> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usekestrel.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration Reference

> Complete reference for all Kestrel Operator configuration options

## Helm Values Reference

The Kestrel Operator is configured through Helm values. Below is a complete reference of all available configuration options.

## Quick Configuration Examples

### Basic Cilium Setup

```yaml theme={null}
auth:
  token: "your-token-here"

operator:
  cluster:
    id: "cluster-uuid"
    name: "production-cluster"
```

### Istio Service Mesh Setup

```yaml theme={null}
auth:
  token: "your-token-here"

operator:
  cluster:
    id: "cluster-uuid"
    name: "production-cluster"
  cilium:
    disableFlows: true
  istio:
    enabled: true
    alsPort: 8080
```

### Safe-Apply Enabled

```yaml theme={null}
auth:
  token: "your-token-here"

operator:
  cluster:
    id: "cluster-uuid"
    name: "production-cluster"
  safeApply:
    enabled: true
```

## Complete Values Reference

### Image Configuration

#### `image.repository`

* **Type**: string
* **Default**: `ghcr.io/kestrelai/kestrel-operator`
* **Description**: Container image repository

#### `image.tag`

* **Type**: string
* **Default**: `latest`
* **Description**: Container image tag

#### `image.pullPolicy`

* **Type**: string
* **Default**: `IfNotPresent`
* **Description**: Image pull policy

### Authentication

#### `auth.token` (Required)

* **Type**: string
* **Default**: `""`
* **Description**: JWT token for operator authentication
* **Example**: `"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."`

<Note>
  Generate this token through the Kestrel AI Dashboard. The token automatically renews every 24 hours.
</Note>

### Server Connection

#### `server.host`

* **Type**: string
* **Default**: `grpc.platform.usekestrel.ai`
* **Description**: Kestrel AI platform gRPC endpoint

#### `server.port`

* **Type**: integer
* **Default**: `443`
* **Description**: gRPC server port

### Cilium Integration

#### `operator.cilium.disableFlows`

* **Type**: boolean
* **Default**: `false`
* **Description**: Disable Cilium flow collection entirely

Set to `true` when:

* Using Istio for flow collection instead
* Cluster doesn't have Cilium installed
* Only want resource inventory management

#### `operator.cilium.hubble.tls.forceDisable`

* **Type**: boolean
* **Default**: `false`
* **Description**: Force disable TLS for Hubble connections

<Info>
  By default, the operator attempts to use TLS when connecting to Hubble Relay. Only disable if your Hubble setup doesn't support TLS.
</Info>

### Istio Integration

#### `operator.istio.enabled`

* **Type**: boolean
* **Default**: `false`
* **Description**: Enable Istio Access Log Service (ALS) for L7 flow collection

#### `operator.istio.alsPort`

* **Type**: integer
* **Default**: `8080`
* **Description**: Port for the ALS gRPC server

<Note>
  When enabling Istio, you must also configure Istio's mesh configuration to define the Kestrel Operator as an extension provider. See the Istio mesh configuration section below.
</Note>

### Istio Mesh Configuration

The operator's Helm chart automatically creates the `Telemetry` resources, but you must register the extension providers in Istio's mesh configuration.

**Required extension providers:**

```yaml theme={null}
meshConfig:
  extensionProviders:
    - name: kestrel-operator-als
      envoyHttpAls:
        service: kestrel-operator-als.kestrel-ai.svc.cluster.local
        port: 8080
    - name: kestrel-operator-als-tcp
      envoyTcpAls:
        service: kestrel-operator-als.kestrel-ai.svc.cluster.local
        port: 8080
```

**For new Istio installations** (or Helm-managed Istio), pass these as Helm `--set` flags:

```bash theme={null}
helm upgrade --install istiod istio/istiod -n istio-system \
  --set 'meshConfig.extensionProviders[0].name=kestrel-operator-als' \
  --set 'meshConfig.extensionProviders[0].envoyHttpAls.service=kestrel-operator-als.kestrel-ai.svc.cluster.local' \
  --set 'meshConfig.extensionProviders[0].envoyHttpAls.port=8080' \
  --set 'meshConfig.extensionProviders[1].name=kestrel-operator-als-tcp' \
  --set 'meshConfig.extensionProviders[1].envoyTcpAls.service=kestrel-operator-als.kestrel-ai.svc.cluster.local' \
  --set 'meshConfig.extensionProviders[1].envoyTcpAls.port=8080'
```

**For existing installations without custom mesh config**, use `kubectl patch`:

```bash theme={null}
kubectl patch configmap istio -n istio-system --type merge -p '{"data":{"mesh":"extensionProviders:\n- name: kestrel-operator-als\n  envoyHttpAls:\n    service: kestrel-operator-als.kestrel-ai.svc.cluster.local\n    port: 8080\n- name: kestrel-operator-als-tcp\n  envoyTcpAls:\n    service: kestrel-operator-als.kestrel-ai.svc.cluster.local\n    port: 8080"}}'
```

<Warning>
  The `kubectl patch --type merge` command replaces the entire `mesh` key. Only use this if you don't have existing custom mesh configuration. If you do, use the edit-in-place approach below.
</Warning>

**For existing installations with custom mesh config**, edit the ConfigMap directly to preserve your settings:

```bash theme={null}
kubectl edit configmap istio -n istio-system
```

Add the `extensionProviders` block into the existing `mesh:` YAML, keeping all other settings intact. Then restart Istiod:

```bash theme={null}
kubectl rollout restart deployment istiod -n istio-system
```

### Namespace Sidecar Injection

Application namespaces must have Istio sidecar injection enabled for L7 flow collection to work. Label each namespace before deploying workloads:

```bash theme={null}
kubectl label namespace <your-namespace> istio-injection=enabled
```

If workloads are already running, add the label and restart deployments:

```bash theme={null}
kubectl label namespace <your-namespace> istio-injection=enabled --overwrite
kubectl rollout restart deployment -n <your-namespace> <deployment-name>
```

Verify sidecars are injected by checking that pods have an `istio-proxy` container:

```bash theme={null}
kubectl get pods -n <your-namespace> -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{range .spec.containers[*]}{.name}{" "}{end}{"\n"}{end}' | grep istio-proxy
```

If sidecars are injected, each pod will show `istio-proxy` in the container list.

### Safe-Apply Configuration

#### `operator.safeApply.enabled`

* **Type**: boolean
* **Default**: `false`
* **Description**: Grant RBAC permissions for applying approved YAML changes

When enabled, the operator can:

* Create network policies
* Update existing resources
* Delete resources (with approval)

## Next Steps

* [Troubleshoot configuration issues](/operator/troubleshooting)
* [Monitor operator performance](/operator/monitoring)
* [Configure namespace permissions](/permissions/namespaces)