Confidential AI ･ Helm values

The c8s chart values you set by hand with -f — measurement pinning, operator keys, the sandbox inventory range, the bootstrap allowlist, CA handoff, volumed, and the tls-lb front door — with their defaults and what each one binds.

c8s install collects everything its flags imply into one computed values file and passes it to Helm as the last -f. Precedence is therefore: chart defaults, then your -f files in the order you list them, then the installer's computed values — a flag always wins on the keys it sets.

This page covers the values you are likely to set by hand. It is not the whole chart; run helm show values against the embedded chart, or read internal/helmchart/c8s/values.yaml in the c8s repo, for the full surface.

Passing any -f hands you ownership of the installer's default-path checks, which it then skips — including the --operator-keys guard. See Choosing the install shape.

Trust pinning

The values that decide whether the cluster pins anything at all.

Value	Default	Binds
`cds.measurements`	`[]`	Launch digests CDS admits to `/attest`, `/sign-csr`, and `/handoff`; also what `ratls-mesh` and `nri-image-policy` pin when they dial CDS. Empty means no pinning.
`ratlsMesh.measurements`	`[]`	Launch digests mesh peers accept from each other. Empty means no pinning.
`cds.operatorKeys`	`""`	PEM content of the operator EC public keys authorized to write the allowlist. Empty rejects every write; reads still serve.
`cds.sandboxInventoryCIDRs`	`[]`	The only addresses CDS dials for a node's admission inventory. Required for sandbox identity — unset, CDS refuses every request carrying a sandbox token.
`cds.ratlsPlatform`	`snp`	Platform for the CDS serving cert's evidence. Empty disables TLS entirely — unsafe outside tests.

c8s install --measurements <M> sets the first two together; --operator-keys and --node-cidr set the next two. Prefer the flags: cds.operatorKeys is the PEM content, not a path, and the flag reads the file for you.

cds.measurements is also the handoff allowlist.

With cds.handoff.enabled, every digest listed there can pull the mesh CA private key over /handoff. There is no separate, narrower handoff allowlist.

Certificate authority and handoff

Value	Default	Effect
`cds.ca.commonName`	`c8s Mesh CA`	CN of the generated mesh CA.
`cds.ca.certValidity`	`8760h`	CA lifetime (one year).
`cds.ca.minValidity`	`1h`	`/readyz` starts failing below this remaining validity, so a successor is brought up in time.
`cds.handoff.enabled`	`false`	Register `/handoff` so a joining replica can adopt the live CA. Requires `cds.measurements` and `cds.operatorKeys`.
`cds.handoff.peerUrl`	`""`	Where a starting CDS adopts its CA from. The sentinel `self` expands to the CDS Service URL. Setting it flips the rollout to RollingUpdate so the new pod adopts before the old one retires. Cannot combine with `cds.persistence.enabled`.
`cds.tokenSignerRotationInterval`	`720h`	How often a new EAR-signing key becomes active.
`cds.tokenSignerOverlap`	`25h`	How long a retired signing key stays valid and published.

Allowlist seeding

Value	Default	Effect
`nriImagePolicy.bootstrapAllowlist.digests`	`{}`	Digest → image reference pairs seeded into the floor before CDS serves its first request. The GitOps-friendly alternative to `c8s allowlist add`.
`nriImagePolicy.bootstrapAllowlist.workloads`	`{}`	Named workload entries seeded the same way.
`nriImagePolicy.bootstrapAllowlist.deriveComponents`	`false`	Auto-add the chart's own component images to the floor whenever their `image.digest` is set. `c8s install --resolve-digests` (the default) turns this on.
`nriImagePolicy.refresh.interval`	`30s`	How often enforcers re-poll `GET /allowlist`.
`nriImagePolicy.policy.mode`	`fail-closed`	`audit` logs the would-be denial and admits — a bring-up setting, never production.

Seeding is additive: it inserts only what is missing and leaves existing entries untouched. Any seed error halts CDS startup. See Seeding and bootstrap.

Encrypted volumes

Value	Default	Effect
`volumed.enabled`	`false`	The node agent that opens devices and mounts them. Nothing about encrypted volumes works without it.
`volumed.maxMounts`	`64`	Live volumes per node; each costs two dm devices and a mount.
`volumed.reapInterval`	`15s`	How often teardown checks which pods have gone.
`volumed.nodeSelector`	`{}`	Confine the daemon to the nodes that carry volume devices.

The front door (`tls-lb`)

Value	Default	Effect
`tlsLb.enabled`	`true`	The public front door: nginx plus the `cds-attest` sidecar.
`tlsLb.attest.enabled`	`true`	Serve `/.well-known/c8s/` — the endpoints browser and CLI verifiers read. `c8s install --attest=false` omits it.
`tlsLb.allowlist.enabled`	`true`	Publish the CDS allowlist API through the front door. Turning it off leaves only the direct CDS URL.
`tlsLb.upstream`	—	Host and port of the upstream. A `c8s-<id>.<ns>.svc.cluster.local` address is recognized as mesh-wrapped and may be plaintext; anything else must be `https` with verification.
`tlsLb.publicTLS.secretName`	`""`	Serve your own public certificate instead of the CDS-issued one. This makes the allowlist CLI refuse the endpoint — that certificate is not bound to the discovery attestation.
`tlsLb.hostPort.enabled`	`true`	Publish nginx's TLS listener on the node's host port. Grabs the node's `443`; turn it off on clusters whose ingress already owns it (notably RKE2).
`tlsLb.cors.enabled`	`false`	Your own CORS block, which replaces the built-in policy everywhere, protocol endpoints included.
`tlsLb.cors.protocolEndpoints`	`true`	Wide-open CORS on the c8s protocol endpoints only, so any browser can verify the cluster.
`tlsLb.routes`	`[]`	Extra routes. A route backend must be `https` with `tls.verify: true`.

tlsLb.hostPort.enabled forces a Recreate rollout.

With the port bound, every tls-lb roll drops the node-IP front door for the restart window — under Pod-as-CVM, a full CVM boot. For gapless rolls set enabled: false and expose tls-lb through its Service.

Scheduling

Value	Default	Effect
`cds.node.selector`	`role: cds`	Pins the singleton CDS to a known node. `{}` for a single-node cluster — `c8s install --single-node` sets this.
`cds.node.tolerations`	`dedicated=cds:NoSchedule`	Lets CDS land on a node dedicated to it. `[]` for an untainted node.
`cds.persistence.enabled`	`false`	An RWO volume for CDS. Cannot combine with `handoff.peerUrl` — a surge pod cannot share it.
`hostNamespacePolicy.enabled`	`true`	Withholds host namespaces from tenant pods, which is what reserves port `1019` for the admission inventory.

Helm values