Self-Hosted Configuration Reference
The confident-ai Helm chart is configured through a values file. This page explains the settings you will actually touch, grouped by concern. Each cloud's Deploy page (AWS, GCP, Azure) gives a complete, working values file; this is the reference for what each block means. For the long tail (fine-grained resource tuning, operator internals), read the chart's values.yaml directly.
Images and registry
Each app image is referenced as a full repository plus tag, so every image is traceable directly from values.yaml. All four app images share one tag through a YAML anchor, so the chart's default tag matches its release (appVersion) — installing a chart version gives you the app version it bundles, with no override needed.
| Value | Default | Description |
|---|---|---|
image.registry | Confident AI's ECR | Registry host, used only by the ECR pull-secret refresher. |
image.backend.repository (and frontend, evals, otel) | Confident AI's ECR repos | Full repository per app image. Override to pull from a mirror. |
image.backend.tag (and frontend, evals, otel) | chart appVersion | The release each image runs. Defaults to the chart's appVersion; set the per-service tag to pin or override. |
image.pullPolicy | IfNotPresent | Standard Kubernetes pull policy. |
Pulling the images
The images live in Confident AI's private registry. The chart can mint and refresh the pull secret for you, since ECR tokens expire about every 12 hours.
| Value | Default | Description |
|---|---|---|
imagePullSecrets | [] | Pull secrets referenced by every workload, for example [{name: ecr-registry-credentials}]. |
imagePullSecretRefresh.enabled | false | Create and refresh the ECR pull secret on a schedule. |
imagePullSecretRefresh.region | "" | AWS region of the registry (required when enabled). |
imagePullSecretRefresh.awsAccessKeyId / awsSecretAccessKey | "" | ECR credentials from Confident AI, rendered into the refresher Secret. |
imagePullSecretRefresh.awsCredentialsSecret | "" | Use an existing Secret with the AWS keys instead of inlining them. |
imagePullSecretRefresh.schedule | 0 */6 * * * | Refresh cadence. |
Application config
Non-secret settings, rendered into a ConfigMap every workload reads.
| Value | Default | Description |
|---|---|---|
config.cloudProvider | AWS | AWS, GCP, or AZURE. Selects the storage backend. |
config.frontendUrl | "" | Public dashboard URL, for example https://app.acme.com. Drives the app. ingress host. |
config.backendUrl | "" | Public API URL, for example https://api.acme.com. Drives the api. ingress host. |
config.subdomain | "" | Cookie domain shared by the frontend and backend, for example acme.com. |
config.isAzureEnvironment | false | Set true on Azure. |
config.disableNonSsoLogin | false | Require SSO and turn off email and password login. |
config.disableSignUp | false | Turn off new-account signup; existing users can still log in. |
config.enableExperimentalFeatures | false | Enable experimental and preview features. |
config.useWebsockets | true | Use WebSockets for real-time updates in the dashboard. |
config.auditLogStdout | false | Mirror audit events to stdout as JSON for log-based metrics (for example, Datadog). |
config.region | US | Data region label. |
config.betterAuthTrustedOrigins | "" | Extra comma-separated trusted origins for auth. |
config.poc | false | Marks the environment as a proof of concept. |
config.extraEnv | {} | Extra key and value pairs appended to the ConfigMap. |
Identity
How the app authenticates to your cloud. The details differ per cloud.
| Value | Default | Description |
|---|---|---|
serviceAccount.create | true | Create the ServiceAccount all workloads share. |
serviceAccount.name | "" | Reuse a pre-provisioned ServiceAccount instead. |
serviceAccount.annotations | {} | Cloud workload-identity binding (see below). |
podLabels | {} | Extra pod labels. Azure Workload Identity requires azure.workload.identity/use: "true". |
The annotation per cloud:
- AWS: none. EKS Pod Identity binds the role out of band, so the ServiceAccount carries no annotation.
- GCP:
iam.gke.io/gcp-service-account: <gsa-email>. - Azure: none for Blob (a connection string is used); Workload Identity is only needed for the External Secrets Operator.
Object storage
| Value | Default | Description |
|---|---|---|
storage.testCasesBucket / storage.payloadsBucket | "" | Bucket names (AWS, GCP) or container names (Azure). |
storage.aws.region | us-east-1 | Region for S3. |
storage.gcp.projectId / storage.gcp.region | "" | Project and region for GCS. |
storage.azure.storageAccountName | "" | Storage account for Blob. The connection string goes in secrets. |
Secrets
Application secrets reach the workloads one of two ways. Pick one.
| Value | Default | Description |
|---|---|---|
secrets.create | true | Render a Kubernetes Secret from secrets.data. |
secrets.existingSecret | "" | Use a Secret you created yourself (Vault, SealedSecrets, and so on). |
secrets.data.DATABASE_URL | "" | PostgreSQL connection string. |
secrets.data.BETTER_AUTH_SECRET | "" | Auth token signing secret (openssl rand -hex 32). |
secrets.data.OPENAI_API_KEY | "" | Optional, backs the built-in Confident AI evaluation provider. |
secrets.data.CONFIDENT_LICENSE_KEY | "" | Your signed Enterprise license key. |
secrets.data.GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET | "" | Optional Google OAuth. |
secrets.data.AZURE_STORAGE_CONNECTION_STRING | "" | Blob credential (Azure only). |
secrets.data.SMTP_PASSWORD | "" | Password for the SMTP relay set in email.smtp (see Email). |
secrets.data.RESEND_API_KEY | "" | Resend API key, used when no SMTP relay is configured (see Email). |
To pull from a cloud secret store instead, enable the External Secrets Operator. When externalSecrets.enabled is true, secrets.data is ignored and the operator owns the app Secret.
| Value | Default | Description |
|---|---|---|
secrets.externalSecrets.enabled | false | Sync secrets from a cloud store through ESO. |
secrets.externalSecrets.provider | aws | aws (Secrets Manager), gcpsm (Secret Manager), or azurekv (Key Vault). |
secrets.externalSecrets.createStore | false | Also render the (Cluster)SecretStore for the provider. |
secrets.externalSecrets.remoteKey | "" | Name of the one JSON secret (aws, gcpsm). Key Vault pulls all secrets instead. |
secrets.externalSecrets.serviceAccountRef.name | external-secrets-sa | ServiceAccount ESO authenticates as. |
secrets.externalSecrets.aws.region / gcp.* / azure.vaultUrl | "" | Provider-specific location. |
The backend sends invitations, password resets, assignment and export notifications, and email alerts and reports. It needs one outbound transport; with neither configured the app runs but skips every email and logs a warning, so invited users never receive their link.
| Value | Default | Description |
|---|---|---|
email.from | "" | Sender address, for example noreply@acme.com. Must be one your relay or provider is allowed to send as. Required when email.smtp.host is set. |
email.smtp.host | "" | SMTP relay host. When set, SMTP is used for every email. |
email.smtp.port | 587 | 587 for STARTTLS, 465 for implicit TLS (set secure: true). Cloud providers block outbound port 25. |
email.smtp.secure | false | Use implicit TLS. |
email.smtp.user | "" | SMTP username. Leave empty for relays that authenticate by network. The password goes in secrets.data.SMTP_PASSWORD. |
email.resend.baseUrl | "" | Point the Resend client at a self-hosted Resend-compatible endpoint instead of api.resend.com. |
SMTP is the recommended path on-prem: relay through the mail server you already operate (Exchange or Office 365, Google Workspace, Amazon SES SMTP, SendGrid, an internal Postfix). Deliverability (SPF, DKIM, DMARC) then lives on your domain and relay, nothing is sent directly from the cluster.
email:
from: noreply@acme.com
smtp:
host: email-smtp.us-east-1.amazonaws.com
port: 587
user: AKIA_CHANGE_ME
secrets:
data:
SMTP_PASSWORD: CHANGE_METo use Resend (or any Resend-compatible API) instead, set secrets.data.RESEND_API_KEY and email.from, and leave email.smtp.host empty. On the External Secrets path add SMTP_PASSWORD or RESEND_API_KEY to the remote store like any other key. A fresh Amazon SES account starts in sandbox mode and only delivers to verified addresses until you request production access.
Code executor
Required for code-based and transformer metrics. The provider selects which block is used; an empty provider disables it.
| Value | Default | Description |
|---|---|---|
codeExecutor.provider | "" | AWS_LAMBDA, GCP_CLOUD_FUNCTIONS, or AZURE_FUNCTIONS. |
codeExecutor.aws.lambdaFunctionName / lambdaRegion | "" | Lambda target. |
codeExecutor.gcp.functionUrl | "" | Cloud Run service URL. |
codeExecutor.azure.functionUrl | "" | Function URL (append /api/execute). |
ClickHouse
Runs in the cluster by default, replicated for high availability. See Scaling and Disaster Recovery.
| Value | Default | Description |
|---|---|---|
clickhouse.internal | true | Run the bundled cluster. Set false and externalHost to use your own. |
clickhouse.password | "" | Admin password, also exposed to the app as CLICKHOUSE_PASSWORD. |
clickhouse.clusterType | replicated | Replication across replicas via Keeper. |
clickhouse.replicas / clickhouse.shards | 2 / 1 | Cluster size. |
clickhouse.storage / clickhouse.storageClass | 256Gi / "" | Data volume. Size for growth. |
clickhouse.keeper.replicas / keeper.storage | 3 / 20Gi | Keeper quorum. Keep at 3. |
clickhouse.backup.enabled | false | Nightly backup to object storage (see Disaster Recovery). |
clickhouse.extraConfig | IPv4 listen | Pins the pods to listen on 0.0.0.0. Leave as is unless you run dual-stack. |
Redis
| Value | Default | Description |
|---|---|---|
redis.internal | true | Run the bundled Redis. Set false to use managed Redis. |
redis.externalUrl | "" | Managed Redis URL when internal: false. |
redis.storage / redis.storageClass | 1Gi / "" | Volume for the in-cluster Redis. |
Workloads and scaling
Each service (backend, frontend, evals, evalsWorker, ingestionWorker, worker, otel) has the same shape. See Scaling for how to tune them.
| Value | Description |
|---|---|
<service>.replicas | Fixed replica count when autoscaling is off. |
<service>.autoscaling.enabled | Turn HPA on or off (on by default for most). |
<service>.autoscaling.minReplicas / maxReplicas / targetCPU | HPA bounds and target. |
<service>.resources | CPU and memory requests and limits. |
<service>.readinessProbe | HTTP readiness path (drives the cloud load balancer health check). |
backend.migrations.enabled | Run the database migration job on install and upgrade (leave on). |
Ingress
| Value | Default | Description |
|---|---|---|
ingress.enabled | false | Create the Ingress. |
ingress.className | alb | Ingress class (alb, nginx, webapprouting.kubernetes.io, or empty for GKE's annotation-driven controller). |
ingress.annotations | {} | Cloud-specific annotations, see the Deploy pages. |
ingress.hosts.evals / ingress.hosts.otel | "" | The evals. and otel. hostnames. app. and api. come from config. |
ingress.tls | [] | TLS blocks (host list plus secret name). |
Observability
| Value | Default | Description |
|---|---|---|
datadog.enabled | false | Emit Datadog APM and metrics. |
datadog.env / datadog.version | prod / appVersion | Tags on the emitted telemetry. |
The full list
This page covers the settings most deployments set. The chart's values.yaml is the source of truth and carries inline comments for every option, including operator internals, per-service resource defaults, and the ClickHouse backup providers. When in doubt, read it there.
Last updated on