# Deployment method configuration
deployment:
method: standard # Deployment method: "standard" (K8s resources) or "toolhive" (MCPServer CRD)
# Application image configuration
image:
repository: ghcr.io/vfarcic/dot-ai # Container image repository
tag: "0.188.0" # Container image tag - set by CI pipeline during release
# Resource configuration
resources:
requests:
memory: "512Mi" # Minimum memory required
cpu: "200m" # Minimum CPU required
limits:
memory: "2Gi" # Maximum memory allowed
cpu: "1000m" # Maximum CPU allowed
# Secrets configuration
secrets:
name: dot-ai-secrets # Name of the Kubernetes Secret resource
auth:
keyName: auth-token # Key name within the secret for Bearer token auth
token: "" # Auth token value (only needed if chart should create the secret)
anthropic:
keyName: anthropic-api-key # Key name within the secret
apiKey: "" # API key value (only needed if chart should create the secret)
openai:
keyName: openai-api-key # Key name within the secret
apiKey: "" # API key value (only needed if chart should create the secret)
google:
keyName: google-api-key # Key name within the secret
apiKey: "" # API key value (only needed if chart should create the secret)
xai:
keyName: xai-api-key # Key name within the secret
apiKey: "" # API key value (only needed if chart should create the secret)
moonshot:
keyName: moonshot-api-key # Key name within the secret (PRD #237: Kimi K2)
apiKey: "" # API key value (only needed if chart should create the secret)
customLlm:
keyName: custom-llm-api-key # Key name within the secret for custom LLM endpoint
apiKey: "" # API key value (only needed if chart should create the secret)
customEmbeddings:
keyName: custom-embeddings-api-key # Key name within the secret for custom embeddings endpoint
apiKey: "" # API key value (only needed if chart should create the secret)
# ServiceAccount configuration
serviceAccount:
create: true # Create a ServiceAccount
name: "" # ServiceAccount name override (generated if empty)
# Ingress configuration
# NOTE: Mutually exclusive with gateway.enabled - only one can be enabled
ingress:
enabled: false # Create Ingress resource
className: nginx # Ingress class name
host: dot-ai.127.0.0.1.nip.io # Ingress hostname
# Annotations required for HTTP transport with SSE (Server-Sent Events)
# If using different className, update annotations for your ingress controller:
# - Traefik: traefik.ingress.kubernetes.io/service.sticky.cookie.httponly: "true"
# - HAProxy: haproxy.org/timeout-http-request: "3600s"
# - AWS ALB: alb.ingress.kubernetes.io/target-group-attributes: idle_timeout.timeout_seconds=3600
annotations:
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" # Allow long-running SSE connections
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" # Allow long-running SSE connections
nginx.ingress.kubernetes.io/proxy-buffering: "off" # Disable buffering for real-time streaming
nginx.ingress.kubernetes.io/proxy-request-buffering: "off" # Disable request buffering for real-time streaming
tls:
enabled: false # Enable TLS/HTTPS
secretName: "" # TLS secret name (generated if empty when enabled)
clusterIssuer: "" # cert-manager ClusterIssuer name (e.g., "letsencrypt")
# Gateway API configuration (Kubernetes 1.26+)
# NOTE: Mutually exclusive with ingress.enabled - only one can be enabled
# Requires Gateway API CRDs pre-installed in cluster
#
# RECOMMENDED: Reference existing Gateway (platform team manages Gateway infrastructure)
# Example:
# gateway:
# name: "cluster-gateway" # Reference existing Gateway
# namespace: "gateway-system" # Optional: Gateway namespace (if in different namespace)
#
# ALTERNATIVE: Create Gateway for development/testing (with -http suffix to prevent naming collisions)
# Example:
# gateway:
# create: true # Create Gateway resource
# className: "istio" # GatewayClass name required when create=true
gateway:
# Reference mode: Specify name of existing Gateway resource (RECOMMENDED)
# When set, HTTPRoute will reference this Gateway. Gateway must exist before deployment.
# Leave empty when using create mode.
name: "" # Gateway name to reference (e.g., "cluster-gateway")
# Optional: Gateway namespace for cross-namespace references
# Only used when 'name' is set. Requires ReferenceGrant in Gateway namespace.
# Leave empty if Gateway is in same namespace as this chart.
namespace: "" # Gateway namespace (e.g., "gateway-system")
# Creation mode: Create a new Gateway resource (for development/testing only)
# When true, creates Gateway with name "<fullname>-http" to prevent kGateway naming collisions.
# Requires 'className' to be set. Not recommended for production (use reference mode instead).
create: false # Create Gateway resource (false = reference mode)
# GatewayClass name - REQUIRED when create=true, ignored when referencing existing Gateway
className: "" # GatewayClass name (e.g., "istio", "envoy-gateway", "gke-l7-global-external-managed")
# Annotations for integration with external-dns, cert-manager, etc.
# Only used when create=true. For existing Gateways, configure annotations on the Gateway resource directly.
# Example for external-dns: external-dns.alpha.kubernetes.io/hostname: "dot-ai.example.com"
annotations: {}
# Listener configuration - only used when create=true
# For existing Gateways, listeners are already configured on the Gateway resource.
listeners:
http:
enabled: true # Enable HTTP listener on port 80
hostname: "" # Optional: hostname for HTTP listener (e.g., "dot-ai.example.com")
https:
enabled: false # Enable HTTPS listener on port 443
hostname: "" # Optional: hostname for HTTPS listener (e.g., "dot-ai.example.com")
secretName: "" # TLS secret name (generated if empty: <fullname>-tls)
# Optional: certificateRefs for advanced TLS configuration
# Useful for cert-manager integration or cross-namespace secrets (requires ReferenceGrant)
# certificateRefs:
# - kind: Secret
# name: dot-ai-tls
# # Optional: group (defaults to core for Secret)
# # Optional: namespace (for cross-namespace references, requires ReferenceGrant)
certificateRefs: []
# Timeouts for SSE streaming support (GEP-1742)
# Applied to HTTPRoute rules for both reference and create modes
timeouts:
request: "3600s" # Request timeout (supports SSE streaming)
backendRequest: "3600s" # Backend request timeout
# AI Provider configuration
ai:
provider: anthropic # AI provider type (anthropic, anthropic_opus, anthropic_haiku, openai, google, kimi, kimi_thinking, xai, amazon_bedrock)
model: "" # Optional: model override (e.g., "llama3.1:70b", "gpt-4o")
# Custom endpoint configuration for self-hosted or alternative SaaS providers (PRD #194)
customEndpoint:
enabled: false # Enable custom endpoint
baseURL: "" # Custom LLM endpoint URL - MUST include /v1 suffix for OpenAI-compatible APIs (e.g., "http://ollama-service:11434/v1")
embeddingsBaseURL: "" # Optional: custom embeddings endpoint URL (if different from LLM endpoint, also requires /v1 suffix)
embeddingsModel: "" # Optional: custom embeddings model name (e.g., "nomic-embed-text" for Ollama, defaults to "text-embedding-3-small" for OpenAI)
embeddingsDimensions: "" # Optional: custom embeddings dimensions (e.g., "768" for nomic-embed-text, defaults to "1536" for OpenAI)
# Examples (commented out):
# Example 1: Ollama (self-hosted) - IMPORTANT: Include /v1 suffix
# ai:
# provider: openai
# model: "llama3.1:70b"
# customEndpoint:
# enabled: true
# baseURL: "http://ollama-service:11434/v1" # /v1 suffix is REQUIRED
#
# Example 2: Azure OpenAI (SaaS)
# ai:
# provider: openai
# model: "gpt-4o"
# customEndpoint:
# enabled: true
# baseURL: "https://YOUR_RESOURCE.openai.azure.com/openai/deployments/YOUR_DEPLOYMENT"
#
# Example 3: vLLM (self-hosted) - IMPORTANT: Include /v1 suffix
# ai:
# provider: openai
# model: "meta-llama/Llama-3.1-70B-Instruct"
# customEndpoint:
# enabled: true
# baseURL: "http://vllm-service:8000/v1" # /v1 suffix is REQUIRED
#
# Note: OpenAI-compatible endpoints (Ollama, vLLM, LocalAI) REQUIRE the /v1 suffix.
# Without it, API calls will fail with 404 Not Found errors.
# Custom endpoints must support OpenAI-compatible API and models must
# support 8K+ output tokens for reliable YAML generation.
# Web UI integration (PRD #317: Query Visualization)
# When configured, query tool responses include a visualizationUrl that opens
# rich visualizations in the Web UI (resource topology, relationships, health)
webUI:
baseUrl: "" # Web UI base URL (e.g., "https://dot-ai-ui.example.com")
# When set, query responses include visualizationUrl field
# Format: {baseUrl}/v/{sessionId}
# Additional environment variables (optional)
# Use this to add any custom environment variables to the MCP server
# Example use cases: tracing configuration, custom integrations, feature flags
extraEnv: []
# - name: OTEL_TRACING_ENABLED
# value: "true"
# - name: OTEL_EXPORTER_OTLP_ENDPOINT
# value: "http://jaeger-collector:4318/v1/traces"
# - name: OTEL_SERVICE_NAME
# value: "dot-ai-mcp-production"
# Qdrant Vector Database
qdrant:
enabled: true # Deploy Qdrant as dependency (false = use external)
image:
repository: qdrant/qdrant # Qdrant image repository
tag: v1.15.5 # Qdrant image tag
external:
url: "" # External Qdrant URL (required when enabled=false)
apiKey: "" # External Qdrant API key (optional)
