> ## Documentation Index
> Fetch the complete documentation index at: https://benchgen.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Helm values reference

> Every parameter you need to set to run the BenchGen Helm chart.

The chart's `values.yaml` carries complete defaults for all workloads, so a deployment values file only sets what is environment-specific. This page lists those parameters in the order they appear in `values-minimal.yaml` - the template to copy for a new environment.

<Note>
  Helm merges maps but **replaces lists wholesale**. To override anything inside a service's `env`, `containers`, or `volumes` lists, copy the whole list from the chart's `values.yaml` into your values file and edit it there.
</Note>

***

## `secrets` - platform credentials

Every key is required. Generate strong random values for a new environment.

```yaml theme={null}
secrets:
  SECRET_KEY: "CHANGE-ME"
  DB_PASSWORD: "CHANGE-ME"
  RABBITMQ_DEFAULT_PASS: "CHANGE-ME"
  NODERED_PASSWORD: "CHANGE-ME"
  LITELLM_MASTER_KEY: "sk-CHANGE-ME"
  LITELLM_SALT_KEY: "CHANGE-ME"
  UI_PASSWORD: "sk-CHANGE-ME"
  RAY_PASSWORD: "CHANGE-ME"
  GENERIC_LOGGER_HEADERS: "Authorization=Bearer CHANGE-ME"
  GRAFANA_ADMIN_PASSWORD: "CHANGE-ME"
  FLOWER_BASIC_AUTH: "root:CHANGE-ME"
  PREFECT_API_AUTH_STRING: "admin:CHANGE-ME"
  MINIO_ACCESS_KEY: "CHANGE-ME"
  MINIO_SECRET_KEY: "CHANGE-ME"
  SUPERADMIN_PASSWORD: "CHANGE-ME"
  ADMIN_SECRET_PATH: "CHANGE-ME"
  EXTERNAL_API_TOKEN: ""
```

| Key                                     | Used by                                                                                           |
| --------------------------------------- | ------------------------------------------------------------------------------------------------- |
| `SECRET_KEY`                            | Django signing key                                                                                |
| `DB_PASSWORD`                           | Shared PostgreSQL (also Chatwoot's database)                                                      |
| `RABBITMQ_DEFAULT_PASS`                 | RabbitMQ broker                                                                                   |
| `NODERED_PASSWORD`                      | Node-RED basic auth; fans out to the agentspace services as the fine-tuning/platform API password |
| `LITELLM_MASTER_KEY`                    | LiteLLM master key (`sk-…`); fans out as `LITELLM_TOKEN` to every agentspace service              |
| `LITELLM_SALT_KEY`                      | LiteLLM credential encryption - never rotate after models are added                               |
| `UI_PASSWORD`                           | LiteLLM admin UI login                                                                            |
| `RAY_PASSWORD`                          | Basic auth for the (remote) Ray dashboard ingress                                                 |
| `GENERIC_LOGGER_HEADERS`                | Auth header LiteLLM sends to the usage-logging webhook                                            |
| `GRAFANA_ADMIN_PASSWORD`                | Grafana `admin` user                                                                              |
| `FLOWER_BASIC_AUTH`                     | Celery Flower dashboard (`user:password`)                                                         |
| `PREFECT_API_AUTH_STRING`               | Prefect server/UI basic auth (`user:password`)                                                    |
| `MINIO_ACCESS_KEY` / `MINIO_SECRET_KEY` | MinIO root credentials                                                                            |
| `SUPERADMIN_PASSWORD`                   | BenchGen `superadmin` account; fans out as the platform password for agentspace                   |
| `ADMIN_SECRET_PATH`                     | URL path segment of the Django admin panel                                                        |
| `EXTERNAL_API_TOKEN`                    | Token for external API integrations; empty if unused                                              |

***

## `global.imagePullSecrets` - registry access

```yaml theme={null}
global:
  imagePullSecrets:
    - name: dockerhub-creds
```

The secret must exist in the namespace before installing. The agentspace workloads reference the same secret name from the chart defaults, so keep it `dockerhub-creds` unless you also override their `extraImagePullSecrets`.

***

## `ingress` - public hosts of the core

```yaml theme={null}
ingress:
  provider: traefik          # or nginx - must match the installed controller
  className: traefik
  hosts:
    main: benchgen.example.com
    minio: benchgen-minio.example.com
    litellmAgentspace: ""    # optional compatibility host, empty = off
```

| Key                       | Description                                                                                                  |
| ------------------------- | ------------------------------------------------------------------------------------------------------------ |
| `provider` / `className`  | `traefik` or `nginx`; controls which annotations and middlewares are rendered                                |
| `hosts.main`              | The platform UI and API. Grafana, Prefect, LiteLLM, and Node-RED are served under `/services/*` on this host |
| `hosts.minio`             | S3 endpoint for datasets and submissions                                                                     |
| `hosts.litellmAgentspace` | Optional extra host serving LiteLLM at the root path (legacy compatibility); leave empty to disable          |

TLS is issued per host by cert-manager using the `letsencrypt-prod` ClusterIssuer (`ingress.tls.clusterIssuer` to override).

***

## `config` - public URLs (derived since 0.5.23)

Every public URL derives from `ingress.hosts` automatically - `DOMAIN_NAME`, `CSRF_TRUSTED_ORIGINS`, `ALLOWED_HOSTS`, `GRAFANA_ROOT_URL`, `PREFECT_UI_API_URL`, the S3/MinIO endpoints, and `litellm.proxyBaseURL`. You only set what cannot be derived:

```yaml theme={null}
config:
  TLS_EMAIL: admin@example.com          # Let's Encrypt registration e-mail
  RAY_URL: http://ray:8265              # Ray dashboard/jobs API
  RAY_MODEL_API: http://ray:8080        # Ray Serve (model endpoints)
```

| Key             | Description                                                                   |
| --------------- | ----------------------------------------------------------------------------- |
| `TLS_EMAIL`     | E-mail used for the Let's Encrypt account                                     |
| `RAY_URL`       | In-cluster Ray: `http://ray:8265`. Remote GPU server: its https dashboard URL |
| `RAY_MODEL_API` | In-cluster Ray: `http://ray:8080`. Remote GPU server: its https serve URL     |

Any explicitly set `config.*` value still wins over the derived one. `UBOS_BASE_URL`, `UBOS_ALLOWED_BASE_URLS`, and `GENERIC_LOGGER_ENDPOINT` derive from `agentspace.hosts` the same way.

***

## `ray` - GPU inference

Run Ray + vLLM inside the cluster on a GPU node (set the internal `RAY_URL` / `RAY_MODEL_API` shown above), or keep `enabled: false` and point those URLs at a remote GPU server.

```yaml theme={null}
ray:
  enabled: true
  runtimeClassName: nvidia     # k3s + NVIDIA toolkit: REQUIRED, else no GPU
  gpuCount: 1
  gpuResourceKey: nvidia.com/gpu
  nodeSelector:
    nvidia.com/gpu.present: "true"
  rayResources:
    default_gpu: 1             # custom Ray resource the flows target
  shmSize: 4Gi
```

| Key                | Description                                                                                                                                                            |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `runtimeClassName` | Container runtime class for the Ray pods. On k3s the NVIDIA toolkit registers as a non-default RuntimeClass - without `nvidia` the pod runs under runc and sees no GPU |
| `rayResources`     | Custom Ray resources the head advertises (`ray start --resources`). The platform flows schedule model deployments against `default_gpu`                                |
| `extraEnv`         | Extra env vars (k8s `EnvVar` list) for the Ray head and worker containers                                                                                              |
| `worker.groups`    | Optional worker groups - one Deployment per group, each joining the head with its own `nodeSelector`, `gpuCount`, and `rayResources`. Use one group per extra GPU node |

GPU node prerequisites: NVIDIA driver + container toolkit + device plugin (so the node advertises `nvidia.com/gpu`), and the `nvidia.com/gpu.present=true` node label.

Adding a worker on a second GPU node:

```yaml theme={null}
ray:
  worker:
    enabled: true
    groups:
      - name: node2
        replicas: 1
        gpuCount: 1
        nodeSelector:
          kubernetes.io/hostname: <gpu-node-2>
        rayResources:
          gpu_node2: 1
```

***

## `agentspace` - shared inputs for the agent bundle

Single source for everything the ten agentspace services share. The chart renders it into the `benchgen-agentspace-common` secret, which every service consumes via `envFrom` - hostnames, the admin identity, Keycloak client, LiteLLM URL/token, and the backing database credentials all live here once.

```yaml theme={null}
agentspace:
  enabled: true
  hosts:
    chatui: chat.example.com
    nodered: aibot.example.com
    uboschat: support.example.com
    uiEditor: editor.example.com
    hostAgent: host-agent.example.com
    externalTool: tools.example.com
    onboarding: welcome.example.com
  admin:
    email: admin@example.com
    password: CHANGE-ME
  keycloak:
    host: auth.example.com
    realm: MyRealm
    clientId: my-client
    clientSecret: CHANGE-ME
  mainUrl: platform.example.com
  hostenv: QA
  chatuiDb:
    name: chatui
    user: admin
    password: CHANGE-ME
  aibotDb:
    name: aibot
    user: admin
    password: CHANGE-ME
```

| Key                              | Description                                                                                                                                                                                        |
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hosts.*`                        | Public hostname of each agentspace service. Drives the rendered ingresses, the `*_URL` environment variables, and the UI Editor's NGINX config. DNS for every host must point at the cluster       |
| `admin.email` / `admin.password` | The one agentspace admin identity - used as the chat UI's first (admin) user, the AI-bot's chat login, and the default credentials for both admin-init hooks                                       |
| `keycloak.*`                     | OAuth/OIDC client for single sign-on across the bundle                                                                                                                                             |
| `mainUrl`                        | UBOS platform host the agent flows link back to                                                                                                                                                    |
| `hostenv`                        | Environment label passed to the services (for example `QA`, `PROD`)                                                                                                                                |
| `chatuiDb.*`                     | Chat UI's PostgreSQL database name/user/password. The database host is derived from the `agentPostgres` service automatically; the pod and every client get the credentials from the common secret |
| `aibotDb.*`                      | AI-bot's MongoDB database name/user/password. Host derived from `agentMongo` the same way                                                                                                          |

<Tip>
  Changing a `chatuiDb` / `aibotDb` password in this block updates the database pod **and** all of its clients consistently on the next upgrade.
</Tip>

***

## Agentspace services - enable flags and per-env credentials

The full deployment spec of each service (images, probes, volumes, resource names) lives in the chart defaults. A values file only enables them and sets credentials where a service has its own:

```yaml theme={null}
uboschat:            # Chatwoot support chat
  enabled: true
  admin:
    email: admin@example.com
    name: Admin
    password: CHANGE-ME
    account_name: My Account
    app_token: CHANGE-ME

vectordb:            # Chroma vector store
  enabled: true

agentPostgres:       # PostgreSQL for the chat UI
  enabled: true

agentMongo:          # MongoDB for the AI-bot agent
  enabled: true

agentNodered:        # Node-RED AI-bot agent
  enabled: true
  adminInit:
    client:
      email: client@example.com
      password: CHANGE-ME

hostAgent:           # Bot API host agent
  enabled: true

externalTool:        # External tools service
  enabled: true

chatui:              # Chat UI (open-webui)
  enabled: true

uiEditor:            # Agent UI editor (backend + NGINX frontend)
  enabled: true

onboarding:          # Agentspace landing page
  enabled: true
```

| Key                               | Description                                                                                                                                                         |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<service>.enabled`               | All ten services are required parts of the platform - enable them all                                                                                               |
| `uboschat.admin.*`                | Chatwoot admin account seeded on install; `app_token` is fanned out to the agent services as `chatwoot_token`                                                       |
| `agentNodered.adminInit.client.*` | The client account created by the `job-aibot-admin-init` hook (used to sign in to the agentspace admin UI). The admin account itself defaults to `agentspace.admin` |

### Admin-init hooks

Both bootstrap hooks are enabled in the chart defaults and read their credentials from `agentspace.admin`:

| Hook                     | What it does                                                                                                                                                       | Extra values                                                                                                 |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------ |
| `chatui.adminInit`       | Creates the chat UI admin, opens self-registration, sets the default role to `user`, grants default workspace permissions, and registers the AI-bot API connection | `enableSignup`, `defaultUserRole`, `defaultPermissions`, `connections` - preconfigured in the chart defaults |
| `agentNodered.adminInit` | Creates the agentspace admin and the client account through the AI-bot API, then verifies login                                                                    | `client.*` - see above                                                                                       |

***

## Advanced overrides

Everything below has working defaults; override only when needed.

| Key                               | Default                         | Description                                                                                                             |
| --------------------------------- | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `computeWorker.hostDirectory`     | `/var/codabench`                | Shared submission directory inside the Docker-in-Docker sidecar. Must not live under `/tmp`                             |
| `computeWorker.submissionNetwork` | `llm-benchmarking-base_default` | Docker network pre-created for submission containers                                                                    |
| `litellm.detailedDebug`           | `false`                         | Verbose LiteLLM logging (degrades performance)                                                                          |
| `config.SECURE_SSL_REDIRECT`      | `False`                         | Keep `False` - the HTTPS redirect is handled at the ingress; Django redirecting in-cluster callers breaks Prefect flows |
| `monitoring.*`                    | enabled                         | Grafana, Loki, and Promtail toggles and sizes                                                                           |
| `image.*`                         | chart defaults                  | Repository/tag/pull policy per core component                                                                           |
| `<service>.releasePrefix`         | chart defaults                  | Resource-name prefix of each agentspace service. **Do not change** - agent flows reference these DNS names internally   |

***

## Complete values template

Copy this file, replace every `CHANGE-ME` and `example.com` hostname with your real values, and install with `-f my-values.yaml`. Everything not set here falls back to the chart defaults.

```yaml my-values.yaml [expandable] theme={null}
# ============================================================================
# BenchGen platform - deployment values.
# The platform = core + the agentspace bundle (all of it required). Only Ray
# is optional and may live on a separate GPU server (see the RAY_* keys).
# Everything not set here falls back to the chart defaults in values.yaml.
#
#   helm upgrade --install benchgen ./benchgen-<version>.tgz \
#     -n <namespace> --create-namespace -f my-values.yaml
#
# Cluster prereqs: ingress controller (nginx or traefik), cert-manager
# ClusterIssuer `letsencrypt-prod`, pull secret `dockerhub-creds`,
# DNS of every host below pointing at this cluster.
# ============================================================================

# --- 1. Secrets: every value is required, replace them all -------------------
secrets:
  SECRET_KEY: "CHANGE-ME"               # django
  DB_PASSWORD: "CHANGE-ME"              # shared postgres (also chatwoot's DB)
  RABBITMQ_DEFAULT_PASS: "CHANGE-ME"
  NODERED_PASSWORD: "CHANGE-ME"
  LITELLM_MASTER_KEY: "sk-CHANGE-ME"
  LITELLM_SALT_KEY: "CHANGE-ME"         # never rotate after models are added
  UI_PASSWORD: "sk-CHANGE-ME"           # litellm UI
  RAY_PASSWORD: "CHANGE-ME"             # basic auth of the (remote) ray ingress
  GENERIC_LOGGER_HEADERS: "Authorization=Bearer CHANGE-ME"
  GRAFANA_ADMIN_PASSWORD: "CHANGE-ME"
  FLOWER_BASIC_AUTH: "root:CHANGE-ME"
  PREFECT_API_AUTH_STRING: "admin:CHANGE-ME"
  MINIO_ACCESS_KEY: "CHANGE-ME"
  MINIO_SECRET_KEY: "CHANGE-ME"
  SUPERADMIN_PASSWORD: "CHANGE-ME"
  ADMIN_SECRET_PATH: "CHANGE-ME"        # URL path of the django admin panel
  EXTERNAL_API_TOKEN: ""                # blank if unused

# --- 2. Pull secret for the private images -----------------------------------
global:
  imagePullSecrets:
    - name: dockerhub-creds             # must exist in the namespace

# --- 3. Public hosts of the core (DNS → this cluster) ------------------------
ingress:
  provider: traefik                     # or nginx - must match the controller
  className: traefik
  hosts:
    main: benchgen.example.com
    minio: benchgen-minio.example.com
    litellmAgentspace: ""               # optional compat host, empty = off

# --- 4. Everything else derives from the hosts above (0.5.23+) ---------------
# DOMAIN_NAME, CSRF_TRUSTED_ORIGINS, ALLOWED_HOSTS, GRAFANA_ROOT_URL,
# PREFECT_UI_API_URL, S3/MinIO endpoints and litellm.proxyBaseURL are derived
# from ingress.hosts - set them in config only to override.
config:
  TLS_EMAIL: admin@example.com
  # In-cluster Ray (below). For a remote GPU server use its https URLs.
  RAY_URL: http://ray:8265
  RAY_MODEL_API: http://ray:8080

# --- 5. Ray + vLLM on a GPU node ---------------------------------------------
# Node prereqs: NVIDIA driver + container toolkit + device plugin and the
# nvidia.com/gpu.present=true label. Disable and point RAY_URL/RAY_MODEL_API
# at a remote GPU server if this cluster has no GPU.
ray:
  enabled: true
  runtimeClassName: nvidia    # k3s + NVIDIA toolkit: required, else no GPU
  gpuCount: 1
  rayResources:
    default_gpu: 1            # custom Ray resource the flows target

# ============================================================================
# Agentspace bundle - required part of the platform. The full service blocks
# (deployments, probes, volumes) live in the chart defaults; this file only
# enables each service and sets the per-environment inputs.
# NOTE: Helm replaces lists wholesale - to override anything inside a
# service's env/containers/volumes, copy that whole list from values.yaml.
# ============================================================================

# Shared inputs - rendered into the benchgen-agentspace-common secret that
# every agentspace service consumes via envFrom (explicit env entries win).
agentspace:
  enabled: true
  hosts:
    chatui: chat.example.com
    nodered: aibot.example.com
    uboschat: support.example.com
    uiEditor: editor.example.com
    hostAgent: host-agent.example.com
    externalTool: tools.example.com
    onboarding: welcome.example.com
  # The one agentspace admin identity - hooks and the common secret read it.
  admin:
    email: admin@example.com
    password: CHANGE-ME
  keycloak:
    host: auth.example.com
    realm: MyRealm
    clientId: my-client
    clientSecret: CHANGE-ME
  mainUrl: platform.example.com
  hostenv: QA
  # Backing DBs of the bundle - single definition; the DB pods and all their
  # clients get these credentials from the common secret. Hosts are derived
  # from the agentPostgres/agentMongo services automatically.
  chatuiDb:
    name: chatui
    user: admin
    password: CHANGE-ME
  aibotDb:
    name: aibot
    user: admin
    password: CHANGE-ME

# --- Agentspace services: enable flags + per-env credentials ------------------
uboschat:            # Chatwoot support chat
  enabled: true
  # app_token is consumed by the common secret (chatwoot_token).
  admin:
    email: admin@example.com
    name: Admin
    password: CHANGE-ME
    account_name: My Account
    app_token: CHANGE-ME

vectordb:            # Chroma vector store
  enabled: true

agentPostgres:       # PostgreSQL for the chat UI
  enabled: true

agentMongo:          # MongoDB for the AI-bot agent
  enabled: true

agentNodered:        # Node-RED AI-bot agent
  enabled: true
  # The admin-init hook creates the agentspace admin (from agentspace.admin)
  # and this client account.
  adminInit:
    client:
      email: client@example.com
      password: CHANGE-ME

hostAgent:           # Bot API host agent
  enabled: true

externalTool:        # External tools service
  enabled: true

chatui:              # Chat UI (open-webui)
  enabled: true

uiEditor:            # Agent UI editor (backend + NGINX frontend)
  enabled: true

onboarding:          # Agentspace landing page
  enabled: true
```