litellm/helm/litellm/values.yaml

# LiteLLM helm chart values

nameOverride: ""
fullnameOverride: ""

imagePullSecrets: []

# Optional Ingress wiring the three component Services behind a single L7
# entrypoint. Required when serving the static UI bundle over the network.
ingress:
  enabled: false
  className: ""
  # Which ingress controller serves this Ingress. Controllers disagree on the
  # pathTypes they accept, so this picks the pathType of the dotted paths, the
  # built-in ones and any dotted extraPaths entry alike:
  #   alb    AWS Load Balancer Controller (default): Exact and Prefix paths plus
  #          the /*.txt wildcard that routes the UI's RSC payloads.
  #   nginx  ingress-nginx: its admission webhook rejects a dot in an Exact or
  #          Prefix path (strict-validate-path-type, on by default from v1.12.0
  #          until v1.12.6 / v1.13.2 allowed dots again), so /favicon.ico and
  #          /eu.assemblyai render as ImplementationSpecific, which nginx serves
  #          as a plain prefix location. /*.txt is dropped: nginx has no
  #          wildcard pathType, so that rule could never match there.
  controller: alb
  annotations: {}
  host: ""        # optional; if set, becomes the rule's host
  tls: []
  # Extra HTTP paths appended to the ingress rule. Additive: every built-in
  # UI / gateway / backend path is still rendered, these entries are placed
  # after them and before the backend catch-all, and an entry that repeats a
  # path the chart already routes is rejected at render time rather than
  # silently taking it over.
  #
  # The chart's built-in gateway prefix list is a snapshot of the data-plane
  # surface at release time. Use extraPaths for passthrough routes it does not
  # cover: a provider prefix added upstream after this chart version, or a
  # custom general_settings.pass_through_endpoints route.
  #
  #   path      required; the HTTP path to route
  #   service   which component serves it: gateway (default), backend, or ui
  #   pathType  Prefix (default), Exact, or ImplementationSpecific; a dotted
  #             path renders as ImplementationSpecific when controller is nginx
  #
  # The target component only answers paths its own route allowlist keeps, so
  # a path here still has to be one that component serves.
  extraPaths: []
  # - path: /watsonx
  #   pathType: Prefix
  #   service: gateway

# Per-component ServiceAccounts for gateway, backend, and ui.
#
# Each section mirrors the old shared serviceAccount shape. Set `create:
# true` to have the chart provision the SA (useful for EKS Pod Identity /
# GKE Workload Identity annotations). Set `name` to bind an existing SA.
# When both are unset the component pod runs with the namespace `default` SA.
#
# The UI SA deliberately defaults to `automount: false` — the static nginx
# container does not need the K8s API and should not carry a projected
# ServiceAccount token that a compromised container could use to call the
# cloud-provider metadata service or the K8s API.
serviceAccounts:
  gateway:
    create: false
    automount: true
    annotations: {}
    name: ""
  backend:
    create: false
    automount: true
    annotations: {}
    name: ""
  ui:
    create: false
    automount: false
    annotations: {}
    name: ""

# Pre-install / pre-upgrade Helm hook that runs `prisma migrate deploy`
# against the writer database, creating the LiteLLM schema (tables that
# gateway + backend assume exist at startup: LiteLLM_Config,
# LiteLLM_VerificationToken, LiteLLM_SpendLogs, ...). Disable if your
# pipeline runs migrations out-of-band.
#
# Uses a dedicated `litellm-migrations` image (prisma CLI + the migration
# files from `litellm-proxy-extras`) instead of the backend image, so the
# Job doesn't drag in the rest of the proxy and doesn't run `prisma
# generate` — the migration engine doesn't need the generated client.
migrationJob:
  enabled: true
  # Which controller is responsible for running the Job.
  #
  # `helm.enabled` renders the Helm pre-install / pre-upgrade hook, so the Job
  # runs whenever `helm upgrade` sees a change to apply. `argocd.enabled`
  # renders an Argo CD PreSync hook instead, which runs the Job on every sync
  # even when the rendered manifests are unchanged: the way to re-run
  # migrations on demand from a GitOps pipeline. Turning the Helm hook off
  # while the Argo CD hook is on leaves the Job out of Helm's own upgrade
  # path, which is what Argo CD users want since Argo, not Helm, applies the
  # manifests.
  hooks:
    helm:
      enabled: true
      weight: "0"
    argocd:
      enabled: false
  backoffLimit: 4
  ttlSecondsAfterFinished: 120
  # Wall-clock budget for the whole Job, shared across every `backoffLimit`
  # retry rather than granted per attempt. Without it a migration that blocks
  # on the database never fails, and because this is a pre-upgrade hook the
  # release waits on it forever: `helm upgrade` and any GitOps controller
  # driving it stop reconciling the whole chart until someone deletes the Job
  # by hand. A migration that has exhausted its retries is not going to
  # succeed on the next one, so failing is strictly better than hanging.
  # Set to null to opt out and restore the unbounded behaviour.
  activeDeadlineSeconds: 1800
  resources: {}
  # ServiceAccount for the Job pod only.
  #
  # The Job is a pre-install / pre-upgrade hook, so it runs before the chart's
  # ordinary resources exist. With `serviceAccounts.backend.create: true` the
  # backend ServiceAccount is one of those ordinary resources, so a Job that
  # borrowed its name would reference an account that does not exist yet and
  # the first install would fail with a forbidden pod creation. The name set
  # here always wins; when it is empty the Job falls back to `default` if the
  # chart creates the backend ServiceAccount, and to the backend
  # ServiceAccount name otherwise (that name is either an existing account you
  # supplied or `default`).
  #
  # Point this at a pre-existing ServiceAccount when the Job needs credentials
  # of its own, e.g. the IRSA / Workload Identity annotations that
  # `database.writer.useIAMAuth` relies on. That is also the upgrade path to
  # watch: a release already running with `serviceAccounts.backend.create:
  # true` used to hand the Job the created backend account on every upgrade,
  # and now hands it `default` unless you name an account here.
  serviceAccountName: ""
  # The Job runs `prisma migrate deploy` against Postgres and never calls the
  # K8s API, so it defaults to no projected ServiceAccount token, the same
  # reasoning the ui SA above uses. Flip to true if your Job genuinely needs
  # one; IAM database auth does not, since EKS Pod Identity injects its own
  # projected token volume and GKE Workload Identity goes through the
  # metadata server, neither of which is the default token mount.
  automountServiceAccountToken: false
  # Standard k8s pod-level and container-level securityContext for the Job
  # pod. Same shape as gateway.podSecurityContext / gateway.securityContext.
  podSecurityContext: {}
  securityContext: {}
  # Extra pod labels on the Job pod, merged into the chart's common labels.
  podLabels: {}
  # Additional volumes on the Job pod and volumeMounts on its container, e.g.
  # the writable scratch space a read-only root filesystem needs.
  volumes: []
  volumeMounts: []
  # Scheduling for the Job pod, same shape as gateway.nodeSelector /
  # gateway.tolerations / gateway.affinity. The Job does not inherit the other
  # components' scheduling values: a migration usually needs a larger node
  # than the gateway, so pin it here explicitly.
  nodeSelector: {}
  tolerations: []
  affinity: {}
  image:
    repository: ghcr.io/berriai/litellm-migrations
    tag: ""              # defaults to .Chart.AppVersion
    pullPolicy: IfNotPresent
  # Extra env appended to the migration container. The migration entrypoint
  # uses the v2 resolver by default (no diff-and-force recovery — avoids the
  # schema thrashing seen during rolling deploys). To opt back into the v1
  # resolver, append `- name: USE_V2_MIGRATION_RESOLVER` / `value: "false"`.
  extraEnv: []

# Required: a master key used by gateway + backend to mint/verify proxy tokens.
# Must reference an existing Secret.
masterKey:
  secretName: litellm-master-key-secret              # name of a Secret containing the master key
  secretKey: master-key

# Optional: enterprise billable-request metering. When enabled, the gateway and
# backend count successful requests to inference, MCP, and A2A endpoints and push
# them to LiteLLM's collector over mutual TLS. Both components serve billable
# routes: the backend keeps the named-server MCP transport. Requires an
# enterprise license. The client certificate identifies the deployment, so it is
# mounted read-only from an existing Secret and never passed through the env.
billingMetrics:
  enabled: false
  endpoint: https://telemetry.litellm.ai              # collector to push the counter to
  # An existing Secret holding the client certificate under tls.crt and its key
  # under tls.key, usually created from the onboarding artifact. The default is
  # the conventional name, so the common path is to create that Secret and set
  # enabled: true. Override only if yours is named differently.
  secretName: litellm-billing-metrics-mtls
  # Only for private or test collectors whose server certificate is not on the
  # public web PKI. The production collector needs no CA override.
  caSecretName: ""                                    # existing Secret holding ca.crt
  exportIntervalMs: ""                                # push cadence; the proxy defaults to 60000

# External Postgres connection. 
database:
  writer:
    host: ""
    port: 5432
    dbname: ""
    schema: ""
    useIAMAuth: false
    # Azure Database for PostgreSQL with a Microsoft Entra ID token; mutually exclusive with useIAMAuth
    useAzureEntraAuth: false
    passwordSecret:
      name: litellm-writer-secret
      usernameKey: username
      passwordKey: password
    # libpq sslmode / sslrootcert applied to the writer and reader URLs (Prisma and the
    # in-container PgBouncer); e.g. verify-full with /etc/ssl/certs/ca-certificates.crt for AWS RDS.
    # sslRootCert on its own implies sslMode verify-full
    sslMode: ""
    sslRootCert: ""

  # Optional read-replica routing. When `reader.host` is set, the proxy routes
  # reads (find_*, count, group_by, query_raw/_first) to this endpoint while
  # writes stay on the writer. Leave `reader.host` empty to disable.
  reader:
    host: ""
    port: 5432
    dbname: ""
    schema: ""
    useIAMAuth: false
    # Azure Database for PostgreSQL with a Microsoft Entra ID token; mutually exclusive with useIAMAuth
    useAzureEntraAuth: false
    passwordSecret:
      name: litellm-reader-secret
      usernameKey: username
      passwordKey: password

  # In-container connection pool (PgBouncer, transaction mode) shared by every
  # gateway worker in the pod. Without it each of the `gateway.numWorkers`
  # workers opens its own Prisma pool straight to Postgres, so a pod's
  # footprint against the database's connection ceiling is
  # numWorkers x connection_limit and grows with every replica. With it, the
  # pod holds at most maxDbConnections upstream connections no matter how many
  # workers run; the workers connect to the pool over loopback, with no extra
  # network hop. The chart emits LITELLM_PGBOUNCER_ENABLED /
  # LITELLM_PGBOUNCER_MAX_DB_CONNECTIONS / LITELLM_PGBOUNCER_MAX_CLIENT_CONN on
  # the gateway container and its collector sidecar only: the backend runs a
  # single worker and the migrations Job must keep a direct connection. With
  # `database.writer.useIAMAuth` or `useAzureEntraAuth` the pool mints and
  # renews the database token itself, so the workers never see it. Starting profile for
  # `gateway.numWorkers: 4` is maxDbConnections: 20, so a database with a
  # 5000-connection ceiling fits roughly 200 gateway replicas.
  connectionPool:
    enabled: false
    maxDbConnections: 20
    maxClientConn: 1000

# Optional Redis. Leave host empty to disable.
#
# This is the proxy's coordination store: cross-pod tpm/rpm rate limits, spend
# tracking, and the pod lock manager. The chart emits REDIS_HOST / REDIS_PORT /
# REDIS_PASSWORD, which the proxy picks up through its coordination Redis env
# fallback. Response caching is separate and off unless you enable it in
# `proxy_config.litellm_settings.cache`.
#
# For full control, define `general_settings.coordination_redis` in
# `proxy_config` (host/port/password/username/url/ssl/startup_nodes/
# sentinel_nodes/sentinel_password/service_name, each accepting os.environ/VAR
# refs). An explicit block overrides these env vars.
#
# Set `cluster: true` for Redis Cluster mode (e.g. AWS ElastiCache Cluster,
# self-hosted Redis Cluster). The chart emits REDIS_CLUSTER_NODES from
# `host` / `port` as the single seed; the cluster client discovers the
# remaining nodes from CLUSTER SLOTS at startup.
redis:
  cluster: false
  host: ""
  port: 6379
  passwordSecret:
    name: "" # Leave empty for auth-less Redis
    passwordKey: password

# ---------- gateway (LLM data plane) ----------
gateway:
  enabled: true
  logLevel: INFO
  # Number of uvicorn worker processes per gateway pod. Sets NUM_WORKERS,
  # consumed by the gateway image entrypoint. Default is 1.
  numWorkers: 1
  extraEnv: [] # Add extra environment variables to the gateway
  envConfigMaps: [] # Add extra environment variables to the gateway from config maps
  envSecrets: [] # Add extra environment variables to the gateway from secrets
  # Additional volumes on the gateway Deployment (e.g. a ConfigMap holding
  # custom callback / SSO handler code, mounted next to the proxy config).
  volumes: []
  # Additional volumeMounts on the gateway container.
  volumeMounts: []
  config:
    create: true
    proxy_config: {}
  # Serve Prometheus /metrics from a `metrics` sidecar container (same image,
  # `python -m litellm.proxy.prometheus_metrics_server`) that aggregates the
  # workers' PROMETHEUS_MULTIPROC_DIR samples over a shared emptyDir, so a
  # scrape never runs on an inference worker. Adds a `metrics` port to the pod
  # and a dedicated ClusterIP `<gateway>-metrics` Service; point your scrape
  # config at it. The port has no virtual-key auth: keep it off public ingress.
  # Needs the gateway image v1.101.0 or newer.
  metricsServer:
    enabled: false
    port: 4001
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        memory: 512Mi
  # Prometheus Operator ServiceMonitor for the gateway pods. Scrapes the
  # `<gateway>-metrics` Service, so it requires metricsServer above (the http
  # port serves /metrics/ behind virtual-key auth). Every pod is its own scrape
  # target, so the samples carry the `pod` label the per-pod autoscaling
  # queries below group by.
  serviceMonitor:
    enabled: false
    labels: {}
    interval: 15s
    scrapeTimeout: 10s
  # Opt-in `collector` sidecar (same image, `python -m litellm.proxy.collector`)
  # that runs the post-response spend pipeline (cost calculation, spend logs,
  # spend counters, budget reservation reconciliation) so the uvicorn workers
  # only serialise a compact event over loopback and go back to serving
  # requests. It shares the pod's env, proxy config, in-container pgbouncer and
  # Redis spend buffer, so the per-pod DB connection budget is unchanged.
  # Delivery is at-most-once inside the pod: events already handed over are
  # lost if the sidecar dies before writing them; events the workers cannot
  # hand over follow `onUnavailable`.
  collector:
    enabled: false
    # unix:///<dir>/<file>.sock (the <dir> becomes a shared emptyDir) or
    # tcp://127.0.0.1:<port>
    address: unix:///var/run/litellm/collector.sock
    # Events each uvicorn worker holds in memory while the sidecar is slow or
    # restarting.
    bufferSize: 1000
    # fallback: run the pipeline in the worker when the sidecar is unreachable
    # or the buffer is full (spend stays exact, that request costs gateway CPU
    # again). drop: count and discard the event instead (spend under-reports).
    onUnavailable: fallback
    # How long the workers keep pushing buffered events on shutdown, and how
    # long the sidecar keeps serving open connections after SIGTERM.
    drainTimeoutSeconds: 10
    # Sized independently of the gateway container; the pipeline is CPU bound.
    resources:
      requests:
        cpu: 500m
        memory: 1Gi
      limits:
        cpu: "1"
        memory: 2Gi
    # With hpa.targetCPUUtilizationPercentage set, scale on an autoscaling/v2
    # ContainerResource metric of the `gateway` container only, so the
    # sidecar's CPU never drives inference replicas. Needs Kubernetes 1.30+.
    scaleOnGatewayContainerCpu: true
  image:
    repository: ghcr.io/berriai/litellm-gateway
    tag: ""              # defaults to .Chart.AppVersion
    pullPolicy: IfNotPresent
  service:
    type: ClusterIP
    port: 4000
  resources:
    requests:
      cpu: "1"
      memory: 4Gi
    limits:
      cpu: "2"
      memory: 4Gi
  livenessProbe:
    httpGet: { path: /health/liveliness, port: http }
    initialDelaySeconds: 10
    periodSeconds: 15
    timeoutSeconds: 10
    failureThreshold: 6
  readinessProbe:
    httpGet: { path: /health/readiness, port: http }
    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 10
  # Rolling update tuning for the gateway Deployment. Empty by default, so
  # Kubernetes applies its own RollingUpdate defaults (25% maxSurge /
  # 25% maxUnavailable). Example, for a surge-only rollout behind a load
  # balancer that must never lose capacity:
  #   type: RollingUpdate
  #   rollingUpdate:
  #     maxUnavailable: 0
  #     maxSurge: 1
  strategy: {}
  # Optional startupProbe. Empty by default, so existing installs are unchanged
  # and liveness/readiness apply from container start. Set it to gate
  # liveness/readiness until a slow cold start finishes — a high failureThreshold
  # tolerates long first-boot times without a liveness-kill loop, e.g.:
  #   httpGet: { path: /health/readiness, port: http }
  #   failureThreshold: 30
  #   periodSeconds: 10
  startupProbe: {}
  hpa:
    enabled: true
    minReplicas: 1
    maxReplicas: 10
    targetCPUUtilizationPercentage: 70
    targetMemoryUtilizationPercentage: 80
    # Optional autoscaling/v2 scaling behavior (scaleUp / scaleDown policies and
    # stabilization windows). Empty by default -> Kubernetes' default behavior.
    # Rendered verbatim under spec.behavior, e.g.:
    #   scaleUp:
    #     stabilizationWindowSeconds: 0
    #     policies:
    #       - { type: Percent, value: 100, periodSeconds: 30 }
    behavior: {}
    # Opt-in per-pod workload targets, rendered as autoscaling/v2 `Pods` metrics
    # named `litellm_requests_per_second` and `litellm_tokens_per_second` with an
    # AverageValue target. They coexist with the CPU/memory targets above: the
    # HPA scales on whichever metric asks for the most replicas. Kubernetes has
    # no idea what a token is, so a Prometheus Adapter must serve those two
    # names on custom.metrics.k8s.io from the proxy's counters, grouped by the
    # scrape target's `pod` label (enable serviceMonitor above):
    #   litellm_requests_per_second:
    #     sum(rate(litellm_proxy_total_requests_metric_total{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
    #   litellm_tokens_per_second:
    #     sum(rate(litellm_total_tokens_metric_total{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
    # rate() over [1m] is already per second, so no `* 60`. How fast the HPA
    # reacts is set by that window, the scrape interval and the HPA sync period
    # (15s by default), not by the unit: keep serviceMonitor.interval at 15s or
    # faster so a 1m window holds at least 4 samples. averageValue takes SI
    # suffixes, so "6M" is six million tokens per second per pod. Tokens are
    # counted when a response completes, so TPS trails long streams.
    targetRequestsPerSecond: ""
    targetTokensPerSecond: ""
  # PodDisruptionBudget for the gateway pods. Set exactly one of
  # `minAvailable` / `maxUnavailable` (minAvailable wins if both are set;
  # enabling without either falls back to `maxUnavailable: 1`). Disabled by
  # default: with the default hpa.minReplicas of 1, a `minAvailable: 1` PDB
  # would block node drains entirely.
  pdb:
    enabled: false
    minAvailable: ""
    maxUnavailable: ""
  podAnnotations: {}
  # Extra pod labels, merged into the chart's selector labels. Do not
  # re-declare `app.kubernetes.io/name` / `instance` / `component` here: they
  # form the Deployment's immutable selector.
  podLabels: {}
  # Pod-level securityContext, applied to every container in the pod
  # (runAsNonRoot, runAsUser, fsGroup, seccompProfile, ...). Empty by default
  # so the cluster's own defaults keep applying to existing installs; clusters
  # enforcing a restricted Pod Security Standard usually want at least
  # `runAsNonRoot: true` and `seccompProfile.type: RuntimeDefault`.
  podSecurityContext: {}
  # Container-level securityContext for the gateway container. Empty by
  # default for the same reason. Example:
  #   allowPrivilegeEscalation: false
  #   readOnlyRootFilesystem: true
  #   capabilities:
  #     drop:
  #       - ALL
  # `readOnlyRootFilesystem: true` needs writable scratch space; supply it
  # through `volumes` / `volumeMounts` above rather than expecting the chart
  # to guess the paths your workload writes to.
  securityContext: {}
  # Extra sidecar containers appended to the gateway pod, e.g. an auth or
  # egress proxy. Rendered through `tpl`, so entries may reference chart
  # values and release metadata.
  extraContainers: []
  # Container lifecycle hooks (postStart / preStop) for the gateway container.
  lifecycle: {}
  # Grace period the kubelet allows between SIGTERM and SIGKILL. Leave empty
  # to inherit the Kubernetes default of 30s. Set it a few seconds above the
  # proxy's GRACEFUL_SHUTDOWN_TIMEOUT when you use a draining preStop hook.
  terminationGracePeriodSeconds: ""
  nodeSelector: {}
  tolerations: []
  affinity: {}
  # Standard k8s topologySpreadConstraints for the gateway pods, e.g. to
  # spread replicas across zones:
  #   - maxSkew: 1
  #     topologyKey: topology.kubernetes.io/zone
  #     whenUnsatisfiable: ScheduleAnyway
  #     labelSelector:
  #       matchLabels:
  #         app.kubernetes.io/component: gateway
  topologySpreadConstraints: []

# ---------- backend (UI / management API) ----------
backend:
  enabled: true
  logLevel: INFO
  extraEnv: []
  envConfigMaps: []
  envSecrets: []
  # Additional volumes on the backend Deployment.
  volumes: []
  # Additional volumeMounts on the backend container.
  volumeMounts: []
  image:
    repository: ghcr.io/berriai/litellm-backend
    tag: ""
    pullPolicy: IfNotPresent
  service:
    type: ClusterIP
    port: 4001
  resources:
    requests:
      cpu: "1"
      memory: 4Gi
    limits:
      cpu: "2"
      memory: 4Gi
  livenessProbe:
    httpGet: { path: /health/liveliness, port: http }
    initialDelaySeconds: 10
    periodSeconds: 15
    timeoutSeconds: 10
    failureThreshold: 6
  readinessProbe:
    httpGet: { path: /health/readiness, port: http }
    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 10
  # Same shape as gateway.strategy.
  strategy: {}
  # Optional startupProbe; same shape as gateway.startupProbe. Empty by default.
  startupProbe: {}
  hpa:
    enabled: true
    minReplicas: 1
    maxReplicas: 4
    targetCPUUtilizationPercentage: 70
    # Optional autoscaling/v2 scaling behavior; same shape as gateway.hpa.behavior.
    behavior: {}
  # Same shape as gateway.pdb.
  pdb:
    enabled: false
    minAvailable: ""
    maxUnavailable: ""
  podAnnotations: {}
  # Same shape as the gateway blocks of the same name.
  podLabels: {}
  podSecurityContext: {}
  securityContext: {}
  extraContainers: []
  lifecycle: {}
  terminationGracePeriodSeconds: ""
  nodeSelector: {}
  tolerations: []
  affinity: {}
  # Same shape as gateway.topologySpreadConstraints.
  topologySpreadConstraints: []

# ---------- ui (Next.js static dashboard) ----------
ui:
  enabled: true
  logLevel: INFO
  extraEnv: []
  envConfigMaps: []
  envSecrets: []
  # Additional volumes on the ui Deployment.
  volumes: []
  # Additional volumeMounts on the ui container.
  volumeMounts: []
  image:
    repository: ghcr.io/berriai/litellm-ui
    tag: ""
    pullPolicy: IfNotPresent
  service:
    type: ClusterIP
    port: 3000
  # The dashboard expects to know where to reach the backend API. Set this to
  # the externally-routable URL (typically the ingress host + /api or similar).
  backendUrl: ""
  resources:
    requests:
      cpu: 500m
      memory: 500Mi
    limits:
      cpu: "1"
      memory: 1Gi
  livenessProbe:
    httpGet: { path: /, port: http }
    initialDelaySeconds: 5
    periodSeconds: 20
  readinessProbe:
    httpGet: { path: /, port: http }
    initialDelaySeconds: 2
    periodSeconds: 10
  # Same shape as gateway.strategy.
  strategy: {}
  # Optional startupProbe; same shape as gateway.startupProbe. Empty by default.
  startupProbe: {}
  hpa:
    enabled: false
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 80
    # Optional autoscaling/v2 scaling behavior; same shape as gateway.hpa.behavior.
    behavior: {}
  # Same shape as gateway.pdb.
  pdb:
    enabled: false
    minAvailable: ""
    maxUnavailable: ""
  podAnnotations: {}
  # Same shape as the gateway blocks of the same name. The nginx runtime
  # writes its pid, cache, and proxy temp files under /tmp, so it boots as
  # any (arbitrary, non-root) uid; `securityContext.readOnlyRootFilesystem:
  # true` here needs an emptyDir volume mounted over /tmp. Images before
  # the /tmp move instead need emptyDirs over /var/cache/nginx and /run to
  # run as a non-root uid at all.
  podLabels: {}
  podSecurityContext: {}
  securityContext: {}
  extraContainers: []
  lifecycle: {}
  terminationGracePeriodSeconds: ""
  nodeSelector: {}
  tolerations: []
  affinity: {}
  # Same shape as gateway.topologySpreadConstraints.
  topologySpreadConstraints: []