Kubernetes values.yaml reference

This reference describes every supported configuration option in the Kubernetes values.yaml file used by the Baseshift Helm chart. Use it to customize your deployment or to better understand the configuration generated by the setup wizard.

System identifiers

These top-level values identify the Baseshift organization, Dub server, Helm chart version, cloud gateway, and image pull credentials used by the deployed components.

orgId: "<uuid provided by Baseshift>"
serverId: "<uuid provided by Baseshift>"
password: "<encryption password>"
gateway: "aws-gw-elb.dubhub.io:50052"
environment: "production"
chartVersion: "0.1.0"

Option	Default	Description
orgId	""	Baseshift organization ID. Provided by Baseshift.
serverId	""	Dub server ID generated by the setup wizard. Provided by Baseshift.
password	""	Encryption password used to encrypt data stored in Docker snapshot images. Required. Can contain letters and numbers (does not accept special characters).
gateway	"aws-gw-elb.dubhub.io:50052"	Baseshift gateway address used by the deployed components to communicate with Baseshift Cloud.
environment	"production"	Runtime environment. Do not change this value unless instructed by Baseshift.
chartVersion	"0.1.0"	Helm chart version value included in the generated configuration.

Replication server parameters

The repserver section configures the Replication Server StatefulSet.

repserver:
  enabled: true
  image:
    repository: registry.gitlab.com/dubhub/core/multi-ubuntu2404/repserver
    tag: master
    pullPolicy: Always
  resources:
    requests:
      cpu: "4"
      memory: "8Gi"
    limits:
      cpu: "16"
      memory: "32Gi"
  sharedMemorySize: "512Mi"
  proxyTimeout: "45s"
  storage:
    size: "250Gi"
    storageClass: ""
  ports:
    ssh: 15056
    tokenServer: 15057
    proxyServer: 50055
    cloneRangeStart: 32768
    cloneRangeEnd: 32812

Option	Default	Description
repserver.enabled	true	Deploys the Replication Server.
repserver.image.repository	registry.gitlab.com/dubhub/core/multi-ubuntu2404/repserver	Replication Server container image repository.
repserver.image.tag	master	Replication Server image tag.
repserver.image.pullPolicy	Always	Kubernetes image pull policy for the Replication Server image. Allows the replication server to receive updates, do not change this value.
repserver.resources.requests.cpu	"4"	CPU request for the Replication Server pod. Increasing the number of CPU cores will decrease the time it takes to create the snapshot.
repserver.resources.requests.memory	"8Gi"	Memory request for the Replication Server pod.
repserver.resources.limits.cpu	"16"	CPU limit for the Replication Server pod.
repserver.resources.limits.memory	"32Gi"	Memory limit for the Replication Server pod.
repserver.sharedMemorySize	"512Mi"	Shared memory size allocated for database operations.
repserver.storage.size	"250Gi"	Persistent storage size for the Replication Server. Recommended to be twice the size of the snapshot
repserver.storage.storageClass	""	Storage class for the Replication Server persistent volume. Leave empty to use the cluster default.
repserver.ports.ssh	15056	Required for the connector to connect to the Replication Server. This port is only exposed within the cluster.
repserver.ports.tokenServer	15057	Required for the connector to connect to the Replication Server. This port is only exposed within the cluster.
repserver.ports.proxyServer	50055	Required for the connector to connect to the Replication Server. This port is only exposed within the cluster.
repserver.ports.cloneRangeStart	32768	First port in the clone port range.
repserver.ports.cloneRangeEnd	32812	Last port in the clone port range. If required increase the range to accommodate more concurrent clones

Connector parameters

The agent section configures the Baseshift Connector deployment.

agent:
  enabled: true
  image:
    repository: public.ecr.aws/x5e2w4i3/proxy
    tag: master
    pullPolicy: Always
  id: ""
  token: ""
  resources:
    requests:
      cpu: "1"
      memory: "4Gi"
    limits:
      cpu: "4"
      memory: "16Gi"
  useTls: false
  awsSecretArn: ""
  verboseLogging: false
  hostNetwork: false

Option	Default	Description
agent.enabled	true	Deploys the Agent.
agent.image.repository	public.ecr.aws/x5e2w4i3/proxy	Agent container image repository.
agent.image.tag	master	Agent image tag.
agent.image.pullPolicy	Always	Kubernetes image pull policy for the Agent image. Allows the agent to receive updates, do not change this value.
agent.id	""	Agent ID generated by the setup wizard. Required when agent.enabled is true.
agent.token	""	Agent token generated by the setup wizard. Required when agent.enabled is true.
agent.resources.requests.cpu	"1"	CPU request for the Agent pod. If copying large amounts of data, it's recommended to increase this value to shorten the snapshot time.
agent.resources.requests.memory	"4Gi"	Memory request for the Agent pod.
agent.resources.limits.cpu	"4"	CPU limit for the Agent pod.
agent.resources.limits.memory	"16Gi"	Memory limit for the Agent pod.
agent.awsSecretArn	""	If using AWS Secrets Manager for database credentials, specify the secret ARN here. The setup wizard will set this value automatically.
agent.verboseLogging	false	Enables verbose Agent logging.
agent.hostNetwork	false	Runs the Agent with host networking. Useful for stable egress IPs, simpler IP allowlisting, or clusters without a NAT gateway.

Docker snapshot registry

Overview

The Docker snapshot registry stores the Docker snapshot images generated by the Replication Server.

Docker snapshot publishing is optional. If disabled, Baseshift continues to support server-hosted clones, but Docker snapshot images are not generated.

Supported registry providers:

• AWS ECR
• GCP Artifact Registry
• Azure Container Registry
• Harbor

The following sections describe the configuration required for each provider.

---

AWS ECR

Overview

Use the AWS ECR provider to publish Docker snapshot images to Amazon Elastic Container Registry.

Baseshift automatically creates the repository if it does not already exist.

Example configuration

dockerSnapshotRegistry:
  enabled: true
  provider: aws_ecr
  registry: "123456789012.dkr.ecr.eu-west-1.amazonaws.com"
  repository: "baseshift"
  pathPrefix: ""
  region: "eu-west-1"
  useTls: true
  auth:
    type: iamRole
    roleArn: "<ARN for the IRSA role>"

Configuration reference

Option	Default	Description
dockerSnapshotRegistry.enabled	false	Enables Docker snapshot generation and registry publishing.
dockerSnapshotRegistry.provider	harbor	Registry provider.
dockerSnapshotRegistry.registry	""	AWS ECR registry hostname, for example 123456789012.dkr.ecr.eu-west-1.amazonaws.com.
dockerSnapshotRegistry.repository	""	ECR repository used to store Docker snapshot images. The repository is created automatically if it does not exist.
dockerSnapshotRegistry.pathPrefix	""	Optional nested path below the repository (for example prod/myapp).
dockerSnapshotRegistry.region	""	AWS region containing the registry.
dockerSnapshotRegistry.useTls	true	Uses HTTPS for registry communication.
dockerSnapshotRegistry.auth.type	iamRole	Authentication method. Supported values are iamRole and accessKey.
dockerSnapshotRegistry.auth.roleArn	""	IAM role ARN for IRSA authentication. Required only when using iamRole.
dockerSnapshotRegistry.auth.accessKeyId	""	AWS access key ID. Required only when using accessKey.
dockerSnapshotRegistry.auth.secretAccessKey	""	AWS secret access key. Required only when using accessKey.

Authentication

The AWS ECR provider supports the following authentication methods:

• IRSA (recommended)
• IAM Role
• AWS Access Keys

IRSA is recommended for Amazon EKS deployments because it eliminates the need to manage long-lived credentials.

Required permissions

Grant the IAM role or IAM user the following permissions:

• ecr:CreateRepository
• ecr:DescribeRepositories
• ecr:GetAuthorizationToken
• ecr:BatchCheckLayerAvailability
• ecr:InitiateLayerUpload
• ecr:UploadLayerPart
• ecr:CompleteLayerUpload
• ecr:PutImage

Notes

• Baseshift automatically creates the repository when required.
• pathPrefix can be used to organize snapshots by environment or application.

---

GCP Artifact Registry

Overview

Use the GCP Artifact Registry provider to publish Docker snapshot images to Google Artifact Registry.

The target repository must exist before deploying Baseshift.

Example configuration

dockerSnapshotRegistry:
  enabled: true
  provider: gcp_artifact_registry
  registry: "us-central1-docker.pkg.dev"
  project: "my-project"
  repository: "baseshift"
  pathPrefix: ""
  useTls: true
  auth:
    type: workloadIdentity
    serviceAccountEmail: "baseshift-ecr-sa@my-project.iam.gserviceaccount.com"

Configuration reference

Option	Default	Description
dockerSnapshotRegistry.enabled	false	Enables Docker snapshot generation and registry publishing.
dockerSnapshotRegistry.provider	gcp_artifact_registry	Registry provider.
dockerSnapshotRegistry.registry	""	Artifact Registry hostname, for example us-central1-docker.pkg.dev.
dockerSnapshotRegistry.project	""	Google Cloud project containing the repository.
dockerSnapshotRegistry.repository	""	Artifact Registry repository used to store Docker snapshot images.
dockerSnapshotRegistry.pathPrefix	""	Optional nested path below the repository.
dockerSnapshotRegistry.useTls	true	Uses HTTPS for registry communication.
dockerSnapshotRegistry.auth.type	workloadIdentity	Authentication method. Supported values are workloadIdentity, serviceAccountKey, and basic.
dockerSnapshotRegistry.auth.username	""	Username for basic authentication.
dockerSnapshotRegistry.auth.password	""	Password or token for basic authentication.
dockerSnapshotRegistry.auth.serviceAccountEmail	""	Service account email used with Workload Identity.
dockerSnapshotRegistry.auth.serviceAccountKey	""	Service account JSON key used. Configure using --set-file dockerSnapshotRegistry.auth.serviceAccountKey=<path to key file>.

Authentication

Supported authentication methods:

• GKE Workload Identity (recommended)
• Service Account Key
• Basic authentication

Required permissions

Grant the service account or user:

• roles/artifactregistry.writer

When using Workload Identity, also grant:

• roles/iam.workloadIdentityUser

Notes

• Baseshift does not create Artifact Registry repositories.
• Create the repository before deploying the Helm chart.
• Configure the service account key using --set-file dockerSnapshotRegistry.auth.serviceAccountKey=<path>.

---

Azure Container Registry

Overview

Use the Azure Container Registry provider to publish Docker snapshot images to Azure Container Registry.

Baseshift automatically creates the repository if it does not already exist.

Example configuration

dockerSnapshotRegistry:
  enabled: true
  provider: azure_acr
  registry: "myregistry.azurecr.io"
  repository: "baseshift"
  pathPrefix: ""
  useTls: true
  auth:
    type: basic
    username: "<repository token name>"
    password: "<repository token password>"

Configuration reference

Option	Default	Description
dockerSnapshotRegistry.enabled	false	Enables Docker snapshot generation and registry publishing.
dockerSnapshotRegistry.provider	azure_acr	Registry provider.
dockerSnapshotRegistry.registry	""	Azure Container Registry hostname.
dockerSnapshotRegistry.repository	""	Repository used to store Docker snapshot images. Created automatically if it does not exist.
dockerSnapshotRegistry.pathPrefix	""	Optional nested path below the repository.
dockerSnapshotRegistry.useTls	true	Uses HTTPS for registry communication.
dockerSnapshotRegistry.auth.type	workloadIdentity	Authentication method. Supported values are workloadIdentity and basic.
dockerSnapshotRegistry.auth.clientId	""	Managed Identity client ID.
dockerSnapshotRegistry.auth.tenantId	""	Optional Azure tenant ID override.
dockerSnapshotRegistry.auth.federatedTokenFile	""	Optional federated token file override.
dockerSnapshotRegistry.auth.username	""	Repository token name when using basic.
dockerSnapshotRegistry.auth.password	""	Repository token password when using basic.

Authentication

Supported authentication methods:

• Azure Workload Identity (recommended)
• Repository token

Required permissions

Grant one of the following:

• AcrPush role on the registry

• A repository-scoped token with:

  • repositories/<repository>/content/read
  • repositories/<repository>/content/write
  • repositories/<repository>/metadata/read
  • repositories/<repository>/metadata/write

Notes

• Baseshift automatically creates the repository when required.
• Azure Workload Identity is recommended over repository tokens whenever possible.

---

Harbor

Overview

Use the Harbor provider to publish Docker snapshot images to a Harbor container registry. The target Harbor project must exist before deploying Baseshift.

Example configuration

dockerSnapshotRegistry:
  enabled: true
  provider: harbor
  registry: "harbor.example.com"
  pullRegistry: ""
  port: ""
  project: "baseshift"
  pathPrefix: ""
  useTls: true
  auth:
    type: basic
    username: ""
    password: ""

Configuration reference

Option	Default	Description
dockerSnapshotRegistry.enabled	false	Enables Docker snapshot generation and registry publishing.
dockerSnapshotRegistry.provider	harbor	Registry provider.
dockerSnapshotRegistry.registry	""	Harbor registry hostname.
dockerSnapshotRegistry.pullRegistry	""	Optional. Registry hostname returned to users when it differs from the push registry.
dockerSnapshotRegistry.port	""	Optional Harbor registry port.
dockerSnapshotRegistry.project	""	Harbor project used to store Docker snapshot images.
dockerSnapshotRegistry.pathPrefix	""	Optional nested path below the project.
dockerSnapshotRegistry.useTls	true	Uses HTTPS for registry communication.
dockerSnapshotRegistry.auth.type	basic	Authentication method. Harbor supports only basic authentication.
dockerSnapshotRegistry.auth.username	""	Harbor username or robot account name.
dockerSnapshotRegistry.auth.password	""	Harbor password or robot account token.

Authentication

Harbor supports:

• Harbor user accounts
• Harbor robot accounts

Required permissions

Project user:

• Developer role or higher

Robot account:

• Push permission for the target project or repository

Notes

• Baseshift does not create Harbor projects.
• Create the Harbor project before deploying the Helm chart.
• Robot accounts are recommended for automated deployments because they can be scoped to a single project.

Server clone access

The cloneService section controls how database clones are exposed inside or outside the Kubernetes cluster, including service mode, provider-specific load balancer behavior, external hostnames, and service annotations.

cloneService:
  mode: clusterIP
  provider: aws
  externalHostname: ""
  annotations:
    external-dns.alpha.kubernetes.io/hostname: "clones.mydb.example.com"
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"
    "cloneService.annotations.service.beta.kubernetes.io/aws-load-balancer-subnets: "subnet-id1,subnet-id2"

Option	Default	Description
cloneService.mode	clusterIP	Clone access mode. Controls how clone traffic is exposed.
cloneService.provider	aws	Provider-specific behavior for lb mode. Supported values are aws, gcp, and generic.
cloneService.externalHostname	""	External DNS name that resolves to the LoadBalancer in lb mode. When set, clone connection strings use this hostname instead of 127.0.0.1. Note that you will need to update the release with externalHostname after the LoadBalancer is created.
cloneService.annotations	{}	Extra annotations added to the clone Service. These annotations do not apply to the internal Agent ClusterIP Service.

Supported cloneService.mode values:

Mode	Description
lb	Creates a clone-only LoadBalancer Service so the clones can be accessed from outside the cluster.
clusterIP	Creates a clone-only ClusterIP Service. In this mode clones can be accessed only from within the cluster. This is a separate service from the internal Agent ClusterIP Service.
none	Clones are not exposed. Use this for snapshot or image-push only deployments.

Supported cloneService.provider values for lb mode:

Provider	Description
aws	Adds AWS NLB annotations and names the NLB lb-<release>.
gcp	Uses GKE's default L4 LoadBalancer behavior.
generic	Does not add provider-specific LoadBalancer annotations.

Notes:

• When using aws provider, specify the subnets for the NLB using the cloneService.annotations.service.beta.kubernetes.io/aws-load-balancer-subnets annotation.
• Set cloneService.externalHostname to an external DNS name that resolves to the LoadBalancer after it is created.

Pod scheduling and metadata

These options apply Kubernetes metadata and scheduling rules to the deployed pods.

Option	Default	Description
podAnnotations	{}	Additional annotations applied to pods.
nodeSelector	{}	Node selector rules for pod scheduling.
tolerations	[]	Tolerations for scheduling pods on tainted nodes.
affinity	{}	Affinity and anti-affinity rules for pod scheduling.