diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index 226f6c5..5f18e48 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -11,6 +11,11 @@ jobs: - uses: actions/checkout@v6 - uses: ./.github/actions/setup-nix + - name: Render templates with dummy values + run: | + nix develop --no-pure-eval --accept-flake-config "./tools/nix#ci" --command \ + just helm::template --values tools/helm/lint-values.yaml + - name: Log in to GHCR env: GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.gitignore b/.gitignore index 0602f3d..c4bdbcf 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,12 @@ **/charts/*.tgz config.toml -*.dec.* -.env +*.env .devenv/ .direnv/ .output/ + +# agentic setup +.agents/ +.claude/ +AGENTS.md +CLAUDE.md diff --git a/.helmignore b/.helmignore index 2aea2ff..0319115 100644 --- a/.helmignore +++ b/.helmignore @@ -2,14 +2,13 @@ # This supports shell glob matching, relative path matching, and # negation (prefixed with !). Only one pattern per line. .DS_Store -scripts -otlp-openmeter-bridge .github +# Sources for the images the chart references (built separately, not part of the chart) +src # Dev tooling and docs (not part of the chart) tools docs justfile -CONTRIBUTING.md .devenv/ .direnv/ .output/ @@ -38,3 +37,9 @@ values.*.yaml .idea/ *.tmproj +# agentic files + +.agents/ +AGENTS.md +.claude/ +CLAUDE.md diff --git a/.tpl.env b/.tpl.env new file mode 100644 index 0000000..5cc85e8 --- /dev/null +++ b/.tpl.env @@ -0,0 +1,4 @@ +# Copy to .env and fill in. Values are paths to secret files kept outside the repository. +# Used by `just db-bootstrap`. +OPENWEBUI_PG_PASSWORD_FILE= +AUTHENTIK_PG_PASSWORD_FILE= diff --git a/Chart.lock b/Chart.lock index dbf34ab..474446a 100644 --- a/Chart.lock +++ b/Chart.lock @@ -1,9 +1,6 @@ dependencies: -- name: postgresql - repository: https://charts.bitnami.com/bitnami - version: 18.7.0 - name: authentik repository: https://goauthentik.github.io/helm version: 2026.5.2 -digest: sha256:2f5bc89396b1bb7a388a1c12c221d8f4a194812e83e54bd1839fb9bdb53e1b1c -generated: "2026-06-04T09:20:49.97286315+02:00" +digest: sha256:7cf416b44f9132417c0006541e59049f9a44a28e36f003842cd334781523d8a5 +generated: "2026-08-04T00:00:00.000000000+02:00" diff --git a/Chart.yaml b/Chart.yaml index 2184bf0..576db94 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -5,10 +5,6 @@ appVersion: latest description: Helm chart for vLLM inference on vanilla Kubernetes type: application dependencies: - - name: postgresql - version: 18.x - repository: https://charts.bitnami.com/bitnami - condition: postgresql.enabled - name: authentik version: 2026.x repository: https://goauthentik.github.io/helm diff --git a/README.md b/README.md index 8648de6..23525c8 100644 --- a/README.md +++ b/README.md @@ -12,12 +12,13 @@ The chart only creates custom resources that rely on these systems being install - [Envoy Gateway](https://gateway.envoyproxy.io/) with the [Envoy AI Gateway](https://aigateway.envoyproxy.io/) extension (controller in `envoy-gateway-system`) - [Knative Serving](https://knative.dev/docs/serving/) (scale-to-zero model services) - [cert-manager](https://cert-manager.io/) with a `ClusterIssuer` matching `envoy.clusterissuer` +- A PostgreSQL server, with roles and databases created up front. See [postgresql.md](docs/postgresql.md) ## Usage The repository contains a [`justfile`](justfile) to automate routine commands. You may use it as reference, or run it with `just` (by default, just will list available recipes). -See [CONTRIBUTING.md](CONTRIBUTING.md) for more information. +See [CONTRIBUTING.md](docs/CONTRIBUTING.md) for more information. ### Helm (Kubernetes) @@ -38,10 +39,8 @@ helm upgrade --install -n vllm . --values values..yaml where `` is your Kubernetes namespace. -Components have no enforced apply ordering: PostgreSQL, Authentik, OpenWebUI, the -gateway, and the models reconcile independently, and pods restart until their -dependencies are ready. The init job runs as a `post-install,post-upgrade` Helm -hook, after the rest of the release is applied. +The init job runs as a `post-install,post-upgrade` Helm hook, after the rest of the +release is applied. To preview the rendered manifests before applying: @@ -65,8 +64,10 @@ models: fullName: "Qwen/Qwen2.5-Omni-7B-AWQ" # name of the hosted model on huggingface internal: true # true means this is a model hosted by us, false would be for forwarding to external apis (experimental) nodeType: "A100" # the type of GPU to use - apiKey: # the API key to use for external APIs, if not hosted by us - image: # the vllm image to use for hosting the model, can be left empty + apiKey: # required: the API key to use for external APIs, if not hosted by us. + image: # optional: the vllm image to use for hosting the model + # repository: + # tag: cacheDir: # the directory for the vllm cache (leaving this empty should work in most cases) # path: /myhome # claimName: # the PVC claim to mount the cache to. On runai, use something like `pvc--home` (e.g. `pvc-codev-ralf-home`) diff --git a/docs/postgresql.md b/docs/postgresql.md new file mode 100644 index 0000000..16eb745 --- /dev/null +++ b/docs/postgresql.md @@ -0,0 +1,56 @@ +# PostgreSQL + +The chart connects to an external PostgreSQL server, which +must be reachable from the cluster and accept TLS: both OpenWebUI and Authentik connect with +`sslmode=require`. + +## Roles and databases + +The databases and roles need to be created ahead of time. We provide a helper just recipe to do it. + +To use it, run this before installing: + +```bash +just db-bootstrap [] [] [] +``` + +The recipe reads the two application passwords from the files named in `.env` (copy +`.tpl.env` and fill in the paths), and prompts for the admin password. It needs an account +allowed to `CREATE ROLE` and `CREATE DATABASE`; on a managed or central server you may have +to ask a DBA to run [bootstrap-db.sql](../tools/scripts/bootstrap-db.sql) instead. Either way +it is safe to re-run: existing roles and databases are left untouched. + +> [!NOTE] +> +> The sql script sends the application passwords in `CREATE ROLE` statements, so connect over TLS. +> The recipe does this for you. When running manually, use : +> +> ```bash +> psql "postgresql://@/postgres?sslmode=require" -f tools/scripts/bootstrap-db.sql +> ``` + +## Values + +The postgres values must be specified for `authentik` and `openwebui`. They may use the same +server, but should have different roles and databases. + +## Sharing a server between releases + +The names default to `vllm-openwebui` and `vllm-authentik`, if multiple +releases share one server. Scope them per release, and pass the same names to +`just db-bootstrap`: + +```yaml +openwebui: + postgres: + database: staging-openwebui +authentik: + authentik: + postgresql: + name: staging-authentik + user: staging-authentik +``` + +A collision does not fail loudly: the bootstrap skips roles that already exist, so a second +release either fails to authenticate or, if the password was copied across, quietly shares +the first release's database. Give each release its own names, or its own server. diff --git a/justfile b/justfile index a54c0b6..7347ac3 100644 --- a/justfile +++ b/justfile @@ -77,6 +77,20 @@ test *args: deploy namespace release values_file: helm upgrade --install -n "{{namespace}}" "{{release}}" . --values "{{values_file}}" +# init roles and databases. psql prompts for the admin password. +[group('chart')] +db-bootstrap host admin_user="postgres" openwebui_db="vllm-openwebui" authentik_db="vllm-authentik": + #!/usr/bin/env bash + set -eu + : "${OPENWEBUI_PG_PASSWORD_FILE:?not set, see .tpl.env}" + : "${AUTHENTIK_PG_PASSWORD_FILE:?not set, see .tpl.env}" + OPENWEBUI_PG_DATABASE="{{openwebui_db}}" \ + AUTHENTIK_PG_DATABASE="{{authentik_db}}" \ + OPENWEBUI_PG_PASSWORD="$(< "$OPENWEBUI_PG_PASSWORD_FILE")" \ + AUTHENTIK_PG_PASSWORD="$(< "$AUTHENTIK_PG_PASSWORD_FILE")" \ + psql "postgresql://{{admin_user}}@{{host}}/postgres?sslmode=require" \ + --file "{{root_dir}}/tools/scripts/bootstrap-db.sql" + # Errors if the repository contains unformatted files. [private] check-format *args: diff --git a/templates/models/knative-serving.yaml b/templates/models/knative-serving.yaml index 0a1ee79..a6423d1 100644 --- a/templates/models/knative-serving.yaml +++ b/templates/models/knative-serving.yaml @@ -1,4 +1,8 @@ {{- range $name, $model := .Values.models }} + {{- /* default optional sub-maps so a missing key does not fail. */}} + {{- $persistence := $model.persistence | default dict }} + {{- $image := $model.image | default dict }} + {{- $cacheDir := $model.cacheDir | default dict }} {{- if $model.dummy }} --- apiVersion: serving.knative.dev/v1 @@ -64,12 +68,12 @@ spec: nvidia.com/gpu: {{ $model.resources.limits.gpu }} {{- end }} volumeMounts: - {{- if $model.persistence.enabled }} - - mountPath: {{ $model.cacheDir.path | default "/myhome" }} + {{- if $persistence.enabled }} + - mountPath: {{ $cacheDir.path | default "/myhome" }} name: pvc-cache subPath: {{ $.Values.environment | default "." }}/model_cache/ - {{- else if (and $model.cacheDir $model.cacheDir.claimName) }} - - mountPath: {{ $model.cacheDir.path }} + {{- else if (and $cacheDir $cacheDir.claimName) }} + - mountPath: {{ $cacheDir.path }} name: pvc-cache subPath: {{ $.Values.environment | default "." }}/model_cache {{- end }} @@ -93,11 +97,11 @@ spec: timeoutSeconds: 600 responseStartTimeoutSeconds: 600 idleTimeoutSeconds: 600 - {{- if or $model.persistence.enabled (and $model.cacheDir $model.cacheDir.claimName) }} + {{- if or $persistence.enabled (and $cacheDir $cacheDir.claimName) }} volumes: - name: pvc-cache persistentVolumeClaim: - claimName: {{ if $model.persistence.enabled }}{{ $.Release.Name }}-model-{{ $name }}-cache{{ else }}{{ $model.cacheDir.claimName }}{{ end }} + claimName: {{ if $persistence.enabled }}{{ $.Release.Name }}-model-{{ $name }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }} {{- end }} traffic: - latestRevision: true @@ -126,7 +130,7 @@ spec: spec: containers: - name: user-container - image: "{{ $model.image.repository | default "vllm/vllm-openai" }}:{{ $model.image.tag | default "latest" }}" + image: "{{ $image.repository | default "vllm/vllm-openai" }}:{{ $image.tag | default "latest" }}" imagePullPolicy: IfNotPresent {{- if not $model.defaultCommand}} command: @@ -173,9 +177,9 @@ spec: secretKeyRef: name: vllm-secret-{{ $name }} key: apiKey - {{- if or $model.persistence.enabled $model.cacheDir }} + {{- if or $persistence.enabled $cacheDir }} - name: VLLM_CACHE_ROOT - value: {{ $model.cacheDir.path | default "/myhome" }} + value: {{ $cacheDir.path | default "/myhome" }} {{- end }} startupProbe: httpGet: @@ -213,14 +217,14 @@ spec: ports: - containerPort: 8000 protocol: TCP - workingDir: {{ $model.cacheDir.path | default "/myhome" }} + workingDir: {{ $cacheDir.path | default "/myhome" }} volumeMounts: - {{- if $model.persistence.enabled }} - - mountPath: {{ $model.cacheDir.path | default "/myhome" }} + {{- if $persistence.enabled }} + - mountPath: {{ $cacheDir.path | default "/myhome" }} name: pvc-cache subPath: {{ $.Values.environment | default "." }}/model_cache/ - {{- else if (and $model.cacheDir $model.cacheDir.claimName) }} - - mountPath: {{ $model.cacheDir.path }} + {{- else if (and $cacheDir $cacheDir.claimName) }} + - mountPath: {{ $cacheDir.path }} name: pvc-cache subPath: {{ $.Values.environment | default "." }}/model_cache {{- end }} @@ -238,11 +242,11 @@ spec: affinity: {{- toYaml $.Values.global.affinity | nindent 8 }} {{- end }} - {{- if or $model.persistence.enabled (and $model.cacheDir $model.cacheDir.claimName) }} + {{- if or $persistence.enabled (and $cacheDir $cacheDir.claimName) }} volumes: - name: pvc-cache persistentVolumeClaim: - claimName: {{ if $model.persistence.enabled }}{{ $.Release.Name }}-model-{{ $name }}-cache{{ else }}{{ $model.cacheDir.claimName }}{{ end }} + claimName: {{ if $persistence.enabled }}{{ $.Release.Name }}-model-{{ $name }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }} {{- end }} timeoutSeconds: 600 responseStartTimeoutSeconds: 600 diff --git a/templates/models/pvc.yaml b/templates/models/pvc.yaml index a5a1355..92ce4e8 100644 --- a/templates/models/pvc.yaml +++ b/templates/models/pvc.yaml @@ -1,5 +1,8 @@ {{- range $name, $model := .Values.models }} - {{- if and $model.internal $model.persistence.enabled }} + {{- /* These sub-maps are optional in values.yaml; default them so a missing + key renders empty instead of failing with a nil pointer. */}} + {{- $persistence := $model.persistence | default dict }} + {{- if and $model.internal $persistence.enabled }} --- apiVersion: v1 kind: PersistentVolumeClaim @@ -10,10 +13,10 @@ metadata: release: {{ $.Release.Name }} spec: accessModes: - - {{ $model.persistence.accessMode | default "ReadWriteOnce" }} - storageClassName: {{ $model.persistence.storageClass | default "default" }} + - {{ $persistence.accessMode | default "ReadWriteOnce" }} + storageClassName: {{ $persistence.storageClass | default "default" }} resources: requests: - storage: {{ $model.persistence.size | default "50Gi" }} + storage: {{ $persistence.size | default "50Gi" }} {{- end }} {{- end }} diff --git a/templates/openwebui/deployment.yaml b/templates/openwebui/deployment.yaml index 87a1a9c..c6cf51e 100644 --- a/templates/openwebui/deployment.yaml +++ b/templates/openwebui/deployment.yaml @@ -32,13 +32,11 @@ spec: value: "true" - name: OPENAI_API_BASE_URL value: https://gateway.{{ .Values.envoy.baseDomain }}/v1 - {{- if .Values.openwebui.postgres }} - name: DATABASE_URL valueFrom: secretKeyRef: name: postgres-secret key: OPENWEBUI_DATABASE_URL - {{- end }} - name: ENABLE_OAUTH_SIGNUP value: "true" - name: ENABLE_LOGIN_FORM @@ -46,7 +44,10 @@ spec: - name: OAUTH_CLIENT_ID value: {{ .Values.authentik.oauthApp.clientId | required ".Values.authentik.oauthApp.clientId is required" }} - name: OAUTH_CLIENT_SECRET - value: {{ .Values.authentik.oauthApp.clientSecret | required ".Values.authentik.oauthApp.clientSecret is required" }} + valueFrom: + secretKeyRef: + name: openwebui-oauth + key: OAUTH_CLIENT_SECRET - name: OAUTH_ADMIN_ROLES value: gateway admins - name: OPENID_PROVIDER_URL @@ -81,7 +82,8 @@ spec: path: /health port: 8080 periodSeconds: 10 - failureThreshold: 1 + # Liveness should catch a deadlocked process, not one slow health check. + failureThreshold: 3 resources: requests: cpu: {{ .Values.openwebui.resources.requests.cpu | quote }} diff --git a/templates/openwebui/oauth_secret.yaml b/templates/openwebui/oauth_secret.yaml new file mode 100644 index 0000000..6faa18f --- /dev/null +++ b/templates/openwebui/oauth_secret.yaml @@ -0,0 +1,10 @@ +{{- if .Values.openwebui.enabled }} + {{- /* Kept out of the Deployment so the credential is not readable from the pod spec. */}} +apiVersion: v1 +kind: Secret +metadata: + name: "openwebui-oauth" +type: Opaque +stringData: + OAUTH_CLIENT_SECRET: {{ .Values.authentik.oauthApp.clientSecret | required ".Values.authentik.oauthApp.clientSecret is required" }} +{{- end }} diff --git a/templates/postgres-initdb-scripts.yaml b/templates/postgres-initdb-scripts.yaml deleted file mode 100644 index 6dd294b..0000000 --- a/templates/postgres-initdb-scripts.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: postgres-initdb-scripts -data: - init-users.sql: | - CREATE USER openwebui WITH PASSWORD '{{ .Values.openwebui.postgres.password}}'; - CREATE DATABASE openwebui WITH OWNER openwebui; - GRANT ALL PRIVILEGES ON DATABASE "openwebui" TO openwebui; - GRANT ALL PRIVILEGES ON SCHEMA "public" TO openwebui; - - - CREATE USER authentik WITH PASSWORD '{{ .Values.authentik.authentik.postgresql.password }}'; - CREATE DATABASE authentik WITH OWNER authentik; - GRANT ALL PRIVILEGES ON DATABASE "authentik" TO authentik; - GRANT ALL PRIVILEGES ON SCHEMA "public" TO authentik; diff --git a/templates/postgres_initdb_secret.yaml b/templates/postgres_initdb_secret.yaml deleted file mode 100644 index 2abbe53..0000000 --- a/templates/postgres_initdb_secret.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: postgres-initdb-secret -type: Opaque -stringData: - OPENWEBUI_PG_PASSWORD: {{ .Values.openwebui.postgres.password | required ".Values.openwebui.postgres.password is required" }} - AUTHENTIK_PG_PASSWORD: {{ .Values.authentik.authentik.postgresql.password | required ".Values.authentik.postgresql.password is required" }} diff --git a/templates/postgres_secret.yaml b/templates/postgres_secret.yaml index 55c1a94..2c0ad21 100644 --- a/templates/postgres_secret.yaml +++ b/templates/postgres_secret.yaml @@ -1,10 +1,16 @@ +{{- if .Values.authentik.enabled }} + {{- /* The subchart defaults this to "-postgresql", which will not resolve. */}} + {{- $_ := .Values.authentik.authentik.postgresql.host | required ".Values.authentik.authentik.postgresql.host is required: the chart does not deploy PostgreSQL" }} +{{- end }} +{{- if .Values.openwebui.enabled }} apiVersion: v1 kind: Secret metadata: name: "postgres-secret" type: Opaque + {{- $pg := .Values.openwebui.postgres }} + {{- /* One value fills both db and role. */}} + {{- $db := $pg.database | required ".Values.openwebui.postgres.database is required" }} stringData: - POSTGRES_PASSWORD: {{ .Values.postgresql.auth.postgresPassword | required ".Values.postgresql.auth.postgresPassword is required" }} - OPENWEBUI_PG_PASSWORD: {{ .Values.openwebui.postgres.password | required ".Values.openwebui.postgres.password is required" }} - OPENWEBUI_DATABASE_URL: "postgresql://openwebui:{{.Values.openwebui.postgres.password | required ".Values.openwebui.postgres.password is required"}}@{{ .Release.Name }}-postgresql:5432/openwebui" - AUTHENTIK_PG_PASSWORD: {{ .Values.authentik.authentik.postgresql.password | required ".Values.authentik.postgresql.password is required" }} + OPENWEBUI_DATABASE_URL: "postgresql://{{ $db }}:{{ $pg.password | required ".Values.openwebui.postgres.password is required" }}@{{ $pg.host | required ".Values.openwebui.postgres.host is required" }}:5432/{{ $db }}?sslmode=require" +{{- end }} diff --git a/tools/config/treefmt.toml b/tools/config/treefmt.toml index 8b65868..624557c 100644 --- a/tools/config/treefmt.toml +++ b/tools/config/treefmt.toml @@ -6,7 +6,6 @@ excludes = [ "external/*", # Helm templates are not valid YAML (Go template syntax). "templates/**", - "*.enc.*", ] [formatter.prettier] diff --git a/tools/helm/lint-values.yaml b/tools/helm/lint-values.yaml index 10ef3b1..1276334 100644 --- a/tools/helm/lint-values.yaml +++ b/tools/helm/lint-values.yaml @@ -2,6 +2,7 @@ authentik: authentik: postgresql: + host: pg.example.invalid password: dummy oauthApp: clientId: dummy @@ -10,9 +11,7 @@ openwebui: admin: password: dummy postgres: + host: pg.example.invalid password: dummy -postgresql: - auth: - postgresPassword: dummy initJob: image: {} diff --git a/tools/just/helm.just b/tools/just/helm.just index e88cb35..0aed117 100644 --- a/tools/just/helm.just +++ b/tools/just/helm.just @@ -9,8 +9,9 @@ charts_dir := root_dir / "charts" default: just --list helm +# Remove fetched subchart archives. clean: - rm "{{charts_dir}}"/* + rm -rf "{{charts_dir}}" # Lint chart and templates. lint: @@ -22,7 +23,6 @@ fetch-deps: #!/usr/bin/env bash set -eu cd "{{root_dir}}" - helm repo add bitnami https://charts.bitnami.com/bitnami helm repo add authentik https://goauthentik.github.io/helm helm dependency build diff --git a/tools/nix/flake.nix b/tools/nix/flake.nix index f07f95f..1c0a6a4 100644 --- a/tools/nix/flake.nix +++ b/tools/nix/flake.nix @@ -68,6 +68,7 @@ ]; devTools = with pkgs; [ gitleaks + postgresql prek zsh ]; diff --git a/tools/scripts/bootstrap-db.sql b/tools/scripts/bootstrap-db.sql new file mode 100644 index 0000000..9c6dee9 --- /dev/null +++ b/tools/scripts/bootstrap-db.sql @@ -0,0 +1,25 @@ +-- Create the roles and databases the chart expects. Idempotent. +-- +-- \gexec executes the statement the SELECT returns, and only when it returns a row. +-- CREATE DATABASE cannot run inside a DO block, so roles and databases both use this pattern rather than one each. +-- %I quotes identifiers, so scoped names containing hyphens or capitals are safe. +-- Each database is owned by a role of the same name. +-- Aborts on first error. +\set ON_ERROR_STOP on + +\getenv openwebui_db OPENWEBUI_PG_DATABASE +\getenv openwebui_password OPENWEBUI_PG_PASSWORD +\getenv authentik_db AUTHENTIK_PG_DATABASE +\getenv authentik_password AUTHENTIK_PG_PASSWORD + +SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'openwebui_db', :'openwebui_password') + WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'openwebui_db')\gexec + +SELECT format('CREATE DATABASE %I OWNER %I', :'openwebui_db', :'openwebui_db') + WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = :'openwebui_db')\gexec + +SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'authentik_db', :'authentik_password') + WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'authentik_db')\gexec + +SELECT format('CREATE DATABASE %I OWNER %I', :'authentik_db', :'authentik_db') + WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = :'authentik_db')\gexec diff --git a/values.yaml b/values.yaml index c45b507..f7acc61 100644 --- a/values.yaml +++ b/values.yaml @@ -1,15 +1,18 @@ envoy: enabled: true - name: vllm baseDomain: clusterissuer: letsencrypt - gatewayclass: clientBufferLimit: 50Mi security: jwksUri: gatewayClass: enabled: false name: + # Overrides for the proxy Envoy Gateway manages. Unset means use its defaults. + # {annotations: {...}} also switches the proxy Service to LoadBalancer. + service: + # {requests: {...}, limits: {...}} for the proxy container. + resources: telemetry: enabled: false # OpenMeter API endpoint for billing (required when telemetry is enabled) @@ -45,7 +48,14 @@ openwebui: enabled: false storageClass: default size: 10Gi + accessMode: # defaults to ReadWriteOnce + # Mount an existing claim instead of creating one, used when persistence is disabled. + dataClaimName: + # External PostgreSQL server: the database and role must exist before install. postgres: + host: + # Database name, and the name of the role that owns it. + database: vllm-openwebui password: admin: user: admin @@ -69,36 +79,15 @@ initJob: tag: "" # defaults to .Chart.AppVersion pullPolicy: IfNotPresent -postgresql: - enabled: true - auth: - postgresPassword: - database: postgres - username: postgres - primary: - serviceAccount: - create: false - resources: - requests: - cpu: 500m - memory: 1Gi - limits: - cpu: 2 - memory: 4Gi - persistence: - enabled: false - tolerations: [] - affinity: {} - initdb: - scriptsConfigMap: postgres-initdb-scripts - authentik: enabled: true authentik: postgresql: + host: port: 5432 - name: authentik - user: authentik + sslmode: require + name: vllm-authentik + user: vllm-authentik password: secret_key: