Skip to main content
Configure the chart with a values file (-f my-values.yaml) rather than --set flags — it’s reproducible and reviewable, and the chart validates it against a bundled values.schema.json at parse time (typos and wrong types fail fast). To see every key with its live default: 
helm show values oci://ghcr.io/tensormesh-production/charts/tensormesh-operator --version 0.4.5
Pin explicit image tags in your values file — never latest. With imagePullPolicy: IfNotPresent, a node that cached an image under a mutable tag keeps the stale copy. Pin the chart (--version 0.4.5) and the runtime image (v0.4.5 or an explicit nightly). By default the operator image tag follows the chart appVersion, but you can still override it with operator.image.tag. See the Compatibility Matrix for the validated version tuple.

​
Top level

KeyTypeDefaultDescription
crds.enabledbooltrueInstall the LMCacheEngine CRD.
nameOverridestring""Override the chart name used in resource names.
fullnameOverridestring""Fully override the generated <release>-<chart> prefix.

​
operator — controller-manager

KeyTypeDefaultDescription
operator.enabledbooltrueDeploy the controller-manager. Disable for CR-only installs.
operator.replicasint1Replicas. Leader-elected; >1 = HA standby.
operator.image.repositorystringlmcache/lmcache-operatorOperator image repo.
operator.image.tagstring""Empty = chart appVersion. Pinning the chart version is the explicit pin.
operator.image.pullPolicystringIfNotPresentAlways / IfNotPresent / Never.
operator.image.pullSecretslist[]Image pull secret names.
operator.resourcesobjectrequests 10m/256Mi, limits 500m/1GiOperator container resources. Override these for unusually large clusters, but the chart now defaults to a more conservative memory floor than the original low-memory settings.
operator.leaderElection.enabledbooltrueRequired when replicas > 1.
operator.healthProbe.portint8081Liveness/readiness probe port.
operator.metrics.enabledbooltrueExpose controller-manager metrics.
operator.metrics.portint8443Metrics port.
operator.metrics.securebooltrueHTTPS + authn/authz filter on metrics.
operator.metrics.enableHTTP2boolfalseOff by default (CVE guidance).
operator.metrics.tls.*——Mount a TLS cert (certPath, certName, certKey, secretName). Empty = self-signed.
operator.serviceAccount.createbooltrueCreate the operator ServiceAccount.
operator.serviceAccount.namestring""Override SA name.
operator.serviceAccount.annotationsobject{}SA annotations.
operator.rbac.createbooltrueCreate the operator ClusterRole + ClusterRoleBinding (cluster-scoped).
operator.serviceMonitor.enabledboolfalseServiceMonitor for the operator’s own metrics (:8443).
operator.serviceMonitor.interval / .scrapeTimeoutstring30s / 10sScrape timing.
operator.serviceMonitor.labels / .tlsConfigobject{}Selector labels / TLS override.
operator.networkPolicy.enabledboolfalseRestrict ingress to the operator pod.
operator.networkPolicy.metricsNamespaceSelectorobject{matchLabels: {metrics: enabled}}Who may scrape metrics.
operator.nodeSelector / .tolerations / .affinity—{} / [] / {}Operator pod scheduling.
operator.podAnnotations / .podLabels / .priorityClassName—{} / {} / ""Operator pod metadata.

​
engine — the LMCacheEngine CR

KeyTypeDefaultDescription
engine.enabledbooltrueCreate an LMCacheEngine CR in this release.
engine.namestring""CR name. Empty = <fullname>-default.
engine.namespacestring""CR namespace. Empty = release namespace.
engine.specobject{l1: {sizeGB: 60}}Rendered verbatim into the CR’s spec. Required: l1.sizeGB.
engine.spec is a passthrough to the LMCacheEngine CRD, so its full surface is defined by the CRD — not the chart. Common fields: l1.sizeGB, image.{repository,tag,pullPolicy}, nodeSelector, serviceAccountName, extraArgs. Inspect with kubectl explain lmcacheengine.spec once the CRD is installed.

​
openshift — privileged SCC for hostIPC

KeyTypeDefaultDescription
openshift.enabledboolfalseBind a privileged SCC to engine pods (required on OpenShift).
openshift.sccClusterRolestringsystem:openshift:scc:privilegedClusterRole granting use on the SCC.
openshift.serviceAccount.createbooltrueCreate the privileged SA in the engine namespace.
openshift.serviceAccount.namestring""Override SA name. Empty = <fullname>-engine-privileged.
openshift.serviceAccount.annotationsobject{}SA annotations.

​
observability — OTel Collector, metrics, traces

KeyTypeDefaultDescription
observability.enabledboolfalseCreate an OpenTelemetryCollector CR and auto-wire the engine. Requires the OpenTelemetry Operator CRD.
observability.otelCollector.resourcesobject{}Collector pod resources.
observability.otelCollector.debugboolfalseDebug exporter — logs every metric/trace to stdout. Dev only.
observability.otelCollector.envFromlist[]envFrom entries (e.g. a secretRef) to mount auth tokens; reference with ${env:VAR}.
observability.prometheus.serviceMonitor.enabledbooltrueServiceMonitor for the Collector’s prometheus exporter (:8889).
observability.prometheus.serviceMonitor.intervalstring30sScrape interval.
observability.prometheus.serviceMonitor.additionalLabelsobject{}Selector labels (e.g. release: kube-prometheus-stack).
observability.prometheus.remoteWrite.enabledboolfalsePush metrics to a Prometheus remote-write endpoint (Grafana Cloud, Mimir, …).
observability.prometheus.remoteWrite.endpointstring""Remote-write URL.
observability.prometheus.remoteWrite.headersobject{}Headers (use ${env:VAR} for secrets).
observability.prometheus.remoteWrite.externalLabelsobject{}Labels added to all remote-written metrics.
observability.traces.externalEndpoint.enabledboolfalsePush traces to an external OTLP endpoint.
observability.traces.externalEndpoint.endpointstring""OTLP gRPC endpoint (e.g. tempo.monitoring:4317).
observability.traces.externalEndpoint.tls.insecurebooltrueSet false for TLS endpoints (e.g. Grafana Cloud :443).
observability.traces.externalEndpoint.headersobject{}Headers (use ${env:VAR}).
observability.traces.tempoCR.enabledboolfalseCreate a TempoMonolithic CR. Requires the Tempo Operator.

​
preDelete and tests

KeyTypeDefaultDescription
preDelete.imagestringbitnami/kubectl:latestImage for the pre-delete hook Job (removes the CR before the operator).
preDelete.timeoutSecondsint120Hook Job activeDeadlineSeconds.
tests.enabledbooltrueRender helm test smoke pods.
tests.imagestringbitnami/kubectl:latestkubectl-based test pod image.
tests.curlImagestringcurlimages/curl:8.10.1curl-based test pod image.

​
Example overlays

The chart repo ships ready-to-use overlays under examples/:
FileShape
values-minimal.yamlOperator + engine, smallest viable install.
values-openshift.yamlAdds the privileged SCC binding for hostIPC.
values-observability-e2e.yamlEngine + full OTel stack (Collector + ServiceMonitor + debug).

​
Minimal (Kubernetes)

my-values.yaml
engine:
  enabled: true
  spec:
    l1:
      sizeGB: 60
    image:
      repository: lmcache/vllm-openai
      tag: v0.4.5
      pullPolicy: IfNotPresent

​
OpenShift

values-openshift.yaml
openshift:
  enabled: true
engine:
  enabled: true
  spec:
    l1:
      sizeGB: 60
    image:
      repository: lmcache/vllm-openai
      tag: v0.4.5
      pullPolicy: IfNotPresent

​
Observability (metrics + traces to a local Tempo)

values-observability.yaml
openshift:
  enabled: true
engine:
  enabled: true
  spec:
    l1:
      sizeGB: 60
    image:
      repository: lmcache/vllm-openai
      tag: v0.4.5
      pullPolicy: IfNotPresent
observability:
  enabled: true
  otelCollector:
    debug: true
  prometheus:
    serviceMonitor:
      enabled: true
  traces:
    tempoCR:
      enabled: true
Apply any of these with: 
helm upgrade --install tensormesh-operator \
  oci://ghcr.io/tensormesh-production/charts/tensormesh-operator \
  --version 0.4.5 -n tensormesh-operator --create-namespace \
  -f my-values.yaml --wait

​
Next steps

Architecture

What each value deploys, and which resources are cluster-scoped.

Install with Helm

The install/upgrade/uninstall flow.