Self-Hosted Configuration Reference
The confident-ai Helm chart is configured through a values file. This page explains the settings you will actually touch, grouped by concern. Each cloud's Deploy page (AWS, GCP, Azure) gives a complete, working values file; this is the reference for what each block means. For the long tail (fine-grained resource tuning, operator internals), read the chart's values.yaml directly.
Images and registry
Each app image is referenced as a full repository plus tag, so every image is traceable directly from values.yaml. All four app images share one tag through a YAML anchor, so the chart's default tag matches its release (appVersion) — installing a chart version gives you the app version it bundles, with no override needed.
| Value | Default | Description |
|---|---|---|
image.registry | Confident AI's ECR | Registry host, used only by the ECR pull-secret refresher. |
image.backend.repository (and frontend, evals, otel) | Confident AI's ECR repos | Full repository per app image. Override to pull from a mirror. |
image.backend.tag (and frontend, evals, otel) | chart appVersion | The release each image runs. Defaults to the chart's appVersion; set the per-service tag to pin or override. |
image.pullPolicy | IfNotPresent | Standard Kubernetes pull policy. |
Pulling the images
The images live in Confident AI's private registry. The chart can mint and refresh the pull secret for you, since ECR tokens expire about every 12 hours.
| Value | Default | Description |
|---|---|---|
imagePullSecrets | [] | Pull secrets referenced by every workload, for example [{name: ecr-registry-credentials}]. |
imagePullSecretRefresh.enabled | false | Create and refresh the ECR pull secret on a schedule. |
imagePullSecretRefresh.region | "" | AWS region of the registry (required when enabled). |
imagePullSecretRefresh.awsAccessKeyId / awsSecretAccessKey | "" | ECR credentials from Confident AI, rendered into the refresher Secret. |
imagePullSecretRefresh.awsCredentialsSecret | "" | Use an existing Secret with the AWS keys instead of inlining them. |
imagePullSecretRefresh.schedule | 0 */6 * * * | Refresh cadence. |
Application config
Non-secret settings, rendered into a ConfigMap every workload reads.
| Value | Default | Description |
|---|---|---|
config.cloudProvider | AWS | AWS, GCP, or AZURE. Selects the storage backend. |
config.frontendUrl | "" | Public dashboard URL, for example https://app.acme.com. Drives the app. ingress host. |
config.backendUrl | "" | Public API URL, for example https://api.acme.com. Drives the api. ingress host. |
config.subdomain | "" | Cookie domain shared by the frontend and backend, for example acme.com. |
config.isAzureEnvironment | false | Set true on Azure. |
config.disableNonSsoLogin | false | Require SSO and turn off email and password login. |
config.disableSignUp | false | Turn off new-account signup; existing users can still log in. |
config.enableExperimentalFeatures | false | Enable experimental and preview features. |
config.useWebsockets | true | Use WebSockets for real-time updates in the dashboard. |
config.auditLogStdout | false | Mirror audit events to stdout as JSON for log-based metrics (for example, Datadog). |
config.region | US | Data region label. |
config.betterAuthTrustedOrigins | "" | Extra comma-separated trusted origins for auth. |
config.poc | false | Marks the environment as a proof of concept. |
config.extraEnv | {} | Extra key and value pairs appended to the ConfigMap. |
Identity
How the app authenticates to your cloud. The details differ per cloud.
| Value | Default | Description |
|---|---|---|
serviceAccount.create | true | Create the ServiceAccount all workloads share. |
serviceAccount.name | "" | Reuse a pre-provisioned ServiceAccount instead. |
serviceAccount.annotations | {} | Cloud workload-identity binding (see below). |
podLabels | {} | Extra pod labels. Azure Workload Identity requires azure.workload.identity/use: "true". |
The annotation per cloud:
- AWS: none. EKS Pod Identity binds the role out of band, so the ServiceAccount carries no annotation.
- GCP:
iam.gke.io/gcp-service-account: <gsa-email>. - Azure: none for Blob (a connection string is used); Workload Identity is only needed for the External Secrets Operator.
Object storage
| Value | Default | Description |
|---|---|---|
storage.testCasesBucket / storage.payloadsBucket | "" | Bucket names (AWS, GCP) or container names (Azure). |
storage.aws.region | us-east-1 | Region for S3. |
storage.gcp.projectId / storage.gcp.region | "" | Project and region for GCS. |
storage.azure.storageAccountName | "" | Storage account for Blob. The connection string goes in secrets. |
Secrets
Application secrets reach the workloads one of two ways. Pick one.
| Value | Default | Description |
|---|---|---|
secrets.create | true | Render a Kubernetes Secret from secrets.data. |
secrets.existingSecret | "" | Use a Secret you created yourself (Vault, SealedSecrets, and so on). |
secrets.data.DATABASE_URL | "" | PostgreSQL connection string. |
secrets.data.BETTER_AUTH_SECRET | "" | Auth token signing secret (openssl rand -hex 32). |
secrets.data.OPENAI_API_KEY | "" | Optional, backs the built-in Confident AI evaluation provider. |
secrets.data.CONFIDENT_LICENSE_KEY | "" | Your signed Enterprise license key. |
secrets.data.GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET | "" | Optional Google OAuth. |
secrets.data.AZURE_STORAGE_CONNECTION_STRING | "" | Blob credential (Azure only). |
To pull from a cloud secret store instead, enable the External Secrets Operator. When externalSecrets.enabled is true, secrets.data is ignored and the operator owns the app Secret.
| Value | Default | Description |
|---|---|---|
secrets.externalSecrets.enabled | false | Sync secrets from a cloud store through ESO. |
secrets.externalSecrets.provider | aws | aws (Secrets Manager), gcpsm (Secret Manager), or azurekv (Key Vault). |
secrets.externalSecrets.createStore | false | Also render the (Cluster)SecretStore for the provider. |
secrets.externalSecrets.remoteKey | "" | Name of the one JSON secret (aws, gcpsm). Key Vault pulls all secrets instead. |
secrets.externalSecrets.serviceAccountRef.name | external-secrets-sa | ServiceAccount ESO authenticates as. |
secrets.externalSecrets.aws.region / gcp.* / azure.vaultUrl | "" | Provider-specific location. |
Code executor
Required for code-based and transformer metrics. The provider selects which block is used; an empty provider disables it.
| Value | Default | Description |
|---|---|---|
codeExecutor.provider | "" | AWS_LAMBDA, GCP_CLOUD_FUNCTIONS, or AZURE_FUNCTIONS. |
codeExecutor.aws.lambdaFunctionName / lambdaRegion | "" | Lambda target. |
codeExecutor.gcp.functionUrl | "" | Cloud Run service URL. |
codeExecutor.azure.functionUrl | "" | Function URL (append /api/execute). |
ClickHouse
Runs in the cluster by default, replicated for high availability. See Scaling and Disaster Recovery.
| Value | Default | Description |
|---|---|---|
clickhouse.internal | true | Run the bundled cluster. Set false and externalHost to use your own. |
clickhouse.password | "" | Admin password, also exposed to the app as CLICKHOUSE_PASSWORD. |
clickhouse.clusterType | replicated | Replication across replicas via Keeper. |
clickhouse.replicas / clickhouse.shards | 2 / 1 | Cluster size. |
clickhouse.storage / clickhouse.storageClass | 256Gi / "" | Data volume. Size for growth. |
clickhouse.keeper.replicas / keeper.storage | 3 / 20Gi | Keeper quorum. Keep at 3. |
clickhouse.backup.enabled | false | Nightly backup to object storage (see Disaster Recovery). |
clickhouse.extraConfig | IPv4 listen | Pins the pods to listen on 0.0.0.0. Leave as is unless you run dual-stack. |
Redis
| Value | Default | Description |
|---|---|---|
redis.internal | true | Run the bundled Redis. Set false to use managed Redis. |
redis.externalUrl | "" | Managed Redis URL when internal: false. |
redis.storage / redis.storageClass | 1Gi / "" | Volume for the in-cluster Redis. |
Workloads and scaling
Each service (backend, frontend, evals, evalsWorker, ingestionWorker, worker, otel) has the same shape. See Scaling for how to tune them.
| Value | Description |
|---|---|
<service>.replicas | Fixed replica count when autoscaling is off. |
<service>.autoscaling.enabled | Turn HPA on or off (on by default for most). |
<service>.autoscaling.minReplicas / maxReplicas / targetCPU | HPA bounds and target. |
<service>.resources | CPU and memory requests and limits. |
<service>.readinessProbe | HTTP readiness path (drives the cloud load balancer health check). |
backend.migrations.enabled | Run the database migration job on install and upgrade (leave on). |
Ingress
| Value | Default | Description |
|---|---|---|
ingress.enabled | false | Create the Ingress. |
ingress.className | alb | Ingress class (alb, nginx, webapprouting.kubernetes.io, or empty for GKE's annotation-driven controller). |
ingress.annotations | {} | Cloud-specific annotations, see the Deploy pages. |
ingress.hosts.evals / ingress.hosts.otel | "" | The evals. and otel. hostnames. app. and api. come from config. |
ingress.tls | [] | TLS blocks (host list plus secret name). |
Observability
| Value | Default | Description |
|---|---|---|
datadog.enabled | false | Emit Datadog APM and metrics. |
datadog.env / datadog.version | prod / appVersion | Tags on the emitted telemetry. |
The full list
This page covers the settings most deployments set. The chart's values.yaml is the source of truth and carries inline comments for every option, including operator internals, per-service resource defaults, and the ClickHouse backup providers. When in doubt, read it there.
Last updated on