added repo

helm-templates/bifrost-v1.5.12/values-examples/external-postgres.yaml

@@ -0,0 +1,35 @@
+# Configuration: External PostgreSQL (not deployed by Helm)
+# Usage: helm install bifrost ./bifrost -f values-examples/external-postgres.yaml
+
+# Storage configuration
+storage:
+  mode: postgres
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# Use external PostgreSQL
+postgresql:
+  enabled: false
+  external:
+    enabled: true
+    host: "your-postgres-host.example.com"
+    port: 5432
+    user: bifrost
+    password: "your-secure-password"
+    database: bifrost
+    sslMode: require
+
+# No vector store
+vectorStore:
+  enabled: false
+  type: none
+
+# Bifrost configuration
+bifrost:
+  encryptionKey: "your-encryption-key-here"
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here

helm-templates/bifrost-v1.5.12/values-examples/mixed-backend.yaml

@@ -0,0 +1,51 @@
+# Configuration: SQLite for config store + PostgreSQL for logs store
+# This demonstrates independent backend selection for each store
+# Usage: helm install bifrost ./bifrost -f values-examples/mixed-backend.yaml
+
+# Storage configuration with mixed backends
+storage:
+  mode: sqlite  # Default fallback (not used when per-store type is set)
+  persistence:
+    enabled: true
+    size: 5Gi
+  configStore:
+    enabled: true
+    type: sqlite    # Config store uses SQLite (fast, local, simple)
+  logsStore:
+    enabled: true
+    type: postgres  # Logs store uses PostgreSQL (scalable, queryable)
+
+# Deploy PostgreSQL for logs store
+postgresql:
+  enabled: true
+  auth:
+    username: bifrost
+    password: bifrost_password
+    database: bifrost
+  primary:
+    persistence:
+      enabled: true
+      size: 10Gi
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 1Gi
+      requests:
+        cpu: 250m
+        memory: 256Mi
+
+# No vector store
+vectorStore:
+  enabled: false
+  type: none
+
+# Bifrost configuration
+bifrost:
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here
+    # openai:
+    #   keys:
+    #     - value: "sk-..."
+    #       weight: 1

helm-templates/bifrost-v1.5.12/values-examples/postgres-only.yaml

@@ -0,0 +1,45 @@
+# Configuration: PostgreSQL for config and logs store
+# Usage: helm install bifrost ./bifrost -f values-examples/postgres-only.yaml
+
+# Storage configuration
+storage:
+  mode: postgres
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# Deploy PostgreSQL
+postgresql:
+  enabled: true
+  auth:
+    username: bifrost
+    password: bifrost_password
+    database: bifrost
+  primary:
+    persistence:
+      enabled: true
+      size: 10Gi
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 1Gi
+      requests:
+        cpu: 250m
+        memory: 256Mi
+
+# No vector store
+vectorStore:
+  enabled: false
+  type: none
+
+# Bifrost configuration
+bifrost:
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here
+    # openai:
+    #   keys:
+    #     - value: "sk-..."
+    #       weight: 1

helm-templates/bifrost-v1.5.12/values-examples/postgres-qdrant.yaml

@@ -0,0 +1,82 @@
+# Configuration: PostgreSQL for config/logs + Qdrant for vector store
+# Usage: helm install bifrost ./bifrost -f values-examples/postgres-qdrant.yaml
+#
+# SECURITY NOTE: This example contains placeholder values that MUST be replaced
+# before deployment. Specifically:
+# - PostgreSQL password must be set to a strong, randomly generated value
+# - Provider API keys must be replaced with real keys
+# See inline comments for specific requirements.
+
+# Storage configuration
+storage:
+  mode: postgres
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# PostgreSQL configuration
+postgresql:
+  enabled: true
+  auth:
+    username: bifrost
+    # REQUIRED: Replace with a strong, randomly generated password
+    # Example: Use `openssl rand -base64 32` to generate a secure password
+    # Or set via Helm: --set postgresql.auth.password="$(openssl rand -base64 32)"
+    password: "REPLACE_ME_WITH_STRONG_PASSWORD"
+    database: bifrost
+  primary:
+    persistence:
+      enabled: true
+      size: 20Gi
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 2Gi
+      requests:
+        cpu: 500m
+        memory: 1Gi
+
+# Deploy Qdrant for vector store
+vectorStore:
+  enabled: true
+  type: qdrant
+  qdrant:
+    enabled: true
+    persistence:
+      enabled: true
+      size: 10Gi
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 2Gi
+      requests:
+        cpu: 500m
+        memory: 1Gi
+
+# Bifrost configuration
+bifrost:
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here
+
+  # Enable semantic cache plugin to use Qdrant vector store
+  plugins:
+    semanticCache:
+      enabled: true
+      # OPTION 1 (Recommended): Reference to external Kubernetes Secret for OpenAI API key
+      # Create the secret with: kubectl create secret generic bifrost-semantic-cache --from-literal=openai-key=sk-YOUR_OPENAI_KEY
+      secretRef:
+        name: "bifrost-semantic-cache"
+        key: "openai-key"
+      # OPTION 2 (Not recommended): Or uncomment to provide keys directly (not secure)
+      # Remove secretRef above and uncomment the keys below:
+      config:
+        provider: "openai"
+        # keys:
+        #   - "REPLACE_WITH_OPENAI_API_KEY"  # Not recommended: use secretRef instead
+        embedding_model: "text-embedding-3-small"
+        dimension: 1536
+        threshold: 0.8
+        ttl: "5m"

helm-templates/bifrost-v1.5.12/values-examples/postgres-redis.yaml

@@ -0,0 +1,74 @@
+# Configuration: PostgreSQL for config/logs + Redis for vector store
+# Usage: helm install bifrost ./bifrost -f values-examples/postgres-redis.yaml
+
+# Storage configuration
+storage:
+  mode: postgres
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# Deploy PostgreSQL
+postgresql:
+  enabled: true
+  auth:
+    username: bifrost
+    password: bifrost_password
+    database: bifrost
+  primary:
+    persistence:
+      enabled: true
+      size: 10Gi
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 1Gi
+      requests:
+        cpu: 250m
+        memory: 256Mi
+
+# Deploy Redis for vector store
+vectorStore:
+  enabled: true
+  type: redis
+  redis:
+    enabled: true
+    auth:
+      enabled: true
+      password: "redis_password"
+    master:
+      persistence:
+        enabled: true
+        size: 8Gi
+      resources:
+        limits:
+          cpu: 500m
+          memory: 512Mi
+        requests:
+          cpu: 250m
+          memory: 256Mi
+
+# Bifrost configuration
+bifrost:
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here
+
+  # Enable semantic cache plugin to use Redis vector store
+  plugins:
+    semanticCache:
+      enabled: true
+      # Reference to external Kubernetes Secret for OpenAI API key
+      # Create the secret with: kubectl create secret generic bifrost-semantic-cache --from-literal=openai-key=sk-YOUR_OPENAI_KEY
+      secretRef:
+        name: "bifrost-semantic-cache"
+        key: "openai-key"
+      config:
+        provider: "openai"
+        # keys are injected from the secret via environment variable
+        embedding_model: "text-embedding-3-small"
+        dimension: 1536
+        threshold: 0.8
+        ttl: "5m"

helm-templates/bifrost-v1.5.12/values-examples/postgres-weaviate.yaml

@@ -0,0 +1,71 @@
+# Configuration: PostgreSQL for config/logs + Weaviate for vector store
+# Usage: helm install bifrost ./bifrost -f values-examples/postgres-weaviate.yaml
+
+# Storage configuration
+storage:
+  mode: postgres
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# Deploy PostgreSQL
+postgresql:
+  enabled: true
+  auth:
+    username: bifrost
+    password: bifrost_password
+    database: bifrost
+  primary:
+    persistence:
+      enabled: true
+      size: 10Gi
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 1Gi
+      requests:
+        cpu: 250m
+        memory: 256Mi
+
+# Deploy Weaviate for vector store
+vectorStore:
+  enabled: true
+  type: weaviate
+  weaviate:
+    enabled: true
+    replicas: 1
+    persistence:
+      enabled: true
+      size: 10Gi
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 2Gi
+      requests:
+        cpu: 500m
+        memory: 1Gi
+
+# Bifrost configuration
+bifrost:
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here
+
+  # Enable semantic cache plugin to use vector store
+  plugins:
+    semanticCache:
+      enabled: true
+      # Reference to external Kubernetes Secret for OpenAI API key
+      # Create the secret with: kubectl create secret generic bifrost-semantic-cache --from-literal=openai-key=sk-YOUR_OPENAI_KEY
+      secretRef:
+        name: "bifrost-semantic-cache"
+        key: "openai-key"
+      config:
+        provider: "openai"
+        # keys are injected from the secret via environment variable
+        embedding_model: "text-embedding-3-small"
+        dimension: 1536
+        threshold: 0.8
+        ttl: "5m"

helm-templates/bifrost-v1.5.12/values-examples/production-ha.yaml

@@ -0,0 +1,144 @@
+# Configuration: Production High-Availability Setup
+# PostgreSQL + Weaviate + Auto-scaling + Ingress
+# Usage: helm install bifrost ./bifrost -f values-examples/production-ha.yaml
+
+# Multiple replicas for HA
+replicaCount: 3
+
+# Auto-scaling configuration
+autoscaling:
+  enabled: true
+  minReplicas: 3
+  maxReplicas: 10
+  targetCPUUtilizationPercentage: 70
+  targetMemoryUtilizationPercentage: 80
+
+# Ingress configuration
+ingress:
+  enabled: true
+  className: "nginx"
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+  hosts:
+    - host: bifrost.yourdomain.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: bifrost-tls
+      hosts:
+        - bifrost.yourdomain.com
+
+# Resource limits for production
+resources:
+  limits:
+    cpu: 4000m
+    memory: 4Gi
+  requests:
+    cpu: 1000m
+    memory: 1Gi
+
+# Storage configuration
+storage:
+  mode: postgres
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# PostgreSQL with higher resources
+postgresql:
+  enabled: true
+  auth:
+    username: bifrost
+    password: "CHANGE_ME_SECURE_PASSWORD"
+    database: bifrost
+  primary:
+    persistence:
+      enabled: true
+      size: 50Gi
+    resources:
+      limits:
+        cpu: 2000m
+        memory: 4Gi
+      requests:
+        cpu: 1000m
+        memory: 2Gi
+
+# Weaviate for semantic caching
+vectorStore:
+  enabled: true
+  type: weaviate
+  weaviate:
+    enabled: true
+    replicas: 2
+    persistence:
+      enabled: true
+      size: 50Gi
+    resources:
+      limits:
+        cpu: 2000m
+        memory: 4Gi
+      requests:
+        cpu: 1000m
+        memory: 2Gi
+
+# Bifrost production configuration
+bifrost:
+  # Reference to external Kubernetes Secret for encryption key
+  # Create the secret with: kubectl create secret generic bifrost-encryption --from-literal=key=YOUR_ENCRYPTION_KEY
+  encryptionKeySecret:
+    name: "bifrost-encryption"
+    key: "key"
+
+  client:
+    initialPoolSize: 1000
+    allowedOrigins:
+      - "https://yourdomain.com"
+      - "https://app.yourdomain.com"
+    enableLogging: true
+    maxRequestBodySizeMb: 100
+
+  providers: {}
+    # Add your production provider keys here
+
+  plugins:
+    telemetry:
+      enabled: true
+      config: {}
+
+    logging:
+      enabled: true
+      config: {}
+
+    semanticCache:
+      enabled: true
+      # Reference to external Kubernetes Secret for OpenAI API key
+      # Create the secret with: kubectl create secret generic bifrost-semantic-cache --from-literal=openai-key=sk-YOUR_OPENAI_KEY
+      secretRef:
+        name: "bifrost-semantic-cache"
+        key: "openai-key"
+      config:
+        provider: "openai"
+        # keys are injected from the secret via environment variable
+        embedding_model: "text-embedding-3-small"
+        dimension: 1536
+        threshold: 0.85
+        ttl: "1h"
+        conversation_history_threshold: 5
+
+# Pod affinity for better distribution
+affinity:
+  podAntiAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        podAffinityTerm:
+          labelSelector:
+            matchExpressions:
+              - key: app.kubernetes.io/name
+                operator: In
+                values:
+                  - bifrost
+          topologyKey: kubernetes.io/hostname

helm-templates/bifrost-v1.5.12/values-examples/providers-and-virtual-keys.yaml

@@ -0,0 +1,620 @@
+# Configuration: Full Provider and Virtual Key Reference
+# Usage: helm install bifrost ./bifrost -f values-examples/providers-and-virtual-keys.yaml
+#
+# This example demonstrates configuration for every Bifrost-supported provider
+# (23 total) plus 7 virtual-key patterns covering different access-control needs:
+#   - Simple API-key providers (openai, anthropic, cohere, groq, gemini, ...)
+#   - Deployment-map providers (huggingface, replicate)
+#   - URL-based / self-hosted providers (ollama, sgl, vllm)
+#   - Cloud-native providers with nested config (azure, vertex, bedrock)
+#
+# Secrets are referenced via env.VAR_NAME (see ENVIRONMENT VARIABLES block
+# below). Provide them via extraEnv (map), env, envFrom, or a Kubernetes Secret
+# mounted on the pod — see values-examples/secrets-from-k8s.yaml for patterns.
+#
+# Field names follow transports/config.schema.json (the Bifrost runtime config
+# contract). VK provider_configs use the helm-native keys:[{name:...}] form,
+# which the helm chart template passes through to config.json.
+
+# ==========================================================================
+# ENVIRONMENT VARIABLES REFERENCED
+# ==========================================================================
+# This file uses env.VAR_NAME for all secret values. Supply them via extraEnv
+# (map), env, envFrom, or an external secret store. Full list:
+#
+#   Provider API keys:
+#     OPENAI_API_KEY_1, OPENAI_API_KEY_2, OPENAI_API_KEY_3
+#     ANTHROPIC_API_KEY_1, ANTHROPIC_API_KEY_2
+#     GROQ_API_KEY_1, GROQ_API_KEY_2
+#     COHERE_API_KEY, MISTRAL_API_KEY, GEMINI_API_KEY, OPENROUTER_API_KEY
+#     PARASAIL_API_KEY, PERPLEXITY_API_KEY, CEREBRAS_API_KEY
+#     ELEVENLABS_API_KEY, XAI_API_KEY, NEBIUS_API_KEY, FIREWORKS_API_KEY
+#     RUNWAY_API_KEY, HUGGINGFACE_API_KEY, REPLICATE_API_KEY
+#
+#   Azure:
+#     AZURE_API_KEY, AZURE_ENDPOINT
+#
+#   Vertex (Google Cloud):
+#     VERTEX_PROJECT_ID, VERTEX_AUTH_CREDENTIALS (service-account key JSON)
+#
+#   Bedrock (AWS) — choose static creds OR STS AssumeRole:
+#     AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
+#     AWS_ROLE_ARN, AWS_EXTERNAL_ID
+#
+#   Self-hosted endpoints:
+#     OLLAMA_URL, SGL_URL, VLLM_URL
+
+# Image configuration
+image:
+  repository: docker.io/maximhq/bifrost
+  pullPolicy: IfNotPresent
+  tag: "v1.3.55"
+
+replicaCount: 1
+
+# Service
+service:
+  type: ClusterIP
+  port: 8080
+
+# Storage configuration - using SQLite for simplicity
+storage:
+  mode: sqlite
+  persistence:
+    enabled: true
+    size: 5Gi
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# No PostgreSQL needed for this example
+postgresql:
+  enabled: false
+
+# No vector store for this example
+vectorStore:
+  enabled: false
+  type: none
+
+# Bifrost configuration
+bifrost:
+  appDir: /app/data
+  port: 8080
+  host: 0.0.0.0
+  logLevel: info
+  logStyle: json
+
+  client:
+    dropExcessRequests: false
+    initialPoolSize: 100
+    allowedOrigins:
+      - "*"
+    enableLogging: true
+    enforceGovernanceHeader: false
+    maxRequestBodySizeMb: 100
+
+  # ==========================================================================
+  # PROVIDERS
+  # ==========================================================================
+  # Every key entry supports the base fields:
+  #   name (required), value, weight (optional; defaults to 1), models, use_for_batch_api, aliases
+  # Providers with nested configs add *_key_config blocks
+  # (azure_key_config, vertex_key_config, bedrock_key_config, vllm_key_config,
+  # ollama_key_config, sgl_key_config, replicate_key_config).
+
+  providers:
+    # ------------------------------------------------------------------------
+    # Simple API-key providers (base_key shape)
+    # ------------------------------------------------------------------------
+
+    # OpenAI — 3 keys with weighted load balancing.
+    # openai-batch is flagged use_for_batch_api so it can serve the Batch API.
+    openai:
+      keys:
+        - name: "openai-primary"
+          value: "env.OPENAI_API_KEY_1"
+          weight: 2 # 50% of traffic (2 of 4 total weight)
+          models: ["*"]
+        - name: "openai-secondary"
+          value: "env.OPENAI_API_KEY_2"
+          weight: 1 # 25%
+          models: ["*"]
+        - name: "openai-batch"
+          value: "env.OPENAI_API_KEY_3"
+          weight: 1 # 25%
+          models: ["*"]
+          use_for_batch_api: true # Allow Batch API with this key
+
+    # Anthropic — 2 keys, equal weight
+    anthropic:
+      keys:
+        - name: "anthropic-primary"
+          value: "env.ANTHROPIC_API_KEY_1"
+          weight: 1
+          models: ["*"]
+        - name: "anthropic-secondary"
+          value: "env.ANTHROPIC_API_KEY_2"
+          weight: 1
+          models: ["*"]
+
+    # Groq — 2 keys
+    groq:
+      keys:
+        - name: "groq-primary"
+          value: "env.GROQ_API_KEY_1"
+          weight: 1
+          models: ["*"]
+        - name: "groq-secondary"
+          value: "env.GROQ_API_KEY_2"
+          weight: 1
+          models: ["*"]
+
+    cohere:
+      keys:
+        - name: "cohere-main"
+          value: "env.COHERE_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    mistral:
+      keys:
+        - name: "mistral-main"
+          value: "env.MISTRAL_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    gemini:
+      keys:
+        - name: "gemini-main"
+          value: "env.GEMINI_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    openrouter:
+      keys:
+        - name: "openrouter-main"
+          value: "env.OPENROUTER_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    parasail:
+      keys:
+        - name: "parasail-main"
+          value: "env.PARASAIL_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    perplexity:
+      keys:
+        - name: "perplexity-main"
+          value: "env.PERPLEXITY_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    cerebras:
+      keys:
+        - name: "cerebras-main"
+          value: "env.CEREBRAS_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    elevenlabs:
+      keys:
+        - name: "elevenlabs-main"
+          value: "env.ELEVENLABS_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    xai:
+      keys:
+        - name: "xai-main"
+          value: "env.XAI_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    nebius:
+      keys:
+        - name: "nebius-main"
+          value: "env.NEBIUS_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    fireworks:
+      keys:
+        - name: "fireworks-main"
+          value: "env.FIREWORKS_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    runway:
+      keys:
+        - name: "runway-main"
+          value: "env.RUNWAY_API_KEY"
+          weight: 1
+          models: ["*"]
+
+    # ------------------------------------------------------------------------
+    # Deployment-map providers (use `aliases` to map logical -> provider IDs)
+    # ------------------------------------------------------------------------
+
+    huggingface:
+      keys:
+        - name: "huggingface-main"
+          value: "env.HUGGINGFACE_API_KEY"
+          weight: 1
+          models: ["llama-3", "mixtral"]
+          aliases:
+            # Logical model name -> HF repo path used when invoking
+            llama-3: "meta-llama/Meta-Llama-3-8B-Instruct"
+            mixtral: "mistralai/Mixtral-8x7B-Instruct-v0.1"
+
+    replicate:
+      keys:
+        - name: "replicate-main"
+          value: "env.REPLICATE_API_KEY"
+          weight: 1
+          models: ["llama-3"]
+          aliases:
+            llama-3: "meta/meta-llama-3-70b-instruct"
+          replicate_key_config:
+            use_deployments_endpoint: false # false = /models endpoint (default)
+
+    # ------------------------------------------------------------------------
+    # URL-based / self-hosted providers
+    # ------------------------------------------------------------------------
+    # These providers talk to an HTTP endpoint you operate yourself. They do
+    # not typically require API keys (value stays empty).
+
+    ollama:
+      keys:
+        - name: "ollama-main"
+          value: ""
+          weight: 1
+          models: ["*"]
+          ollama_key_config:
+            url: "env.OLLAMA_URL" # e.g. http://ollama.svc.cluster.local:11434
+
+    sgl:
+      keys:
+        - name: "sgl-main"
+          value: ""
+          weight: 1
+          models: ["*"]
+          sgl_key_config:
+            url: "env.SGL_URL" # e.g. http://sgl-router.svc.cluster.local:30000
+
+    vllm:
+      # vLLM instances are model-specific: one key per served model.
+      keys:
+        - name: "vllm-llama3-70b"
+          value: ""
+          weight: 1
+          models: ["llama-3-70b"]
+          vllm_key_config:
+            url: "env.VLLM_URL" # e.g. http://vllm.svc.cluster.local:8000
+            model_name: "meta-llama/Meta-Llama-3-70B-Instruct"
+
+    # ------------------------------------------------------------------------
+    # Cloud-native providers (nested provider-specific config)
+    # ------------------------------------------------------------------------
+
+    # Azure OpenAI — two auth modes:
+    #   1. azure-apikey:           explicit API key (via env var).
+    #   2. azure-managed-identity: inherits credentials via DefaultAzureCredential
+    #                              when `value` is empty. Covers managed identity
+    #                              on Azure VMs / AKS workload identity / env vars
+    #                              (AZURE_CLIENT_ID etc.) / Azure CLI (dev).
+    # (Service-principal client_id/client_secret/tenant_id fields exist in the
+    # runtime code but aren't exposed in the current schema — use env-based
+    # DefaultAzureCredential instead.)
+    azure:
+      keys:
+        - name: "azure-apikey"
+          value: "env.AZURE_API_KEY"
+          weight: 1
+          models: ["gpt-4o", "gpt-4o-mini", "text-embedding-3-small"]
+          azure_key_config:
+            endpoint: "env.AZURE_ENDPOINT" # e.g. https://my-resource.openai.azure.com
+            api_version: "2024-10-21"
+            deployments:
+              # Logical model name -> Azure deployment name
+              gpt-4o: "gpt-4o-prod"
+              gpt-4o-mini: "gpt-4o-mini-prod"
+              text-embedding-3-small: "embeddings-prod"
+        - name: "azure-managed-identity"
+          # Pure identity inheritance: empty `value` triggers DefaultAzureCredential.
+          # Works out-of-the-box on AKS with workload identity, Azure VMs with
+          # system/user-assigned managed identity, or local dev via `az login`.
+          value: ""
+          weight: 1
+          models: ["gpt-4o"]
+          azure_key_config:
+            endpoint: "env.AZURE_ENDPOINT"
+            api_version: "2024-10-21"
+            deployments:
+              gpt-4o: "gpt-4o-prod"
+
+    # Google Vertex AI — two auth modes:
+    #   1. vertex-sa-key:       explicit service-account key JSON via env var.
+    #   2. vertex-workload-id:  inherits credentials from the environment
+    #                           (GKE Workload Identity, GCE metadata server,
+    #                           or GOOGLE_APPLICATION_CREDENTIALS path). Omit
+    #                           `auth_credentials` and the Google SDK calls
+    #                           google.FindDefaultCredentials automatically.
+    vertex:
+      keys:
+        - name: "vertex-sa-key"
+          value: ""
+          weight: 1
+          models: ["*"]
+          vertex_key_config:
+            project_id: "env.VERTEX_PROJECT_ID"
+            region: "us-central1"
+            auth_credentials: "env.VERTEX_AUTH_CREDENTIALS"
+            # project_number: "env.VERTEX_PROJECT_NUMBER"   # optional
+        - name: "vertex-workload-id"
+          # Pure ADC inheritance: works on GKE with Workload Identity, GCE
+          # VMs, Cloud Run, or local dev via `gcloud auth application-default login`.
+          value: ""
+          weight: 1
+          models: ["*"]
+          vertex_key_config:
+            project_id: "env.VERTEX_PROJECT_ID"
+            region: "us-central1"
+            # auth_credentials intentionally omitted -> ADC lookup
+
+    # AWS Bedrock — three auth modes:
+    #   1. bedrock-static:   explicit AWS access/secret keys + S3 batch bucket
+    #   2. bedrock-irsa:     inherits pod/EKS credentials (IRSA, EC2 instance
+    #                        profile, env vars, ~/.aws/credentials) — set only
+    #                        `region`; the AWS SDK default credential chain
+    #                        resolves the rest.
+    #   3. bedrock-assumerole: STS AssumeRole chained on top of the default
+    #                          chain — inherits *source* creds from the pod,
+    #                          then assumes a cross-account role.
+    bedrock:
+      keys:
+        - name: "bedrock-static"
+          value: ""
+          weight: 1
+          models: ["*"]
+          bedrock_key_config:
+            region: "us-east-1"
+            access_key: "env.AWS_ACCESS_KEY_ID"
+            secret_key: "env.AWS_SECRET_ACCESS_KEY"
+            deployments:
+              # Logical model -> Bedrock inference profile
+              anthropic.claude-3-5-sonnet: "us.anthropic.claude-3-5-sonnet-20240620-v1:0"
+            batch_s3_config:
+              buckets:
+                - bucket_name: "my-bedrock-batch-bucket"
+                  prefix: "batch/"
+                  is_default: true
+        - name: "bedrock-irsa"
+          # Pure credential inheritance: works out-of-the-box on EKS with IRSA,
+          # on EC2 with an instance profile, or with AWS_* env vars present.
+          value: ""
+          weight: 1
+          models: ["*"]
+          bedrock_key_config:
+            region: "us-east-1"
+            # access_key / secret_key intentionally omitted -> SDK default chain
+        - name: "bedrock-assumerole"
+          value: ""
+          weight: 1
+          models: ["*"]
+          bedrock_key_config:
+            region: "us-west-2"
+            # No static creds -> source identity comes from pod's default chain.
+            role_arn: "env.AWS_ROLE_ARN"
+            external_id: "env.AWS_EXTERNAL_ID"
+            session_name: "bifrost-session"
+
+  # ==========================================================================
+  # GOVERNANCE — budgets, rate limits, and virtual keys
+  # ==========================================================================
+
+  governance:
+    # --------------------------------------------------------------------
+    # Budgets — spending caps per period
+    # --------------------------------------------------------------------
+    budgets:
+      - id: "budget-dev"
+        max_limit: 50 # $50
+        reset_duration: "1M" # monthly
+      - id: "budget-production"
+        max_limit: 500 # $500
+        reset_duration: "1M"
+      - id: "budget-testing"
+        max_limit: 10 # $10
+        reset_duration: "1d" # daily
+      - id: "budget-team-platform"
+        max_limit: 2000 # $2000 — larger team/platform budget
+        reset_duration: "1M"
+
+    # --------------------------------------------------------------------
+    # Rate limits — token + request caps per period
+    # --------------------------------------------------------------------
+    rateLimits:
+      - id: "rate-limit-standard"
+        token_max_limit: 100000
+        token_reset_duration: "1h"
+        request_max_limit: 1000
+        request_reset_duration: "1h"
+      - id: "rate-limit-high"
+        token_max_limit: 500000
+        token_reset_duration: "1h"
+        request_max_limit: 5000
+        request_reset_duration: "1h"
+      - id: "rate-limit-testing"
+        token_max_limit: 10000
+        token_reset_duration: "1h"
+        request_max_limit: 100
+        request_reset_duration: "1h"
+      - id: "rate-limit-burst"
+        token_max_limit: 50000
+        token_reset_duration: "1m" # Short-window burst cap
+        request_max_limit: 500
+        request_reset_duration: "1m"
+
+    # --------------------------------------------------------------------
+    # Virtual keys — access tokens scoped to providers/models/keys
+    # --------------------------------------------------------------------
+    # provider_configs[].keys scopes the VK to specific provider keys by name.
+    # Omit provider_configs to grant access to every provider.
+    # Omit keys inside a provider_config to allow all keys for that provider.
+
+    virtualKeys:
+      # 1. Dev key — access to every provider, no restrictions.
+      - id: "vk-all-providers-dev"
+        name: "Dev: all providers"
+        is_active: true
+        budget_id: "budget-dev"
+        rate_limit_id: "rate-limit-standard"
+        # No provider_configs -> all providers accessible
+
+      # 2. OpenAI only — restricted to 2 keys and 2 models.
+      - id: "vk-openai-scoped"
+        name: "OpenAI only (scoped)"
+        is_active: true
+        budget_id: "budget-production"
+        rate_limit_id: "rate-limit-high"
+        provider_configs:
+          - provider: "openai"
+            weight: 1
+            allowed_models: ["gpt-4o", "gpt-4o-mini"]
+            keys:
+              - name: "openai-primary"
+              - name: "openai-secondary"
+
+      # 3. Multi-provider — weighted routing across OpenAI/Anthropic/Groq.
+      # OpenAI gets 50% (weight 2), the others 25% each (weight 1).
+      - id: "vk-multi-provider"
+        name: "Multi-provider weighted"
+        is_active: true
+        budget_id: "budget-production"
+        rate_limit_id: "rate-limit-high"
+        provider_configs:
+          - provider: "openai"
+            weight: 2
+            allowed_models: ["*"]
+            # Omitting keys -> all openai keys allowed
+          - provider: "anthropic"
+            weight: 1
+            allowed_models: ["*"]
+            keys:
+              - name: "anthropic-primary"
+          - provider: "groq"
+            weight: 1
+            allowed_models: ["*"]
+
+      # 4. Cloud providers — Azure + Vertex + Bedrock only.
+      # Shows that VK scoping is identical regardless of nested key_config.
+      - id: "vk-cloud-providers"
+        name: "Cloud providers (Azure/Vertex/Bedrock)"
+        is_active: true
+        budget_id: "budget-team-platform"
+        rate_limit_id: "rate-limit-high"
+        provider_configs:
+          - provider: "azure"
+            weight: 1
+            keys:
+              - name: "azure-apikey"
+              - name: "azure-managed-identity"
+          - provider: "vertex"
+            weight: 1
+            keys:
+              - name: "vertex-sa-key"
+              - name: "vertex-workload-id"
+          - provider: "bedrock"
+            weight: 1
+            keys:
+              - name: "bedrock-static"
+              - name: "bedrock-irsa"
+              - name: "bedrock-assumerole"
+
+      # 5. Self-hosted — Ollama + vLLM + SGL only.
+      # Low budget because self-hosted inference is ~free.
+      - id: "vk-self-hosted"
+        name: "Self-hosted (Ollama/vLLM/SGL)"
+        is_active: true
+        budget_id: "budget-dev"
+        rate_limit_id: "rate-limit-high"
+        provider_configs:
+          - provider: "ollama"
+            weight: 1
+          - provider: "vllm"
+            weight: 1
+          - provider: "sgl"
+            weight: 1
+
+      # 6. Testing — tight budget, tight rate limit, single model, single key.
+      - id: "vk-testing-limited"
+        name: "Testing (gpt-4o-mini only)"
+        is_active: true
+        budget_id: "budget-testing"
+        rate_limit_id: "rate-limit-testing"
+        provider_configs:
+          - provider: "openai"
+            weight: 1
+            allowed_models: ["gpt-4o-mini"]
+            keys:
+              - name: "openai-secondary"
+
+      # 7. Batch API — restricted to keys flagged use_for_batch_api: true.
+      # Pairs with the openai-batch key above. Burst rate-limit for batch flushes.
+      - id: "vk-batch-api"
+        name: "Batch API workloads"
+        is_active: true
+        budget_id: "budget-production"
+        rate_limit_id: "rate-limit-burst"
+        provider_configs:
+          - provider: "openai"
+            weight: 1
+            allowed_models: ["*"]
+            keys:
+              - name: "openai-batch"
+
+  # Plugins configuration
+  plugins:
+    telemetry:
+      enabled: false
+    logging:
+      enabled: true
+      config: {}
+    governance:
+      enabled: true
+      config:
+        is_vk_mandatory: false # Set to true to require virtual key on all requests
+
+# Resource limits
+resources:
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+  requests:
+    cpu: 250m
+    memory: 256Mi
+
+# Probes
+livenessProbe:
+  httpGet:
+    path: /health
+    port: http
+  initialDelaySeconds: 30
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+readinessProbe:
+  httpGet:
+    path: /health
+    port: http
+  initialDelaySeconds: 10
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+autoscaling:
+  enabled: false

helm-templates/bifrost-v1.5.12/values-examples/secrets-from-k8s.yaml

@@ -0,0 +1,109 @@
+# Configuration: Using Kubernetes Secrets for All Sensitive Values
+# Usage: helm install bifrost ./bifrost -f values-examples/secrets-from-k8s.yaml
+#
+# This example demonstrates how to use existing Kubernetes secrets for all
+# sensitive values instead of putting them directly in the values file.
+#
+# Prerequisites:
+# 1. Create the required Kubernetes secrets before installing the chart:
+#
+#    # PostgreSQL password secret
+#    kubectl create secret generic postgres-credentials \
+#      --from-literal=password='your-postgres-password'
+#
+#    # Encryption key secret
+#    kubectl create secret generic bifrost-encryption \
+#      --from-literal=key='your-encryption-key'
+#
+#    # Provider API keys secret
+#    kubectl create secret generic provider-api-keys \
+#      --from-literal=openai-api-key='sk-...' \
+#      --from-literal=anthropic-api-key='sk-ant-...'
+#
+#    # Qdrant API key secret (if using Qdrant)
+#    kubectl create secret generic qdrant-credentials \
+#      --from-literal=api-key='your-qdrant-api-key'
+
+# Storage configuration
+storage:
+  mode: postgres
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# External PostgreSQL with credentials from Kubernetes secret
+postgresql:
+  enabled: false
+  external:
+    enabled: true
+    host: "your-postgres-host.example.com"
+    port: 5432
+    user: bifrost
+    database: bifrost
+    sslMode: require
+    # Reference existing Kubernetes secret for password
+    existingSecret: "postgres-credentials"
+    passwordKey: "password"
+
+# Vector store with API key from Kubernetes secret
+vectorStore:
+  enabled: true
+  type: qdrant
+  qdrant:
+    enabled: false
+    external:
+      enabled: true
+      host: "your-qdrant-host.example.com"
+      port: 6334
+      useTls: true
+      # Reference existing Kubernetes secret for API key
+      existingSecret: "qdrant-credentials"
+      apiKeyKey: "api-key"
+
+# Bifrost configuration
+bifrost:
+  # Encryption key from Kubernetes secret
+  encryptionKeySecret:
+    name: "bifrost-encryption"
+    key: "key"
+
+  client:
+    enableLogging: true
+
+  # Provider configurations using env.VAR_NAME syntax
+  # The actual values come from providerSecrets below
+  providers:
+    openai:
+      keys:
+        - name: "openai-primary"
+          value: "env.OPENAI_API_KEY"
+          weight: 1
+          models: ["*"]
+    anthropic:
+      keys:
+        - name: "anthropic-primary"
+          value: "env.ANTHROPIC_API_KEY"
+          weight: 1
+          models: ["*"]
+
+  # Provider secrets - inject API keys from Kubernetes secrets as env vars
+  providerSecrets:
+    openai:
+      existingSecret: "provider-api-keys"
+      key: "openai-api-key"
+      envVar: "OPENAI_API_KEY"
+    anthropic:
+      existingSecret: "provider-api-keys"
+      key: "anthropic-api-key"
+      envVar: "ANTHROPIC_API_KEY"
+
+  plugins:
+    # Maxim plugin with API key from secret
+    maxim:
+      enabled: false  # Set to true if using Maxim
+      config:
+        log_repo_id: "your-log-repo-id"
+      secretRef:
+        name: "maxim-credentials"
+        key: "api-key"

helm-templates/bifrost-v1.5.12/values-examples/semantic-cache-secret-example.yaml

@@ -0,0 +1,27 @@
+# Example Kubernetes Secret for Semantic Cache API Key
+# This secret is referenced by production-ha.yaml
+#
+# IMPORTANT: Do not commit this file with real API keys to version control!
+#
+# Usage:
+#   1. Replace 'YOUR_OPENAI_API_KEY' with your actual OpenAI API key
+#   2. Apply the secret: kubectl apply -f semantic-cache-secret-example.yaml -n <namespace>
+#   3. Deploy Bifrost with: helm install bifrost . -f values-examples/production-ha.yaml -n <namespace>
+#
+# Alternative: Create the secret using kubectl command:
+#   kubectl create secret generic bifrost-semantic-cache \
+#     --from-literal=openai-key=sk-YOUR_OPENAI_API_KEY \
+#     -n <namespace>
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: bifrost-semantic-cache
+  namespace: default  # Change this to your target namespace
+  labels:
+    app.kubernetes.io/name: bifrost
+    app.kubernetes.io/component: semantic-cache
+type: Opaque
+stringData:
+  # Replace with your actual OpenAI API key
+  openai-key: "sk-YOUR_OPENAI_API_KEY"

helm-templates/bifrost-v1.5.12/values-examples/sqlite-only.yaml

@@ -0,0 +1,33 @@
+# Configuration: SQLite for config and logs store
+# Usage: helm install bifrost ./bifrost -f values-examples/sqlite-only.yaml
+
+# Storage configuration
+storage:
+  mode: sqlite
+  persistence:
+    enabled: true
+    size: 10Gi
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# No PostgreSQL
+postgresql:
+  enabled: false
+
+# No vector store
+vectorStore:
+  enabled: false
+  type: none
+
+# Bifrost configuration
+bifrost:
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here
+    # openai:
+    #   keys:
+    #     - value: "sk-..."
+    #       weight: 1

helm-templates/bifrost-v1.5.12/values-examples/sqlite-qdrant.yaml

@@ -0,0 +1,58 @@
+# Configuration: SQLite for config/logs + Qdrant for vector store
+# Usage: helm install bifrost ./bifrost -f values-examples/sqlite-qdrant.yaml
+
+# Storage configuration
+storage:
+  mode: sqlite
+  persistence:
+    enabled: true
+    size: 10Gi
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# No PostgreSQL
+postgresql:
+  enabled: false
+
+# Deploy Qdrant for vector store
+vectorStore:
+  enabled: true
+  type: qdrant
+  qdrant:
+    enabled: true
+    persistence:
+      enabled: true
+      size: 10Gi
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 2Gi
+      requests:
+        cpu: 500m
+        memory: 1Gi
+
+# Bifrost configuration
+bifrost:
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here
+
+  # Enable semantic cache plugin to use vector store
+  plugins:
+    semanticCache:
+      enabled: true
+      # Reference to external Kubernetes Secret for OpenAI API key
+      # Create the secret with: kubectl create secret generic bifrost-semantic-cache --from-literal=openai-key=sk-YOUR_OPENAI_KEY
+      secretRef:
+        name: "bifrost-semantic-cache"
+        key: "openai-key"
+      config:
+        provider: "openai"
+        # keys are injected from the secret via environment variable
+        embedding_model: "text-embedding-3-small"
+        dimension: 1536
+        threshold: 0.8
+        ttl: "5m"

helm-templates/bifrost-v1.5.12/values-examples/sqlite-redis.yaml

@@ -0,0 +1,75 @@
+# Configuration: SQLite for config/logs + Redis for vector store
+# Usage: helm install bifrost ./bifrost -f values-examples/sqlite-redis.yaml
+#
+# SECURITY NOTE: This example contains placeholder values that MUST be replaced
+# before deployment. Specifically:
+# - Redis password must be set to a strong, randomly generated value
+# - Provider API keys must be replaced with real keys
+# See inline comments for specific requirements.
+
+# Storage configuration
+storage:
+  mode: sqlite
+  persistence:
+    enabled: true
+    size: 10Gi
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# No PostgreSQL
+postgresql:
+  enabled: false
+
+# Deploy Redis for vector store
+vectorStore:
+  enabled: true
+  type: redis
+  redis:
+    enabled: true
+    auth:
+      enabled: true
+      # REQUIRED: Replace with a strong, randomly generated password
+      # Example: Use `openssl rand -base64 32` to generate a secure password
+      # Or set via Helm: --set vectorStore.redis.auth.password="$(openssl rand -base64 32)"
+      # Or use a Kubernetes secret: --set vectorStore.redis.auth.existingSecret=redis-secret
+      password: "REPLACE_ME_WITH_STRONG_PASSWORD"
+    master:
+      persistence:
+        enabled: true
+        size: 8Gi
+      resources:
+        limits:
+          cpu: 500m
+          memory: 512Mi
+        requests:
+          cpu: 250m
+          memory: 256Mi
+
+# Bifrost configuration
+bifrost:
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here
+
+  # Enable semantic cache plugin to use Redis vector store
+  plugins:
+    semanticCache:
+      enabled: true
+      # OPTION 1 (Recommended): Reference to external Kubernetes Secret for OpenAI API key
+      # Create the secret with: kubectl create secret generic bifrost-semantic-cache --from-literal=openai-key=sk-YOUR_OPENAI_KEY
+      secretRef:
+        name: "bifrost-semantic-cache"
+        key: "openai-key"
+      # OPTION 2 (Not recommended): Or uncomment to provide keys directly (not secure)
+      # Remove secretRef above and uncomment the keys below:
+      config:
+        provider: "openai"
+        # keys:
+        #   - "REPLACE_WITH_OPENAI_API_KEY"  # Not recommended: use secretRef instead
+        embedding_model: "text-embedding-3-small"
+        dimension: 1536
+        threshold: 0.8
+        ttl: "5m"

helm-templates/bifrost-v1.5.12/values-examples/sqlite-weaviate.yaml

@@ -0,0 +1,59 @@
+# Configuration: SQLite for config/logs + Weaviate for vector store
+# Usage: helm install bifrost ./bifrost -f values-examples/sqlite-weaviate.yaml
+
+# Storage configuration
+storage:
+  mode: sqlite
+  persistence:
+    enabled: true
+    size: 10Gi
+  configStore:
+    enabled: true
+  logsStore:
+    enabled: true
+
+# No PostgreSQL
+postgresql:
+  enabled: false
+
+# Deploy Weaviate for vector store
+vectorStore:
+  enabled: true
+  type: weaviate
+  weaviate:
+    enabled: true
+    replicas: 1
+    persistence:
+      enabled: true
+      size: 10Gi
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 2Gi
+      requests:
+        cpu: 500m
+        memory: 1Gi
+
+# Bifrost configuration
+bifrost:
+  client:
+    enableLogging: true
+  providers: {}
+    # Add your provider keys here
+
+  # Enable semantic cache plugin to use vector store
+  plugins:
+    semanticCache:
+      enabled: true
+      # Reference to external Kubernetes Secret for OpenAI API key
+      # Create the secret with: kubectl create secret generic bifrost-semantic-cache --from-literal=openai-key=sk-YOUR_OPENAI_KEY
+      secretRef:
+        name: "bifrost-semantic-cache"
+        key: "openai-key"
+      config:
+        provider: "openai"
+        # keys are injected from the secret via environment variable
+        embedding_model: "text-embedding-3-small"
+        dimension: 1536
+        threshold: 0.8
+        ttl: "5m"