> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/agentic-access/agentic-gateway/gateway/deploy/chart-values/gateway-chart.md). # Gateway chart values Every value in the p0security/ai-gateway Helm chart, with whether it is required and its default. This page lists the values of the `p0security/ai-gateway` chart, which deploys the gateway and its Auth Server. If you deploy with the [Batteries-included chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/batteries-included-chart.md), set these values under its `ai-gateway` key. That chart already sets several of them for you; see [Batteries-included chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/batteries-included-chart.md#defaults-the-batteries-included-chart-changes). {% hint style="info" %} A value marked **Conditional** is required only in some situations; see the field description for details. An empty default means the value is unset. {% endhint %} ## Top-level values | Value | Required | Default | Description | | ------------------------ | -------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `imageRegistry` | No | Empty | Registry prefix for the gateway and Auth Server images, such as `gcr.io/my-project`. Set this when you mirror P0's images into your own registry. It doesn't apply to the [#management-tunnel](#management-tunnel "mention") image, which you set with `braekhus.image.name`. | | `imagePullSecrets` | No | Empty | Image pull secrets for the Auth Server, gateway and tunnel client pods, such as `[{name: my-registry}]`. Needed when `imageRegistry` or `braekhus.image.name` points at a registry that requires authentication. The secrets job uses them too, unless you set `secretsJob.imagePullSecrets`. | | `clusterRoleBindingName` | No | `ai-gateway-token-reviewer` | Name of the cluster-wide role binding that lets the gateway verify Kubernetes service account tokens. Give each release in the same cluster its own name. | | `secretsName` | No | `app-secrets` | Name of the Kubernetes Secret that holds the gateway's credentials. See [#the-credentials-secret](#the-credentials-secret "mention"). | | `caBundle` | No | Empty | Extra certificates, as PEM text, that the gateway, the Auth Server, and the management tunnel trust for outbound connections. See [#tls-inspecting-proxies](#tls-inspecting-proxies "mention"). | ## Gateway routing These values configure the Gateway API `Gateway`, as well as routes that expose the gateway and its Auth Server under a single public hostname. | Value | Required | Default | Description | | --------------------------- | -------- | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `gateway.className` | Yes | Empty | The `GatewayClass` the gateway's `Gateway` uses, such as `eg` for Envoy Gateway or `gke-l7-global` for GKE. With the batteries-included chart, this is also the name of the `GatewayClass` that chart creates, so it must be unique in the cluster. | | `gateway.host` | Yes | Empty | The public hostname of the gateway, such as `gateway.example.com`. Both MCP traffic and the OAuth endpoints are served from this host. | | `gateway.tlsSecretName` | No | `gateway-tls` | Name of the `kubernetes.io/tls` Secret that holds the certificate for `gateway.host`. The chart does not create this Secret, and the value must not be empty. | | `gateway.httpsRedirect` | No | `true` | Adds a port 80 listener that redirects HTTP requests to HTTPS. Keep this enabled with the batteries-included chart, which uses the same listener to obtain its certificate. | | `gateway.annotations` | No | Empty | Annotations to add to the `Gateway` resource, for implementation-specific settings such as Cloud Armor or IAP. | | `gateway.requestTimeout` | No | `0s` | Request timeout for gateway traffic. `0s` disables it on Envoy Gateway. On GKE's built-in gateway classes, set this to an empty string and configure a `GCPBackendPolicy` timeout instead. | | `gateway.streamIdleTimeout` | No | Empty | How long Envoy Gateway keeps an idle streaming connection open, such as `20m`. When unset, Envoy's own 5-minute limit applies. Set this only with Envoy Gateway. | | `gateway.oauthPaths` | No | The standard OAuth and OpenID Connect endpoints | Exact paths routed to the Auth Server. Change this only if you have changed the Auth Server's routes; setting it replaces the whole list. | | `gateway.oauthPathPrefixes` | No | `/authorize`, `/public`, `/oauth-registration` | Path prefixes routed to the Auth Server. As with `oauthPaths`, setting it replaces the whole list. | ## Auth Server These values configure the Auth Server, which authenticates people through your identity provider, binds their identity to the agent making the request, and issues the tokens the gateway accepts. ### Connection, issuers, and image | Value | Required | Default | Description | | ---------------------------------- | -------- | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `authServer.p0Url` | Yes | Empty | Your organization's P0 API URL, `https://api.p0.app/o/`. | | `authServer.p0Audience` | No | The value of `authServer.p0Url` | The audience for tokens exchanged with P0. Set it only if it differs from `p0Url`. | | `authServer.caches` | Yes | Empty | Cache configuration as a JSON string, such as `{"valkey":{"url":"redis://valkey-primary:6379"},"defaults":[{"type":"memory"},{"type":"valkey"}]}`. Agent authentication with federated credentials, such as JWT-SVIDs (see [JWT-SVID](/agentic-access/using-the-gateway/spiffe-svid.md)), requires a Valkey or Redis tier. | | `authServer.defaultIssuer` | No | Empty | The token audience to use when an MCP client does not request one. Set this only for clients that need an audience other than the gateway's URL. | | `authServer.accessTokenTtlSeconds` | No | `1024` | Lifetime, in seconds, of the access tokens the Auth Server issues. A shorter lifetime means agents refresh their tokens more often, but a leaked token stops working sooner. | | `authServer.awsRegion` | No | `us-east-1` | Region of the AWS STS endpoint used to obtain credentials for AWS MCP servers. Credentials work in every region, so this only selects a nearby endpoint. | | `authServer.port` | No | `52701` | Port the Auth Server listens on inside the cluster. The gateway's default `accessProxy.authServerUrl` follows it. | | `authServer.image.name` | No | `auth-server` | Auth Server image name. | | `authServer.image.tag` | No | Empty (the chart's app version) | Auth Server image tag. The default ties the image to the chart version. If you set a tag, use one at least as new as the chart. | | `authServer.image.pullPolicy` | No | `IfNotPresent` | Kubernetes image pull policy for the Auth Server: `Always`, `IfNotPresent`, or `Never`. If you set a tag that can point at a new build later, set `Always`. | ### User sign-in `authServer.loginMode` chooses how users sign in. The default is 'oidc' mode, where the Auth Server redirects users to your identity provider. In `gcip` mode, it shows its own login form and authenticates against Google Cloud Identity Platform, which needs no OAuth client. | Value | Required | Default | Description | | --------------------------------------- | ----------- | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `authServer.loginMode` | No | `oidc` | Either `oidc` or `gcip`. | | `authServer.openIdDomain` | No | Empty | Sign-in allowlist, in both modes: a regular expression matched against a person's whole email address, such as `[^@]*@example[.]com`. When empty, any account your identity provider authenticates can sign in. | | `authServer.oidcClientId` | Conditional | Empty | Required in `oidc` mode. The OAuth client ID registered at your identity provider. The matching client secret goes in the credentials Secret, not in values. | | `authServer.oidcIssuer` | No | `https://accounts.google.com` | Your identity provider's issuer URL, exactly as the provider publishes it. Used in `oidc` mode. | | `authServer.oidcPrompt` | No | `select_account` | The `prompt` parameter sent to your identity provider. Set it to an empty string to send none, so the provider can reuse an existing session. Used in `oidc` mode. | | `authServer.oidcRequireEmailVerified` | No | `"true"` | Whether sign-in requires the identity provider to mark the email address as verified. Set it to `"false"` for providers such as Okta and Entra ID that often omit that claim, and rely on `openIdDomain` instead. Used in `oidc` mode. | | `authServer.gcipApiKey` | Conditional | Empty | Required in `gcip` mode. Your Firebase Web API key. This key is public, so it belongs in values rather than in a Secret. | | `authServer.gcipProjectId` | Conditional | Empty | Required in `gcip` mode. The Google Cloud project that hosts your Identity Platform tenant. | | `authServer.gcipTenantId` | Conditional | Empty | Required in `gcip` mode. The Identity Platform tenant this gateway signs people in against. | | `authServer.gcipAllowedSignInProviders` | No | `password` | Comma-separated Identity Platform sign-in providers to accept. Add providers here if your tenant uses more than email and password. | | `authServer.gcipRequireEmailVerified` | No | `"true"` | Whether sign-in requires a verified email address. Set it to `"false"` only if your tenant verifies addresses another way. | ### Agent authentication with federated credentials These values control how agents authenticate to the Auth Server with JWTs issued by an external identity provider, such as JWT-SVIDs (see [JWT-SVID](/agentic-access/using-the-gateway/spiffe-svid.md)). Agents that sign in interactively don't use them, and the defaults suit most deployments. | Value | Required | Default | Description | | ---------------------------------------------- | -------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `authServer.federatedIssuerAllowlist` | No | Empty | Comma-separated issuer URLs this gateway trusts for agent authentication. An issuer must be listed here as well as configured in P0. When empty, the gateway accepts no federated credentials. | | `authServer.clientAssertionAlgorithms` | No | `RS256,ES256` | Comma-separated signing algorithms accepted for agent JWTs. | | `authServer.clientAssertionMaxLifetimeSeconds` | No | `300` | Longest lifetime, in seconds, accepted for an agent JWT. | | `authServer.clientAssertionClockSkewSeconds` | No | `30` | Clock skew, in seconds, tolerated when checking an agent JWT's timestamps. | | `authServer.federatedJwksConnectTimeoutMs` | No | `3000` | Connection timeout, in milliseconds, when fetching an issuer's signing keys. | | `authServer.federatedJwksReadTimeoutMs` | No | `5000` | Read timeout, in milliseconds, when fetching an issuer's signing keys. | | `authServer.federatedJwksResponseMaxBytes` | No | `1048576` | Largest signing-key response accepted, in bytes. | | `authServer.federatedJwksCacheMaxAgeSeconds` | No | `300` | How long, in seconds, an issuer's signing keys are cached. | | `authServer.federatedJwksStaleGraceSeconds` | No | `300` | How long, in seconds, cached signing keys remain usable after a failed refresh. | | `authServer.federatedJwksCooldownSeconds` | No | `30` | Minimum time, in seconds, between fetches of the same issuer's signing keys. | ## Gateway server These values configure the gateway itself, which authenticates requests and connects agents to MCP servers and A2A agents. | Value | Required | Default | Description | | ----------------------------------------------- | ----------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `accessProxy.p0Url` | Yes | Empty | Your organization's P0 API URL. Use the same value as `authServer.p0Url`. | | `accessProxy.p0Audience` | No | The value of `accessProxy.p0Url` | The audience for tokens exchanged with P0. Set it only if it differs from `p0Url`. | | `accessProxy.authServerUrl` | No | `http://agentic-auth-server:` | The Auth Server's address inside the cluster. The default is this release's own Auth Server Service, so set it only if your Auth Server runs elsewhere. | | `accessProxy.manageAllowedEmails` | Conditional | Empty | Required when `manageGcpIssuers` is set. Comma-separated Google service account emails allowed to call the gateway's management API, normally the one P0 assigned to this gateway. See [Gateway](/agentic-access/agentic-gateway/gateway.md#register-a-gateway-you-deployed-yourself). | | `accessProxy.manageGcpIssuers` | No | Empty | Comma-separated token issuers accepted on the management API, normally `https://accounts.google.com`. When empty, the management API accepts no Google identity tokens, so P0 can't manage the gateway. | | `accessProxy.victorialogsUrl` | No | Empty | Base URL of a VictoriaLogs instance, such as `http://victorialogs:9428`. When set, P0 reads the gateway's activity logs from it through the management API. | | `accessProxy.gcpWifPoolProvider` | No | Empty | The Google Cloud workload identity pool provider that Google Cloud MCP servers use to obtain credentials. See [GCP Workload Identity Federation](/agentic-access/credential-sources/gcp-wif.md). | | `accessProxy.backendImagePullPolicy` | No | `IfNotPresent` | Image pull policy for the MCP server pods the gateway starts. The gateway starts a pod for every session, so `Always` pulls an image on every session. Use `Always` only for images tagged with a moving tag. | | `accessProxy.containerCredentialMinLifetimeMs` | No | `120000` | Minimum remaining lifetime, in milliseconds, that cloud credentials must have before the gateway starts an MCP server with them. | | `accessProxy.mcpMetaTracePropagationEnabled` | No | `false` | Sends OpenTelemetry trace context to the MCP servers listed in `mcpMetaTracePropagationBackendIds`. | | `accessProxy.mcpMetaTracePropagationBackendIds` | No | Empty | Comma-separated IDs of the MCP servers that receive trace context when `mcpMetaTracePropagationEnabled` is `true`. | | `accessProxy.a2aProxyIdleTimeoutMs` | No | `60000` | How long, in milliseconds, a streaming A2A call can be idle between the gateway and the A2A bridge before it is closed. | | `accessProxy.a2aUpstreamIdleTimeoutMs` | No | `60000` | How long, in milliseconds, a streaming A2A call can be idle between the A2A bridge and the upstream agent before it is closed. | | `accessProxy.a2aAgentHandlerIdleTimeoutMs` | No | `300000` | How long, in milliseconds, an idle connection to an upstream A2A agent is kept for reuse. If you set `gateway.streamIdleTimeout`, set this to match it. | | `accessProxy.sseHeartbeatIntervalMs` | No | Empty (15 seconds) | How often, in milliseconds, the gateway writes a heartbeat on a quiet MCP or A2A event stream, so `gateway.streamIdleTimeout` doesn't cut off a slow but active call. Keep it shorter than that timeout. | | `accessProxy.httpJsonBodyLimit` | No | `1mb` | Largest JSON request body the gateway accepts, such as `5mb`. | | `accessProxy.gateway.port` | No | `3300` | Port the gateway listens on inside the cluster. | | `accessProxy.managementPort` | No | `3399` | Port inside the cluster that serves only the management API. | | `accessProxy.p0.port` | No | `3301` | Port the gateway's built-in P0 MCP server listens on. It is reachable only from within the gateway's pod. | | `accessProxy.image.name` | No | `access-proxy` | Gateway image name. | | `accessProxy.image.tag` | No | Empty (the chart's app version) | Gateway image tag. The default ties the image to the chart version. | | `accessProxy.image.pullPolicy` | No | `IfNotPresent` | Kubernetes image pull policy for the gateway. If you set a tag that can point at a new build later, set `Always`. MCP server pods use `backendImagePullPolicy` instead. | ## Management tunnel The chart runs a small client that opens an outbound connection to P0, so that P0 can reach the gateway's management API without the API being exposed publicly. The client needs no inbound port. After installing, register the tunnel by pasting its public key into the gateway's page in the P0 admin console. The install notes print the command that reads the key: ```bash kubectl -n get secret braekhus-client-jwk -o jsonpath='{.data.BRAEKHUS_JWK_PUBLIC}' | base64 -d ``` | Value | Required | Default | Description | | --------------------------- | -------- | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `braekhus.orgSlug` | Yes | Empty | Your organization's slug in P0: the `` in `accessProxy.p0Url`. | | `braekhus.gatewayId` | Yes | Empty | The gateway's identifier in the P0 admin console. It must match exactly. | | `braekhus.tunnelHost` | No | `api.p0.app` | Host name of the P0 API the tunnel connects to. It must not be empty. | | `braekhus.tunnelPort` | No | `443` | Port of the P0 API the tunnel connects to. It must not be empty. | | `braekhus.secretsName` | No | `braekhus-client-jwk` | Name of the Secret that holds the tunnel's key pair. It must differ from `secretsName`, so that the tunnel can't read the gateway's other credentials. See [#the-tunnel-key-secret](#the-tunnel-key-secret "mention"). | | `braekhus.image.name` | No | `p0security/braekhus` | Tunnel client image. `imageRegistry` doesn't apply, so set the full name here if you mirror images into your own registry. | | `braekhus.image.tag` | No | `sha-6f9ba9d` | Tunnel client image tag. | | `braekhus.image.pullPolicy` | No | `IfNotPresent` | Kubernetes image pull policy for the tunnel client. | ## TLS-inspecting proxies If your cluster sends outbound traffic through a proxy that decrypts HTTPS and re-signs it with your own certificate authority, the gateway can't reach P0 until it trusts that authority. Its logs then show `UNABLE_TO_GET_ISSUER_CERT_LOCALLY` and `server sync failed`. Set `caBundle` to the proxy's root certificate and any intermediates: ```yaml caBundle: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- ``` With the [Terraform module](https://registry.terraform.io/modules/p0-security/p0-ai-gateway-stack/kubernetes/latest), use version 1.1.0-beta or later. Save the certificates to a file next to your configuration, and add `caBundle` to the `ai-gateway` block of the module's `values`. Module versions 0.6.x and 1.0.0-beta also support `caBundle`, but take the block as `agentic-gateway`. ```hcl module "p0_agentic_gateway" { # ... values = [yamlencode({ # ... "ai-gateway" = { caBundle = file("${path.module}/proxy-ca.pem") # ... } })] } ``` The gateway, the Auth Server, and the management tunnel trust these certificates alongside the usual public ones, so connections that don't pass through the proxy keep working. Changing `caBundle` restarts their pods. ## Database This chart does not deploy a database, but both the gateway and the Auth Server require one to run. If not using the [Batteries-included chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/batteries-included-chart.md), these values should point to a database both deployments share. The password comes from the `POSTGRESQL_PASSWORD` key of [#the-credentials-secret](#the-credentials-secret "mention"). | Value | Required | Default | Description | | --------------------- | -------- | ------- | ---------------------------------- | | `postgresql.host` | Yes | Empty | Hostname of the PostgreSQL server. | | `postgresql.port` | No | `5432` | Port of the PostgreSQL server. | | `postgresql.database` | No | `mcp` | Name of the database. | | `postgresql.username` | No | `mcp` | User the gateway connects as. | ### Encrypted database connections The gateway and the Auth Server connect to the database without SSL unless you set `PGSSLMODE` in [#the-credentials-secret](#the-credentials-secret "mention"). Set it if your database refuses unencrypted connections, as Amazon RDS for PostgreSQL 15 and later does by default. If you don't, both pods fail to start, and their logs show `no pg_hba.conf entry for host` ending in `no encryption`. `PGSSLMODE` takes one of these values: * `verify-full` encrypts the connection and checks the server's certificate. Add the certificate authority that signed it to `caBundle` (see [#tls-inspecting-proxies](#tls-inspecting-proxies "mention")). For RDS, that is the [certificate bundle for your AWS Region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html). * `no-verify` encrypts the connection without checking the certificate. `prefer`, `require`, and `verify-ca` behave like `verify-full`, so they also need the certificate authority in `caBundle`. Add the key and restart both deployments, which read the Secret only when a pod starts: ```bash kubectl -n patch secret app-secrets --type merge \ --patch '{"stringData":{"PGSSLMODE":"verify-full"}}' kubectl -n rollout restart deploy/agentic-gateway-server deploy/agentic-auth-server ``` The chart never removes or changes `PGSSLMODE` once it's set. ## Credentials The gateway and Auth Server read their credentials from a Kubernetes Secret, and the [#management-tunnel](#management-tunnel "mention") reads its key pair from a second one. By default, the chart generates both for you. ### The credentials Secret The Secret named by `secretsName` holds the gateway's credentials. [Deploying the gateway](/agentic-access/agentic-gateway/gateway/deploy.md#secrets-the-chart-creates) describes each key. If you set `secretsJob.enabled: false` (see [#secret-generation](#secret-generation "mention")), create the Secret yourself with these keys: | Key | Required | Description | | ----------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `JWT_PRIVATE_KEY`, `JWT_PUBLIC_KEY` | Yes | The Auth Server's RSA signing key pair, as PEM or base64-encoded PEM. The Auth Server doesn't start without both halves. | | `REFRESH_TOKEN_SECRET` | Yes | A base64-encoded value of at least 32 bytes, used to protect refresh tokens. The Auth Server doesn't start without it. | | `POSTGRESQL_PASSWORD` | Yes | The password for `postgresql.username`. Without it, the gateway and Auth Server pods can't start. | | `OIDC_CLIENT_SECRET` | Conditional | Required in `oidc` mode. The client secret for `authServer.oidcClientId`. The Auth Server doesn't start without it. | | `PGSSLMODE` | No | Set it to connect to the database over SSL. See [#encrypted-database-connections](#encrypted-database-connections "mention"). | | `KMS_LOCAL_ENCRYPTION_KEY` | No | A 32-byte key, as 64 hexadecimal characters, for encrypting stored data. Set it: without it, the Auth Server generates a new key on every restart and can't read data encrypted before the restart. | ### The tunnel key Secret The Secret named by `braekhus.secretsName` holds the management tunnel's key pair, kept apart from the credentials Secret. If you set `secretsJob.enabled: false`, create it yourself with these keys: | Key | Required | Description | | --------------------------------------------- | -------- | ------------------------------------------------- | | `BRAEKHUS_JWK_PRIVATE`, `BRAEKHUS_JWK_PUBLIC` | Yes | The tunnel's EC P-384 key pair, as JSON Web Keys. | ### Secret generation Before installing or upgrading, the chart runs a job that creates [#the-credentials-secret](#the-credentials-secret "mention") and [#the-tunnel-key-secret](#the-tunnel-key-secret "mention"), and fills in any key that is missing. It never overwrites a key that already has a value. | Value | Required | Default | Description | | ------------------------------------- | -------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `secretsJob.enabled` | No | `true` | Set to `false` to manage both Secrets yourself, for example from External Secrets or Vault. They must then exist, with every required key, before you install. | | `secretsJob.imagePullSecrets` | No | Empty | Image pull secrets for the job, such as `[{name: my-registry}]`. Needed if the Auth Server image comes from a private registry, because the job doesn't use the namespace's default pull secrets. | | `secretsJob.activeDeadlineSeconds` | No | `300` | How long, in seconds, the job may run before it fails. Pass Helm a longer `--timeout`, such as `6m`, so a stuck job reports its own error. | | `secretsJob.resources` | No | 50m CPU and 64Mi memory requested; 128Mi memory limit | CPU and memory for the job's container. | | `secretsJob.podSecurityContext` | No | Runs as non-root user and group `65532` with the `RuntimeDefault` seccomp profile | Pod security context for the job. Fields you set are merged with the default. | | `secretsJob.containerSecurityContext` | No | No privilege escalation, a read-only root filesystem, and all capabilities dropped | Container security context for the job. Fields you set are merged with the default. | ## Observability The gateway and Auth Server always write structured logs to standard output. These values add an export to an OpenTelemetry collector. | Value | Required | Default | Description | | ------------------------------ | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `observability.otlpEndpoint` | No | Empty | Address of an OpenTelemetry collector's gRPC receiver, such as `otel-collector.observability.svc.cluster.local:4317`. When empty, logs go only to standard output and no traces are exported. | | `observability.logsExporter` | No | Empty | OpenTelemetry logs exporters, comma-separated. When empty, logs go to standard output, and also to the collector when `otlpEndpoint` is set. Set `none` to turn log export off. | | `observability.tracesExporter` | No | Empty | OpenTelemetry traces exporters, comma-separated. When empty, traces go to the collector when `otlpEndpoint` is set. Set `none` to turn trace export off. | | `observability.stdoutFormat` | No | `json` | Format of standard output logs: `json`, for log collectors, or `text`, for reading with `kubectl logs`. | | `observability.stdoutLevel` | No | Empty | Lowest severity written to standard output: `debug`, `info`, `warn`, or `error`. When empty, every level is written. | | `observability.otlpLevel` | No | Empty | Lowest severity exported to the collector. Audit records are always exported. Use `warn` to reduce volume on a sink that charges by volume. | | `observability.gcpProjectId` | No | Empty | A Google Cloud project ID. When set, JSON log lines include the fields Cloud Logging uses to link each line to its Cloud Trace span. |