Skip to content

Environment Variables

Configure a Private Location with environment variables. The agent reads them when it starts, so restart or redeploy it after changing a value.

Authentication and Connection

Variable Default Description
ESCAPE_API_KEY Required unless ESCAPE_AUTHORIZATION is set API key in UUID format used to register the location and call the Escape API. The Helm chart can read it from existingSecret instead.
ESCAPE_TRANSPORT ssh Tunnel transport: ssh, auto, wss, or https. See Choose a Transport.

Runtime and Health

Variable Default Description
ESCAPE_CLI_RESTART_INTERVAL Unset. Helm: 24h. Schedules a clean process exit after a Go duration such as 24h. The delay has a random jitter of plus or minus 10%, followed by 30 seconds before exit. With a restart policy, Kubernetes or Docker Compose then starts a new container. Invalid, zero, negative, and unset values disable the scheduled restart. This setting doesn't detect a disconnection: the agent retries its tunnel connection independently.
HEALTH_CHECK_PORT Unset. Helm: 8080. Starts the health server on this port. GET /health returns 200 OK when the tunnel is connected and 503 Not connected otherwise. No health server starts when the value is empty. The Helm chart uses port 8080.
ESCAPE_K8S_INTEGRATION true Set to false to disable the Kubernetes API proxy and Kubernetes integration registration. Any other value enables it. Docker Compose and local CLI still skip registration when no kubeconfig and no in-cluster config are available.

Proxy and TLS

Variable Default Description
ESCAPE_FRONTEND_PROXY_URL Unset Proxy between the Private Location and Escape. Include a scheme and port: use http:// or socks5:// for the tunnel. HTTP proxies must allow CONNECT to the tunnel endpoint. HTTPS proxies work for API calls only.
ESCAPE_REPEATER_PROXY_URL Unset Legacy name for the frontend proxy. If set, it takes precedence over ESCAPE_FRONTEND_PROXY_URL. Use ESCAPE_FRONTEND_PROXY_URL for new deployments.
ESCAPE_BACKEND_PROXY_URL Unset Proxy between the Private Location and the target API. Include http://, https://, or socks5:// and a port.
ESCAPE_SSL_INSECURE Secure TLS verification Set to true to skip TLS certificate verification for the agent's HTTPS connections to Escape. This doesn't affect target TLS.
ESCAPE_SSL_CERT_PATH System trust store Path to a PEM CA bundle for the agent's HTTPS connections to Escape. Replaces system roots: include every CA needed to reach Escape. This doesn't affect target TLS.

Use ESCAPE_FRONTEND_PROXY_URL and ESCAPE_BACKEND_PROXY_URL to configure Private Location proxies. The standard environment variables HTTP_PROXY, HTTPS_PROXY, and NO_PROXY aren't used.

Logging and Output

Variable Default Description
ESCAPE_VERBOSITY 0 Logging level: 0 for essential output, 1 for debug logs, 2 for trace logs, and 3 for trace logs with raw Escape API HTTP request and response details. Invalid values use 0. The effective level is the higher of this value and the number of -v flags; Helm includes -v.
ESCAPE_COLOR_DISABLED false Set to true to disable ANSI color output.

Helm Values

These values configure the Helm chart. Some are passed to the container as environment variables; others configure Kubernetes resources.

Helm value Default Description
ESCAPE_PRIVATE_LOCATION Helm release name Private Location name passed to escape-cli locations start.
ESCAPE_API_KEY 00000000-0000-0000-0000-000000000000 Placeholder API key. Replace it or configure existingSecret.
existingSecret.name and existingSecret.key Empty Existing Kubernetes Secret and key that supply ESCAPE_API_KEY. This takes precedence over the chart value.
ESCAPE_K8S_INTEGRATION true Enables Kubernetes integration registration and creates the ServiceAccount, ClusterRole, and ClusterRoleBinding. Set to false to disable them.
ESCAPE_ENABLE_LOGS_ENDPOINT false Enables local POST /log debug output on the health server.
ESCAPE_COLOR_DISABLED false Disables ANSI color output when set to true.
ESCAPE_CLI_RESTART_INTERVAL 24h Scheduled restart interval.
commonLabels {} Labels applied to chart resources and pods.
podLabels {} Additional labels applied only to pods.
container.image escapetech/cli:latest Container image. The chart uses imagePullPolicy: Always.
container.resources.cpu 1 CPU request and limit.
container.resources.memory 2Gi Memory request and limit.
container.extra {} Additional container fields. Use this only to add fields, not to override existing fields such as args.
container.env [] Additional environment variables to inject into the Private Location container.