Generated against chart presponsieve 0.1.0. The commented source of truth is charts/presponsievelite/values.yaml.
Image
| Value | Default | Notes |
|---|
image.repository | ghcr.io/m-a-m-a-ai/presponsievelite | |
image.tag | "" | Falls back to .Chart.AppVersion |
image.pullPolicy | IfNotPresent | |
imagePullSecrets | [] | |
Workload
| Value | Default | Notes |
|---|
replicaCount | 1 | Two is the production floor |
nameOverride | "" | |
fullnameOverride | "" | Set this to presponsieve. Otherwise resources render as <release>-<chart> |
resources.requests.cpu | 250m | |
resources.requests.memory | 512Mi | |
resources.limits.cpu | 1 | |
resources.limits.memory | 1Gi | |
autoscaling.enabled | false | |
autoscaling.minReplicas | 1 | |
autoscaling.maxReplicas | 5 | |
autoscaling.targetCPUUtilizationPercentage | 75 | |
podAnnotations | {} | |
podSecurityContext | non-root, uid 10001 | |
securityContext | read-only rootfs, no caps | |
Service account
| Value | Default | Notes |
|---|
serviceAccount.create | true | |
serviceAccount.name | "" | Defaults to the full name |
serviceAccount.annotations | {} | Workload identity goes here |
Service and ingress
| Value | Default | Notes |
|---|
service.type | ClusterIP | |
service.port | 80 | |
service.targetPort | 8080 | |
service.annotations | {} | cloud.google.com/neg for GKE |
ingress.enabled | true | |
ingress.className | nginx | gce, alb, etc. |
ingress.host | presponsieve.local | |
ingress.annotations | body size and timeouts | |
ingress.tls.enabled | false | |
ingress.tls.secretName | presponsieve-tls | |
ingress.managedCertificate.enabled | false | GKE only |
ingress.managedCertificate.name | "" | Defaults to <fullname>-cert |
ingress.managedCertificate.domains | [] | Defaults to [ingress.host] |
Probes
All three hit GET /healthz.
| Value | Default | Notes |
|---|
probes.startup.failureThreshold | 30 | ~150s budget |
probes.startup.periodSeconds | 5 | |
probes.liveness.periodSeconds | 15 | |
probes.liveness.failureThreshold | 6 | 90s of headroom |
probes.liveness.timeoutSeconds | 5 | |
probes.readiness.periodSeconds | 10 | |
probes.readiness.failureThreshold | 3 | |
probes.readiness.timeoutSeconds | 3 | |
probes.readiness.path | /healthz | |
Application config
Non-secret. Rendered into a ConfigMap.
| Key | Default | Notes |
|---|
OPENAI_RESPONSES_MODEL | gpt-4o-mini | Rendering only |
SIMULATION_SAMPLES | 1000 | Local computation |
AUTH_COOKIE_SECURE | 1 | |
S3_FORCE_PATH_STYLE | true | false for real S3 |
S3_PREFIX | reports | |
STORAGE_BACKEND | unset | gcs for native GCS |
GCS_SIGNER_SERVICE_ACCOUNT | unset | Required for GCS signed URLs |
KMS_BACKEND | k8s | k8s, aws, gcp, vault |
LICENSE_PUBLIC_KEY | "" | Blank disables the gate |
LICENSE_ENFORCEMENT | enforce | enforce, warn, disabled |
LICENSE_VALIDATION_URL | "" | Blank means fully offline. https://presponsieve.ai/validate enables revocation polling |
LICENSE_REFRESH_INTERVAL_HOURS | 12 | How often to poll the validation URL |
TRANSCRIPTION_BACKEND | disabled | gcp enables Speech-to-Text |
SPEECH_LOCATION | global | |
SPEECH_LANGUAGE_CODES | en-US | |
SPEECH_MAX_SPEAKERS | 6 | |
Application secrets
| Value | Notes |
|---|
app.existingSecret | Use this. Names a secret you manage |
app.secrets.OPENAI_API_KEY | Optional. Rendering and chat |
app.secrets.MODEL_CONTENT_KEY | Required unless the license carries it |
app.secrets.LICENSE_KEY | Required when the gate is on |
app.secrets.APP_KEK | Required when KMS_BACKEND=k8s |
app.secrets.INDEX_PEPPER | Blind index HMAC |
app.secrets.AUTH_TOKEN_PEPPER | Token hashing HMAC |
app.secrets.SESSION_SECRET | Required for >1 replica |
Setting values under app.secrets puts plaintext in your values file. Use app.existingSecret.
Database
| Value | Default | Notes |
|---|
postgresql.enabled | true | Wires to <release>-postgresql. Does not install it |
postgresql.auth.username | presponsieve | |
postgresql.auth.password | changeme-postgres | |
postgresql.auth.database | presponsieve | |
externalDatabase.url | "" | Full SQLAlchemy DSN |
cloudSqlProxy.enabled | false | Takes precedence over both above |
cloudSqlProxy.image | cloud-sql-proxy:2.14.1 | |
cloudSqlProxy.instanceConnectionName | "" | PROJECT:REGION:INSTANCE |
cloudSqlProxy.port | 5432 | |
cloudSqlProxy.autoIamAuthn | true | |
cloudSqlProxy.iamUser | "" | GSA email, suffix stripped |
cloudSqlProxy.dbName | presponsieve | |
Object storage
| Value | Default | Notes |
|---|
minio.enabled | true | Wires to <release>-minio. Does not install it |
minio.defaultBuckets | presponsieve-artifacts | |
externalObjectStore.endpointUrl | "" | |
externalObjectStore.bucket | presponsieve-artifacts | |
externalObjectStore.region | us-east-1 | |
externalObjectStore.accessKeyId | "" | Leave empty with IRSA or WI |
externalObjectStore.secretAccessKey | "" | |
Identity
| Value | Default | Notes |
|---|
keycloak.enabled | true | Derives the issuer from <release>-keycloak |
oidc.issuerUrl | "" | |
oidc.clientId | presponsieve | |
oidc.clientSecret | "" | Prefer the secret |
Jobs
| Value | Default | Notes |
|---|
migration.enabled | true | Pre-install and pre-upgrade hook |
backfill.enabled | false | One-off encryption backfill. Idempotent |
GKE
Off by default so the chart stays portable.
| Value | Default | Notes |
|---|
gke.iap.enabled | false | Requires ingress.className: gce |
gke.iap.oauthClientSecretName | "" | Secret with client_id, client_secret |
gke.backendConfig.enabled | false | Rendered when IAP is on |
gke.backendConfig.timeoutSec | 600 | GCLB default is 30 |
gke.backendConfig.drainingTimeoutSec | 60 | |