110 lines
3.0 KiB
YAML
110 lines
3.0 KiB
YAML
# Configuration: Using Kubernetes Secrets for All Sensitive Values
|
|
# Usage: helm install bifrost ./bifrost -f values-examples/secrets-from-k8s.yaml
|
|
#
|
|
# This example demonstrates how to use existing Kubernetes secrets for all
|
|
# sensitive values instead of putting them directly in the values file.
|
|
#
|
|
# Prerequisites:
|
|
# 1. Create the required Kubernetes secrets before installing the chart:
|
|
#
|
|
# # PostgreSQL password secret
|
|
# kubectl create secret generic postgres-credentials \
|
|
# --from-literal=password='your-postgres-password'
|
|
#
|
|
# # Encryption key secret
|
|
# kubectl create secret generic bifrost-encryption \
|
|
# --from-literal=key='your-encryption-key'
|
|
#
|
|
# # Provider API keys secret
|
|
# kubectl create secret generic provider-api-keys \
|
|
# --from-literal=openai-api-key='sk-...' \
|
|
# --from-literal=anthropic-api-key='sk-ant-...'
|
|
#
|
|
# # Qdrant API key secret (if using Qdrant)
|
|
# kubectl create secret generic qdrant-credentials \
|
|
# --from-literal=api-key='your-qdrant-api-key'
|
|
|
|
# Storage configuration
|
|
storage:
|
|
mode: postgres
|
|
configStore:
|
|
enabled: true
|
|
logsStore:
|
|
enabled: true
|
|
|
|
# External PostgreSQL with credentials from Kubernetes secret
|
|
postgresql:
|
|
enabled: false
|
|
external:
|
|
enabled: true
|
|
host: "your-postgres-host.example.com"
|
|
port: 5432
|
|
user: bifrost
|
|
database: bifrost
|
|
sslMode: require
|
|
# Reference existing Kubernetes secret for password
|
|
existingSecret: "postgres-credentials"
|
|
passwordKey: "password"
|
|
|
|
# Vector store with API key from Kubernetes secret
|
|
vectorStore:
|
|
enabled: true
|
|
type: qdrant
|
|
qdrant:
|
|
enabled: false
|
|
external:
|
|
enabled: true
|
|
host: "your-qdrant-host.example.com"
|
|
port: 6334
|
|
useTls: true
|
|
# Reference existing Kubernetes secret for API key
|
|
existingSecret: "qdrant-credentials"
|
|
apiKeyKey: "api-key"
|
|
|
|
# Bifrost configuration
|
|
bifrost:
|
|
# Encryption key from Kubernetes secret
|
|
encryptionKeySecret:
|
|
name: "bifrost-encryption"
|
|
key: "key"
|
|
|
|
client:
|
|
enableLogging: true
|
|
|
|
# Provider configurations using env.VAR_NAME syntax
|
|
# The actual values come from providerSecrets below
|
|
providers:
|
|
openai:
|
|
keys:
|
|
- name: "openai-primary"
|
|
value: "env.OPENAI_API_KEY"
|
|
weight: 1
|
|
models: ["*"]
|
|
anthropic:
|
|
keys:
|
|
- name: "anthropic-primary"
|
|
value: "env.ANTHROPIC_API_KEY"
|
|
weight: 1
|
|
models: ["*"]
|
|
|
|
# Provider secrets - inject API keys from Kubernetes secrets as env vars
|
|
providerSecrets:
|
|
openai:
|
|
existingSecret: "provider-api-keys"
|
|
key: "openai-api-key"
|
|
envVar: "OPENAI_API_KEY"
|
|
anthropic:
|
|
existingSecret: "provider-api-keys"
|
|
key: "anthropic-api-key"
|
|
envVar: "ANTHROPIC_API_KEY"
|
|
|
|
plugins:
|
|
# Maxim plugin with API key from secret
|
|
maxim:
|
|
enabled: false # Set to true if using Maxim
|
|
config:
|
|
log_repo_id: "your-log-repo-id"
|
|
secretRef:
|
|
name: "maxim-credentials"
|
|
key: "api-key"
|