<!-- HAND-MAINTAINED - do NOT regenerate with `make helm-operator-docs` (helm-docs). values.yaml carries no `# --` description comments and there is no README.md.gotmpl here, so the generator would delete the extended chart description, the "CRD lifecycle" section, and every Description cell below. Regenerating is safe only after that migration (curated prose -> README.md.gotmpl, descriptions -> `# --` comments in values.yaml); until then edit by hand and keep the badges, Requirements and Values defaults in step with Chart.yaml/values.yaml. The two subchart READMEs under charts/ are pure helm-docs output and are safe. -->

meshery-operator

Meshery Operator chart. Deploys the meshery-operator manager, which reconciles the Broker (NATS) and MeshSync custom resources.

The chart's version/appVersion and the CRD bundles under crds/ and files/ are kept in lockstep with meshery-operator releases by that repo's sync-downstream workflow — do not hand-edit them here.

CRD lifecycle

• Install: Helm applies crds/crds.yaml before anything else, and the crds.updateJob pre-install hook server-side-applies the same bundle.

• Upgrade: Helm never touches crds/ on upgrade; the crds.updateJob pre-upgrade hook is what refreshes the CRDs, so helm upgrade delivers schema updates to live clusters.

• Uninstall: the CRDs (and every Broker/MeshSync object) deliberately survive helm uninstall — they are never owned by the release. To remove them permanently, including all custom resources of those types:

  consoleCopy

  kubectl delete crd brokers.meshery.io meshsyncs.meshery.io
  

• Conversion: both CRDs serve v1alpha1 and v1alpha2 (storage) with conversion strategy None, which is exact while the two schemas are field-identical — no webhook and no cert-manager required. When the schemas diverge upstream, enable webhook.enabled (chart-generated self-signed certificate) or webhook.certManager.enabled (cert-manager v1) and the CRD update Job patches webhook conversion onto the CRDs.

Maintainers

Name	Email	Url
Meshery Authors	[email protected]
aisuko	[email protected]
maintainers	[email protected]

Requirements

Repository	Name	Version
	meshery-broker	0.5.0
	meshery-meshsync	0.5.0

Values

Key	Type	Default	Description
affinity	object	{}
annotations	object	{}	Extra annotations for the manager Deployment
crds.updateJob.enabled	bool	true	Pre-install/pre-upgrade hook Job that server-side-applies files/crds.yaml; disabling means upgrades will NOT refresh CRDs
crds.updateJob.image.pullPolicy	string	"IfNotPresent"
crds.updateJob.image.repository	string	"alpine/k8s"	kubectl-capable image for the CRD update Job
crds.updateJob.image.tag	string	"1.35.6"
env	object	{}	Extra environment variables for the manager container
fullnameOverride	string	"meshery-operator"
image.pullPolicy	string	"IfNotPresent"
image.repository	string	"meshery/meshery-operator"
image.tag	string	"1.0.5"	Pinned operator release, stamped by the sync workflow. Kept explicit because server-release chart publishing re-stamps appVersion with the server tag; empty falls back to the chart appVersion
imagePullSecrets	list	[]
ingress.annotations	object	{}
ingress.enabled	bool	false
ingress.hosts[0].host	string	"chart-example.local"
ingress.hosts[0].paths	list	[]
ingress.tls	list	[]
leaderElection.enabled	bool	true	Leader election (adds the leases Role/RoleBinding and --enable-leader-election)
meshery-broker.enabled	bool	true
meshery-broker.fullnameOverride	string	"meshery-broker"
meshery-broker.serviceAccountNameOverride	string	"meshery-server"
meshery-meshsync.enabled	bool	true
meshery-meshsync.fullnameOverride	string	"meshery-meshsync"
meshery-meshsync.serviceAccountNameOverride	string	"meshery-server"
nameOverride	string	""
nodeSelector	object	{}
podAnnotations	object	{}
podSecurityContext	object	runAsNonRoot 65532, RuntimeDefault seccomp	Parity with the operator's own config/manager
replicaCount	int	1
resources	object	limits 500m/256Mi, requests 100m/64Mi	Parity with the operator's own config/manager
securityContext	object	no privilege escalation, read-only rootfs, drop ALL
service.annotations	object	{}
service.port	int	8443	TLS metrics endpoint (authn/authz-filtered; bind scrapers to the meshery-metrics-reader ClusterRole)
service.type	string	"ClusterIP"
serviceAccount.create	bool	true
serviceAccount.name	string	"meshery-operator"
tolerations	list	[]
webhook.certManager.enabled	bool	false	Issue the webhook serving cert with cert-manager (cert-manager.io/v1) + CA injection instead of the chart-generated self-signed certificate
webhook.enabled	bool	false	Serve v1alpha1<->v1alpha2 CRD conversion through the operator's webhook; not required while the schemas are field-identical