Configuration

Helm values

The chart lives at helm/kimo/. The values that matter:

operator:
  image:
    repository: ghcr.io/hermannchristopher/kimo
    tag: latest
    pullPolicy: IfNotPresent
  replicas: 1
  resources:
    requests: { cpu: 10m, memory: 64Mi }
    limits: { cpu: 500m, memory: 128Mi }

api:
  port: 8080

integration:
  backend: generic          # generic | ctfd | <custom>
  config: {}                # backend-specific JSON, see below
  existingConfigSecret: ""  # name of a Secret holding the config instead

ctfDomain: ctf.example.com  # informational domain for endpoints

global:
  maxInstances: 1000        # cluster-wide informational cap

Backend config

integration.config is passed verbatim to the selected backend:

Backend	Config keys
generic	apiKey — the bearer token API callers must present.
ctfd	baseUrl (CTFd instance, used for auth), webhookUrl (optional event receiver), apiKey (token for KIMO → CTFd calls).

If the config contains credentials, create a Secret whose data is the JSON blob and set existingConfigSecret instead of inlining it.

Environment variables

When running the manager outside Helm (e.g. go run ./cmd/manager):

Variable	Default	Meaning
KIMO_BACKEND	generic	Which registered backend to activate.
KIMO_BACKEND_CONFIG	(empty)	JSON config for that backend, e.g. {"apiKey":"..."}.

Manager flags

The operator binary accepts the standard controller-runtime flags — the notable ones:

Flag	Default	Meaning
--health-probe-bind-address	:8081	Liveness/readiness probe endpoint.
--metrics-bind-address	0 (disabled)	Metrics endpoint (:8443 HTTPS / :8080 HTTP).
--metrics-secure	true	Serve metrics over HTTPS with authn/authz.
--leader-elect	false	Enable leader election for HA deployments.
--zap-log-level, --zap-devel, …		Standard zap logging flags.

The REST API always binds :8080 inside the pod.

Namespaces

The operator runs wherever you install it (Helm: release namespace; kustomize: workspace-system). Challenge CRs and their workloads currently live in the default namespace — the REST API creates and reads instances there.