Helm values reference

The chart’s values.yaml carries complete defaults for all workloads, so a deployment values file only sets what is environment-specific. This page lists those parameters in the order they appear in values-minimal.yaml - the template to copy for a new environment.

Helm merges maps but replaces lists wholesale. To override anything inside a service’s env, containers, or volumes lists, copy the whole list from the chart’s values.yaml into your values file and edit it there.

`secrets` - platform credentials

Every key is required. Generate strong random values for a new environment.

secrets:
  SECRET_KEY: "CHANGE-ME"
  DB_PASSWORD: "CHANGE-ME"
  RABBITMQ_DEFAULT_PASS: "CHANGE-ME"
  NODERED_PASSWORD: "CHANGE-ME"
  LITELLM_MASTER_KEY: "sk-CHANGE-ME"
  LITELLM_SALT_KEY: "CHANGE-ME"
  UI_PASSWORD: "sk-CHANGE-ME"
  RAY_PASSWORD: "CHANGE-ME"
  GENERIC_LOGGER_HEADERS: "Authorization=Bearer CHANGE-ME"
  GRAFANA_ADMIN_PASSWORD: "CHANGE-ME"
  FLOWER_BASIC_AUTH: "root:CHANGE-ME"
  PREFECT_API_AUTH_STRING: "admin:CHANGE-ME"
  MINIO_ACCESS_KEY: "CHANGE-ME"
  MINIO_SECRET_KEY: "CHANGE-ME"
  SUPERADMIN_PASSWORD: "CHANGE-ME"
  ADMIN_SECRET_PATH: "CHANGE-ME"
  EXTERNAL_API_TOKEN: ""

Key	Used by
`SECRET_KEY`	Django signing key
`DB_PASSWORD`	Shared PostgreSQL (also Chatwoot’s database)
`RABBITMQ_DEFAULT_PASS`	RabbitMQ broker
`NODERED_PASSWORD`	Node-RED basic auth; fans out to the agentspace services as the fine-tuning/platform API password
`LITELLM_MASTER_KEY`	LiteLLM master key (`sk-…`); fans out as `LITELLM_TOKEN` to every agentspace service
`LITELLM_SALT_KEY`	LiteLLM credential encryption - never rotate after models are added
`UI_PASSWORD`	LiteLLM admin UI login
`RAY_PASSWORD`	Basic auth for the (remote) Ray dashboard ingress
`GENERIC_LOGGER_HEADERS`	Auth header LiteLLM sends to the usage-logging webhook
`GRAFANA_ADMIN_PASSWORD`	Grafana `admin` user
`FLOWER_BASIC_AUTH`	Celery Flower dashboard (`user:password`)
`PREFECT_API_AUTH_STRING`	Prefect server/UI basic auth (`user:password`)
`MINIO_ACCESS_KEY` / `MINIO_SECRET_KEY`	MinIO root credentials
`SUPERADMIN_PASSWORD`	BenchGen `superadmin` account; fans out as the platform password for agentspace
`ADMIN_SECRET_PATH`	URL path segment of the Django admin panel
`EXTERNAL_API_TOKEN`	Token for external API integrations; empty if unused

`global.imagePullSecrets` - registry access

global:
  imagePullSecrets:
    - name: dockerhub-creds

The secret must exist in the namespace before installing. The agentspace workloads reference the same secret name from the chart defaults, so keep it dockerhub-creds unless you also override their extraImagePullSecrets.

`ingress` - public hosts of the core

ingress:
  provider: traefik          # or nginx - must match the installed controller
  className: traefik
  hosts:
    main: benchgen.example.com
    minio: benchgen-minio.example.com
    litellmAgentspace: ""    # optional compatibility host, empty = off

Key	Description
`provider` / `className`	`traefik` or `nginx`; controls which annotations and middlewares are rendered
`hosts.main`	The platform UI and API. Grafana, Prefect, LiteLLM, and Node-RED are served under `/services/*` on this host
`hosts.minio`	S3 endpoint for datasets and submissions
`hosts.litellmAgentspace`	Optional extra host serving LiteLLM at the root path (legacy compatibility); leave empty to disable

TLS is issued per host by cert-manager using the letsencrypt-prod ClusterIssuer (ingress.tls.clusterIssuer to override).

`config` - public URLs (derived since 0.5.23)

Every public URL derives from ingress.hosts automatically - DOMAIN_NAME, CSRF_TRUSTED_ORIGINS, ALLOWED_HOSTS, GRAFANA_ROOT_URL, PREFECT_UI_API_URL, the S3/MinIO endpoints, and litellm.proxyBaseURL. You only set what cannot be derived:

config:
  TLS_EMAIL: admin@example.com          # Let's Encrypt registration e-mail
  RAY_URL: http://ray:8265              # Ray dashboard/jobs API
  RAY_MODEL_API: http://ray:8080        # Ray Serve (model endpoints)

Key	Description
`TLS_EMAIL`	E-mail used for the Let’s Encrypt account
`RAY_URL`	In-cluster Ray: `http://ray:8265`. Remote GPU server: its https dashboard URL
`RAY_MODEL_API`	In-cluster Ray: `http://ray:8080`. Remote GPU server: its https serve URL

Any explicitly set config.* value still wins over the derived one. UBOS_BASE_URL, UBOS_ALLOWED_BASE_URLS, and GENERIC_LOGGER_ENDPOINT derive from agentspace.hosts the same way.

`ray` - GPU inference

Run Ray + vLLM inside the cluster on a GPU node (set the internal RAY_URL / RAY_MODEL_API shown above), or keep enabled: false and point those URLs at a remote GPU server.

ray:
  enabled: true
  runtimeClassName: nvidia     # k3s + NVIDIA toolkit: REQUIRED, else no GPU
  gpuCount: 1
  gpuResourceKey: nvidia.com/gpu
  nodeSelector:
    nvidia.com/gpu.present: "true"
  rayResources:
    default_gpu: 1             # custom Ray resource the flows target
  shmSize: 4Gi

Key	Description
`runtimeClassName`	Container runtime class for the Ray pods. On k3s the NVIDIA toolkit registers as a non-default RuntimeClass - without `nvidia` the pod runs under runc and sees no GPU
`rayResources`	Custom Ray resources the head advertises (`ray start --resources`). The platform flows schedule model deployments against `default_gpu`
`extraEnv`	Extra env vars (k8s `EnvVar` list) for the Ray head and worker containers
`worker.groups`	Optional worker groups - one Deployment per group, each joining the head with its own `nodeSelector`, `gpuCount`, and `rayResources`. Use one group per extra GPU node

GPU node prerequisites: NVIDIA driver + container toolkit + device plugin (so the node advertises nvidia.com/gpu), and the nvidia.com/gpu.present=true node label. Adding a worker on a second GPU node:

ray:
  worker:
    enabled: true
    groups:
      - name: node2
        replicas: 1
        gpuCount: 1
        nodeSelector:
          kubernetes.io/hostname: <gpu-node-2>
        rayResources:
          gpu_node2: 1

`agentspace` - shared inputs for the agent bundle

Single source for everything the ten agentspace services share. The chart renders it into the benchgen-agentspace-common secret, which every service consumes via envFrom - hostnames, the admin identity, Keycloak client, LiteLLM URL/token, and the backing database credentials all live here once.

agentspace:
  enabled: true
  hosts:
    chatui: chat.example.com
    nodered: aibot.example.com
    uboschat: support.example.com
    uiEditor: editor.example.com
    hostAgent: host-agent.example.com
    externalTool: tools.example.com
    onboarding: welcome.example.com
  admin:
    email: admin@example.com
    password: CHANGE-ME
  keycloak:
    host: auth.example.com
    realm: MyRealm
    clientId: my-client
    clientSecret: CHANGE-ME
  mainUrl: platform.example.com
  hostenv: QA
  chatuiDb:
    name: chatui
    user: admin
    password: CHANGE-ME
  aibotDb:
    name: aibot
    user: admin
    password: CHANGE-ME

Key	Description
`hosts.*`	Public hostname of each agentspace service. Drives the rendered ingresses, the `*_URL` environment variables, and the UI Editor’s NGINX config. DNS for every host must point at the cluster
`admin.email` / `admin.password`	The one agentspace admin identity - used as the chat UI’s first (admin) user, the AI-bot’s chat login, and the default credentials for both admin-init hooks
`keycloak.*`	OAuth/OIDC client for single sign-on across the bundle
`mainUrl`	UBOS platform host the agent flows link back to
`hostenv`	Environment label passed to the services (for example `QA`, `PROD`)
`chatuiDb.*`	Chat UI’s PostgreSQL database name/user/password. The database host is derived from the `agentPostgres` service automatically; the pod and every client get the credentials from the common secret
`aibotDb.*`	AI-bot’s MongoDB database name/user/password. Host derived from `agentMongo` the same way

Changing a chatuiDb / aibotDb password in this block updates the database pod and all of its clients consistently on the next upgrade.

Agentspace services - enable flags and per-env credentials

The full deployment spec of each service (images, probes, volumes, resource names) lives in the chart defaults. A values file only enables them and sets credentials where a service has its own:

uboschat:            # Chatwoot support chat
  enabled: true
  admin:
    email: admin@example.com
    name: Admin
    password: CHANGE-ME
    account_name: My Account
    app_token: CHANGE-ME

vectordb:            # Chroma vector store
  enabled: true

agentPostgres:       # PostgreSQL for the chat UI
  enabled: true

agentMongo:          # MongoDB for the AI-bot agent
  enabled: true

agentNodered:        # Node-RED AI-bot agent
  enabled: true
  adminInit:
    client:
      email: client@example.com
      password: CHANGE-ME

hostAgent:           # Bot API host agent
  enabled: true

externalTool:        # External tools service
  enabled: true

chatui:              # Chat UI (open-webui)
  enabled: true

uiEditor:            # Agent UI editor (backend + NGINX frontend)
  enabled: true

onboarding:          # Agentspace landing page
  enabled: true

Key	Description
`<service>.enabled`	All ten services are required parts of the platform - enable them all
`uboschat.admin.*`	Chatwoot admin account seeded on install; `app_token` is fanned out to the agent services as `chatwoot_token`
`agentNodered.adminInit.client.*`	The client account created by the `job-aibot-admin-init` hook (used to sign in to the agentspace admin UI). The admin account itself defaults to `agentspace.admin`

Admin-init hooks

Both bootstrap hooks are enabled in the chart defaults and read their credentials from agentspace.admin:

Hook	What it does	Extra values
`chatui.adminInit`	Creates the chat UI admin, opens self-registration, sets the default role to `user`, grants default workspace permissions, and registers the AI-bot API connection	`enableSignup`, `defaultUserRole`, `defaultPermissions`, `connections` - preconfigured in the chart defaults
`agentNodered.adminInit`	Creates the agentspace admin and the client account through the AI-bot API, then verifies login	`client.*` - see above

Advanced overrides

Everything below has working defaults; override only when needed.

Key	Default	Description
`computeWorker.hostDirectory`	`/var/codabench`	Shared submission directory inside the Docker-in-Docker sidecar. Must not live under `/tmp`
`computeWorker.submissionNetwork`	`llm-benchmarking-base_default`	Docker network pre-created for submission containers
`litellm.detailedDebug`	`false`	Verbose LiteLLM logging (degrades performance)
`config.SECURE_SSL_REDIRECT`	`False`	Keep `False` - the HTTPS redirect is handled at the ingress; Django redirecting in-cluster callers breaks Prefect flows
`monitoring.*`	enabled	Grafana, Loki, and Promtail toggles and sizes
`image.*`	chart defaults	Repository/tag/pull policy per core component
`<service>.releasePrefix`	chart defaults	Resource-name prefix of each agentspace service. Do not change - agent flows reference these DNS names internally

Complete values template

Copy this file, replace every CHANGE-ME and example.com hostname with your real values, and install with -f my-values.yaml. Everything not set here falls back to the chart defaults.

my-values.yaml

# ============================================================================
# BenchGen platform - deployment values.
# The platform = core + the agentspace bundle (all of it required). Only Ray
# is optional and may live on a separate GPU server (see the RAY_* keys).
# Everything not set here falls back to the chart defaults in values.yaml.
#
#   helm upgrade --install benchgen ./benchgen-<version>.tgz \
#     -n <namespace> --create-namespace -f my-values.yaml
#
# Cluster prereqs: ingress controller (nginx or traefik), cert-manager
# ClusterIssuer `letsencrypt-prod`, pull secret `dockerhub-creds`,
# DNS of every host below pointing at this cluster.
# ============================================================================

# --- 1. Secrets: every value is required, replace them all -------------------
secrets:
  SECRET_KEY: "CHANGE-ME"               # django
  DB_PASSWORD: "CHANGE-ME"              # shared postgres (also chatwoot's DB)
  RABBITMQ_DEFAULT_PASS: "CHANGE-ME"
  NODERED_PASSWORD: "CHANGE-ME"
  LITELLM_MASTER_KEY: "sk-CHANGE-ME"
  LITELLM_SALT_KEY: "CHANGE-ME"         # never rotate after models are added
  UI_PASSWORD: "sk-CHANGE-ME"           # litellm UI
  RAY_PASSWORD: "CHANGE-ME"             # basic auth of the (remote) ray ingress
  GENERIC_LOGGER_HEADERS: "Authorization=Bearer CHANGE-ME"
  GRAFANA_ADMIN_PASSWORD: "CHANGE-ME"
  FLOWER_BASIC_AUTH: "root:CHANGE-ME"
  PREFECT_API_AUTH_STRING: "admin:CHANGE-ME"
  MINIO_ACCESS_KEY: "CHANGE-ME"
  MINIO_SECRET_KEY: "CHANGE-ME"
  SUPERADMIN_PASSWORD: "CHANGE-ME"
  ADMIN_SECRET_PATH: "CHANGE-ME"        # URL path of the django admin panel
  EXTERNAL_API_TOKEN: ""                # blank if unused

# --- 2. Pull secret for the private images -----------------------------------
global:
  imagePullSecrets:
    - name: dockerhub-creds             # must exist in the namespace

# --- 3. Public hosts of the core (DNS → this cluster) ------------------------
ingress:
  provider: traefik                     # or nginx - must match the controller
  className: traefik
  hosts:
    main: benchgen.example.com
    minio: benchgen-minio.example.com
    litellmAgentspace: ""               # optional compat host, empty = off

# --- 4. Everything else derives from the hosts above (0.5.23+) ---------------
# DOMAIN_NAME, CSRF_TRUSTED_ORIGINS, ALLOWED_HOSTS, GRAFANA_ROOT_URL,
# PREFECT_UI_API_URL, S3/MinIO endpoints and litellm.proxyBaseURL are derived
# from ingress.hosts - set them in config only to override.
config:
  TLS_EMAIL: admin@example.com
  # In-cluster Ray (below). For a remote GPU server use its https URLs.
  RAY_URL: http://ray:8265
  RAY_MODEL_API: http://ray:8080

# --- 5. Ray + vLLM on a GPU node ---------------------------------------------
# Node prereqs: NVIDIA driver + container toolkit + device plugin and the
# nvidia.com/gpu.present=true label. Disable and point RAY_URL/RAY_MODEL_API
# at a remote GPU server if this cluster has no GPU.
ray:
  enabled: true
  runtimeClassName: nvidia    # k3s + NVIDIA toolkit: required, else no GPU
  gpuCount: 1
  rayResources:
    default_gpu: 1            # custom Ray resource the flows target

# ============================================================================
# Agentspace bundle - required part of the platform. The full service blocks
# (deployments, probes, volumes) live in the chart defaults; this file only
# enables each service and sets the per-environment inputs.
# NOTE: Helm replaces lists wholesale - to override anything inside a
# service's env/containers/volumes, copy that whole list from values.yaml.
# ============================================================================

# Shared inputs - rendered into the benchgen-agentspace-common secret that
# every agentspace service consumes via envFrom (explicit env entries win).
agentspace:
  enabled: true
  hosts:
    chatui: chat.example.com
    nodered: aibot.example.com
    uboschat: support.example.com
    uiEditor: editor.example.com
    hostAgent: host-agent.example.com
    externalTool: tools.example.com
    onboarding: welcome.example.com
  # The one agentspace admin identity - hooks and the common secret read it.
  admin:
    email: admin@example.com
    password: CHANGE-ME
  keycloak:
    host: auth.example.com
    realm: MyRealm
    clientId: my-client
    clientSecret: CHANGE-ME
  mainUrl: platform.example.com
  hostenv: QA
  # Backing DBs of the bundle - single definition; the DB pods and all their
  # clients get these credentials from the common secret. Hosts are derived
  # from the agentPostgres/agentMongo services automatically.
  chatuiDb:
    name: chatui
    user: admin
    password: CHANGE-ME
  aibotDb:
    name: aibot
    user: admin
    password: CHANGE-ME

# --- Agentspace services: enable flags + per-env credentials ------------------
uboschat:            # Chatwoot support chat
  enabled: true
  # app_token is consumed by the common secret (chatwoot_token).
  admin:
    email: admin@example.com
    name: Admin
    password: CHANGE-ME
    account_name: My Account
    app_token: CHANGE-ME

vectordb:            # Chroma vector store
  enabled: true

agentPostgres:       # PostgreSQL for the chat UI
  enabled: true

agentMongo:          # MongoDB for the AI-bot agent
  enabled: true

agentNodered:        # Node-RED AI-bot agent
  enabled: true
  # The admin-init hook creates the agentspace admin (from agentspace.admin)
  # and this client account.
  adminInit:
    client:
      email: client@example.com
      password: CHANGE-ME

hostAgent:           # Bot API host agent
  enabled: true

externalTool:        # External tools service
  enabled: true

chatui:              # Chat UI (open-webui)
  enabled: true

uiEditor:            # Agent UI editor (backend + NGINX frontend)
  enabled: true

onboarding:          # Agentspace landing page
  enabled: true

Get started

Agents

Eval

Train

Deploy Benchgen Platform

`secrets` - platform credentials

`global.imagePullSecrets` - registry access

`ingress` - public hosts of the core

`config` - public URLs (derived since 0.5.23)

`ray` - GPU inference

`agentspace` - shared inputs for the agent bundle

Agentspace services - enable flags and per-env credentials

Admin-init hooks

Advanced overrides

Complete values template

​secrets - platform credentials

​global.imagePullSecrets - registry access

​ingress - public hosts of the core

​config - public URLs (derived since 0.5.23)

​ray - GPU inference

​agentspace - shared inputs for the agent bundle

​Agentspace services - enable flags and per-env credentials

​Admin-init hooks

​Advanced overrides

​Complete values template

`secrets` - platform credentials

`global.imagePullSecrets` - registry access

`ingress` - public hosts of the core

`config` - public URLs (derived since 0.5.23)

`ray` - GPU inference

`agentspace` - shared inputs for the agent bundle

Agentspace services - enable flags and per-env credentials

Admin-init hooks

Advanced overrides

Complete values template