Helm values reference

The chart is at deploy/helm/simian/. Reference for every value lives in the chart’s values.yaml — that file has long inline comments explaining each setting and is the canonical source. This page summarizes by category.

For installs that want a known-good starting point rather than the chart defaults, layer the recommended overlay on top.

Image

Eligibility

Provisioner subsystem (M2 Part A)

LLM provider

Executor safety policy

How permittedTiers fails

This is the one value an operator sets to make the policy narrower — usually to keep node-level chaos off a cluster they care about — so its failure modes are deliberately loud rather than convenient.

• An unrecognised tier name stops the controller starting, with --permitted-tiers: unknown blast-radius tier "...". A typo that fell back to the default would silently restore the very tier the operator was removing.
• An empty list means “use the built-in default” (namespace, node), not “permit nothing”. The chart renders no flag at all in that case, and a flag the operator never set must not be a capability change.
• --set executor.permittedTiers={} is not an empty list. Helm’s --set turns it into a one-element list holding the empty string, which renders --permitted-tiers= and stops the controller with an unknown-tier error. Use --set-json 'executor.permittedTiers=[]', or set it in a values file.

autonomous.maxSeverityPerCycle is validated the same way, at startup rather than in the loop: an unparseable cap makes every planned step ineligible, which otherwise looks exactly like a planner that produced nothing.

Topology + SUT

Autonomous mode

The autonomous.* values are the install’s settings. With the web UI behind IAP, ui.iap.admins may change them at runtime within the executor.* limits; their changes are kept in the simian-runtime-config ConfigMap and win over these until reverted from the page.

Audit trail

With persistence off, the file is on an emptyDir, which survives container restarts but not the pod being deleted or rescheduled; persistence keeps the trail past both. At start-up the controller reads the file for faults the previous process applied and never ended. A fault still before its deadline is adopted (lease.adopted, reason untracked-after-restart): it counts against --max-concurrent-faults and the health gate, and is cleared at its deadline as if this process had applied it. Every other one gets a lease.expired event with the same reason, so a restart no longer leaves faults with no end on record. It then lists the faults still running in the arenas from the objects the drivers left (lease.adopted, found_in: cluster) and adopts any the file did not cover — all of them when the file was lost with an emptyDir. A fault with no object of its own (envoy-fault) can only be adopted from the file. Read the trail back with simian audit export.

On GKE the controller’s stdout already reaches Cloud Logging, so the audit events are retained there as well; the file is what you have on clusters without a log pipeline, and what simian audit export reads directly.

Web UI

Metrics

What the metrics are, with example queries and alerts: Seeing what Simian is doing.

MCP server

Resources + security