> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# Helm chart configuration
This page documents the configuration options for the 1Password Helm charts:
* [Connect and Operator Helm chart](#connect-and-operator-helm-chart)
* [Secrets Injector Helm chart](#secrets-injector-helm-chart)
## Connect and Operator Helm chart
The 1Password Connect and Operator Helm chart allows you to use Helm to deploy [Connect](/connect/get-started/), the [Kubernetes Operator](/k8s/operator/), or both.
You can override configuration values in a chart with the `helm install` command using either the `--values` flag or the `--set` flag. You can also force a string value with the `--set-string` flag.
For example, the following code block shows how to use the `--set` flag to set the `connect.applicationName` configuration value:
```shell theme={null}
helm install --set connect.applicationName=connect connect 1password/connect
```
Refer to the [official `helm install` documentation ](https://helm.sh/docs/helm/helm_install/) for more information.
By default, installing a 1Password Helm chart also installs the `OnePasswordItem` database operations for CRD (Custom Resource Definition).
If you don't want to install the `OnePasswordItem` custom resource definitions (CRD), run `helm install` with the [`--skip-crds` flag ](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-1-let-helm-do-it-for-you).
### Configuration options
The following table documents the available configuration options for the 1Password Connect and Operator Helm chart.
If you have a large configuration value, use `--set-file` to read the single large value from the file (instead of `--values` or `--set`).
For example:
```
$ helm install -f myvalues.yaml injector 1password/secrets-injector
```
| Key | Type | Default | Description |
| ------------------------------------- | ---------- | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `connect.create` | boolean | `true` | Denotes whether to deploy the 1Password Connect server. Set this value to `false` and `operator.create` to `true` to only deploy the Kubernetes Operator. See [Deploy without Connect](/k8s/operator?deployment-type=helm#helm-step-2). |
| `connect.replicas` | integer | `1` | The number of replicas to run the 1Password Connect deployment. |
| `connect.applicationName` | string | `"onepassword-connect"` | The name of 1Password Connect application. |
| `connect.host` | string | `"onepassword-connect"` | The name of 1Password Connect host. |
| `connect.api.imageRepository` | string | `"1password/connect-api` | The 1Password Connect API repository. |
| `connect.api.name` | string | `"connect-api"` | The name of the 1Password Connect API container. |
| `connect.api.resources` | object | `{}` | The resources requests/limits for the 1Password Connect API pod. |
| `connect.api.httpPort` | integer | `8080` | The port the Connect API is served on when not using TLS. |
| `connect.api.httpsPort` | integer | `8443` | The port the Connect API is served on when using TLS. |
| `connect.api.logLevel` | string | `info` | The log level of the Connect API container. Valid options are `trace`, `debug`, `info`, `warn`, and `error`. |
| `connect.credentials` | jsonString | | The contents of the `1password-credentials.json` file for Connect. You can set it by adding `--set-file connect.credentials=` to your `helm install` command. |
| `connect.credentials_base64` | string | | The base64-encoded contents of the `1password-credentials.json` file for Connect. You can use this instead of `connect.credentials` if supplying raw JSON to `connect.credentials` lead to issues. |
| `connect.credentialsKey` | string | `"1password-credentials.json"` | The key for the 1Password Connect credentials (stored in the credentials secret). The credentials must be encoded as a base64 string. |
| `connect.credentialsName` | string | `"op-credentials"` | The name of Kubernetes Secret containing the 1Password Connect credentials. |
| `connect.dataVolume.name` | string | `"shared-data"` | The name of the shared [volume ](https://kubernetes.io/docs/concepts/storage/volumes/) used between 1Password Connect containers. |
| `connect.dataVolume.type` | string | `"emptyDir"` | The type of shared [volume ](https://kubernetes.io/docs/concepts/storage/volumes/) used between 1Password Connect containers. |
| `connect.dataVolume.values` | object | `{}` | Describes the fields and values for the configuration of the shared [volume ](https://kubernetes.io/docs/concepts/storage/volumes/) for 1Password Connect. |
| `connect.imagePullPolicy` | string | `"IfNotPresent"` | The 1Password Connect API image pull policy. |
| `connect.ingress.annotations` | object | `{}` | The 1Password Connect [ingress ](https://kubernetes.io/docs/concepts/services-networking/ingress/) annotations. |
| `connect.ingress.enabled` | bool | `false` | Whether to enable 1Password Connect [ingress ](https://kubernetes.io/docs/concepts/services-networking/ingress/) traffic. |
| `connect.ingress.extraPaths` | list | `[]` | Additional [ingress ](https://kubernetes.io/docs/concepts/services-networking/ingress/) paths. |
| `connect.ingress.hosts[0].host` | string | `"chart-example.local"` | The 1Password Connect [ingress ](https://kubernetes.io/docs/concepts/services-networking/ingress/) hostname. |
| `connect.ingress.hosts[0].paths` | list | `[]` | The 1Password Connect [ingress ](https://kubernetes.io/docs/concepts/services-networking/ingress/) path. |
| `connect.ingress.ingressClassName` | string | `""` | Optionally use `ingressClassName` instead of a deprecated annotation. |
| `connect.ingress.labels` | object | `{}` | [Ingress ](https://kubernetes.io/docs/concepts/services-networking/ingress/) labels for 1Password Connect. |
| `connect.ingress.pathType` | string | `"Prefix"` | Ingress [PathType ](https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types). |
| `connect.ingress.tls` | list | `[]` | [Ingress TLS ](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls). |
| `connect.nodeSelector` | object | `{}` | The [Node selector ](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) stanza for the Connect pod. |
| `connect.probes.readiness` | boolean | `true` | Denotes whether the 1Password Connect API readiness probe operates and ensures the pod is ready before serving traffic. |
| `connect.probes.liveness` | boolean | `true` | Denotes whether Kubernetes continually checks the 1Password Connect API for liveness and restarts if the pod becomes unresponsive. |
| `connect.annotations` | object | `{}` | Additional [annotations ](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to add to the Connect API deployment resource. |
| `connect.labels` | object | `{}` | Additional [labels ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) to add to the Connect API deployment resource. |
| `connect.podAnnotations` | object | `{}` | Additional [annotations ](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to be added to the Connect API pods. |
| `connect.podLabels` | object | `{}` | Additional [labels ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) to be added to the Connect API pods. |
| `connect.serviceType` | string | `NodePort` | The type of Service resource to create for the Connect API and Connect Sync services. |
| `connect.serviceAnnotations` | object | `{}` | Additional [annotations ](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to be added to the service. |
| `connect.sync.imageRepository` | string | `"1password/connect-sync"` | The 1Password Connect Sync repository. |
| `connect.sync.name` | string | `"connect-sync"` | The name of the 1Password Connect Sync container. |
| `connect.sync.resources` | object | `{}` | The resources requests/limits for the 1Password Connect Sync pod. |
| `connect.sync.httpPort` | integer | `8081` | The port serving the health of the Connect Sync container. |
| `connect.sync.logLevel` | string | `info` | The log level of the Connect Sync container. Valid options are `trace`, `debug`, `info`, `warn`, and `error`. |
| `connect.tls.enabled` | boolean | `false` | Denotes whether the Connect API is secured with TLS. |
| `connect.tls.secret` | string | `"op-connect-tls"` | The name of the secret containing the TLS key (`tls.key`) and certificate (`tls.crt`). |
| `connect.tolerations` | list | `[]` | A list of tolerations to be added to the Connect API pods. |
| `connect.version` | string | `{{.Chart.AppVersion}}` | The 1Password Connect version to pull. |
| `operator.autoRestart` | boolean | `false` | Denotes whether the Kubernetes Operator automatically restarts deployments based on associated updated secrets. See [Automatic redeployment](/k8s/operator#enable-auto-redeployment). |
| `operator.create` | boolean | `false` | Denotes whether to deploy the Kubernetes Operator. You can set this to `false` to only deploy Connect. |
| `operator.imagePullPolicy` | string | `"IfNotPresent"` | The Kubernetes Operator image pull policy. |
| `operator.imageRepository` | string | `"1password/onepassword-operator"` | The Kubernetes Operator repository. |
| `operator.nodeSelector` | object | `{}` | [Node selector ](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) stanza for the Kubernetes Operator pod. |
| `operator.annotations` | object | `{}` | Additional [annotations ](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to add to the Kubernetes Operator deployment resource. |
| `operator.labels` | object | `{}` | Additional [labels ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) to be added to the Operator deployment resource. |
| `operator.logLevel` | string | `info` | The log level of the Kubernetes Operator container. Valid options are: `debug`, `info`, and `error`. |
| `operator.podAnnotations` | object | `{}` | Additional [annotations ](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to add to the Kubernetes Operator pods. |
| `operator.podLabels` | object | `{}` | Additional [labels ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) to add to the Kubernetes Operator pods. |
| `operator.pollingInterval` | integer | `600` | The interval at which the Kubernetes Operator polls for secrets updates. |
| `operator.clusterRole.create` | boolean | `{{.Values.operator.create}}` | Denotes whether to create a cluster role for the Kubernetes Operator. |
| `operator.clusterRole.name` | string | `"onepassword-connect-operator"` | The name of the Kubernetes Operator [Cluster Role ](https://kubernetes.io/docs/reference/access-authn-authz/rbac/). |
| `operator.clusterRoleBinding.create` | boolean | `{{.Values.operator.create}}` | Denotes whether to create a [ClusterRole binding ](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) for the Kubernetes Operator Service Account. |
| `operator.roleBinding.create` | boolean | `{{.Values.operator.create}}` | Denotes whether to create a role binding for each Namespace for the Kubernetes Operator Service Account. |
| `operator.roleBinding.name` | string | `"onepassword-connect-operator"` | The name of the Kubernetes Operator Role Binding. |
| `operator.serviceAccount.annotations` | object | `{}` | The [annotations ](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) for the 1Password Connect Service Account. |
| `operator.serviceAccount.create` | boolean | `{{.Values.operator.create}}` | Denotes whether to create a [Service Account](/service-accounts/get-started/) for the Kubernetes Operator. |
| `operator.serviceAccount.name` | string | `"onepassword-connect-operator"` | The name of the Kubernetes Operator. |
| `operator.tolerations` | list | `[]` | A list of tolerations to add to the Kubernetes Operator pods. |
| `operator.version` | string | `"1.8.0"` | The Kubernetes Operator version to pull. It defaults to the latest version. |
| `operator.token.key` | string | `"token"` | The key for the 1Password Connect token (stored in the 1Password token secret). |
| `operator.token.name` | string | `"onepassword-token"` | The name of Kubernetes Secret containing the 1Password Connect API token. |
| `operator.token.value` | string | `"onepassword-token"` | An API token generated for 1Password Connect to be used by the Kubernetes Operator. |
| `operator.watchNamespace` | list | `[]` | A list of namespaces for the Kubernetes Operator to watch and manage. Use the empty list to watch all namespaces. |
| `operator.resources` | object | `{}` | The resources requests/limits for the Kubernetes Operator pod. |
## Secrets Injector Helm chart
The 1Password Secrets Injector Helm chart allows you to use Helm to deploy the [Kubernetes Secrets Injector](/k8s/injector/).
You can override configuration values in a chart with the `helm install` command using either the `--values` flag or the `--set` flag. You can also force a string value with the `--set-string` flag.
For example, the following code block shows how to use the `--set` flag to set the `injector.applicationName` configuration value:
```shell theme={null}
helm install --set injector.applicationName=injector injector 1password/secrets-injector
```
Refer to the [official `helm install` documentation ](https://helm.sh/docs/helm/helm_install/) for more information.
### Configuration options
The following table documents the available configuration options for the Secrets Injector Helm chart.
If you have a large configuration value, use `--set-file` to read the single large value from the file (instead of `--values` or `--set`).
For example:
```
$ helm install -f myvalues.yaml injector 1password/secrets-injector
```
| Key | Type | Default | Description |
| -------------------------- | ------- | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| `injector.applicationName` | string | `"secrets-injector"` | The name of 1Password Kubernetes Secrets Injector Application. |
| `injector.imagePullPolicy` | string | `"IfNotPresent"` | The 1Password Secrets Injector Docker image policy. `"IfNotPresent"` means the image is pulled only if it is not already present locally. |
| `injector.imageRepository` | string | `"1password/kubernetes-secrets-injector"` | The 1Password Secrets Injector docker image repository. |
| `injector.port` | string | `443` | The port the Secrets Injector exposes. |
| `injector.targetPort` | integer | `8443` | The port the Secrets Injector API sends requests to the pod. |
| `injector.version` | string | `{{.Chart.AppVersion}}` | The 1Password Secrets Injector version to pull. |