Environment variables
The chart derives these from Helm values. Set values, not variables.
This page exists for debugging a running pod and for the rare case of deploying without Helm, which is unsupported.
From the ConfigMap
Everything under app.config becomes an environment variable with the same name. See the config table.
From the Secret
Everything under app.secrets, or the keys of the secret named by app.existingSecret.
| Variable | Purpose |
|---|---|
APP_KEK | KEK when KMS_BACKEND=k8s |
SESSION_SECRET | Signs the session cookie |
INDEX_PEPPER | Blind index HMAC |
AUTH_TOKEN_PEPPER | Token hashing HMAC |
LICENSE_KEY | Signed license token |
MODEL_CONTENT_KEY | Decrypts model assets |
OPENAI_API_KEY | Narrative rendering and chat |
ACCESS_TOKENS | Break-glass login tokens |
GOOGLE_CLIENT_ID | Google Sign-In |
DATABASE_URL | Full DSN, when not using the proxy |
Set by the chart
| Variable | Source |
|---|---|
DATABASE_URL | cloudSqlProxy, externalDatabase.url, or postgresql.* |
S3_ENDPOINT_URL | externalObjectStore.endpointUrl |
S3_BUCKET | externalObjectStore.bucket |
S3_REGION | externalObjectStore.region |
OIDC_ISSUER_URL | oidc.issuerUrl, or derived from in-cluster Keycloak |
OIDC_CLIENT_ID | oidc.clientId |
Cloud credentials are not variables. Workload identity supplies them: AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE on EKS, Application Default Credentials on GKE, AZURE_CLIENT_ID and AZURE_FEDERATED_TOKEN_FILE on AKS. All injected by the platform.
Inspecting a running pod
kubectl exec -n presponsieve deploy/presponsieve -- \
env | grep -Ev 'KEY|SECRET|PEPPER|KEK|TOKEN'
The filter is there because secret values are present in the environment. Do not paste unfiltered env output into an issue.
Proxy
Standard variables are honoured for the OpenAI, storage, and OIDC calls.
HTTPS_PROXY
HTTP_PROXY
NO_PROXY
Nothing else makes outbound connections.