Configure a Private Location with environment variables. The agent reads them when it starts, so restart or redeploy it after changing a value. ## Authentication and Connection | Variable | Default | Description | | --- | --- | --- | | `ESCAPE_API_KEY` | Required unless `ESCAPE_AUTHORIZATION` is set | API key in UUID format used to register the location and call the Escape API. The Helm chart can read it from `existingSecret` instead. | | `ESCAPE_TRANSPORT` | `ssh` | Tunnel transport: `ssh`, `auto`, `wss`, or `https`. See [Choose a Transport](). | ## Runtime and Health | Variable | Default | Description | | --- | --- | --- | | `ESCAPE_CLI_RESTART_INTERVAL` | Unset. Helm: `24h`. | Schedules a clean process exit after a Go duration such as `24h`. The delay has a random jitter of plus or minus 10%, followed by 30 seconds before exit. With a restart policy, Kubernetes or Docker Compose then starts a new container. Invalid, zero, negative, and unset values disable the scheduled restart. This setting doesn't detect a disconnection: the agent retries its tunnel connection independently. | | `HEALTH_CHECK_PORT` | Unset. Helm: `8080`. | Starts the health server on this port. `GET /health` returns `200 OK` when the tunnel is connected and `503 Not connected` otherwise. No health server starts when the value is empty. The Helm chart uses port `8080`. | | `ESCAPE_K8S_INTEGRATION` | `true` | Set to `false` to disable the Kubernetes API proxy and Kubernetes integration registration. Any other value enables it. Docker Compose and local CLI still skip registration when no kubeconfig and no in-cluster config are available. | ## Proxy and TLS | Variable | Default | Description | | --- | --- | --- | | `ESCAPE_FRONTEND_PROXY_URL` | Unset | Proxy between the Private Location and Escape. Include a scheme and port: use `http://` or `socks5://` for the tunnel. HTTP proxies must allow `CONNECT` to the [tunnel endpoint](). HTTPS proxies work for API calls only. | | `ESCAPE_REPEATER_PROXY_URL` | Unset | Legacy name for the frontend proxy. If set, it takes precedence over `ESCAPE_FRONTEND_PROXY_URL`. Use `ESCAPE_FRONTEND_PROXY_URL` for new deployments. | | `ESCAPE_BACKEND_PROXY_URL` | Unset | Proxy between the Private Location and the target API. Include `http://`, `https://`, or `socks5://` and a port. | | `ESCAPE_SSL_INSECURE` | Secure TLS verification | Set to `true` to skip TLS certificate verification for the agent's HTTPS connections to Escape. This doesn't affect target TLS. | | `ESCAPE_SSL_CERT_PATH` | System trust store | Path to a PEM CA bundle for the agent's HTTPS connections to Escape. Replaces system roots: include every CA needed to reach Escape. This doesn't affect target TLS. | Use `ESCAPE_FRONTEND_PROXY_URL` and `ESCAPE_BACKEND_PROXY_URL` to configure Private Location proxies. The standard environment variables `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` aren't used. ## Logging and Output | Variable | Default | Description | | --- | --- | --- | | `ESCAPE_VERBOSITY` | `0` | Logging level: `0` for essential output, `1` for debug logs, `2` for trace logs, and `3` for trace logs with raw Escape API HTTP request and response details. Invalid values use `0`. The effective level is the higher of this value and the number of `-v` flags; Helm includes `-v`. | | `ESCAPE_COLOR_DISABLED` | `false` | Set to `true` to disable ANSI color output. | ## Helm Values These values configure the Helm chart. Some are passed to the container as environment variables; others configure Kubernetes resources. | Helm value | Default | Description | | --- | --- | --- | | `ESCAPE_PRIVATE_LOCATION` | Helm release name | Private Location name passed to `escape-cli locations start`. | | `ESCAPE_API_KEY` | `00000000-0000-0000-0000-000000000000` | Placeholder API key. Replace it or configure `existingSecret`. | | `existingSecret.name` and `existingSecret.key` | Empty | Existing Kubernetes Secret and key that supply `ESCAPE_API_KEY`. This takes precedence over the chart value. | | `ESCAPE_K8S_INTEGRATION` | `true` | Enables Kubernetes integration registration and creates the ServiceAccount, ClusterRole, and ClusterRoleBinding. Set to `false` to disable them. | | `ESCAPE_ENABLE_LOGS_ENDPOINT` | `false` | Enables local `POST /log` debug output on the health server. | | `ESCAPE_COLOR_DISABLED` | `false` | Disables ANSI color output when set to `true`. | | `ESCAPE_CLI_RESTART_INTERVAL` | `24h` | Scheduled restart interval. | | `commonLabels` | `{}` | Labels applied to chart resources and pods. | | `podLabels` | `{}` | Additional labels applied only to pods. | | `container.image` | `escapetech/cli:latest` | Container image. The chart uses `imagePullPolicy: Always`. | | `container.resources.cpu` | `1` | CPU request and limit. | | `container.resources.memory` | `2Gi` | Memory request and limit. | | `container.extra` | `{}` | Additional container fields. Use this only to add fields, not to override existing fields such as `args`. | | `container.env` | `[]` | Additional environment variables to inject into the Private Location container. | ## Related - [Deployment Methods]() - [SSL Configuration]() - [Proxy Configuration]() - [Logging & Monitoring]()