Helm values

The chart is published at oci://ghcr.io/thediymaker/charts/obleth; chart version and appVersion are both 2.4.0.

helm install obleth oci://ghcr.io/thediymaker/charts/obleth \
  --version 2.4.0 \
  --namespace obleth --create-namespace \
  --set obleth.adminToken=$(openssl rand -hex 32) \
  --set postgres.password=$(openssl rand -hex 16) \
  --set redis.password=$(openssl rand -hex 16) \
  --set clickhouse.password=$(openssl rand -hex 16) \
  --set controlPlane.dashboardPassword='change-me-now' \
  --set controlPlane.dashboardSessionSecret=$(openssl rand -hex 32) \
  -f my-values.yaml

--set values end up in shell history and the release record. In production, create the Secrets yourself and name them in existingSecret. Upgrading from 1.x changes the Secret keys; see Upgrading from v1.x.

Required values

Rendering fails with a message when one of these is missing.

redis.password goes unescaped into OBLETH_REDIS_URL, so rendering also fails if it contains @, :, /, ?, #, % or whitespace. Use hex (openssl rand -hex 16). The dashboard enforces the lengths itself: dashboardSessionSecret must be at least 32 characters, and a dashboardPassword under 8 characters is not seeded.

Gateway

Values for the gateway Deployment (<release>-obleth) and the objects around it. Fairshare limits are cluster-wide across replicas; see Fairshare engine and Scaling.

shutdownGraceSecs plus the 5 s preStop delay, 20 s telemetry drain and 10 s OTLP flush must fit in the fixed terminationGracePeriodSeconds: 345. The minimum replica count for the PDB is hpa.minReplicas with the HPA on, else obleth.replicas. Capacity discovery RBAC (a ServiceAccount, plus a Role and RoleBinding per namespace granting only get, list, watch on endpointslices) is rendered only when enabled is true and namespaces is not empty. nodeResolution helps the pods reach Slurm compute nodes.

Gateway environment mapping

What the gateway container gets. Any other variable takes its default from Environment variables; to set one, add it as a key in the obleth.existingSecret Secret, which reaches the container through envFrom.

Pre-created Secrets (existingSecret)

When obleth.existingSecret names a Secret, the chart renders none of its own and every pod reads that one. It must carry these keys:

controlPlane.existingSecret works the same way for the dashboard and must carry DASHBOARD_PASSWORD, DASHBOARD_SESSION_SECRET, DATABASE_URL, BETTER_AUTH_SECRET (falls back to DASHBOARD_SESSION_SECRET when absent), BETTER_AUTH_URL, TRUSTED_ORIGINS, DASHBOARD_ADMIN_EMAIL and OIDC_PROVIDERS.

The gateway, Redis and ClickHouse pods carry a checksum/secret annotation, so a change to the chart's Secret rolls them. With existingSecret the checksum never changes: restart the Deployments yourself after editing the Secret. The gateway reads OBLETH_JWT_ISSUERS only at start. Start from values-production.yaml.

Datastores

Each bundled datastore is a single-replica Deployment with the Recreate strategy and a readiness probe (every 5 s, 3 s timeout). Set persistence.enabled: false for an emptyDir that loses data on restart, or enabled: false plus external.url to use your own. Overlays for each case are in deploy/k8s/obleth/examples/.

The bundled Redis runs with the append-only file on, a password, and --maxmemory-policy volatile-lru: only keys with a TTL are evicted. API keys, model routes, MCP servers and committed term-budget usage have none and stay. When nothing is left to evict, Redis refuses writes, which the gateway treats as a Redis failure (see obleth.failOpen). An external Redis must be a single primary; Redis Cluster is not supported. Redis is rebuilt from Postgres after data loss. See Redis layout.

Dashboard, provisioner and sidecars

The dashboard and provisioner get OBLETH_ADMIN_BASE_URL (http://<release>-obleth:9180) and read OBLETH_ADMIN_TOKEN from the gateway Secret; the dashboard also gets OBLETH_PROXY_BASE_URL (:8080). The provisioner only deploys the reconciler; its Slurm connection is set in the dashboard (Slurm provisioning). The compressor holds about 900 MB of model per pod and one inference saturates near four cores, so scale it with replicas, not bigger pods. The gateway works without it.

Ingress

The chart does not deploy HAProxy.

Security contexts (Pod Security Standard)

Both contexts apply to the gateway, dashboard, provisioner, compressor and benchmark backend, and meet the Kubernetes restricted standard. No UID is pinned (gateway runs as 10001, dashboard as 1000). The bundled datastores are left out because their images manage their own users.

With networkPolicy.enabled, ingress is limited to:

Minimal production values

obleth:
  existingSecret: obleth-secrets        # keys listed above
  upstreamBaseUrl: "http://inference.inference.svc.cluster.local:8000/v1"
  replicas: 2

postgres:
  enabled: false
redis:
  enabled: false
clickhouse:
  enabled: false
  external:
    url: "http://clickhouse.example.internal:8123"

benchmarkBackend:
  enabled: false

controlPlane:
  existingSecret: obleth-control-plane  # dashboard keys listed above

serviceMonitor:
  enabled: true

ingress:
  enabled: true
  className: nginx
  host: obleth.example.com
  tls:
    - secretName: obleth-tls
      hosts: [obleth.example.com]

With external datastores, the Postgres and Redis URLs come from the Secret, so postgres.external.url and redis.external.url can stay empty.