Configuration Reference

A condensed reference of the operator manager's flags, environment variables, and key Helm values. For guidance and rationale, see the Configuration guide.

Manager flags & environment variables

Flag	Env var	Default	Description
--watch-namespaces	WATCH_NAMESPACES	(empty = all)	Comma-separated namespaces to watch
--leader-elect	—	true	Enable leader election (keep on; the Helm engine needs a single active reconciler)
--metrics-bind-address	—	:8443	Metrics endpoint
--health-probe-bind-address	—	:8081	Health/readiness probe endpoint

Per-controller, MaxConcurrentReconciles is fixed at 1 (the Helm action.Configuration is not concurrency-safe).

Helm chart values

Value	Default	Description
image.repository	ghcr.io/scigility/navique-ai-core-operator	Operator image
image.tag	chart appVersion	Image tag
watchNamespaces	[]	Namespaces to watch (empty = all)
leaderElection	true	Leader election
resources.requests.cpu	100m	CPU request
resources.requests.memory	512Mi	Memory request
resources.limits.memory	1Gi	Memory limit (the Helm engine is memory-hungry)

Resource requirements

Setting	Recommended	Why
Manager memory limit	1Gi	In-process chart rendering / Helm engine; Kubebuilder defaults OOM in-cluster
Manager CPU request	100m	Light steady-state; bursts during installs

RBAC summary

The operator install provisions a broad ClusterRole. It needs, at minimum:

• *.core.navique.com resources + /status — full management.
• The upstream CRD groups it emits (postgresql.cnpg.io, external-secrets.io, litellm.palena.ai, langfuse.palena.ai, redis.redis.opstreelabs.in, …).
• apiextensions.k8s.io customresourcedefinitions — get/list/watch (to wait for Established).
• coordination.k8s.io leases — leader election.
• Helm release storage (Secrets in the release namespaces).
• The management-plane console's least-privilege ServiceAccount + RBAC.

System namespaces

Capability operators are installed into fixed system namespaces (see Bundled Charts): external-secrets, sealed-secrets, cnpg-system, cert-manager, litellm-system, langfuse-system, redis-system, clickhouse-system, mongodb-system. The operator itself and the management console run in navique-system by convention.