Is this a new feature, an enhancement, or a change to existing functionality?
New Feature
How would you describe the priority of this feature request
Medium
Please provide a clear description of problem this feature solves
openssh_certificate_ca_fingerprints and admin_certificate_role are only reachable by setting configFiles.config, which replaces the entire config.toml as one opaque string — the chart's only parameterization is the two replace calls in templates/configmap.yaml (namespace and apiServiceName), and neither touches these keys. Config::load is a plain read_to_string + toml::from_str, so there is no env-var or layered-file override either.
That means any deployment needing a non-default value must copy the whole ~25-line TOML into its own values and maintain it forever, silently diverging from the packaged default whenever upstream changes nico_url, api_poll_interval, the otel endpoint, and so on.
This bites us concretely: we run dev, QA, and staging cluster tiers that each need a different admin_certificate_role, so tier isolation currently costs a full config duplication per tier.
Feature Description
Could these two be first-class values, e.g. sshConsole.adminCertificateRole and sshConsole.opensshCertificateCaFingerprints, applied through the same mechanism as the existing substitutions (or appended as an override stanza, since later TOML keys win)? Keeping configFiles.config as the full-replacement escape hatch would make this backward compatible for anyone already overriding it.
Describe your ideal solution
No response
Describe any alternatives you have considered
No response
Additional context
No response
Code of Conduct
Is this a new feature, an enhancement, or a change to existing functionality?
New Feature
How would you describe the priority of this feature request
Medium
Please provide a clear description of problem this feature solves
openssh_certificate_ca_fingerprints and admin_certificate_role are only reachable by setting configFiles.config, which replaces the entire config.toml as one opaque string — the chart's only parameterization is the two replace calls in templates/configmap.yaml (namespace and apiServiceName), and neither touches these keys. Config::load is a plain read_to_string + toml::from_str, so there is no env-var or layered-file override either.
That means any deployment needing a non-default value must copy the whole ~25-line TOML into its own values and maintain it forever, silently diverging from the packaged default whenever upstream changes nico_url, api_poll_interval, the otel endpoint, and so on.
This bites us concretely: we run dev, QA, and staging cluster tiers that each need a different admin_certificate_role, so tier isolation currently costs a full config duplication per tier.
Feature Description
Could these two be first-class values, e.g. sshConsole.adminCertificateRole and sshConsole.opensshCertificateCaFingerprints, applied through the same mechanism as the existing substitutions (or appended as an override stanza, since later TOML keys win)? Keeping configFiles.config as the full-replacement escape hatch would make this backward compatible for anyone already overriding it.
Describe your ideal solution
No response
Describe any alternatives you have considered
No response
Additional context
No response
Code of Conduct