Helm Chart Configuration Reference
This page lists the NPU Operator chart's main values and defaults. See Helm Configuration Examples for deployment YAML, Kubernetes installation for setup, and Tutorials for worked examples.
Checking values by version
Check the defaults in the chart you plan to install. Image tags vary by release and are shown as <chart default> on this page. Empty operator.image.tag and validator.image.tag values use the chart's appVersion.
| export CHART_VERSION=0.6.0
helm show values oci://docker.io/rebellions/rbln-npu-operator-chart \
--version "$CHART_VERSION"
|
image.* means registry, repository, tag, and pullPolicy. RSMD's driver.smd.image has only registry and repository; its tag follows the driver version.
Applying values
Merge configuration snippets into the installation's npu-values.yaml. Use the currently installed chart version in the following command. To change chart versions, follow the upgrade procedure first.
| helm list -n rbln-system
export CHART_VERSION=<INSTALLED_CHART_VERSION>
helm upgrade rbln-npu-operator oci://docker.io/rebellions/rbln-npu-operator-chart \
--version "$CHART_VERSION" -n rbln-system \
--reset-values -f npu-values.yaml --wait --timeout 10m
|
--reset-values drops any user settings that are not in the file. If the original file is unavailable, use helm get values rbln-npu-operator -n rbln-system -o yaml to recover the user settings before preparing the file. Lists replace earlier lists rather than merging individual entries.
Helm values differ from CR fields. For example, devicePlugin.image.tag maps to RBLNClusterPolicy.spec.devicePlugin.version, and driver.image.tag maps to RBLNDriver.spec.version. OLM installations configure the CRs directly.
Chart-wide
| Key | Description | Default |
nameOverride | Name used for chart resources. It does not rename the RBLNClusterPolicy instance or default RBLNDriver instance, or isolate multiple Operator installations. | rbln-npu-operator |
workloadType | Default workload mode: container or vm-passthrough. See node workload labels for overrides. | container |
nfd.enabled | Deploy the Node Feature Discovery subchart. Keep false when NFD is already installed. | false |
podDefaults.labels | Labels applied to every DaemonSet pod managed by the operator. | {} |
podDefaults.annotations | Annotations applied to every DaemonSet pod managed by the operator. | {} |
podDefaults.tolerations | Tolerations applied to every DaemonSet pod managed by the operator. | [] |
podDefaults.priorityClassName | Priority class applied to every operator-managed DaemonSet pod. | "" |
CRD Upgrade Hook
| Key | Description | Default |
crds.upgrade.enabled | Run the CRD update hook before installation and upgrade. | true |
crds.upgrade.imagePullSecrets | Image pull secret(s) for the hook Job that runs the operator image. | [] |
crds.upgrade.tolerations | Tolerations for the hook Job pod. | [] |
crds.upgrade.resources | CPU/memory requests and limits for the hook Job pod. | {} |
crds.upgrade.logging.level | CRD hook Job log level: error, warning, info, debug. | info |
crds.upgrade.logging.format | Log format for the hook Job: json or text. | json |
Operator
| Key | Description | Default |
operator.image.* | Image of the controller-manager pod. Override tag to pin a specific operator version. | docker.io/rebellions/rbln-npu-operator:<chart default>
pullPolicy: IfNotPresent |
operator.replicas | Number of Operator Pods. Leader election selects the active controller. | 1 |
operator.resources.requests | Minimum guaranteed resources for the operator pod. | cpu: 50m, memory: 128Mi |
operator.resources.limits | Maximum resources for the operator pod. | cpu: 500m, memory: 256Mi |
operator.metrics.enabled | Whether to enable the authenticated operator self-metrics endpoint and its Service. | true |
operator.metrics.port | Metrics HTTPS port. | 8443 |
operator.metrics.serviceMonitor.* | Whether to create a ServiceMonitor for the Prometheus Operator, plus scrape options (interval, scrapeTimeout, and so on). See Operator Observability. | enabled: false |
operator.logging.level | Log level: error, info, debug, panic, or an integer verbosity. Invalid values prevent startup. | info |
operator.logging.encoder | Log encoding: json or console. | json |
operator.logging.timeEncoding | Timestamp format: epoch, millis, nanos, iso8601, rfc3339, or rfc3339nano. | rfc3339nano |
operator.logging.develMode | Enable development logging behavior. Keep the default in production. | false |
operator.driverImageCheck | Check driver image availability before deployment. Set to false if the operator cannot reach the nodes' registry or use their image pull credentials. | true |
operator.securityContext.runAsNonRoot | Pod-level security context. Adjust based on your cluster's security policy. | true |
operator.affinity | Affinity for the operator pod (for example, to pin to control-plane nodes). | {} |
operator.tolerations | Tolerations for the operator pod (for example, to allow scheduling on nodes with taints). | [] |
Driver Manager
| Key | Description | Default |
driver.enabled | Whether the operator installs and manages the NPU driver. Leave false if drivers are already installed on hosts. | false |
driver.image.* | Driver container image. Override these values to use a private mirror or select a specific driver release. Leave the NPU family out of repository; the operator inserts it per node pool. | repo.rebellions.ai/rebellions/rbln-driver:<chart default>
pullPolicy: IfNotPresent |
driver.imagePullSecrets | Image pull secret for the driver image. If you use a secret other than drivercred, specify its name. | [drivercred] |
driver.nodeSelector | Restrict driver pods to specific nodes. The selector cannot use the operator-managed keys rebellions.ai/npu.driver.owner and rebellions.ai/npu.deploy.driver. | {} |
driver.tolerations | Tolerations for driver pods. | [] |
driver.annotations | Annotations for driver pods. | {} |
driver.priorityClassName | Pod priority class. The CRD defaults to system-node-critical when this value is empty. | "" |
driver.resources | CPU/memory requests and limits for the driver pod. Optional; when unset, the driver pod runs without requests or limits. | {} |
driver.env | Environment variables passed to the driver container (for example, log levels). | [] |
driver.manager.image.* | Driver Manager init container image. Use the chart default. | docker.io/rebellions/rbln-k8s-driver-manager:<chart default>
pullPolicy: IfNotPresent |
driver.smd.image.registry
driver.smd.image.repository | Registry and repository of the RSMD node daemon that ships with each driver. There is no tag key: the tag always follows the driver version. | repo.rebellions.ai
rebellions/rbln-smd |
driver.deployDefault | Create the default RBLNDriver. Setting false requires at least one entry in driver.instances. | true |
driver.instances | Additional RBLNDriver resources for running per-node-group driver versions. See Multiple Driver Versions. | {} |
Driver upgrade policy
See manual upgrade settings and automatic upgrade policy for behavior and status.
| Key | Description | Default |
driver.upgradePolicy.autoUpgrade | Enable automatic driver upgrades | false |
driver.upgradePolicy.maxParallelUpgrades | Maximum nodes upgraded concurrently | 1 |
driver.upgradePolicy.podRestartTimeoutSeconds | Driver Pod replacement timeout in seconds | 1800 |
driver.upgradePolicy.waitForCompletion.timeoutSeconds | Timeout in seconds for selected Pods to finish; 0 waits indefinitely | 0 |
driver.upgradePolicy.waitForCompletion.podSelector | Label selector for Pods to wait for; empty skips waiting | "" |
driver.upgradePolicy.npuPodDeletion.force | Allow eviction of NPU Pods without a controller | false |
driver.upgradePolicy.npuPodDeletion.timeoutSeconds | NPU Pod eviction timeout in seconds for automatic upgrades | 300 |
driver.upgradePolicy.npuPodDeletion.deleteEmptyDirData | Allow eviction of NPU Pods using emptyDir, deleting their volume data | false |
RDS
Enable RDS and select the NVMe devices to bind on Rebel100™ nodes. See RDS Support.
| Key | Description | Default |
rds.enabled | Enable RDS binding on nodes labeled rebellions.ai/rds.present=true. Selected NVMe devices are bound to the RDS driver. | false |
rds.deviceSelection | Per-node NVMe allowlists with nodeName and targetBDFs. Nodes absent from this list are not excluded from RDS. | Unset |
Device Plugin
| Key | Description | Default |
devicePlugin.enabled | Whether the standard container Device Plugin is deployed. Disable when running only DRA (draKubeletPlugin) or only VM workloads. | true |
devicePlugin.image.* | Device Plugin image. | docker.io/rebellions/k8s-device-plugin:<chart default>
pullPolicy: IfNotPresent |
devicePlugin.useGenericResourceName | Advertise rebellions.ai/npu in addition to product-specific resources. Match this setting to workload resource names. | true |
devicePlugin.otlpEndpoint | OTLP gRPC endpoint to which the Device Plugin exports NPU allocation traces (host:port or a URL including a scheme). Setting it enables tracing. | "" |
DRA Driver
| Key | Description | Default |
draKubeletPlugin.enabled | Enable on Kubernetes 1.34 or later to use Dynamic Resource Allocation. Mutually exclusive with devicePlugin.enabled. | false |
draKubeletPlugin.image.* | DRA kubelet plugin image. | docker.io/rebellions/k8s-dra-driver-npu:<chart default>
pullPolicy: IfNotPresent |
draKubeletPlugin.driverName | Driver name; must match the value referenced from DeviceClass.spec.config.driver. | npu.rebellions.ai |
draKubeletPlugin.kubeletRegistrarDirectoryPath | Host path where the plugin registers with the kubelet. | /var/lib/kubelet/plugins_registry |
draKubeletPlugin.kubeletPluginsDirectoryPath | Host path where the plugin sockets live. | /var/lib/kubelet/plugins |
draKubeletPlugin.healthcheckPort | TCP port for the plugin's health-check endpoint. | 51515 |
See NPU DRA Driver for full DRA usage.
Sandbox Device Plugin
| Key | Description | Default |
sandboxDevicePlugin.enabled | Whether the VFIO Sandbox Device Plugin is deployed. Enable for KubeVirt or other VM environments. | false |
sandboxDevicePlugin.image.* | Sandbox Device Plugin image. | docker.io/rebellions/sandbox-device-plugin:<chart default>
pullPolicy: IfNotPresent |
Resource names are discovered automatically per NPU product. There is no resource list to configure. See Resource naming.
VFIO Manager
| Key | Description | Default |
vfioManager.enabled | Manage VFIO binding for VM passthrough. Also enable either the Sandbox Device Plugin or the DRA Driver. | false |
vfioManager.image.* | VFIO Manager image. | docker.io/rebellions/rbln-vfio-manager:<chart default>
pullPolicy: IfNotPresent |
vfioManager.driverManager.image.* | Driver manager image used by the VFIO Manager initContainer. | docker.io/rebellions/rbln-k8s-driver-manager:<chart default>
pullPolicy: IfNotPresent |
vfioManager.driverManager.env | Environment variables for that initContainer. | [] |
| Key | Description | Default |
containerToolkit.enabled | Whether the Container Toolkit DaemonSet is deployed. Disable if CDI specs and runtime config are managed externally. | true |
containerToolkit.image.* | Container Toolkit image. | docker.io/rebellions/rbln-container-toolkit:<chart default>
pullPolicy: IfNotPresent |
containerToolkit.imagePullSecrets | Image pull secret(s); required when pulling from a private registry. | [] |
containerToolkit.resources | CPU/memory requests and limits for the toolkit pod. | {} |
containerToolkit.env | Environment variables passed to the toolkit, including RBLN_CTK_DAEMON_SOCKET and RBLN_CTK_DAEMON_CONFIG_PATH. | [] |
containerToolkit.refreshInterval | How often rbln-ctk-daemon reapplies CDI specs and container runtime configuration on each node. Set to 0s to disable periodic refresh. The value is forwarded to the pod as the RBLN_CTK_DAEMON_REFRESH_INTERVAL environment variable. | 5s |
NPU Feature Discovery
| Key | Description | Default |
npuFeatureDiscovery.enabled | Whether the operator deploys NPU Feature Discovery. Disable if you manage NPU node labels through another mechanism. | true |
npuFeatureDiscovery.image.* | NPU Feature Discovery image. | docker.io/rebellions/rbln-npu-feature-discovery:<chart default>
pullPolicy: IfNotPresent |
Metrics Exporter
| Key | Description | Default |
metricsExporter.enabled | Whether the Prometheus metrics exporter is deployed. Disable when another telemetry pipeline already covers NPUs. | true |
metricsExporter.image.* | Metrics exporter image. | docker.io/rebellions/rbln-metrics-exporter:<chart default>
pullPolicy: IfNotPresent |
Operator Validator
| Key | Description | Default |
validator.image.* | Validator DaemonSet image. | docker.io/rebellions/rbln-npu-operator-validator:<chart default>
pullPolicy: IfNotPresent |
validator.imagePullSecrets | Image pull secret(s); required when pulling from a private registry. | [] |
validator.resources | CPU/memory requests and limits for the Validator pod. | {} |
validator.env | Environment variables for the top-level Validator process. | [] |
validator.toolkit.env | Environment variables for the Container Toolkit readiness subcheck. | [] |
validator.driver.env | Environment variables for the driver readiness subcheck. | [] |
RSMD Node Daemon
Each RBLNDriver deploys one RSMD (rbln-smd) DaemonSet. Configure its image through driver.smd.image.* in the Driver Manager table. RSMD listens on host port 50051.