Skip to content

Global values#

Values under global are shared by every subchart: image registry and pull secrets, storage class, scheduling, cloud provider and which optional services are enabled.

Generated from the Hopsworks Helm chart 5.0.14 (Hopsworks 5.0.13).

General#

Defaults as YAML 
global:
  _hopsworks:
    airflow:
      enabled: true
      keysSecretName: hopsworks-airflow-keys
    airflowApiKeySecretName: airflow-api-key
    autoscalers: {}
    brewer:
      enabled: false
    centralNamespace: hopsworks
    cloudProvider: ''
    consulDomainName: consul
    executor_uid: 1235
    full_platform: true
    imagePullPolicy: IfNotPresent
    imagePullSecrets: []
    imageRegistry: docker.hops.works
    initContainerResources:
      runtime:
        limits:
          cpu: 1
          memory: 1Gi
        requests:
          cpu: 250m
          memory: 512Mi
      tool:
        limits:
          cpu: 500m
          memory: 512Mi
        requests:
          cpu: 100m
          memory: 128Mi
      waiter:
        limits:
          cpu: 500m
          memory: 256Mi
        requests:
          cpu: 50m
          memory: 64Mi
    jobs:
      ttlSecondsAfterFinished: 86400
    kafka:
      enabled: true
    kueue:
      enabled: false
    managedObjectStorage:
      enabled: false
      s3: null
    mode: auto
    mysql:
      hopsworksUser: hopsworksroot
      usersSecretname: mysql-users-secrets
    networkPolicy:
      rondbAccessLabels:
        access: mgmd-and-ndbmtd
    nodeSelector: {}
    onlinefs:
      email: onlinefs@hopsworks.ai
      password: onlinefspw
    opensearch:
      enabled: true
    openshift:
      enabled: false
    ray:
      enabled: false
    restoreFromBackup:
      backupId: null
      forceDataClear: false
      inPlace: false
    security:
      tls:
        enabled: true
    securityContextEnabled: true
    serviceAccount:
      annotations: {}
      create: true
      name: hopsworks-service-account
    serviceAccountAnnotations: {}
    skipDatabaseMigration: false
    spark:
      history:
        enabled: true
    storageClassName: null
    superset:
      enabled: true
      mysql:
        enabled: true
      redis:
        enabled: true
    tolerations: []
    toolbox:
      image: hwutils
      tag: 1.7.2
    topologySpreadConstraint:
      maxSkew: 1
      nodeAffinityPolicy: Honor
      nodeTaintsPolicy: Honor
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: ScheduleAnyway
    trino:
      enabled: true
    vpaEnabled: false
    wipeDataOnUninstall: true
  _kserve:
    servingruntime:
      vllmomni:
        tag: v0.20.0
      vllmopenai:
        tag: v0.20.0
  imageDigests: {}
  unmanagedLoadBalancers: {}
global._hopsworks.airflow.enabled #
Type bool, default true. Enable or disable the installation of the airflow sub chart
global._hopsworks.airflow.keysSecretName #
Type string, default "hopsworks-airflow-keys". Name of the Secret holding the shared-bearer secret that hopsworks-instance uses to call the Airflow /auth/internal/* routes. Must match airflow.airflowApi.keysSecretName so the same Secret is mounted on both sides. The default airflow-webserver-airflow-crypto-material is the cert-only secret and does NOT contain internal-shared-secret, so the hopsworks-instance pod fails to mount on a fresh v3 install.
global._hopsworks.airflowApiKeySecretName #
Type string, default "airflow-api-key".
global._hopsworks.autoscalers #
Type object, default {}. Map of autoscaler name to VPA configuration. Each key becomes a VerticalPodAutoscaler resource named -vpa.
global._hopsworks.brewer.enabled #
Type bool, default false. Enable or disable the installation of the brewer sub chart
global._hopsworks.centralNamespace #
Type string, default "hopsworks". Namespace to fetch OLK signing key from. Set to null to generate a new key.
global._hopsworks.cloudProvider #
Type string, default "". cloud provider (AWS, AZURE, GCP, OVH). It is used by HopsFS, Consul, and Hopsworks. Hopsfs uses it to configure the object storage parameters. Consul uses it to configure coredns accordingly. Hopsworks uses it to determine how to store the users docker images within the same hopsworks-base repo as tags or in different repo per project, If cloud provider is set all the users docker images are stored as tags - it is an AWS limitation where only tags within the repo can share layers.
global._hopsworks.consulDomainName #
Type string, default "consul". The domain name for consul where it will answer DNS queries, e.g. service-name.service.consul. If changed, make sure to update consul.consul.global.domain to the same value.
global._hopsworks.executor_uid #
Type int, default 1235. User ID for the user running Hopsworks and Airflow containers
global._hopsworks.full_platform #
Type bool, default true. Flag to indicate if the full platform is installed or just the online feature store infrastructure
global._hopsworks.imagePullPolicy #
Type string, default "IfNotPresent".
global._hopsworks.imagePullSecrets #
Type list, default []. image pull secrets to be used by all the subcharts. Notice that for subcharts the have external dependices, you need to update the image pull secrets accordingly in those subcharts
global._hopsworks.imageRegistry #
Type string, default "docker.hops.works".
global._hopsworks.initContainerResources #

Type object. Resource requests and limits for the chart's init containers, in three tiers by what the container does: waiter for shell wait loops, tool for file copies and small binaries, runtime for anything starting a JVM or a Python interpreter or pulling images. Every init container declares both requests and limits. A namespace LimitRange that supplies a default limit injects it into any container declaring none, and a pod's effective request is max(sum of app containers, highest single init container) where the init term is a floor for the pod's whole lifetime. An init container without resources can therefore pin a node's allocatable to the LimitRange default even after it has exited. Retune these if the target namespace has a LimitRange whose min/max would reject the defaults, since an out-of-range explicit value is rejected rather than defaulted.

Default 
runtime:
  limits:
    cpu: 1
    memory: 1Gi
  requests:
    cpu: 250m
    memory: 512Mi
tool:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 100m
    memory: 128Mi
waiter:
  limits:
    cpu: 500m
    memory: 256Mi
  requests:
    cpu: 50m
    memory: 64Mi
global._hopsworks.jobs #
Type object, default {"ttlSecondsAfterFinished":86400}. Global configuration for Kubernetes Jobs created by the chart
global._hopsworks.jobs.ttlSecondsAfterFinished #
Type int, default 86400. Time in seconds after a finished Job is eligible for automatic cleanup. Applies to all Jobs unless overridden by a subchart-specific ttlSecondsAfterFinished value.
global._hopsworks.kafka.enabled #
Type bool, default true. Enable or disable the installation of the kafka sub chart.
global._hopsworks.kueue.enabled #
Type bool, default false.
global._hopsworks.managedObjectStorage #
Type object, default {"enabled":false,"s3":null}. Configuration for managed object storage to be used by HopsFS, Opensearch, RonDB, and Hopsworks. Opensearch and RonDB uses this configuration to setup a remote sink for their backup, if a different remote sink is configured on the subchart then it will take precedence. Hopsworks uses the bucket configuration as context cache when building users' docker images, only S3 is supported at the moment.
global._hopsworks.managedObjectStorage.s3 #
Type string, default nil. S3 configuration
global._hopsworks.mode #
Type string, default "auto". Helm installation model. "auto" lets the chart decide based on the Release.IsInstall value. "install" forces installation mode, while "upgrade" forces upgrade mode.
global._hopsworks.mysql.hopsworksUser #
Type string, default "hopsworksroot".
global._hopsworks.mysql.usersSecretname #
Type string, default "mysql-users-secrets".
global._hopsworks.networkPolicy.rondbAccessLabels.access #
Type string, default "mgmd-and-ndbmtd".
global._hopsworks.nodeSelector #
Type object, default {}. Specifies the global nodeSelector settings applied across all subcharts unless explicitly overridden within a specific subchart. This ensures Kubernetes schedules Pods only onto nodes that match all the specified labels. Notice that some subcharts do not use this global variable, and you must manually override those by defining them in the values.yaml file, using anchors if necessary.
global._hopsworks.onlinefs.email #
Type string, default "onlinefs@hopsworks.ai".
global._hopsworks.onlinefs.password #
Type string, default "onlinefspw".
global._hopsworks.opensearch #
Type object, default {"enabled":true}. Enable or disable the opensearch
global._hopsworks.opensearch.enabled #
Type bool, default true. Enable or disable the opensearch
global._hopsworks.openshift.enabled #
Type bool, default false. Enable when installing on Openshift platform
global._hopsworks.ray.enabled #
Type bool, default false.
global._hopsworks.restoreFromBackup #
Type object, default {"backupId":null,"forceDataClear":false,"inPlace":false}. restore cluster from a backup id
global._hopsworks.restoreFromBackup.backupId #
Type string, default nil. the backup id to restore
global._hopsworks.restoreFromBackup.forceDataClear #
Type bool, default false. flag to indicate if the data should be forcibly cleared before restore
global._hopsworks.restoreFromBackup.inPlace #
Type bool, default false. flag to indicate if the restore should be done in-place or to a new cluster
global._hopsworks.security.tls.enabled #
Type bool, default true.
global._hopsworks.securityContextEnabled #
Type bool, default true. Flag to disable templating SecurityContext for Openshift
global._hopsworks.serviceAccount.annotations #
Type object, default {}. custom annotations for the Hopsworks service account
global._hopsworks.serviceAccount.create #
Type bool, default true.
global._hopsworks.serviceAccount.name #
Type string, default "hopsworks-service-account".
global._hopsworks.serviceAccountAnnotations #
Type object, default {}. Use it to annotate the serviceAccounts we create for Hopsworks
global._hopsworks.skipDatabaseMigration #
Type bool, default false. Special flag which MUST be used only for 3.x -> 4.0 migrations (HWORKS-1600)
global._hopsworks.spark.history.enabled #
Type bool, default true. Enable or disable installing of the spark history server
global._hopsworks.storageClassName #
Type string, default nil. global storage class name
global._hopsworks.superset.enabled #
Type bool, default true. Enable or disable the installation of the superset sub chart.
global._hopsworks.superset.mysql.enabled #
Type bool, default true. Enable or disable MySQL for Superset. Must match superset.mysql.enabled for consistent behavior across charts.
global._hopsworks.superset.redis.enabled #
Type bool, default true. Enable or disable Redis for Superset. Must match superset.superset.redis.enabled for consistent behavior across charts.
global._hopsworks.tolerations #
Type list, default []. Specifies the global tolerations settings applied to all subcharts unless explicitly overridden in a specific subchart. These tolerations allow Kubernetes to schedule Pods on nodes with matching taints, ensuring proper placement based on cluster policies. Notice that some subcharts do not use this global variable, and you must manually override those by defining them in the values.yaml file, using anchors if necessary.
global._hopsworks.toolbox.image #
Type string, default "hwutils".
global._hopsworks.toolbox.tag #
Type string, default "1.7.2".
global._hopsworks.topologySpreadConstraint #

Type object. default topology spread constraint. If not defined the global topology spread constraint would be used

Default 
maxSkew: 1
nodeAffinityPolicy: Honor
nodeTaintsPolicy: Honor
topologyKey: topology.kubernetes.io/zone
whenUnsatisfiable: ScheduleAnyway
global._hopsworks.trino.enabled #
Type bool, default true. Enable or disable the installation of the trino sub chart.
global._hopsworks.vpaEnabled #
Type bool, default false.
global._hopsworks.wipeDataOnUninstall #
Type bool, default true. on uninstall, delete data PVCs left behind by StatefulSets unless the PVC carries the label hopsworks.ai/keep=true. Consumed by subchart post-delete cleanup hooks via the hopsworkslib.wipeDataOnUninstall helper.
global._kserve #

Type object. Global KServe values shared between the kserve and hopsworks subcharts

Default 
servingruntime:
  vllmomni:
    tag: v0.20.0
  vllmopenai:
    tag: v0.20.0
global._kserve.servingruntime #
Type object, default {"vllmomni":{"tag":"v0.20.0"},"vllmopenai":{"tag":"v0.20.0"}}. Mirrors the kserve subchart's kserve.servingruntime layout. Tags here drive both the kserve ClusterServingRuntime images and the kube_serving_vllm*_versions hopsworks variable seeds.
global._kserve.servingruntime.vllmomni #
Type object, default {"tag":"v0.20.0"}. vLLM-Omni runtime image tag. Drives both the kserve ClusterServingRuntime image and the kube_serving_vllm_omni_versions hopsworks variable seed.
global._kserve.servingruntime.vllmopenai #
Type object, default {"tag":"v0.20.0"}. vLLM-OpenAI runtime image tag. Drives both the kserve ClusterServingRuntime image and the kube_serving_vllm_versions hopsworks variable seed.
global.imageDigests #
Type object, default {}. map image name to sha digest to be used instead of tags for reproducible deployment
global.unmanagedLoadBalancers #
Type object, default {}. Load balancer configuration when using unmanaged LB, in AWS is the TargetGroup ARNs for each service

backups#

Defaults as YAML 
global:
  _hopsworks:
    backups:
      enabled: true
      metadataStore:
        configMap:
          opensearch: opensearch-backups-metadata
          ronDB: rondb-backups-metadata
      schedule: '@weekly'
      ttl: null
global._hopsworks.backups #

Type object. enable global backups configuration

Default 
enabled: true
metadataStore:
  configMap:
    opensearch: opensearch-backups-metadata
    ronDB: rondb-backups-metadata
schedule: '@weekly'
ttl: null
global._hopsworks.backups.enabled #
Type bool, default true. enable global backup
global._hopsworks.backups.metadataStore #

Type object. backups metadata store

Default 
configMap:
  opensearch: opensearch-backups-metadata
  ronDB: rondb-backups-metadata
global._hopsworks.backups.metadataStore.configMap.opensearch #
Type string, default "opensearch-backups-metadata". name of the configmap to store metadata information about opensearch backups
global._hopsworks.backups.metadataStore.configMap.ronDB #
Type string, default "rondb-backups-metadata". name of the configmap to store metadata information about rondb backups
global._hopsworks.backups.schedule #
Type string, default "@weekly". cron schedule
global._hopsworks.backups.ttl #
Type string, default nil. time to live to control when to clean up backups. It is a number followed by either d (days) or h (hours) suffix.

externalLoadBalancers#

Defaults as YAML 
global:
  _hopsworks:
    externalLoadBalancers:
      annotations: {}
      class: null
      enabled: true
      managed: true
global._hopsworks.externalLoadBalancers #
Type object, default {"annotations":{},"class":null,"enabled":true,"managed":true}. Global load balancer configuration for external access to Hopsworks services: ArrowFlight, Kafka, and MySQL We fallback to this loadBalancerClass if the local loadBalancerClass is not defined
global._hopsworks.externalLoadBalancers.annotations #
Type object, default {}. Generic annotations attached to LoadBalancer objects
global._hopsworks.externalLoadBalancers.class #
Type string, default nil. Name of the LoadBalancer class
global._hopsworks.externalLoadBalancers.enabled #
Type bool, default true. Enable LoadBalancer Services
global._hopsworks.externalLoadBalancers.managed #
Type bool, default true. Cloud provider provisions Load Balancers

externalServices#

Defaults as YAML 
global:
  _hopsworks:
    externalServices:
      hopsfs:
        external: false
        namenodeAddresses: []
      opensearch:
        addresses: []
        external: false
      prometheus:
        addresses: []
        external: false
      rondb:
        external: false
        mgmdHostname: ''
global._hopsworks.externalServices #

Type object. Configuration for when services are external to this Kubernetes installation

Default 
hopsfs:
  external: false
  namenodeAddresses: []
opensearch:
  addresses: []
  external: false
prometheus:
  addresses: []
  external: false
rondb:
  external: false
  mgmdHostname: ''
global._hopsworks.externalServices.hopsfs #
Type object, default {"external":false,"namenodeAddresses":[]}. HopsFS configuration when it is installed externally
global._hopsworks.externalServices.hopsfs.external #
Type bool, default false. Flag to indicate HopsFS is installed externally
global._hopsworks.externalServices.hopsfs.namenodeAddresses #
Type list, default []. IP addresses where HopsFS Namenodes are installed
global._hopsworks.externalServices.opensearch #
Type object, default {"addresses":[],"external":false}. Opensearch configuration when it is installed externally
global._hopsworks.externalServices.opensearch.addresses #
Type list, default []. IP addresses where OpenSearch is installed
global._hopsworks.externalServices.opensearch.external #
Type bool, default false. Flag to indicate Opensearch is installed externally
global._hopsworks.externalServices.prometheus #
Type object, default {"addresses":[],"external":false}. prometheus configuration when it is installed externally
global._hopsworks.externalServices.prometheus.addresses #
Type list, default []. IP addresses where prometheus is installed
global._hopsworks.externalServices.prometheus.external #
Type bool, default false. Flag to indicate prometheus is installed externally
global._hopsworks.externalServices.rondb #
Type object, default {"external":false,"mgmdHostname":""}. RonDB configuration when it is installed externally
global._hopsworks.externalServices.rondb.external #
Type bool, default false. Flag to indicate RonDB is installed externally
global._hopsworks.externalServices.rondb.mgmdHostname #
Type string, default "". Hostname of the machine where RonDB management service is running

kyverno#

Defaults as YAML 
global:
  _hopsworks:
    kyverno:
      enabled: false
      policies:
        addCertificatesVolume:
          enabled: false
          initContainers:
            annotation:
              key: kyverno-inject-certs-init
              value: enabled
            enabled: false
          mountPath: /etc/ssl/certs
          preconditions:
            annotation:
              key: kyverno-inject-certs
              value: enabled
            enabled: true
global._hopsworks.kyverno.enabled #
Type bool, default false. Enable or disable kyverno policies installation
global._hopsworks.kyverno.policies.addCertificatesVolume #

Type object. Configuration to add custom certificates to pods as a mounted volume

Default 
enabled: false
initContainers:
  annotation:
    key: kyverno-inject-certs-init
    value: enabled
  enabled: false
mountPath: /etc/ssl/certs
preconditions:
  annotation:
    key: kyverno-inject-certs
    value: enabled
  enabled: true
global._hopsworks.kyverno.policies.addCertificatesVolume.enabled #
Type bool, default false. Enable add certificates volume
global._hopsworks.kyverno.policies.addCertificatesVolume.initContainers #

Type object. Opt-in for injecting the certificates volume into init containers. The main addCertificatesVolume policy only mutates spec.containers; init containers are intentionally left untouched because they are often injected by third-party operators (Istio, KServe, sidecar injectors) that ship minimal images where overwriting /etc/ssl/certs would break them. When enabled, a second mutate rule is rendered that iterates spec.initContainers and is gated by an OR of the dedicated init-container annotation below and any extraAnnotations / labels configured under the hw-kyverno subchart at policies.addCertificatesVolume.initContainers. The annotation is distinct from preconditions.annotation so authors can opt main containers and init containers in independently.

Default 
annotation:
  key: kyverno-inject-certs-init
  value: enabled
enabled: false
global._hopsworks.kyverno.policies.addCertificatesVolume.initContainers.annotation #
Type object, default {"key":"kyverno-inject-certs-init","value":"enabled"}. The key and value of the annotation used to opt a pod's init containers into certificate volume injection. Distinct from preconditions.annotation so authors can opt main containers and init containers in independently. A pod opts in by matching any one of: this annotation, an entry in the hw-kyverno subchart's policies.addCertificatesVolume.initContainers.extraAnnotations, or an entry in policies.addCertificatesVolume.initContainers.labels.
global._hopsworks.kyverno.policies.addCertificatesVolume.initContainers.enabled #
Type bool, default false. Render the init-container mutate rule. When false (default), the policy never touches init containers regardless of any annotation, label, or extra annotation set on a pod.
global._hopsworks.kyverno.policies.addCertificatesVolume.mountPath #
Type string, default "/etc/ssl/certs". Path to mount the certificates volume
global._hopsworks.kyverno.policies.addCertificatesVolume.preconditions.annotation #
Type object, default {"key":"kyverno-inject-certs","value":"enabled"}. The key and value of the annotation used to inject kyverno certificates. If a pod has this annotation, it will be mutated. There are other options under hw-kyverno subchart to use labels and extra annotations as needed.
global._hopsworks.kyverno.policies.addCertificatesVolume.preconditions.enabled #
Type bool, default true. Enable adding preconditions to the police. If disabled, the policy will apply to all the pods in the installation namespace and the hopsworks projects' namespaces created when crating a project.

managedDockerRegistery#

Defaults as YAML 
global:
  _hopsworks:
    managedDockerRegistery:
      credHelper:
        enabled: false
        secretName: ''
      domain: ''
      enabled: false
      namespace: ''
      port: null
global._hopsworks.managedDockerRegistery #

Type object. configure managed docker registry for Hopsworks to store the user's docker image

Default 
credHelper:
  enabled: false
  secretName: ''
domain: ''
enabled: false
namespace: ''
port: null
global._hopsworks.managedDockerRegistery.credHelper #
Type object, default {"enabled":false,"secretName":""}. credentials helper to use for the managed docker registry. We only support cred helpers for AWS and GCP
global._hopsworks.managedDockerRegistery.credHelper.secretName #
Type string, default "". the name of the secret to be created with the credentials helper configuration
global._hopsworks.managedDockerRegistery.domain #
Type string, default "". the managed docker registry domain name
global._hopsworks.managedDockerRegistery.namespace #
Type string, default "". the namespace to be used
global._hopsworks.managedDockerRegistery.port #
Type string, default nil. port number for the managed docker registry

minio#

Defaults as YAML 
global:
  _hopsworks:
    minio:
      enabled: true
      hopsfs:
        bucket: hopsfs
        enabled: true
      password: minioadmin
      region: eu-west-1
      user: minioadmin
global._hopsworks.minio.enabled #
Type bool, default true.
global._hopsworks.minio.hopsfs.bucket #
Type string, default "hopsfs".
global._hopsworks.minio.hopsfs.enabled #
Type bool, default true.
global._hopsworks.minio.password #
Type string, default "minioadmin".
global._hopsworks.minio.region #
Type string, default "eu-west-1".
global._hopsworks.minio.user #
Type string, default "minioadmin".