Node Autoscaler Helm Values
Use the cluster’s Pre Run Command to supply custom Helm values for the AWS,
Azure, or GCP Node Autoscaler (NA) controller. Typical uses include scheduling
the controller onto a dedicated node pool with nodeSelector and tolerations.
These values configure the NA installation, rather than the nodes it provisions;
use NodePools and
NodeClasses for provisioned nodes.
WA components use the independent CLOUDPILOT_WA_HELM_VALUES input. See
Workload Autoscaler Helm values
for its complete reference and examples combining both inputs.
Availability: the selected installation script must support
CLOUDPILOT_NA_HELM_VALUES. Older generated installers ignore this variable.
GCP controller.nodeSelector also requires a chart that renders that field.
Confirm that both changes are included in your target release before using them.
The provider tables below describe the corresponding chart configuration;
available fields and defaults depend on the target chart version.
Set values in Pre Run
- Open the cluster’s Settings in the CloudPilot AI Console.
- Expand Advanced Options and add an exported YAML string to Pre Run Command.
- Save the settings, then obtain and run the console’s installation or manual upgrade command for that cluster.
For example, this partial AWS/Azure configuration adds a node selector:
export CLOUDPILOT_NA_HELM_VALUES='
nodeSelector:
example.com/node-pool: platform
'For GCP, place the selector under controller. See the complete
scheduling examples below.
The variable must be exported because the installer runs in a child shell. You can also export it in your terminal before running the generated command. To load an existing YAML file in that environment:
export CLOUDPILOT_NA_HELM_VALUES="$(cat ./na-values.yaml)"The file must be available in the environment where the command runs. Its contents
are written literally to a temporary values file; the installer does not expand
${VARIABLE} placeholders inside customer YAML. The single-quoted examples on
this page also prevent the shell from expanding their contents.
Keep the configuration for subsequent shell upgrades. Saving or editing Pre Run alone does not change running Pods. Automatic upgrades do not execute Pre Run or these installation scripts: they retain existing scheduling fields, but do not apply newly edited values. Use the shell installation/manual-upgrade path to apply changes.
Empty and partial values
You only need to provide the fields you want to change.
| Input | Result |
|---|---|
Variable unset, an empty string, an empty YAML document, or {} | No customer overrides. The target chart defaults and installer-generated settings apply. |
A partial map, such as only nodeSelector | Map keys merge with defaults. Unspecified settings, including tolerations, keep their chart or installer-generated defaults. |
A list, such as tolerations, controller.env, or topologySpreadConstraints | The entire corresponding list is replaced. Include every entry that must remain. |
tolerations: [] | Explicitly clears that list; this is different from omitting it. |
nodeSelector: {} | Adds no selector keys; it does not clear a default selector map. |
The installers use --reset-values. Consequently, omitted fields use the
target version’s defaults, not values you manually customized in an earlier
Helm release. Put all overrides you want to retain into Pre Run. Explicit installer
arguments still take precedence over customer values.
Find all values for your version
Use helm show values to retrieve the complete default values document for the
target chart version. Use the version selected by the installation command
(CLOUDPILOT_REBALANCE_VERSION in the generated NA installer), rather than assuming
that the Agent version or the latest chart version is the same.
Replace <target-chart-version> before running these commands:
helm repo add onboard https://onboard.cloudpilot.ai
helm repo update onboard
export NA_CHART_VERSION='<target-chart-version>'
helm show values onboard/aws-optimizer --version "${NA_CHART_VERSION}" > aws-na-defaults.yaml
helm show values onboard/azure-optimizer --version "${NA_CHART_VERSION}" > azure-na-defaults.yaml
helm show values onboard/gcp-optimizer --version "${NA_CHART_VERSION}" > gcp-na-defaults.yamlChoose the file for your provider. These are chart defaults, not the complete effective installation configuration. The installer also supplies cluster identity, resources, and other values described below. Azure defaults can contain environment placeholders that its installer resolves; copy only the fields you intend to override, not the entire defaults file.
Inspect the installed release when checking the effective configuration:
helm list --namespace cloudpilot --filter '^cloudpilot$'
helm get values cloudpilot --namespace cloudpilot --all --output yamlArbitrary YAML keys are not automatically supported: Helm can accept an unknown key that no template reads. Use the fields below and verify the rendered Pod configuration after installation.
AWS and Azure value reference
Paths are relative to the YAML root. controller.resources, Kubernetes scheduling
objects, labels, annotations, and lists accept their corresponding Kubernetes
structures. Installer-controlled fields are listed separately under
precedence.
| Values | Type | Purpose and provider differences |
|---|---|---|
nameOverride, fullnameOverride | String | Override chart resource names. Preserve names expected by the managed installer and upgrade workflow. |
additionalLabels, additionalAnnotations | Map | Add resource metadata. |
podLabels, podAnnotations | Map | Add controller Pod metadata. Retain Azure’s Workload Identity label. |
serviceAccount.create, serviceAccount.name, serviceAccount.annotations | Boolean, string, map | Configure the ServiceAccount and identity annotations. |
additionalClusterRoleRules | List | Add Kubernetes RBAC rules to the controller ClusterRole. |
replicas | Integer | Controller replica count; the AWS installer sets it to 2. |
revisionHistoryLimit, strategy | Integer, object | Retained ReplicaSets and Deployment update strategy. |
terminationGracePeriodSeconds | Integer or null | Pod termination grace period override. |
global.priorityClassName (AWS), priorityClassName (Azure) | String | Controller Pod priority class. |
podSecurityContext | Object | Pod security context. |
hostNetwork, dnsPolicy, dnsConfig | Boolean, string, object | Pod networking and DNS configuration. |
nodeSelector, tolerations, affinity, topologySpreadConstraints | Map, list, object, list | Controller Pod placement. AWS/Azure default selectors include kubernetes.io/os: linux. |
podDisruptionBudget.name | String | PodDisruptionBudget name. |
podDisruptionBudget.minAvailable (AWS), podDisruptionBudget.maxUnavailable (Azure) | Integer or percentage string | Controller voluntary disruption budget. |
imagePullPolicy, imagePullSecrets | String, list | Image pull policy and registry secret references. |
controller.image.repository, controller.image.tag, controller.image.digest | String | Controller image identity. Preserve the supported image/tag/digest combination; changing a tag alone does not override a pinned digest. |
controller.env, controller.envFrom | List | Controller environment variables and environment sources. Azure’s generated env list contains essential identity, networking, and cluster settings. |
controller.resources | Object | Controller requests and limits; AWS installer request overrides still apply. |
extraVolumes, controller.extraVolumeMounts | List | Additional Pod volumes and controller mounts. |
controller.sidecarContainer, controller.sidecarVolumeMounts | List | Additional sidecar containers and their shared mounts. |
controller.metrics.port, controller.healthProbe.port | Integer | Metrics and health probe ports. |
webhook.enabled, webhook.port, webhook.metrics.port | Boolean, integer, integer | Webhook enablement and ports. |
serviceMonitor.enabled, serviceMonitor.additionalLabels, serviceMonitor.endpointConfig | Boolean, map, object | Prometheus ServiceMonitor configuration. Requires the Prometheus Operator CRDs. endpointConfig configures the existing metrics endpoint, not extra endpoints. |
logLevel | String | Controller log level. |
logOutputPaths, logErrorOutputPaths | List | AWS log destinations. These are not effective Azure chart controls. |
cloudpilot.clusterID, cloudpilot.predictorAPIEndpoint | String | AWS CloudPilot cluster identity and predictor endpoint. Azure receives these through generated controller environment entries. |
controller.instancesDistributionEnabled, controller.spotAllocationStrategy | Boolean, string | AWS-specific instance distribution and Spot Fleet allocation strategy. |
AWS settings
These paths are relative to root-level settings.
| Values | Type | Purpose |
|---|---|---|
batchMaxDuration, batchIdleDuration | Duration string | Maximum and idle provisioning batch windows. |
clusterCABundle, clusterName, clusterEndpoint | String | Cluster TLS and API connection settings. The installer supplies the cluster name. |
isolatedVPC | Boolean | Restrict calls to AWS services without VPC endpoints, including pricing lookups. |
vmMemoryOverheadPercent | Number | Fraction of VM memory reserved as overhead, for example 0.075 for 7.5%. |
interruptionQueue | String | SQS interruption queue; requires matching controller permissions. |
reservedENIs | String | ENIs excluded from Pod-capacity calculations. |
featureGates.spotToSpotConsolidation | Boolean | Enable Spot-to-Spot replacement consolidation when supported by the controller. |
securityProxy | String | Security proxy supplied by the installation environment. |
Azure settings
These paths are relative to root-level settings.
| Values | Type | Purpose |
|---|---|---|
batchMaxDuration, batchIdleDuration | Duration string | Maximum and idle provisioning batch windows. |
clusterCABundle, clusterName, clusterEndpoint | String | Cluster TLS and API connection settings; preserve consistency with generated identity and environment configuration. |
vmMemoryOverheadPercent | Number | Fraction of VM memory reserved as overhead. |
featureGates.staticCapacity, featureGates.spotToSpotConsolidation, featureGates.nodeRepair, featureGates.nodeOverlay | Boolean | Controller feature gates. Availability and maturity depend on the installed controller version. |
GCP value reference
GCP places Pod scheduling, resources, update behavior, and cloud settings under
controller. It does not use the AWS/Azure root-level scheduling keys.
| Values | Type | Purpose |
|---|---|---|
nameOverride, fullnameOverride | String | Override chart resource names; preserve managed workflow naming. |
additionalAnnotations | Map | Additional resource annotations. |
podLabels, podAnnotations | Map | Controller Pod metadata. |
serviceAccount.create, serviceAccount.automount, serviceAccount.name, serviceAccount.annotations | Boolean, boolean, string, map | ServiceAccount creation, token automounting, name, and Workload Identity annotations. |
imagePullSecrets | List | Registry secret references. |
cloudpilot.clusterID, cloudpilot.predictorAPIEndpoint | String | CloudPilot cluster identity and predictor endpoint. |
podDisruptionBudget.minAvailable | Integer or percentage string | Controller voluntary disruption budget. |
serviceMonitor.enabled, serviceMonitor.additionalLabels | Boolean, map | Enable and label a Prometheus ServiceMonitor; requires the Prometheus Operator CRDs. |
serviceMonitor.interval, serviceMonitor.scrapeTimeout | Duration string | Scrape timing; empty strings use the operator’s defaults. |
serviceMonitor.relabelings, serviceMonitor.metricRelabelings, serviceMonitor.sampleLimit | List, list, integer or null | Prometheus relabeling and sample limits. |
logLevel, logOutputPaths, logErrorOutputPaths | String, list, list | Controller logging. |
controller.replicaCount | Integer | Controller replica count; the first-install identity bootstrap controls this temporarily. |
controller.revisionHistoryLimit, controller.strategy | Integer, object | Retained ReplicaSets and Deployment update strategy. |
controller.image.repository, controller.image.tag, controller.image.digest, controller.image.pullPolicy | String | Controller image identity and pull policy. Preserve the supported image/tag/digest combination. |
controller.priorityClassName, controller.terminationGracePeriodSeconds | String, integer | Controller Pod priority and termination grace period. Use controller.priorityClassName; root global.priorityClassName does not control this Deployment. |
controller.nodeSelector, controller.tolerations, controller.affinity | Map, list, object | Controller Pod placement. nodeSelector requires the updated GCP chart. |
controller.env, controller.resources | List, object | Additional controller environment and resource requests/limits. Installer request overrides still apply. |
controller.metrics.port, controller.healthProbe.port | Integer | Metrics and health probe ports. |
controller.disableControllerWarmup | Boolean | Whether controller sources start only after leader election. |
credentials.enabled, credentials.secretName, credentials.secretKey | Boolean, string, string | Optional existing Kubernetes Secret for GCP service-account credentials. The managed GKE installation uses Workload Identity; retain that identity configuration. |
GCP settings and feature gates
| Values | Type | Purpose |
|---|---|---|
controller.settings.projectID, controller.settings.clusterName | String | Target GCP project and GKE cluster, supplied by the installer. |
controller.settings.clusterLocation, controller.settings.nodeLocation | String | Cloud location inputs supplied by the GKE installer. Preserve the exact location selected for the cluster. |
controller.settings.defaultNodepoolServiceAccount | String | Service account for provisioned node VMs, supplied by the installer. |
controller.settings.defaultNodePoolTemplateName | String | Pin the GKE node pool used for bootstrap metadata. |
controller.settings.vmMemoryOverheadPercent | Number | Fraction of VM memory reserved as overhead. |
controller.settings.batchMaxDuration, controller.settings.batchIdleDuration | Duration string | Maximum and idle provisioning batch windows. |
controller.featureGates.spotToSpotConsolidation, controller.featureGates.nodeOverlay, controller.featureGates.staticCapacity, controller.featureGates.nodeRepair, controller.featureGates.reservedCapacity | Boolean | Controller feature gates. Check controller-version support before changing them; a chart field alone does not establish feature availability. |
Installer precedence
The order, from lowest to highest priority, is:
- Target chart defaults.
- Installer-generated values, including Azure’s generated environment and defaults.
- YAML exported as
CLOUDPILOT_NA_HELM_VALUES. - Explicit installer
--set/--set-stringarguments, including image-source overrides when the selected image source requires them.
| Provider | Values controlled by explicit installer arguments |
|---|---|
| AWS | settings.clusterName, settings.securityProxy, cloudpilot.clusterID, replicas (2), affinity.nodeAffinity (null), serviceAccount.name, the ServiceAccount eks.amazonaws.com/role-arn annotation, and controller.resources.requests.cpu / .memory (1 / 1Gi). |
| Azure | Generated defaults precede customer YAML, so they can be overridden. Replacing controller.env can remove essential generated identity and cluster entries. Preserve them when intentionally supplying a replacement list. |
| GCP | cloudpilot.clusterID, serviceAccount.name, the ServiceAccount iam.gke.io/gcp-service-account annotation, controller.settings.projectID, .clusterName, .clusterLocation, .nodeLocation, .defaultNodepoolServiceAccount, and controller.resources.requests.cpu / .memory (1 / 1Gi). The first-install identity bootstrap sets controller.replicaCount to 0, then restores it to 2 while reusing the custom values. |
| Release installers | Image-source selection can add a final controller.image.repository override for any of these providers. |
For AWS, customer YAML cannot restore affinity.nodeAffinity because the installer
explicitly clears it. Other supported affinity settings still follow Helm’s merge
rules. Azure clears node affinity in its generated defaults, but customer YAML is
applied afterward.
Scheduling examples
The node label and taint below are illustrative. Replace them with the labels and taints on your intended nodes. A selector restricts placement; a toleration only permits a matching taint and does not select a node by itself.
AWS / EKS
Keep the default CriticalAddonsOnly toleration when adding a custom one:
export CLOUDPILOT_NA_HELM_VALUES='
nodeSelector:
example.com/node-pool: platform
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: example.com/dedicated
operator: Equal
value: platform
effect: NoSchedule
'Azure / AKS
The managed installer also supplies an AKS Spot toleration. Retain both existing entries if the controller must remain eligible for those taints:
export CLOUDPILOT_NA_HELM_VALUES='
nodeSelector:
example.com/node-pool: platform
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: kubernetes.azure.com/scalesetpriority
operator: Equal
value: spot
effect: NoSchedule
- key: example.com/dedicated
operator: Equal
value: platform
effect: NoSchedule
'GCP / GKE
The GCP chart has an empty default toleration list. Both scheduling fields belong
under controller:
export CLOUDPILOT_NA_HELM_VALUES='
controller:
nodeSelector:
example.com/node-pool: platform
tolerations:
- key: example.com/dedicated
operator: Equal
value: platform
effect: NoSchedule
'Quote YAML label values such as "true" so that Kubernetes receives strings.
Check that eligible nodes satisfy the controller’s existing affinity and topology
rules. With the usual two replicas and required Pod anti-affinity, plan for at
least two eligible nodes. Restricting the controller to unavailable capacity can
prevent the autoscaler from provisioning more nodes.
Verify and recover
After installation or upgrade, inspect the release and controller placement:
helm get values cloudpilot --namespace cloudpilot --all --output yaml
kubectl get deployments --namespace cloudpilot
kubectl get pods --namespace cloudpilot --output wide
kubectl get events --namespace cloudpilot --sort-by=.metadata.creationTimestampUse kubectl describe pod <controller-pod> --namespace cloudpilot to inspect the
effective selector, tolerations, and scheduling failures. Confirm the NA Deployment
is available before treating the change as complete. Helm rejects malformed YAML,
but the installer may already have applied CRDs before that failure; the operation
is not an atomic rollback.
If the controller remains Pending, correct the selector/tolerations in Pre Run, or restore the last known working overrides, then rerun the supported installation or manual-upgrade command. An empty input restores target defaults plus installer settings on that next run; it does not recover earlier custom values automatically.