rstudio-connect

Posit Connect

Official Helm chart for Posit Connect

Business Users and Collaborators use R and Python data products on Posit Connect that are published by Data Scientists.

Best practices

Helm charts are very useful tools for deploying resources into Kubernetes, however, they do require some familiarity with kubernetes and helm itself. Please ensure you have adequate training and IT support before deploying these charts into production environments. Reach out to your account representative if you need help deciding whether Helm is a good choice for your deployment.

To ensure reproducibility in your environment and insulate yourself from future changes, please:

• "Pin" the version of the Helm chart that you are using. You can do this using the:

  • helm dependency command and the associated "Chart.lock" files or

  • the --version flag.

    :::{.callout-important} This protects you from breaking changes** :::

• Before upgrading check for breaking changes using helm-diff plugin and helm diff upgrade.

• Read NEWS.md for updates on breaking changes and the documentation below on how to use the chart.

Installing the chart

To install the chart with the release name my-release at version 0.21.0:

helm repo add rstudio https://helm.rstudio.com
helm upgrade --install my-release rstudio/rstudio-connect --version=0.21.0

To explore other chart versions, look at:

helm search repo rstudio/rstudio-connect -l

Upgrade guidance

0.20.1

• Chart version 0.10.0 changes the default execution backend to use a new Off-Host Execution implementation: backends.kubernetes.enabled now defaults to true and launcher.enabled now defaults to false. New installations use the new implementation by default. To continue using the Launcher, set launcher.enabled: true and backends.kubernetes.enabled: false in your values.yaml. See the upgrade guide for details on transitioning to the new implementation.
  • IMPORTANT When backends.kubernetes.enabled=true, service accounts used for content execution require the connect.posit.co/service-account label.

0.20.0

• Chart version 0.20.0 switches default images from ghcr.io/rstudio/ to the posit/ namespace on Docker Hub (also available at ghcr.io/posit-dev/). See the migration guide for details.
• Image tag format changed from {tagPrefix}{appVersion} to {appVersion}-{os}. The chart will fail with a clear error if you have image.tagPrefix set — replace it with image.os.
• launcher.customRuntimeYaml and launcher.additionalRuntimeImages have been removed. Use executionEnvironments instead.

0.9.0

• Chart version 0.9.0 adds support for the direct Kubernetes runner via backends.kubernetes.enabled. See the upgrade guide for details on transitioning from launcher.enabled.

0.8.0

• When upgrading to version 0.8.0 or later, Connect now runs in Off-Host Execution mode by default
• If you desire to run Connect in Local Execution mode, then set securityContext.privileged: true and launcher.enabled: false

Required configuration

To function, this chart requires the following:

• A license file. See the Licensing section below for more details.
• A Kubernetes PersistentVolume that contains the data directory for Connect.
  • If sharedStorage.create is set, it creates a Persistent Volume Claim (PVC) that relies on the default storage class to generate the PersistentVolume. Most Kubernetes environments do not have a default storage class that you can use with ReadWriteMany access mode out-of-the-box. In this case, we recommend you disable sharedStorage.create and create your own PersistentVolume and PersistentVolumeClaim, then mount them into the container by specifying the pod.volumes and pod.volumeMounts parameters, or by specifying your PersistentVolumeClaim using sharedStorage.name and sharedStorage.mount.
  • If you cannot use a PersistentVolume to properly mount your data directory, mount your data in the container by using a regular Kubernetes Volume, specified in pod.volumes and pod.volumeMounts.

Licensing

This chart supports activating the product using a license file.

We recommend storing a license file as a Secret and setting the license.file.secret and license.file.secretKey values accordingly.

First, create the secret declaratively with YAML or imperatively using the following command:

kubectl create secret generic rstudio-connect-license --from-file=licenses/rstudio-connect.lic

Second, specify the following values:

license:
  file:
    secret: rstudio-connect-license
    secretKey: rstudio-connect.lic

Alternatively, license files can be set during helm install with the following argument:

--set-file license.file.contents=licenses/rstudio-connect.lic

Database

Connect requires a PostgreSQL database when running in Kubernetes. You must configure a valid connection URI and a password for the product to function correctly. Both the connection URI and password may be specified in the config section of values.yaml. However, we recommend only adding the connection URI and putting the database password in a Kubernetes Secret, which can be automatically set as an environment variable.

Database configuration

Add the following to your values.yaml, replacing the URL with your database details.

config:
  Database:
    Provider: "Postgres"
  Postgres:
    URL: "postgres://<USERNAME>@<HOST>:<PORT>/<DATABASE>"

Database password

First, create a Secret declaratively with YAML or imperatively using the following command (replacing with your actual password):

kubectl create secret generic rstudio-connect-database --from-literal=password=YOURPASSWORDHERE

Second, specify the following in your values.yaml:

pod:
  env:
    - name: CONNECT_POSTGRES_PASSWORD
      valueFrom:
        secretKeyRef:
          name: rstudio-connect-database
          key: password

Alternatively, database passwords may be set during helm install with the following argument:

--set config.Postgres.Password="<YOUR_PASSWORD_HERE>"

Chronicle

Starting with Connect 2026.06, Chronicle is built into Connect and can be enabled by setting config.Chronicle.Enabled: true. Chronicle also requires Connect's Prometheus metrics endpoint, which this chart enables by default (prometheus.enabled: true). At least one storage backend -- local or S3 -- must also be configured, or Chronicle will fail to start.

Chronicle local storage

Chronicle's data directory must be separate from Connect's own data directory (sharedStorage), so a dedicated volume should be mounted for it. The following example creates a PersistentVolumeClaim via extraObjects and mounts it into the Connect pod with pod.volumes / pod.volumeMounts:

extraObjects:
  - apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      name: my-release-chronicle-data
    spec:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 10Gi

pod:
  volumes:
    - name: chronicle-data
      persistentVolumeClaim:
        claimName: my-release-chronicle-data
  volumeMounts:
    - name: chronicle-data
      mountPath: /var/lib/posit-chronicle/data

config:
  Chronicle:
    Enabled: true
    LocalStorageEnabled: true
    LocalStorageLocation: /var/lib/posit-chronicle/data

If persistence isn't needed (for example, local testing), LocalStorageEnabled: true alone is enough -- Chronicle will write to its default path (/var/lib/posit-chronicle/data) on the pod's ephemeral filesystem, and that data is lost on restart.

If you run with replicas > 1, or use off-host execution (backends.kubernetes.enabled or launcher.enabled) on a platform other than AWS, the volume must support ReadWriteMany so every pod can share the same data. On AWS, prefer S3 storage instead so no shared volume is needed.

Chronicle S3 storage

Alternatively, Chronicle can write directly to an S3 bucket, which avoids the need for shared storage entirely:

config:
  Chronicle:
    Enabled: true
    S3StorageEnabled: true
    S3Bucket: my-chronicle-bucket
    S3Region: us-east-1

S3Bucket and S3Region are both required when S3StorageEnabled is set. Chronicle uses the standard AWS credential chain to access the bucket; on EKS, IAM Roles for Service Accounts can be attached to the chart's service account:

rbac:
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::123456789000:role/iam-role-name-here

Whichever credentials Chronicle uses need s3:GetObject, s3:ListBucket, s3:PutObject, and s3:DeleteObject permissions on the bucket (and prefix, if S3Prefix is set).

For more information on running Chronicle within Connect, see the Connect Chronicle documentation.

Chronicle settings not exposed by Connect

Connect rewrites Chronicle's configuration file on every start, so it cannot be edited directly. Use chronicle.localConfig for anything config.Chronicle does not expose. Chronicle applies it after the configuration Connect generates, so any key set here takes precedence.

Keys are Chronicle's own sections and properties, not config.Chronicle keys — see the Chronicle configuration reference. Check the Connect configuration reference for the Chronicle settings your Connect version exposes.

chronicle:
  localConfig:
    Logging:
      Level: DEBUG

Chronicle reads AWS credentials from the environment first, so grant the pod bucket access however the cluster normally does it

Setting this adds an init container that prepares Chronicle's configuration directory: Chronicle creates its socket there as the posit-chronicle user, so the directory has to be a writable volume rather than a read-only mount. It requires a pod running as root, which is Connect's default.

::: {.callout-warning} Chronicle refuses to start on a property it does not recognize. Check every property exists in the Chronicle version bundled with the Connect you are deploying. :::

Deprecated Chronicle Agent

::: {.callout-warning} Deprecated: The sidecar support for Chronicle in this helm chart is deprecated and will be removed in a future release. Use the config options described above to enable Chronicle. :::

This chart supports use of a sidecar Chronicle agent to report data to a Chronicle server. The agent can be enabled by setting chronicleAgent.enabled=true.

By default, the chart will attempt to lookup an existing Chronicle server deployed in the release namespace. The searched namespace can be changed setting by chronicleAgent.serverNamespace. If a server exists, it will set the Chronicle agent's server value to the server's service name and will use an agent version to match the server version. This auto-discovery behavior can be disabled by setting chronicleAgent.autoDiscovery=false.

To set the server address and/or version manually, set the following values:

chronicleAgent:
  enabled: true
  serverAddress: <server-address>
  image:
    tag: <agent-version>

If preferred, the Chronicle agent can be directly defined as a sidecar container using either initContainers (recommended) or sidecar values. Below is an example of directly defining the Chronicle agent as a native sidecar container using initContainers:

initContainers:
  - name: chronicle-agent
    restartPolicy: Always
    image: ghcr.io/rstudio/chronicle-agent:<agent-version>
    env:
      - name: CHRONICLE_SERVER_ADDRESS
        value: "http://<address>"
      - name: CHRONICLE_CONNECT_APIKEY
        valueFrom:
          secretKeyRef:
            name: connect
            key: apikey

For more information on Chronicle, see the Chronicle documentation.

Chronicle Connect API Key

::: {.callout-warning} Deprecated: The sidecar support for Chronicle in this helm chart is deprecated and will be removed in a future release. :::

In order to communicate with Connect, the Chronicle agent must be passed an API key. This can either be done by passing a Kubernetes secret (recommended) or by setting the key directly as an environment variable. Below is an example of how to set the API key using a secret:

chronicleAgent:
  enabled: true
  connectApiKey:
    valueFrom:
      secretKeyRef:
        name: <secret-name>
        key: <key-name>

Due to the way Connect manages its API keys, it is currently not possible to provision an API key automatically for the Chronicle agent at the time of deployment. To workaround this issue in a fresh deployment, you can initially leave the API key unset for the Chronicle agent, deploy the chart, create an administrator API key, and then provision a secret with the API key. Once the secret is created, the value of chronicleAgent.connectApiKey.secretKeyRef can be set and the release can be upgraded to include the new value.

Execution environments

This chart supports declarative management of execution environments via ExecutionEnvironments.ConfigFilePath. Requires Connect version 2026.03.0 or later. Changes to executionEnvironments take effect on every helm upgrade without requiring a pod restart or database reset.

When executionEnvironments is set, the chart renders the list into a dedicated ConfigMap and mounts it into the Connect pod. Connect only manages the execution environments defined in this file. You can still create and manage additional execution environments separately through the Connect UI or API.

By default, the chart sets ExecutionEnvironments.ConfigFilePath to /etc/rstudio-connect/execution-environments/environments.yaml and mounts the ConfigMap at /etc/rstudio-connect/execution-environments/. If you set config.ExecutionEnvironments.ConfigFilePath to a custom path, the chart uses that path instead and mounts the ConfigMap at its parent directory.

The chart deliberately excludes this ConfigMap from the pod's checksum annotations, so changes do not trigger a pod restart. The kubelet updates the mounted file automatically when the ConfigMap changes (typically within 60-120 seconds), and Connect detects the update automatically.

Example values.yaml:

executionEnvironments:
  - name: ghcr.io/my-org/connect-runtime:ubuntu22
    title: "Default Runtime"
    matching: any
    python:
      installations:
        - version: "3.11.3"
          path: /opt/python/3.11.3/bin/python3
    r:
      installations:
        - version: "4.4.0"
          path: /opt/R/4.4.0/bin/R

OpenTelemetry

When config.OpenTelemetry.Enabled is true, the chart automatically injects the pod's IP address as CONNECT_OPENTELEMETRY_COLLECTORADVERTISEHOST via the Kubernetes Downward API. This allows content job pods to reach Connect's embedded OTel collector directly (pod-to-pod).

To override the advertise host, set CONNECT_OPENTELEMETRY_COLLECTORADVERTISEHOST explicitly in pod.env.

General principles

• In most places, we opt to pass Helm values over configmaps. We translate these into the valid .gcfg file format required by rstudio-connect.
• rstudio-connect exposes Prometheus metrics via its built-in /metrics endpoint

Configuration file

The configuration values all take the form of usual Helm values so you can set the database password with something like:

... --set config.Postgres.Password=mypassword ...

The Helm config values are converted into the rstudio-connect.gcfg service configuration file via go-templating.

Values

Key	Type	Default	Description
affinity	object	{}	A map used verbatim as the pod's "affinity" definition
args	list	[]	The pod's run arguments. By default, it uses the container's default
backends.kubernetes.defaultInitContainer.enabled	bool	true	Whether to enable the defaultInitContainer. If disabled, you must ensure that the session components are available another way. Changing the default setting is an advanced option and not recommended. For more information on how Connect uses the session init container refer to https://docs.posit.co/connect/admin/appendix/off-host/arch-overview/#runtime-init-container
backends.kubernetes.defaultInitContainer.imagePullPolicy	string	""	The imagePullPolicy for the default initContainer
backends.kubernetes.defaultInitContainer.repository	string	"posit/connect-content-init"	The repository to use for the Content InitContainer image
backends.kubernetes.defaultInitContainer.resources	object	{}	Optional resources for the default initContainer
backends.kubernetes.defaultInitContainer.securityContext	object	{}	The securityContext for the default initContainer
backends.kubernetes.defaultInitContainer.tag	string	""	Overrides the image tag whose default is the chart appVersion.
backends.kubernetes.defaultResourceJobBase	object	{}	defaultResourceJobBase is an optional Kubernetes Job definition used as the base when launching content jobs. The chart automatically adds the init container and runtime volume when backends.kubernetes.defaultInitContainer.enabled is true. Only set this if you need to customize the job (e.g., add sidecars, node selectors, tolerations). https://kubernetes.io/docs/concepts/workloads/controllers/job/
backends.kubernetes.defaultResourceServiceBase	object	{}	defaultResourceServiceBase contains the Kubernetes Service definition which is used as an overlay "base" when creating a content job's Service in Kubernetes. Conceptually this is similar to a Kustomize base. Connect then applies any required Service configuration on-top of the overlay base to produce a final Service definition. https://kubernetes.io/docs/concepts/services-networking/service/ https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/#bases-and-overlays
backends.kubernetes.enabled	bool	true	Whether to enable off-host execution for running content-jobs in remote Kubernetes pods.
backends.kubernetes.namespace	string	""	The namespace to launch connect-content jobs into. Uses the Release namespace by default
chronicle.localConfig	object	{}	Overrides for Chronicle, rendered as a chronicle-local.gcfg and applied after the configuration Connect generates. Keys are Chronicle's own .gcfg sections and properties (reference). Use it for anything config.Chronicle does not expose.
chronicleAgent.agentEnvironment	string	""	An environment tag to apply to all metrics reported by this agent (reference)
chronicleAgent.autoDiscovery	bool	true	If true, the chart will attempt to lookup the Chronicle Server address and version in the cluster
chronicleAgent.connectApiKey	object	{"value":"","valueFrom":{}}	An Administrator permissions API key generated in Connect for the Chronicle agent to use, API keys can only be created after Connect has been deployed so this value may need to be filled in later if performing an initial deployment (reference)
chronicleAgent.connectApiKey.value	string	""	Connect API key as a raw string to set as the CHRONICLE_CONNECT_APIKEY environment variable (not recommended)
chronicleAgent.connectApiKey.valueFrom	object	{}	Connect API key as a valueFrom reference (ex. a Kubernetes Secret reference) to set as the CHRONICLE_CONNECT_APIKEY environment variable (recommended)
chronicleAgent.enabled	DEPRECATED	false	Creates a Chronicle agent sidecar container in the pod if true
chronicleAgent.env	list	[]	Additional environment variables to set on the Chronicle agent container env
chronicleAgent.image.imagePullPolicy	string	"IfNotPresent"	The pull policy for the Chronicle agent image
chronicleAgent.image.registry	string	"ghcr.io"	The Chronicle agent image registry
chronicleAgent.image.repository	string	"rstudio/chronicle-agent"	The Chronicle agent image repository
chronicleAgent.image.sha	string	""	The Chronicle agent image digest
chronicleAgent.image.tag	string	"2026.01.0"	The Chronicle agent image tag
chronicleAgent.resources	object	{}	Defines resources for the posit-chronicle-agent container
chronicleAgent.securityContext	object	{"privileged":false,"runAsNonRoot":true}	The container-level security context for the Chronicle agent container
chronicleAgent.serverAddress	string	""	Address for the Chronicle server including the protocol (ex. "http://address"), defaults to auto-discovered Chronicle server in the given namespace or is required if chronicleAgent.autoDiscovery=false
chronicleAgent.serverNamespace	string	""	Namespace to search for the Chronicle server when chronicleAgent.autoDiscovery=true, has no effect if chronicleAgent.autoDiscovery=false
chronicleAgent.volumeMounts	list	[]	Verbatim volumeMounts to attach to the Chronicle agent container
command	list	[]	The pod's run command. By default, it uses the container's default
config	object	Posit Connect Configuration Reference	A nested map of maps that generates the rstudio-connect.gcfg file
deployment.annotations	object	{}	Additional annotations to add to the rstudio-connect deployment
executionEnvironments	list	[] (disabled)	Optional list of execution environments to manage declaratively. Requires Connect version 2026.03.0 or later. When set, the chart renders these into a ConfigMap, mounts it into the Connect pod, and sets ExecutionEnvironments.ConfigFilePath in the Connect configuration. Changes take effect on every helm upgrade without requiring a pod restart or database reset.
extraObjects	list	[]	Extra objects to deploy (value evaluated as a template)
fullnameOverride	string	""	The full name of the release (can be overridden)
image	object	{"imagePullPolicy":"IfNotPresent","imagePullSecrets":[],"os":"ubuntu-24.04","repository":"posit/connect","tag":""}	Defines the Posit Connect image to deploy
image.imagePullPolicy	string	"IfNotPresent"	The imagePullPolicy for the main pod image
image.imagePullSecrets	list	[]	an array of kubernetes secrets for pulling the main pod image from private registries
image.os	string	"ubuntu-24.04"	The OS version for the image tag (e.g. ubuntu-24.04, ubuntu-22.04). Only used if tag is not defined
image.repository	string	"posit/connect"	The repository to use for the main pod image
image.tag	string	""	Overrides the image tag whose default is the chart appVersion.
ingress.annotations	object	{}
ingress.enabled	bool	false
ingress.hosts	string	nil
ingress.ingressClassName	string	""	The ingressClassName for the ingress resource. Only used for clusters that support networking.k8s.io/v1 Ingress resources
ingress.tls	list	[]
initContainers	bool	false	The initContainer spec that will be used verbatim
launcher.defaultInitContainer	object	{"enabled":true,"imagePullPolicy":"","repository":"posit/connect-content-init","resources":{},"securityContext":{},"tag":""}	Image definition for the default Posit Connect Content InitContainer
launcher.defaultInitContainer.enabled	bool	true	Whether to enable the defaultInitContainer. If disabled, you must ensure that the session components are available another way.
launcher.defaultInitContainer.imagePullPolicy	string	""	The imagePullPolicy for the default initContainer
launcher.defaultInitContainer.repository	string	"posit/connect-content-init"	The repository to use for the Content InitContainer image
launcher.defaultInitContainer.resources	object	{}	Optional resources for the default initContainer
launcher.defaultInitContainer.securityContext	object	{}	The securityContext for the default initContainer
launcher.defaultInitContainer.tag	string	""	Overrides the image tag whose default is the chart appVersion.
launcher.enabled	bool	false	Whether to enable the launcher
launcher.extraTemplates	object	{}	extra templates to render in the template directory.
launcher.includeDefaultTemplates	bool	true	whether to include the default job.tpl and service.tpl files included with the chart
launcher.includeTemplateValues	bool	true	whether to include the templateValues rendering process
launcher.launcherKubernetesProfilesConf	object	{}	User definition of launcher.kubernetes.profiles.conf for job customization
launcher.namespace	string	""	The namespace to launch sessions into. Uses the Release namespace by default
launcher.templateValues	object	{"job":{"annotations":{},"labels":{}},"pod":{"affinity":{},"annotations":{},"command":[],"containerSecurityContext":{},"defaultSecurityContext":{},"env":[],"extraContainers":[],"hostAliases":[],"imagePullPolicy":"","imagePullSecrets":[],"initContainers":[],"labels":{},"nodeSelector":{},"priorityClassName":"","resources":{"limits":{},"requests":{}},"securityContext":{},"serviceAccountName":"","tolerations":[],"volumeMounts":[],"volumes":[]},"service":{"annotations":{},"labels":{},"type":"ClusterIP"},"sharedStorage":{"name":"","subPath":""}}	Values to pass along to the Posit Connect session templating process
launcher.templateValues.pod.command	list	[]	command for all pods. This is really not something we should expose and will be removed once we have a better option
launcher.templateValues.pod.resources	object	{"limits":{},"requests":{}}	to be used when none are provided in the content runtime settings
launcher.useTemplates	bool	true	Whether to use launcher templates when launching sessions. Defaults to true
license.file	object	{"contents":false,"mountPath":"/etc/rstudio-licensing","mountSubPath":false,"secret":false,"secretKey":"license.lic"}	the file section is used for licensing with a license file
license.file.contents	bool	false	contents is an in-line license file
license.file.mountPath	string	"/etc/rstudio-licensing"	mountPath is the place the license file will be mounted into the container
license.file.mountSubPath	bool	false	It can be preferable not to enable this, because then updates propagate automatically
license.file.secret	bool	false	secret is an existing secret with a license file in it
license.file.secretKey	string	"license.lic"	secretKey is the key for the secret to use for the license file
license.key	string	nil	key is the license to use
license.server	bool	false	server is the : for a license server
livenessProbe	object	{"enabled":false,"failureThreshold":10,"httpGet":{"path":"/__ping__","port":3939},"initialDelaySeconds":10,"periodSeconds":5,"timeoutSeconds":2}	Used to configure the container's livenessProbe. Only included if enabled = true
nameOverride	string	""	The name of the chart deployment (can be overridden)
nameservice	object	{"apiKey":"","enabled":false,"secretName":"","server":"http://127.0.0.1:3939"}	Nameservice configuration for current user execution (RunAsCurrentUser). This can only be enabled if using an SSO authentication provider (OAuth2, SAML, or LDAP).
nameservice.apiKey	string	""	The Connect service token used by the nameservice module. Create a service token with the nameservice:read scope. See https://docs.posit.co/connect/api/#post-/v1/system/service-tokens.
nameservice.enabled	bool	false	Whether to enable nameservice integration.
nameservice.secretName	string	""	Optional: name of existing secret containing libnss_connect.conf (overrides apiKey and server). The secret must be in the same namespace as the Connect deployment.
nameservice.server	string	"http://127.0.0.1:3939"	Connect server URL for nameservice module.
nodeSelector	object	{}	A map used verbatim as the pod's "nodeSelector" definition
pod.affinity	object	{}	A map used verbatim as the pod's "affinity" definition
pod.annotations	object	{}	Additional annotations to add to the rstudio-connect pods
pod.env	list	[]	An array of maps that is injected as-is into the "env:" component of the pod.container spec
pod.haste	bool	true	A helper that defines the RSTUDIO_CONNECT_HASTE environment variable
pod.hostAliases	list	[]	Array of hostnames to supply to the main pod
pod.labels	object	{}	Additional labels to add to the rstudio-connect pods
pod.port	int	3939	The containerPort used by the main pod container
pod.securityContext	object	{}	Values to set the securityContext for the connect pod
pod.sidecar	bool	false	An array of containers that will be run alongside the main pod
pod.terminationGracePeriodSeconds	int	120	The termination grace period seconds allowed for the pod before shutdown
pod.volumeMounts	list	[]	An array of maps that is injected as-is into the "volumeMounts" component of the pod spec
pod.volumes	list	[]	An array of maps that is injected as-is into the "volumes:" component of the pod spec
podDisruptionBudget	object	{}	Pod disruption budget
priorityClassName	string	""	The pod's priorityClassName
prometheus.enabled	bool	true	The parent setting for whether to enable prometheus metrics. Default is to use the built-in product exporter
prometheus.port	int	3232	The port that prometheus will listen on
rbac.clusterRoleCreate	bool	false	Whether to create the ClusterRole that grants access to the Kubernetes nodes API. This is used by the Launcher or direct Kubernetes runner to get all of the IP addresses associated with the node that is running a particular job. When backends.kubernetes.enabled is true, the ClusterRole is also auto-created if the service base type is NodePort. In most cases, this can be disabled as the node's internal address is sufficient to allow proper functionality.
rbac.create	bool	true	Whether to create rbac. (also depends on launcher.enabled = true or backends.kubernetes.enabled = true)
rbac.serviceAccount	object	{"annotations":{},"create":true,"labels":{},"name":""}	The serviceAccount to be associated with rbac (also depends on launcher.enabled = true or backends.kubernetes.enabled = true)
readinessProbe	object	{"enabled":true,"failureThreshold":3,"httpGet":{"path":"/__ping__","port":3939},"initialDelaySeconds":3,"periodSeconds":3,"successThreshold":1,"timeoutSeconds":1}	Used to configure the container's readinessProbe. Only included if enabled = true
replicas	int	1	The number of replica pods to maintain for this service
resources	object	{}	Defines resources for the rstudio-connect container
revisionHistoryLimit	int	3	The revisionHistoryLimit to use for the pod deployment. Do not set to 0
securityContext	object	{}	Values to set the securityContext for the Connect container. It must include "privileged: true" or "CAP_SYS_ADMIN" when running in local execution mode. If launcher or backends.kubernetes is enabled, this can be removed with securityContext: {}
service.annotations	object	{}	Annotations for the service, for example to specify an internal load balancer
service.clusterIP	string	""	The cluster-internal IP to use with service.type ClusterIP
service.loadBalancerIP	string	""	The external IP to use with service.type LoadBalancer, when supported by the cloud provider
service.nodePort	bool	false	The explicit nodePort to use for service.type NodePort. If not provided, Kubernetes will choose one automatically
service.port	int	80	The port to use for the Connect service
service.targetPort	int	3939	The port to forward to on the Connect pod. Also see pod.port
service.type	string	"ClusterIP"	The service type, usually ClusterIP (in-cluster only) or LoadBalancer (to expose the service using your cloud provider's load balancer)
serviceMonitor.additionalLabels	object	{}	additionalLabels normally includes the release name of the Prometheus Operator
serviceMonitor.enabled	bool	false	Whether to create a ServiceMonitor CRD for use with a Prometheus Operator
serviceMonitor.namespace	string	""	Namespace to create the ServiceMonitor in (usually the same as the one in which the Prometheus Operator is running). Defaults to the release namespace
sharedStorage.accessModes	list	["ReadWriteMany"]	A list of accessModes that are defined for the storage PVC (represented as YAML)
sharedStorage.annotations	object	{"helm.sh/resource-policy":"keep"}	Annotations for the Persistent Volume Claim
sharedStorage.create	bool	false	Whether to create the persistentVolumeClaim for shared storage
sharedStorage.mount	bool	false	Whether the persistentVolumeClaim should be mounted (even if not created)
sharedStorage.mountContent	bool	true	Whether the persistentVolumeClaim should be mounted to content pods. When true, the chart automatically configures DataDirPVCName for both Launcher and backends.kubernetes modes.
sharedStorage.name	string	""	The name of the pvc. By default, computes a value from the release name
sharedStorage.path	string	"/var/lib/rstudio-connect"	The path to mount the sharedStorage claim within the Connect pod
sharedStorage.requests.storage	string	"10Gi"	The volume of storage to request for this persistent volume claim
sharedStorage.selector	object	{}	selector for PVC definition
sharedStorage.storageClassName	bool	false	The type of storage to use. Must allow ReadWriteMany
sharedStorage.subPath	string	""	an optional subPath for the volume mount. Also applied to content pod mounts for the launcher and the direct Kubernetes runner (backends.kubernetes.enabled). The direct runner requires Connect 2026.08.0 or later. Must be a relative path.
sharedStorage.volumeName	string	""	the volumeName passed along to the persistentVolumeClaim. Optional
startupProbe	object	{"enabled":false,"failureThreshold":30,"httpGet":{"path":"/__ping__","port":3939},"initialDelaySeconds":10,"periodSeconds":10,"timeoutSeconds":1}	Used to configure the container's startupProbe. Only included if enabled = true
startupProbe.failureThreshold	int	30	failureThreshold * periodSeconds should be strictly > worst case startup time
strategy	object	{"rollingUpdate":{"maxSurge":"100%","maxUnavailable":0},"type":"RollingUpdate"}	Defines the update strategy for a deployment
tolerations	list	[]	An array used verbatim as the pod's "tolerations" definition
topologySpreadConstraints	list	[]	An array used verbatim as the pod's "topologySpreadConstraints" definition
versionOverride	string	""	A Connect version to override the "tag" for the Posit Connect image and the Content Init image. Necessary until helm/helm#8194

---

Autogenerated from chart metadata using helm-docs v1.13.1