image:
200
repository: groundnuty/k8s-wait-for
201
pullPolicy: Always
202
tag: "v2.0"
203
## DEPRECATED: The bundled PostgreSQL and MySQL sub-charts use the Bitnami legacy
204
## archive repository which is no longer actively maintained or receiving security updates.
205
## They are provided for backwards compatibility only and will be removed in subsequent releases.
206
postgresql:
207
## @param postgresql.enabled enable the bitnami/postgresql subchart (DEPRECATED - uses unsupported legacy archive)
208
enabled: false
209
image:
210
registry: docker.io
211
repository: bitnamilegacy/postgresql
212
tag: 15.4.0-debian-11-r45
213
mysql:
214
## @param mysql.enabled enable the bitnami/mysql subchart (DEPRECATED - uses unsupported legacy archive)
215
enabled: false
216
image:
217
registry: docker.io
218
repository: bitnamilegacy/mysql
219
tag: 8.0.32-debian-11-r14
220
grpc:
221
addr: 0.0.0.0:8081
222
tls:
223
enabled: false
224
cert:
225
key:
226
ca:
227
http:
228
enabled: true
229
addr: 0.0.0.0:8080
230
tls:
231
enabled: false
232
cert:
233
key:
234
upstreamTimeout:
235
corsAllowedOrigins: ["*"]
236
corsAllowedHeaders: ["*"]
237
authn:
238
method:
239
preshared:
240
keys: []
241
keysSecret:
242
oidc:
243
audience:
244
issuer:
245
playground:
246
enabled: true
247
port: 3000
248
profiler:
249
enabled: false
250
addr: 0.0.0.0:3001
251
log:
252
level: info
253
format: json
254
timestampFormat: Unix
255
checkQueryCache:
256
enabled: false
257
limit:
258
ttl:
259
experimentals: []
260
maxTuplesPerWrite:
261
maxTypesPerAuthorizationModel:
262
maxAuthorizationModelSizeInBytes:
263
maxConcurrentReadsForCheck:
264
maxConcurrentReadsForListObjects:
265
maxConcurrentReadsForListUsers:
266
maxChecksPerBatchCheck:
267
maxConcurrentChecksPerBatchCheck:
268
changelogHorizonOffset:
269
resolveNodeLimit:
270
resolveNodeBreadthLimit:
271
listObjectsDeadline:
272
listObjectsMaxResults:
273
listUsersDeadline:
274
listUsersMaxResults:
275
requestTimeout:
276
requestDurationDatastoreQueryCountBuckets: [50, 200]
277
allowWriting1_0Models:
278
allowEvaluating1_0Models:
279
ingress:
280
enabled: false
281
className: ""
282
annotations: {}
283
# kubernetes.io/ingress.class: nginx
284
# kubernetes.io/tls-acme: "true"
285
hosts:
286
- host: chart-example.local
287
paths:
288
- path: /
289
pathType: ImplementationSpecific
290
# servicePort: 8080
291
tls: []
292
# - secretName: chart-example-tls
293
# hosts:
294
# - chart-example.local
295
resources: {}
296
lifecycle: {}
297
autoscaling:
298
enabled: false
299
minReplicas: 1
300
maxReplicas: 100
301
targetCPUUtilizationPercentage: 80
302
targetMemoryUtilizationPercentage: 80
303
nodeSelector: {}
304
tolerations: []
305
topologySpreadConstraints: []
306
affinity: {}
307
# @param sidecars Add additional sidecar containers to the pods
308
# Example:
309
# sidecars:
310
# - name: your-image-name
311
# image: your-image
312
# imagePullPolicy: Always
313
# ports:
314
# - name: portname
315
# containerPort: 1234
316
sidecars: []
317
migrate:
318
extraVolumes: []
319
extraVolumeMounts: []
320
extraInitContainers: []
321
sidecars: []
322
# -- Added to the migration Job and its pod. With the operator, helm.sh/* keys
323
# are dropped and the rest is forwarded (e.g. sidecar.istio.io/inject: "false").
324
annotations:
325
helm.sh/hook: "post-install, post-upgrade, post-rollback, post-delete"
326
helm.sh/hook-weight: "-5"
327
helm.sh/hook-delete-policy: "before-hook-creation"
328
# -- Added to the migration Job and its pod in both modes.
329
labels: {}
330
timeout:
331
testPodSpec: {}
332
testContainerSpec: {}
333
# -- Array of extra K8s manifests to deploy
334
## Note: Supports use of custom Helm templates
335
extraObjects: []
336
# -- Configuration for the openfga-operator subchart. When enabled, database
337
# migrations are run by the operator instead of the Helm hook Job.
338
# See charts/openfga-operator/values.yaml for all available options.
339
openfga-operator:
340
enabled: false
341
# migrationJob:
342
# backoffLimit: 3
343
# activeDeadlineSeconds: 0
344
# ttlSecondsAfterFinished: 300
345
# leaderElection:
346
# enabled: true
347
# watchNamespace: ""
348
# resources:
349
# requests:
350
# cpu: 10m
351
# memory: 64Mi
352
# limits:
353
# memory: 128Mi
354
# -- Settings for the migration Jobs the operator creates.
355
# Only used when openfga-operator.enabled is true.
356
migration:
357
# -- The operator runs a migration when the OpenFGA image or the datastore
358
# settings change. Set this to any new value to run it again when neither
359
# changed, e.g. after rotating a Secret to point at a different database.
360
trigger: ""
361
serviceAccount:
362
# -- Create a dedicated service account for migration Jobs. By default the
363
# Job runs as the OpenFGA service account, like the Helm hook Job does.
364
create: false
365
# -- Annotations to add to the migration service account.
366
# Use this to attach cloud IAM roles (e.g., eks.amazonaws.com/role-arn) for DDL permissions.
367
annotations: {}
368
# -- The name of the migration service account.
369
# If not set and create is true, defaults to {fullname}-migration.
370
name: ""
371
372
## Example: Deploy a PostgreSQL instance for dev/test using official Docker images.
373
## For production, use a managed database service or an operator like CloudnativePG.
374
## Configure the chart to use the secret:
375
## datastore:
376
## engine: postgres
377
## uriSecret: openfga-postgres-credentials # (PostgreSQL example)
378
## # or
379
## uriSecret: openfga-mysql-credentials # (MySQL example)
380
#
381
## PostgreSQL dev/test example:
382
# - apiVersion: v1
383
# kind: Secret
384
# metadata:
385
# name: openfga-postgres-credentials
386
# stringData:
387
# POSTGRES_USER: openfga
388
# POSTGRES_PASSWORD: changeme
389
# POSTGRES_DB: openfga
390
# uri: "postgres://openfga:changeme@openfga-postgres:5432/openfga?sslmode=disable"
391
# - apiVersion: apps/v1
392
# kind: Deployment
393
# metadata:
394
# name: openfga-postgres
395
# spec:
396
# replicas: 1
397
# selector:
398
# matchLabels:
399
# app: openfga-postgres
400
# template:
401
# metadata:
402
# labels:
403
# app: openfga-postgres
404
# spec:
405
# containers:
406
# - name: postgres
407
# image: postgres:17
408
# ports:
409
# - containerPort: 5432
410
# envFrom:
411
# - secretRef:
412
# name: openfga-postgres-credentials
413
# volumeMounts:
414
# - name: data
415
# mountPath: /var/lib/postgresql/data
416
# volumes:
417
# - name: data
418
# emptyDir: {}
419
# - apiVersion: v1
420
# kind: Service
421
# metadata:
422
# name: openfga-postgres
423
# spec:
424
# selector:
425
# app: openfga-postgres
426
# ports:
427
# - port: 5432
428
# targetPort: 5432
429
#
430
## MySQL dev/test example:
431
# - apiVersion: v1
432
# kind: Secret
433
# metadata:
434
# name: openfga-mysql-credentials
435
# stringData:
436
# MYSQL_ROOT_PASSWORD: changeme
437
# MYSQL_USER: openfga
438
# MYSQL_PASSWORD: changeme
439
# MYSQL_DATABASE: openfga
440
# uri: "openfga:changeme@tcp(openfga-mysql:3306)/openfga?parseTime=true"
441
# - apiVersion: apps/v1
442
# kind: Deployment
443
# metadata:
444
# name: openfga-mysql
445
# spec:
446
# replicas: 1
447
# selector:
448
# matchLabels:
449
# app: openfga-mysql
450
# template:
451
# metadata:
452
# labels:
453
# app: openfga-mysql
454
# spec:
455
# containers:
456
# - name: mysql
457
# image: mysql:8.4
458
# ports:
459
# - containerPort: 3306
460
# envFrom:
461
# - secretRef:
462
# name: openfga-mysql-credentials
463
# volumeMounts:
464
# - name: data
465
# mountPath: /var/lib/mysql
466
# volumes:
467
# - name: data
468
# emptyDir: {}
469
# - apiVersion: v1
470
# kind: Service
471
# metadata:
472
# name: openfga-mysql
473
# spec:
474
# selector:
475
# app: openfga-mysql
476
# ports:
477
# - port: 3306
478
# targetPort: 3306
479
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.