---
title: Values reference
description: "The OpenLM Platform chart settings you're most likely to change: global switches, ingress, shared configuration, and per-component settings."
product: OpenLM Platform
---

To adjust your OpenLM Platform installation, change the settings on this page. The chart has thousands of settings, because each component has its own, but you rarely need more than these. Every other setting keeps its chart default.

## Global settings

These settings sit under `global` in the values file:

| Setting | Default | What it does |
|---|---|---|
| `global.useOpenShift` | `false` | `true`: create OpenShift Routes instead of Ingresses, and leave pod user/group IDs to OpenShift. |
| `global.securityContext.omitIds` | `false` | `true`: leave pod user/group IDs out without switching to Routes (for clusters that assign IDs, other than OpenShift). |
| `global.affinity.enabled` | `true` | Require nodes labeled `openlm.com/role`. The installation guide sets `false`. See [Node placement](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/node-placement). |
| `global.taints.enabled` | `true` | Tolerate `openlm.com/role` taints. The installation guide sets `false`. |
| `global.masterIngress.enabled` | `false` | `true`: one Ingress for the whole platform. The installation guide sets `true`. |
| `global.masterIngress.hostname` | (empty) | Your `DOMAIN` |
| `global.masterIngress.ingressClassName` | `public` | Your ingress class |
| `global.masterIngress.secretName` | `openlm-lb-cert` | TLS secret for the Ingress |
| `global.masterIngress.apiBackendService` | `gateway-svc-openlm-gateway-tyk-gateway` | Service that receives `/api`. Matches the gateway release name `openlm-gateway`. |
| `global.ingressAnnotations` | nginx rewrite rules | Annotations on the Ingress(es). The installation guide removes the rewrite rules. |
| `global.routeSecurity.enabled` | `true` | OpenShift Routes: add HSTS and security headers |
| `global.routeSecurity.hstsMaxAge` | `31536000` | HSTS max-age in seconds |
| `global.routeSecurity.hstsIncludeSubDomains` | `true` | HSTS `includeSubDomains` |
| `global.traefikRoutes.enabled` | `false` | Alternative routing with Traefik IngressRoutes instead of the API gateway. Leave off. |

:::note[Defaults that differ from the guide]
Several defaults differ from what the guide uses (`affinity`, `taints`, `masterIngress`). The guide's values file always sets them explicitly, so the defaults don't matter as long as you start from it.
:::

## Shared configuration

Every service reads the settings in `openlm_config_generic.configmap.vars_list`. The values file sets the ones that depend on your installation, as the following table shows. [Sign-in and identity](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/identity-and-sign-in) or the comments of [step 4](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/install/step-4-values) explain each one.

| Setting | Set to |
|---|---|
| `LB_FQDN`, `INFRASTRUCTURE__LBFQDN` | `DOMAIN` |
| `AUTHORITY_URL`, `INFRASTRUCTURE__AUTHORITYURL`, `IssuerUri`, `UI_BASE_HREF_URL`, `UI_OAUTH_ISSUER_URL` | `https://DOMAIN/identity` |
| `OLM__K8s__ServiceNamespace` | `openlm` |
| `INFRASTRUCTURE__ServerDbPrefix` | `<DB_PREFIX>_operational` |
| `INFRASTRUCTURE__USESECURITY` | `true` |
| `DbType`, `DB_TYPE`, `DbConnectionConfig__DbType` | `SqlServer_SQLServerAuth` |

The guide sets `openlm_telemetry_config_generic.configmap.vars_list.TELEMETRY__ENABLED` to `false`. To send traces and metrics to your OpenTelemetry collector, set it to `true` together with `TELEMETRY__COLLECTORENDPOINT`.

## Per-component settings

Each component is a top-level key named after it (`identity:`, `licensesui:`, ...). You might need these settings for a component:

| Setting | What it does |
|---|---|
| `<component>.enabled` | Switch the component on or off |
| `<component>.configmap.vars_list.<NAME>` | One configuration value of that service |
| `<component>.resources` | CPU and memory requests and limits |
| `<component>.pvc.storageClassName` | Storage class, for the components that have a volume |
| `<component>.ingress.hostname` | Host name on its Route (OpenShift) |
| `<component>.securityContext.pod` | Pod security context |
| `<component>.secrets` | List of Secrets the component reads. Replacing it replaces the whole list. |

:::warning[One entry per component]
Write each component **once** in your values file. A second entry with the same name replaces the first, including all its settings. If you need settings in a second place, put them in a second values file and pass both with `-f`. Helm merges files, but not duplicate entries inside one file.
:::

## See the defaults

To see the top-level defaults, run:

```bash
helm show values openlm/openlm-platform --version "$OPENLM_VERSION" | less
```

A component's own defaults are in the chart package. To read them, pull and unpack the chart:

```bash
helm pull openlm/openlm-platform --version "$OPENLM_VERSION" --untar --untardir /tmp/openlm-chart
less /tmp/openlm-chart/openlm-platform/charts/<component>/values.yaml
```