| Key | Type | Default | Description |
|---|---|---|---|
global.baseDomain (required) | string | Controls the base domain used to derive all public hostnames. A wildcard DNS record and TLS certificate for *.<baseDomain> covers the entire stack. | |
global.tlsSecretName | string | "qodo-tls" | Controls the pre-created TLS Secret used by every Ingress host. With cert-manager, this is the Secret it mints the certificate into. |
global.caBundle | string | Controls the complete PEM trust bundle for outbound TLS from Qodo services, replacing the containers’ default trust store. Must include public roots before appending private CA certificates. | |
global.pullSecret | string | "qodo-pull" | Controls the Docker registry Secret used to pull every image. The name is fixed in this packaging and cannot be changed. |
global.imageProxyPrefix | string | "artif-reg-self-hosted.codium.ai/proxy/codium-stack/" | Controls the registry prefix prepended to every image reference. Change only when mirroring all images to your own registry. |
global.composeImageProxyPrefix | boolean | true | Controls whether imageProxyPrefix is prepended to every image at render time. Must remain true unless using fully-qualified image repositories. |
global.podSecurityContext | object | {} | Controls the pod-level securityContext applied to every Pod, including migration and provisioning Jobs. Set when the cluster requires Pods to declare security IDs, such as under an OpenShift restricted SCC. |
global.containerSecurityContext | object | {} | Controls the container-level securityContext applied to every container and initContainer. Separate from podSecurityContext per the Kubernetes API split between pod-only and container-only fields. |
global.affinity | object | {} | Controls affinity rules applied to every workload. Uses standard Kubernetes affinity syntax; a per-component affinity takes precedence. |
global.tolerations | array | [] | Controls tolerations applied to every workload. Replaces rather than extends per-component tolerations; pair with nodeSelector for dedicated node pools. |
global.deploymentMode | string | "helm" | Controls the deployment mode. Set argocd for helm template rendering with Argo CD, which requires manual Secret management and an external database. |
global.features.restrictRepoPagesToAdmins | boolean | false | Controls whether repository pages in the portal are restricted to organization owners. |
global.repositoryAccess.enabled | boolean | false | Controls the repository-access worker for account-linked repository visibility. Requires configured GitHub installations with repository access permissions. |
global.repositoryAccess.filteringEnabled | boolean | false | Controls enforcement of per-user repository access filtering. Enable only after verifying account linking and access calculation; requires repositoryAccess.enabled. |
global.repositoryAccess.queue.topic | string | "qodo-platform-user-to-allowed-repos" | Controls the shared queue topic for repository-access events. Use a deployment-specific name when sharing a message broker. |
global.repositoryAccess.queue.subscription | string | "qodo-platform-user-to-allowed-repos" | Controls the queue subscription suffix. The queue name is <topic>.<subscription>; changing either name does not migrate an existing queue. |
global.images.engine-indexer.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/qodo-engine-indexer" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.engine-indexer.tag | string | "2.74.0" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.engine-pr-kn-consumer.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/qodo-engine-indexer" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.engine-pr-kn-consumer.tag | string | "2.74.0" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.engine-retriever.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/qodo-engine-context-retriever" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.engine-retriever.tag | string | "2.74.0" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.git-event-consumer.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/qodo-platform" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.git-event-consumer.tag | string | "2.386.1" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.gitway.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/git-gateway-gitway" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.gitway.tag | string | "1.37.0" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.litegit.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/litegit-gateway" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.litegit.tag | string | "0.307.0" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.platform.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/qodo-platform" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.platform.tag | string | "2.386.1" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.user-to-allowed-repos-consumer.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/qodo-platform" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.user-to-allowed-repos-consumer.tag | string | "2.386.1" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.portal.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/qodo-platform-fe" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.portal.tag | string | "1.230.0" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.qar.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/qodo-agent-runtime" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.qar.tag | string | "1.28.2" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.pr-agent-agentic.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/pr-agent" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.pr-agent-agentic.tag | string | "3.49.0" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.qodo-git.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/pr-agent" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.qodo-git.tag | string | "3.49.0" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.qodo-git-sidecar.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/pr-agent-sidecar" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.qodo-git-sidecar.tag | string | "3.49.0" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.images.qodo-telemetry.repository | string | "us-central1-docker.pkg.dev/codium-production/codium-repo-self-hosted/qodo-telemetry" | Controls the container image repository for this workload. Override only under Qodo guidance. |
global.images.qodo-telemetry.tag | string | "0.6.1" | Controls the container image tag for this workload. Override only under Qodo guidance. |
global.ingress.enabled | boolean | true | Controls whether Kubernetes Ingress resources are created. Set false on OpenShift and enable global.route.enabled instead; the chart refuses to render both. |
global.ingress.className | string | Controls the Kubernetes IngressClass. Leave empty to use the cluster default. | |
global.ingress.annotations | object | {} | Controls annotations added to every generated Ingress resource. |
global.ingress.appHostname | string | Controls the public Qodo Portal hostname. Leave empty to derive as app.<baseDomain>. | |
global.ingress.apiHostname | string | Controls the public API hostname. Leave empty to derive as api.<baseDomain>. | |
global.ingress.portalApiHostname | string | Controls the public portal backend hostname. Portal and platform URLs are derived from this value automatically. | |
global.ingress.authHostname | string | Controls the public sign-on hostname and OIDC issuer. Changing it after provisioning is not supported. | |
global.ingress.gitHostname | string | Controls the webhook hostname for inbound git provider events. The entire host is routed to the webhook receiver and cannot be shared with other hosts. | |
global.ingress.sdkHostname | string | Controls the public Qodo Agent Runtime hostname for SDK and CLI clients. Leave empty to derive as sdk.<baseDomain>. | |
global.route.enabled | boolean | false | Controls OpenShift Route creation as an alternative to Ingress. Requires global.ingress.enabled: false; the chart refuses to render both. |
global.route.annotations | object | {} | Controls annotations added to every generated OpenShift Route resource. |
global.route.tls.termination | string | "edge" | Controls TLS termination mode on OpenShift Routes. Only edge is supported; reencrypt and passthrough are refused. |
global.route.tls.insecureEdgeTerminationPolicy | string | "Redirect" | Controls the OpenShift router behavior for plain HTTP requests. Accepts Redirect, None, or Allow. |
global.nodeSelector.kubernetes.io/arch | string | "amd64" | Controls the architecture node selector applied to every workload. Only amd64 images are available; this constraint cannot be removed via values. |
global.jobScheduling.nodeSelector | object | {} | Controls extra node selection for migration, provisioning, and maintenance Jobs. Merged on top of the installation-wide nodeSelector. |
global.jobScheduling.tolerations | array | [] | Controls extra tolerations for migration, provisioning, and maintenance Jobs. Appended to the installation-wide tolerations list. |
global.repositorySync.schedule | string | "0 * * * *" | Controls the cron schedule for Git installation reconciliation and repository onboarding. Overlapping runs are blocked by concurrencyPolicy: Forbid. |
global.repositorySync.rulesImportEnabled | boolean or string (preserve) | "preserve" | Controls automatic repository standards ingestion. true enables onboarding, false pauses it, preserve keeps the existing database value. |
global.rabbitmqMigration.mode | string | "automatic" | Controls how Helm handles legacy workflow queue migration during upgrades. validate makes the hook read-only and blocks the upgrade until queues are migrated separately. |
global.rabbitmqMigration.drainTimeoutSeconds | integer | 600 | Controls the maximum wait in seconds for in-flight workflow messages during automatic queue migration. Expiry fails the Helm upgrade. |
global.rabbitmqMigration.resumePublisherAfterMigration | boolean | false | Controls whether the webhook publisher resumes after queue migration completes while consumers await the target release. Enable only after verifying gateway compatibility with pending database migrations. |
global.externalDatabase.host (required) | string | Controls the external PostgreSQL server hostname. | |
global.externalDatabase.port | integer | 5432 | Controls the external PostgreSQL port. Some components still require a proxy or Service listening on port 5432. |
global.externalDatabase.adminUser (required) | string | "postgres" | Controls the database user for application database creation. Requires the CREATEDB privilege; set explicitly for managed database services. |
global.externalDatabase.sslMode | string | "require" | Controls the PostgreSQL TLS mode. require encrypts without verifying the server certificate or hostname. |
global.externalDatabase.existingSecret | string | "qodo-db-admin" | Controls the Secret containing POSTGRES_PASSWORD. The default name is required by components that reference it directly. |
global.externalDatabase.qarDatabase | string | "qar" | Controls the database used exclusively by Qodo Agent Runtime. Created during db-init on the shared server. |
global.externalDatabase.qarUser | string | Controls an optional dedicated Qodo Agent Runtime database login. The role must not have SUPERUSER or BYPASSRLS. | |
global.externalRedis.host | string | Controls the external Redis hostname. Also set redis.enabled: false when using an external instance; port 6379 is fixed. | |
global.entra.type | string | "entra" | Controls the identity provider connector type. Use entra for commercial Microsoft cloud or generic-oidc for another OIDC issuer. |
global.entra.name (required) | string | Controls the identity provider display name. Changing it after installation registers a second provider instead of renaming. | |
global.entra.clientId (required) | string | Controls the application client ID for the identity provider. | |
global.entra.tenantId | string | Controls the Entra directory tenant ID. Required when global.entra.type is entra. | |
global.entra.issuerUrl | string | Controls the OIDC issuer URL for generic-oidc providers. Leave empty for the native Entra connector. | |
global.entra.userClaimsSource | string | "id_token" | Controls the user claims source for generic-oidc providers. Set userinfo for Okta when its ID token lacks profile-name claims. |
global.entra.adminRoleName | string | "Qodo-Platform-Admin" | Controls the case-sensitive app-role claim value that grants organization owner access. |
global.entra.existingSecret | string | "qodo-entra-idp" | Controls the Secret containing the identity provider’s IDP_CLIENT_SECRET. |
global.entra.externalIdpsExistingSecret | string | Controls the Secret for multi-provider or SAML identity configuration via Dynaconf. Cannot be combined with single-provider fields. | |
global.llm.bundled | boolean | true | Controls the in-cluster LLM gateway. Must remain enabled; it is the only supported topology for this packaging. |
global.llm.openaiBaseUrl | string | Controls the OpenAI-compatible endpoint forwarded to by the gateway. Leave empty to use api.openai.com, which requires outbound internet access. | |
global.llm.modelMap | object | {} | Controls the model mapping published by the gateway. Replaces the built-in set; must include a text-embedding-3 model for indexing and retrieval. |
global.llm.extraModelList | array | [] | Controls additional models with their own endpoint or provider. Each entry must set api_base explicitly; follows LiteLLM model_list format. |
global.llm.extraHeaders | object | {} | Controls extra HTTP headers added to every LLM gateway request. Do not place credentials here. |
global.merge.settings.OPENAI__RESPONSE_API | string | "true" | Controls Code Review behavior overrides passed as environment-variable style keys. Must be the string "true", not a YAML boolean. |
global.analytics_sidecar.enabled | boolean | true | Controls the review worker’s log-forwarding sidecar for analytics events. Disabling it omits the sidecar container entirely. |
global.tracing.enabled | boolean | false | Controls the built-in OpenTelemetry Collector and Phoenix trace UI. Disabled by default; inspect via port-forward to the Phoenix service. |
global.tracing.projectName | string | "qodo-onprem" | Controls the Phoenix project name receiving traces from this installation. |
global.tracing.samplingPercentage | integer | 10 | Controls the percentage of ordinary traces retained. Error and slow traces are always kept. |
global.generatedSecrets.render | boolean | true | Controls in-cluster generation of internal credentials. Disable only for offline rendering with helm template, providing all Secrets manually. |
telemetry.enabled | boolean | false | Controls optional installation-health telemetry sent to Qodo. Requires customer approval and a valid identity Secret. |
telemetry.mode | string | "automatic" | Controls whether telemetry is sent automatically, on demand, or exported locally as JSON in file mode. Network sends require the qodo-telemetry-auth Secret. |
telemetry.pushInterval | string | "1h" | Controls the automatic telemetry report interval. Accepted values are 1m–1440m or 1h–24h. |
postgres.enabled | boolean | false | Controls the bundled PostgreSQL server. When enabled, point global.externalDatabase.host to qodo-postgres and set sslMode to disable. |
redis.enabled | boolean | true | Controls the bundled Redis server. Disable when global.externalRedis.host points to an external instance. |
Helm charts
Helm chart configuration reference
Reference documentation for the Qodo on-premises Helm chart.
This reference provides a complete list of customer-serviceable Helm values, default settings, and configuration options for the Qodo Helm chart.
If you’re deploying Qodo for the first time, see Deploy Qodo using Helm for step-by-step installation instructions.
Was this page helpful?