deploy/helm/keyring. Runtime-owned environment variables are represented under runtime; general Kubernetes customization follows standard chart patterns.
Set image.repository=composiohq/keyring and image.tag=alpha as shown in the
Kubernetes deployment guide.
Image and rollout
Runtime values
Each scalar has a companion*ValueFrom object for a Kubernetes valueFrom source. For example, authAudienceValueFrom replaces literal authAudience.
The chart always sets
RUNTIME=node. runtime.portValueFrom is rejected because the Service and probes need the port at render time.
Encryption config file
When file mode is enabled, exactly one usable Secret or ConfigMap source must be provided. A Secret takes precedence if both names are set; configure only one to keep intent clear.
Additional environment
extraEnv cannot redefine chart-owned runtime variables. Use the matching runtime.* value or *ValueFrom field instead.
Service account and pod metadata
Set
serviceAccount.automount: true only when a configured auth method needs the standard token, such as Vault Kubernetes auth. EKS Pod Identity does not require it.
Security contexts and scheduling
Service and ingress
Terminate TLS at the Ingress or an upstream private load balancer. Do not expose a production Keyring endpoint over plaintext HTTP.
Probes and autoscaling
The current health routes report process liveness/readiness; they do not perform a KMS, JWKS, manifest, or collector round trip. Use authenticated synthetic operations when dependency readiness must be monitored.