Configuration overview

Everything in the Configure group is chart configuration. It is declarative, it is applied by a redeploy, and it rolls pods. Dreadnode exposes the same chart settings through three configuration interfaces:

Interface	Use it for	Configuration shape
Helm	Existing Kubernetes clusters	Umbrella-chart values overlay
Admin Console	Interactive Embedded Cluster installs and edits	Labeled fields under Config
KOTS ConfigValues	Automated Embedded Cluster installation	Replicated ConfigValues YAML

Settings that live in the running product instead — model deployments, credentials, users, organizations, signup rules — are not here. See Model deployments and Users and organizations.

Every configuration section below uses the same three tabs. Your selection follows you across this section. A KOTS ConfigValues file uses the Admin Console field’s internal item name, not the Helm value path. Every ConfigValues scalar is a string, including numbers and booleans; password items use valuePlaintext so KOTS encrypts them during installation.

ConfigValues automates the initial installation

Embedded Cluster accepts a ConfigValues file during the initial install. Update an existing Embedded Cluster deployment through the Admin Console; headless updates are not supported.

Start with the domain, scheme, ingress class, and resource preset on this page. Use the focused guides for settings that need additional infrastructure or verification.

TLS certificates Prepare a certificate, create the Kubernetes Secret, and verify HTTPS.

External data stores Replace bundled PostgreSQL, ClickHouse, or MinIO with managed services.

Sandbox runtime Choose on-cluster OpenSandbox or configure E2B cloud sandboxes.

Authentication and email Configure SMTP, OAuth providers, and signup policy.

Chart overrides and tuning Tune logging and worker concurrency or inject additional environment variables.

Domain and scheme

The domain appears in every URL Dreadnode generates, including OAuth redirects, presigned S3 URLs, and password reset links.

Helm

Set both values in your Helm overlay:

global:
  domain: dreadnode.example.com
  scheme: https # http (default) or https

Admin Console

Open Config → Dreadnode Identity. Set Domain to dreadnode.example.com and URL Scheme to HTTPS.

KOTS ConfigValues

A ConfigValues-only Embedded Cluster installation should start on HTTP because the TLS Secret does not exist in the new cluster yet:

apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    domain:
      value: dreadnode.example.com
    scheme:
      value: http

Set both values correctly before first use. When you change either value, redeploy the release and access Dreadnode through the newly configured URL. Before changing an Embedded Cluster install from HTTP to HTTPS, create the TLS Secret and follow TLS certificates.

Ingress

The chart emits standard Kubernetes Ingress resources. Set the class to the controller that should reconcile them:

Helm

global:
  ingress:
    className: traefik
    annotations: {}
    httpsRedirect: auto # auto | traefik | none

Admin Console

Open Config → Networking & TLS. Set Ingress Class Name, Ingress Annotations, and HTTP to HTTPS Redirect. Keep the default class, traefik, for Embedded Cluster.

KOTS ConfigValues

apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    ingress_class_name:
      value: traefik
    https_redirect:
      value: auto

Add ingress_annotations to the same document only when your controller requires them:

apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    ingress_class_name:
      value: traefik
    https_redirect:
      value: auto
    ingress_annotations:
      value: |
        nginx.ingress.kubernetes.io/ssl-redirect: "true"

Global annotations cascade to the API, frontend, and MinIO Ingress resources. Use subchart-specific annotations only when one route needs different controller behavior.

Choosing https decides what URLs Dreadnode generates. It does not by itself stop the ingress controller answering on port 80, so a bookmarked http:// link still loads a working UI whose API calls travel in cleartext. The httpsRedirect setting is what closes that:

Value	Behavior
auto	Default. Renders a Traefik redirect Middleware when an enabled Ingress resolves to class traefik. Covers Embedded Cluster, which bundles Traefik.
traefik	Always renders it. Use when Traefik is the cluster’s default class and you left className empty.
none	Renders nothing. Use only when a load balancer or proxy ahead of the cluster already redirects.

On a Helm install using another controller, the chart cannot render a portable redirect, so you own it through annotations. For ingress-nginx:

global:
  ingress:
    className: nginx
    annotations:
      nginx.ingress.kubernetes.io/ssl-redirect: 'true'

Client IP resolution

Helm

dreadnode-api:
  config:
    network:
      trustedProxyHops: 1

Admin Console

Open Config → Networking & TLS and set Trusted Proxy Hops.

KOTS ConfigValues

apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    trusted_proxy_hops:
      value: "1"

Dreadnode reads the client address this many hops from the right of X-Forwarded-For. The default of 1 is correct when your ingress controller is the only thing in front of the platform. Add one for each additional load balancer or CDN. Setting it too low attributes activity to your load balancer instead of the user; setting it too high lets a client spoof its own address in the audit trail.

Outbound finding submissions

Item submission integrations deliver findings to external systems — Linear, Jira, bug bounty platforms, and arbitrary webhooks. Turn them off if findings must not leave your network:

Helm

dreadnode-api:
  config:
    integrations:
      enabled: false

Admin Console

There is no dedicated field. Open Config → Advanced → Advanced Helm Values and add:

dreadnode-api:
  config:
    integrations:
      enabled: false

KOTS ConfigValues

apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    advanced_helm_values:
      value: |
        dreadnode-api:
          config:
            integrations:
              enabled: false

This is a hard stop rather than a display preference. The integrations API refuses every request while it is off, so a user driving the API directly cannot submit either, and a submission already in progress when you apply the change is recorded as failed instead of being delivered.

Existing connections and submission history are kept. Turning integrations back on makes them reachable again with nothing to reconfigure — but read the audit trail first if you switched off in response to an incident, because the history is unreachable through the product while the switch is off.

Storage volumes

Bundled PostgreSQL, ClickHouse, and object storage each get their own volume:

Helm

dreadnode-base:
  postgresql:
    primary:
      persistence:
        size: 8Gi
        storageClass: '' # empty uses the cluster default
  clickhouse:
    persistence:
      size: 10Gi
  minio:
    persistence:
      size: 10Gi

Admin Console

Open Config → Data Stores. Set PostgreSQL Volume Size, ClickHouse Volume Size, and Object Storage Volume Size while each store remains in its in-cluster mode. Embedded Cluster manages the StorageClass.

KOTS ConfigValues

apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    postgres_storage_size:
      value: 8Gi
    clickhouse_storage_size:
      value: 10Gi
    minio_storage_size:
      value: 10Gi

Size these before the first deploy. Growing a volume afterward requires a StorageClass with allowVolumeExpansion plus a manual edit, and shrinking one is not possible at all.

ClickHouse is the volume that fills first, because every agent run writes trace spans to it. If you would rather cap growth than add disk, see the retention settings in Operations.

Resource sizing

Helm

global:
  resourcesPreset: small # small | medium | large

Admin Console

Open Config → Scaling & Resources and set Resource Preset.

KOTS ConfigValues

apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    resources_preset:
      value: small # small | medium | large

The preset applies a component-specific resource profile across the release:

Preset	Suggested deployment size	API requests	API limits
small	Up to about 50 users	250m, 1536Mi	500m, 2Gi
medium	About 50–200 users	500m, 2Gi	1000m, 3Gi
large	More than 200 users	1000m, 3Gi	4000m, 8Gi

The small preset is the default. See Install with Helm — Resource guidance for cluster capacity guidance.

Apply changes

Helm

Keep your overlay in source control and apply it with helm upgrade:

helm upgrade dreadnode oci://registry.replicated.com/dreadnode/dreadnode \
    --version <version> \
    --namespace <namespace> \
    -f values.yaml

Admin Console

Select Save config, review the pending changes, then select Deploy. Saving without deploying does not update the running application.

KOTS ConfigValues

Pass the complete ConfigValues document during the initial Embedded Cluster installation:

sudo ./dreadnode install \
    --license license.yaml \
    --config-values dreadnode-config.yaml \
    --admin-console-password '<admin-console-password>'

Preflight checks run as part of the command. After installation, make configuration changes through the Admin Console.

For settings without a dedicated Admin Console field or ConfigValues item, use Advanced Helm Values. For every available Helm value and its default, pull the chart’s values file:

helm show values oci://registry.replicated.com/dreadnode/dreadnode --version <version>