Confidential AI ･ Helm values

The c8s chart values you set by hand with -f — measurement pinning, operator keys, the sandbox inventory range, the bootstrap allowlist, volumed, and the router front door — with their defaults and what each one binds.

c8s install collects everything its flags imply into one computed values file and passes it to Helm as the last -f. Precedence is therefore: chart defaults, then your -f files in the order you list them, then the installer's computed values — a flag always wins on the keys it sets.

This page covers the values you are likely to set by hand. It is not the whole chart; run helm show values against the embedded chart, or read internal/helmchart/c8s/values.yaml in the c8s repo, for the full surface.

Passing any -f hands you ownership of the installer's default-path checks, which it then skips — including the --operator-keys guard. See Choosing the install shape.

Trust pinning

The values that decide whether the cluster pins anything at all.

Value	Default	Binds
`cds.measurements`	`[]`	Launch digests CDS admits to `/attest` and `/sign-csr`; also what `ratls-mesh` and `nri-image-policy` pin when they dial CDS. Empty means no pinning unless `cds.measurementsConfig` is set.
`ratlsMesh.measurements`	`[]`	Launch digests mesh peers accept from each other. Empty means no pinning unless `ratlsMesh.measurementsConfig` is set.
`cds.rtmrs`	`[]`	TDX register pins, each `"<index>=<sha384-hex>"`, completing `cds.measurements` on TDX: RTMR[1] is the guest kernel, RTMR[2] the kernel command line carrying the dm-verity root hash. Ignored for SNP evidence.
`ratlsMesh.rtmrs`	`[]`	The same register pins, for mesh peers.
`cds.measurementsConfig`	`""`	Measurements config content, not a path: the VM images `cds`, `operator`, and `router`'s `allowlist-proxy` match as whole images.
`ratlsMesh.measurementsConfig`	`""`	The same document for `ratls-mesh` — its mesh peers and the CDS it dials.
`cds.operatorKeys`	`""`	PEM content of the operator EC public keys authorized to write the allowlist. Empty rejects every write; reads still serve.
`cds.sandboxInventoryCIDRs`	`[]`	The only addresses CDS dials for a node's admission inventory. Required for sandbox identity — unset, CDS refuses every request carrying a sandbox token.
`cds.ratlsPlatform`	`snp`	Platform for the CDS serving cert's evidence. Empty disables TLS entirely — unsafe outside tests.

c8s install --measurements <M> sets cds.measurements and ratlsMesh.measurements together, and --rtmrs sets the two rtmrs lists the same way; --operator-keys sets cds.operatorKeys and --node-cidr sets cds.sandboxInventoryCIDRs. Prefer the flags: cds.operatorKeys is the PEM content, not a path, and the flag reads the file.

Either measurementsConfig value renders the <release>-measurements ConfigMap (c8s-measurements on the default release name), mounted read-only at /etc/c8s-measurements by cds, operator, ratls-mesh, and router. A component that reads the config renders --measurements-config in place of its flat measurement and RTMR arguments, and a value that is not JSON content fails the render. Each of those four pod templates carries a checksum/measurements-config annotation over the value, so a changed document rolls the pods. c8s install --measurements-config <file> sets both values and the flat lists in one pass — see Pin multiple measurements.

Certificate authority

Value	Default	Effect
`cds.ca.commonName`	`c8s Mesh CA`	CN of the generated mesh CA.
`cds.ca.certValidity`	`8760h`	CA lifetime (one year).
`cds.ca.minValidity`	`1h`	`/readyz` starts failing below this remaining validity, so an expiring CA is visible before leaves stop verifying.
`cds.tokenSignerRotationInterval`	`720h`	How often a new EAR-signing key becomes active.
`cds.tokenSignerOverlap`	`25h`	How long a retired signing key stays valid and published.

Allowlist seeding

Value	Default	Effect
`nriImagePolicy.bootstrapAllowlist.digests`	`{}`	Digest → image reference pairs seeded into the floor before CDS serves its first request. The GitOps-friendly alternative to `c8s allowlist add`.
`nriImagePolicy.bootstrapAllowlist.workloads`	`{}`	Named workload entries seeded the same way.
`nriImagePolicy.bootstrapAllowlist.deriveComponents`	`false`	Auto-add the chart's own component images to the floor whenever their `image.digest` is set. `c8s install --resolve-digests` (the default) turns this on.
`nriImagePolicy.refresh.interval`	`5s`	How often enforcers re-poll `GET /allowlist`. Bounds how long a freshly applied entry is still refused at container start.
`nriImagePolicy.policy.mode`	`fail-closed`	`audit` logs the would-be denial and admits — a bring-up setting, never production.

Seeding is additive: it inserts only what is missing and leaves existing entries untouched. Any seed error halts CDS startup. See Seeding and bootstrap.

Encrypted volumes

Value	Default	Effect
`volumed.enabled`	`false`	The node agent that opens and mounts encrypted-volume devices; `c8s install --volumes` enables it.
`volumed.maxMounts`	`64`	Live volumes per node; each costs two dm devices and a mount.
`volumed.reapInterval`	`15s`	How often teardown checks which pods have gone.
`volumed.nodeSelector`	`{}`	Confine the daemon to the nodes that carry volume devices.

The front door (`router`)

Value	Default	Effect
`router.enabled`	`true`	The public front door: nginx plus the `cds-attest` sidecar.
`router.attest.enabled`	`true`	Serve `/.well-known/c8s/` — the endpoints browser and CLI verifiers read. `c8s install --attest=false` omits it.
`router.allowlist.enabled`	`true`	Publish the CDS allowlist API through the front door. Turning it off leaves only the direct CDS URL.
`router.upstream`	—	Host and port of the upstream. A `c8s-<id>.<ns>.svc.cluster.local` address is recognized as mesh-wrapped and may be plaintext; anything else must be `https` with verification.
`router.publicTLS.secretName`	`""`	Serve your own public certificate instead of the CDS-issued one. This makes the allowlist CLI refuse the endpoint — that certificate is not bound to the discovery attestation.
`router.hostPort.enabled`	`true`	Publish nginx's TLS listener on the node's host port. Grabs the node's `443`; turn it off on clusters whose ingress already owns it (notably RKE2).
`router.cors.enabled`	`false`	Your own CORS block, which replaces the built-in policy everywhere, protocol endpoints included.
`router.cors.protocolEndpoints`	`true`	Wide-open CORS on the c8s protocol endpoints only, so any browser can verify the cluster.
`router.routes`	`[]`	Extra routes. A route backend must be `https` with `tls.verify: true`.

router.hostPort.enabled forces a Recreate rollout.

With the port bound, every router roll drops the node-IP front door for the restart window. For gapless rolls set enabled: false and expose router through its Service.

Scheduling

Value	Default	Effect
`cds.node.selector`	`role: cds`	Pins the singleton CDS to a known node. `{}` for a single-node cluster — `c8s install --single-node` sets this.
`cds.node.tolerations`	`dedicated=cds:NoSchedule`	Lets CDS land on a node dedicated to it. `[]` for an untainted node.
`cds.persistence.enabled`	`false`	An RWO volume for CDS, keeping operator-added allowlist entries across a restart.
`hostNamespacePolicy.enabled`	`true`	Withholds host namespaces from tenant pods, which is what reserves port `1019` for the admission inventory.

Helm values