> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensormesh.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Configuration
> Every values.yaml key for the Tensormesh Operator chart, plus ready-to-use example overlays.
Configure the chart with a **values file** (`-f my-values.yaml`) rather than `--set` flags —
it's reproducible and reviewable, and the chart validates it against a bundled
`values.schema.json` at parse time (typos and wrong types fail fast). To see every key with
its live default:
```bash theme={null}
helm show values oci://ghcr.io/tensormesh-production/charts/tensormesh-operator --version 0.4.5
```
**Pin explicit image tags** in your values file — never `latest`. With
`imagePullPolicy: IfNotPresent`, a node that cached an image under a mutable tag keeps the
stale copy. Pin the chart (`--version 0.4.5`) and the runtime image (`v0.4.5` or an explicit
nightly). By default the operator image tag follows the chart `appVersion`, but you can still
override it with `operator.image.tag`. See the
[Compatibility Matrix](/operator/installation/compatibility) for the validated version tuple.
## Top level
| Key | Type | Default | Description |
| ------------------ | ------ | ------- | -------------------------------------------------------- |
| `crds.enabled` | bool | `true` | Install the `LMCacheEngine` CRD. |
| `nameOverride` | string | `""` | Override the chart name used in resource names. |
| `fullnameOverride` | string | `""` | Fully override the generated `-` prefix. |
## `operator` — controller-manager
| Key | Type | Default | Description |
| --------------------------------------------------------------- | ------ | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `operator.enabled` | bool | `true` | Deploy the controller-manager. Disable for CR-only installs. |
| `operator.replicas` | int | `1` | Replicas. Leader-elected; `>1` = HA standby. |
| `operator.image.repository` | string | `lmcache/lmcache-operator` | Operator image repo. |
| `operator.image.tag` | string | `""` | Empty = chart `appVersion`. Pinning the chart version is the explicit pin. |
| `operator.image.pullPolicy` | string | `IfNotPresent` | `Always` / `IfNotPresent` / `Never`. |
| `operator.image.pullSecrets` | list | `[]` | Image pull secret names. |
| `operator.resources` | object | `requests 10m/256Mi, limits 500m/1Gi` | Operator container resources. Override these for unusually large clusters, but the chart now defaults to a more conservative memory floor than the original low-memory settings. |
| `operator.leaderElection.enabled` | bool | `true` | Required when `replicas > 1`. |
| `operator.healthProbe.port` | int | `8081` | Liveness/readiness probe port. |
| `operator.metrics.enabled` | bool | `true` | Expose controller-manager metrics. |
| `operator.metrics.port` | int | `8443` | Metrics port. |
| `operator.metrics.secure` | bool | `true` | HTTPS + authn/authz filter on metrics. |
| `operator.metrics.enableHTTP2` | bool | `false` | Off by default (CVE guidance). |
| `operator.metrics.tls.*` | — | — | Mount a TLS cert (`certPath`, `certName`, `certKey`, `secretName`). Empty = self-signed. |
| `operator.serviceAccount.create` | bool | `true` | Create the operator ServiceAccount. |
| `operator.serviceAccount.name` | string | `""` | Override SA name. |
| `operator.serviceAccount.annotations` | object | `{}` | SA annotations. |
| `operator.rbac.create` | bool | `true` | Create the operator **ClusterRole + ClusterRoleBinding** (cluster-scoped). |
| `operator.serviceMonitor.enabled` | bool | `false` | `ServiceMonitor` for the operator's own metrics (`:8443`). |
| `operator.serviceMonitor.interval` / `.scrapeTimeout` | string | `30s` / `10s` | Scrape timing. |
| `operator.serviceMonitor.labels` / `.tlsConfig` | object | `{}` | Selector labels / TLS override. |
| `operator.networkPolicy.enabled` | bool | `false` | Restrict ingress to the operator pod. |
| `operator.networkPolicy.metricsNamespaceSelector` | object | `{matchLabels: {metrics: enabled}}` | Who may scrape metrics. |
| `operator.nodeSelector` / `.tolerations` / `.affinity` | — | `{}` / `[]` / `{}` | Operator pod scheduling. |
| `operator.podAnnotations` / `.podLabels` / `.priorityClassName` | — | `{}` / `{}` / `""` | Operator pod metadata. |
## `engine` — the LMCacheEngine CR
| Key | Type | Default | Description |
| ------------------ | ------ | -------------------- | ------------------------------------------------------------------ |
| `engine.enabled` | bool | `true` | Create an `LMCacheEngine` CR in this release. |
| `engine.name` | string | `""` | CR name. Empty = `-default`. |
| `engine.namespace` | string | `""` | CR namespace. Empty = release namespace. |
| `engine.spec` | object | `{l1: {sizeGB: 60}}` | Rendered **verbatim** into the CR's `spec`. Required: `l1.sizeGB`. |
`engine.spec` is a passthrough to the `LMCacheEngine` CRD, so its full surface is defined by
the CRD — not the chart. Common fields: `l1.sizeGB`, `image.{repository,tag,pullPolicy}`,
`nodeSelector`, `serviceAccountName`, `extraArgs`. Inspect with
`kubectl explain lmcacheengine.spec` once the CRD is installed.
## `openshift` — privileged SCC for hostIPC
| Key | Type | Default | Description |
| -------------------------------------- | ------ | --------------------------------- | ------------------------------------------------------------- |
| `openshift.enabled` | bool | `false` | Bind a privileged SCC to engine pods (required on OpenShift). |
| `openshift.sccClusterRole` | string | `system:openshift:scc:privileged` | ClusterRole granting `use` on the SCC. |
| `openshift.serviceAccount.create` | bool | `true` | Create the privileged SA in the engine namespace. |
| `openshift.serviceAccount.name` | string | `""` | Override SA name. Empty = `-engine-privileged`. |
| `openshift.serviceAccount.annotations` | object | `{}` | SA annotations. |
## `observability` — OTel Collector, metrics, traces
| Key | Type | Default | Description |
| ---------------------------------------------------------- | ------ | ------- | -------------------------------------------------------------------------------------------------------- |
| `observability.enabled` | bool | `false` | Create an `OpenTelemetryCollector` CR and auto-wire the engine. Requires the OpenTelemetry Operator CRD. |
| `observability.otelCollector.resources` | object | `{}` | Collector pod resources. |
| `observability.otelCollector.debug` | bool | `false` | Debug exporter — logs every metric/trace to stdout. Dev only. |
| `observability.otelCollector.envFrom` | list | `[]` | `envFrom` entries (e.g. a `secretRef`) to mount auth tokens; reference with `${env:VAR}`. |
| `observability.prometheus.serviceMonitor.enabled` | bool | `true` | `ServiceMonitor` for the Collector's prometheus exporter (`:8889`). |
| `observability.prometheus.serviceMonitor.interval` | string | `30s` | Scrape interval. |
| `observability.prometheus.serviceMonitor.additionalLabels` | object | `{}` | Selector labels (e.g. `release: kube-prometheus-stack`). |
| `observability.prometheus.remoteWrite.enabled` | bool | `false` | Push metrics to a Prometheus remote-write endpoint (Grafana Cloud, Mimir, …). |
| `observability.prometheus.remoteWrite.endpoint` | string | `""` | Remote-write URL. |
| `observability.prometheus.remoteWrite.headers` | object | `{}` | Headers (use `${env:VAR}` for secrets). |
| `observability.prometheus.remoteWrite.externalLabels` | object | `{}` | Labels added to all remote-written metrics. |
| `observability.traces.externalEndpoint.enabled` | bool | `false` | Push traces to an external OTLP endpoint. |
| `observability.traces.externalEndpoint.endpoint` | string | `""` | OTLP gRPC endpoint (e.g. `tempo.monitoring:4317`). |
| `observability.traces.externalEndpoint.tls.insecure` | bool | `true` | Set `false` for TLS endpoints (e.g. Grafana Cloud :443). |
| `observability.traces.externalEndpoint.headers` | object | `{}` | Headers (use `${env:VAR}`). |
| `observability.traces.tempoCR.enabled` | bool | `false` | Create a `TempoMonolithic` CR. Requires the Tempo Operator. |
## `preDelete` and `tests`
| Key | Type | Default | Description |
| -------------------------- | ------ | ------------------------ | ----------------------------------------------------------------------- |
| `preDelete.image` | string | `bitnami/kubectl:latest` | Image for the pre-delete hook Job (removes the CR before the operator). |
| `preDelete.timeoutSeconds` | int | `120` | Hook Job `activeDeadlineSeconds`. |
| `tests.enabled` | bool | `true` | Render `helm test` smoke pods. |
| `tests.image` | string | `bitnami/kubectl:latest` | kubectl-based test pod image. |
| `tests.curlImage` | string | `curlimages/curl:8.10.1` | curl-based test pod image. |
## Example overlays
The chart repo ships ready-to-use overlays under `examples/`:
| File | Shape |
| ------------------------------- | -------------------------------------------------------------- |
| `values-minimal.yaml` | Operator + engine, smallest viable install. |
| `values-openshift.yaml` | Adds the privileged SCC binding for `hostIPC`. |
| `values-observability-e2e.yaml` | Engine + full OTel stack (Collector + ServiceMonitor + debug). |
### Minimal (Kubernetes)
```yaml my-values.yaml theme={null}
engine:
enabled: true
spec:
l1:
sizeGB: 60
image:
repository: lmcache/vllm-openai
tag: v0.4.5
pullPolicy: IfNotPresent
```
### OpenShift
```yaml values-openshift.yaml theme={null}
openshift:
enabled: true
engine:
enabled: true
spec:
l1:
sizeGB: 60
image:
repository: lmcache/vllm-openai
tag: v0.4.5
pullPolicy: IfNotPresent
```
### Observability (metrics + traces to a local Tempo)
```yaml values-observability.yaml theme={null}
openshift:
enabled: true
engine:
enabled: true
spec:
l1:
sizeGB: 60
image:
repository: lmcache/vllm-openai
tag: v0.4.5
pullPolicy: IfNotPresent
observability:
enabled: true
otelCollector:
debug: true
prometheus:
serviceMonitor:
enabled: true
traces:
tempoCR:
enabled: true
```
Apply any of these with:
```bash theme={null}
helm upgrade --install tensormesh-operator \
oci://ghcr.io/tensormesh-production/charts/tensormesh-operator \
--version 0.4.5 -n tensormesh-operator --create-namespace \
-f my-values.yaml --wait
```
## Next steps
What each value deploys, and which resources are cluster-scoped.
The install/upgrade/uninstall flow.