values.yaml

# nameOverride:
# fullnameOverride:

config:
  licenseKey: "EXPIRED-LICENSE-KEY-TRIAL"
  # licenseKeySecretName is the name of the secret where the Retool license key is stored (can be used instead of licenseKey)
  # licenseKeySecretName:
  # licenseKeySecretKey is the key in the k8s secret, default: license-key
  # licenseKeySecretKey:
  useInsecureCookies: false
  # Timeout for queries, in ms.
  # dbConnectorTimeout: 120000
  # max postgres pool connections for backend
  postgresPoolMaxSize: 10
  auth:
    google:
      # whether to populate CLIENT_ID and CLIENT_SECRET env vars (default: true for backwards compatibility)
      enabled: true
      clientId:
      clientSecret:
      # clientSecretSecretName is the name of the secret where the google client secret is stored (can be used instead of clientSecret)
      # clientSecretSecretName:
      # clientSecretSecretKey is the key in the k8s secret, default: google-client-secret
      # clientSecretSecretKey:
  encryptionKey:
  # encryptionKeySecretName is the name of the secret where the encryption key is stored (can be used instead of encryptionKey)
  # encryptionKeySecretName:
  # encryptionKeySecretKey is the key in the k8s secret, default: encryption-key
  # encryptionKeySecretKey:
  jwtSecret:
  # jwtSecretSecretName is the name of the secret where the jwt secret is stored (can be used instead of jwtSecret)
  # jwtSecretSecretName:
  # jwtSecretSecretKey is the key in the k8s secret, default: jwt-secret
  # jwtSecretSecretKey:

  # IMPORTANT: Incompatible with postgresql subchart
  # Please disable the subchart in order to use a managed or external postgres instance.
  postgresql:
    {}
    # Specify if postgresql subchart is disabled
    # host:
    # port:
    # db:
    # user:
    # password:
    # ssl_enabled: whether to enable SSL for connecting to the Retool Postgres database, equivalent to the POSTGRES_SSL_ENABLED environment variable. Place here instead of in the env block.
    # passwordSecretName is the name of the secret where the pg password is stored (can be used instead of password)
    # passwordSecretName:
    # passwordSecretKey is the key in the k8s secret, default: postgresql-password
    # passwordSecretKey:

image:
  repository: "tryretool/backend"
  # You need to pick a specific tag here, this chart will not make a decision for you
  tag: ""
  pullPolicy: "IfNotPresent"

commandline:
  args: []

env: {}

# Optionally specify additional environment variables to be populated from Kubernetes secrets.
# Useful for passing in SCIM_AUTH_TOKEN or other secret environment variables from Kubernetes secrets.
environmentSecrets:
  []
  # - name: SCIM_AUTH_TOKEN
  #   secretKeyRef:
  #     name: retool-scim-auth-token
  #     key: auth-token
  # - name: GITHUB_APP_PRIVATE_KEY
  #   secretKeyRef:
  #     name: retool-github-app-private-key
  #     key: private-key

# Optionally specify environmental variables. Useful for variables that are not key-value, as env: {} above requires.
# Can also include environment secrets here instead of in environmentSecrets
environmentVariables:
  []
  #   - name: SCIM_AUTH_TOKEN
  #     valueFrom:
  #       secretKeyRef:
  #         name: retool-scim-auth-token
  #         key: auth-token
  #   - name: GITHUB_APP_PRIVATE_KEY
  #     valueFrom:
  #       secretKeyRef:
  #         name: retool-github-app-private-key
  #         key: private-key
  #   - name: POD_HOST_IP
  #     valueFrom:
  #       fieldRef:
  #         fieldPath: status.hostIP

# Enables support for the legacy external secrets (enabled) and the modern External Secrets Operator (externalSecretsOperator.enabled).
# These are mutually exclusive as both enable reading in environments variables via External Secrets.
externalSecrets:
  # Support for legacy external secrets, note this is deprecated in favour of External Secrets Operator: https://github.com/godaddy/kubernetes-external-secrets
  # This mode only allows a single secret name to be provided.
  enabled: false
  # If external secrets are currently enabled, it is disallowed to specify regular configuration secrets as a safeguard from clobbering.
  # This flag allows bypassing that check and specifying both an ExternalSecret and a regular secret for different secrets.
  includeConfigSecrets: false
  name: retool-config
  # Array of secrets to be use as env variables. (Optional)
  secrets:
    []
    # - name: retool-config
    # - name: retool-db
  # Support for External Secrets Operator: https://github.com/external-secrets/external-secrets
  externalSecretsOperator:
    enabled: false

    # RefreshInterval is the amount of time before the values reading again from the SecretStore provider
    # Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h" (from time.ParseDuration)
    # May be set to zero to fetch and create it once
    refreshInterval: "1m"

    # SecretStoreRef defines the default SecretStore to use when fetching the secret data.
    secretStoreRef:
      name: aws-secretsmanager
      kind: SecretStore  # or ClusterSecretStore

    # Array of options to use for the ExternalSecret objects and their
    # corresponding secretRef in pod envFrom.
    #
    # Example with only required fields:
    #
    #   secretRef:
    #     - name: retool-config
    #       path: global-retool-config
    #
    # Example with all optional fields:
    #
    #   secretRef
    #     - name: extra-secrets
    #       path: global-extra-secrets
    #       creationPolicy: Owner
    #       deletionPolicy: Retain
    #       optional: true
    #
    secretRef: []

    # When true, uses kubernetes-client CRDs and not external-secrets CRDs
    # Defaults to true
    useLegacyCR: true
    # Legacy External Secrets Backend Types: https://github.com/external-secrets/kubernetes-external-secrets
    # Default set to AWS Secrets Manager.
    backendType: secretsManager

files: {}

deployment:
  labels: {}
  annotations: {}

service:
  type: ClusterIP
  externalPort: 3000
  internalPort: 3000
  # externalIPs:
  # - 192.168.0.1
  #
  ## LoadBalancer IP if service.type is LoadBalancer
  # loadBalancerIP: 10.2.2.2
  annotations: {}
  labels: {}
  ## Limit load balancer source ips to list of CIDRs (where available)
  # loadBalancerSourceRanges: []
  selector: {}
  # portName: service-port

ingress:
  enabled: true
  # For k8s 1.18+
  # ingressClassName:
  labels: {}
  annotations: {}
  # kubernetes.io/ingress.class: nginx
  # kubernetes.io/tls-acme: "true"
  hosts:
  # - host: retool.example.com
  #   paths:
  #     - path: /
  tls:
  # - secretName: retool.example.com
  #   hosts:
  #     - retool.example.com
  # servicePort: service-port
  pathType: ImplementationSpecific
  # For supporting other ingress controllers that require customizing the .backend.service.name and .backend.service.port.name,
  # like AWS ALB extraPaths allows that customization, and it takes precedence in the list of paths of for the host,
  # this is in order to allow a rule like ssl-redirect from port 80-->443 to be first ( otherwise there wouldn't be a redirect )
  #   extraPaths:
  #     - path: /*
  #       backend:
  #         service:
  #           name: ssl-redirect
  #           port:
  #             name: use-annotation
  #       pathType: ImplementationSpecific

# Gateway API HTTPRoute resource (alternative to ingress)
# Requires a Gateway API implementation (e.g., GKE Gateway Controller, Istio, Envoy Gateway, NGINX Gateway Fabric)
httpRoute:
  enabled: false
  labels: {}
  annotations: {}
  # parentRefs defines which Gateway(s) this route attaches to
  # parentRefs:
  #   - name: my-gateway
  #     namespace: default
  #     sectionName: https
  # hostnames:
  #   - retool.example.com
  # rules allows full customization of HTTPRoute rules; when omitted, a default
  # catch-all rule routes all traffic to the retool backend service
  # rules:
  #   - matches:
  #       - path:
  #           type: PathPrefix
  #           value: /
  #     backendRefs:
  #       - name: my-service
  #         port: 3000

postgresql:
  # We highly recommend you do NOT use this subchart as is to run Postgres in a container
  # for your production instance of Retool; it is a default. Please use a managed Postgres,
  # or self-host more permanently. Use enabled: false and set in config above to do so.
  enabled: true
  ssl_enabled: false
  auth:
    database: hammerhead_production
    username: postgres
    password: retool
    # IMPORTANT: When setting username to `postgres` a random password will be generated unless the postgresPassword field is uncommented
    # postgresPassword: retool
  service:
    port: 5432
  # Use the offical docker image rather than bitnami/docker
  # since Retool depends on the uuid-ossp extension
  image:
    repository: "postgres"
    tag: "13"
  postgresqlDataDir: "/data/pgdata"
  primary:
    persistence:
      enabled: true
      mountPath: "/data/"

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  # If set and create is false, the service account must be existing
  name:
  annotations: {}
  labels: {}
  automountToken: false

# NetworkPolicy applied to the main Retool backend pods. Enforced only by CNIs
# that implement egress NetworkPolicy (Cilium, Calico, AWS VPC CNI network-policy
# agent); a no-op on CNIs that don't.
networkPolicy:
  # Block egress to the cloud instance-metadata endpoint (169.254.169.254 -- AWS
  # IMDS, GCP metadata.google.internal, Azure IMDS) from the backend pods. They
  # execute user-defined resource requests and are the primary SSRF surface, so
  # this closes the SSRF -> metadata credential-theft vector. Allows all other
  # egress (only that one IP is denied).
  #
  # Tri-state:
  #   null (default) -> auto: ON when blob storage is keyless (no static
  #                     credential set), OFF otherwise.
  #   true / false   -> force on/off.
  #
  # Auto-ON is safe for TOKEN-FEDERATED identities (EKS IRSA, GKE Workload
  # Identity, Azure Workload Identity): they resolve credentials via a projected
  # token file + the provider STS/IAM endpoint, not the metadata service.
  #
  # But "no static credential" also covers METADATA-BASED identities that the
  # block breaks. Set this to false if blob storage authenticates via an EC2
  # instance profile, a GCE default service account, or an Azure IMDS-based
  # managed identity -- those read credentials from 169.254.169.254 and are
  # misdetected as keyless. Also set false if a data source connection relies on
  # the metadata endpoint (e.g. an IAM-role connection using the instance profile).
  # Defense in depth -- pair with IMDS hop-limit=1 at the node level and the
  # application-layer SSRF filter.
  blockCloudMetadataEgress: null
  # Additional CIDRs to deny in backend egress (beyond the metadata IP). e.g.
  # private ranges you don't want reachable from user-defined requests.
  blockedRanges: []
  # IPv6 CIDRs to deny. Empty leaves IPv6 egress fully allowed (metadata is IPv4).
  blockedRanges6: []

livenessProbe:
  enabled: true
  path: /api/checkHealth
  # host and scheme are optional. On IPv6-primary or dual-stack clusters, set
  # host to 127.0.0.1 so the kubelet probes the IPv4 loopback. Some services
  # (e.g. code-executor) listen on IPv4 only, so probing the Pod's IPv6 address
  # fails with "connection refused" and the pod CrashLoops. Leave unset for the
  # default behavior (the kubelet probes the Pod IP).
  # host: 127.0.0.1
  # scheme: HTTP
  initialDelaySeconds: 30
  timeoutSeconds: 10
  periodSeconds: 10
  failureThreshold: 3

readinessProbe:
  enabled: true
  path: /api/checkHealth
  # Optional; see livenessProbe above. Set host: 127.0.0.1 on IPv6/dual-stack clusters.
  # host: 127.0.0.1
  # scheme: HTTP
  initialDelaySeconds: 30
  timeoutSeconds: 10
  periodSeconds: 10
  successThreshold: 5

preStopHook:
  enabled: true

# To avoid increasing livenessProbe initialDelaySeconds the good practice is to use a startupProbe.
startupProbe:
  enabled: false
  path: /api/checkHealth
  # Optional; see livenessProbe above. Set host: 127.0.0.1 on IPv6/dual-stack clusters.
  # host: 127.0.0.1
  # scheme: HTTP
  initialDelaySeconds: 60
  timeoutSeconds: 10
  periodSeconds: 10
  successThreshold: 1

extraContainers: []

extraVolumeMounts: []

extraVolumes: []

# These resource specifications will apply to the main backend, jobs-runner, dbconnector, and workflows-backend pods unless container specific resources are set.
resources:
  # If you have more than 1 replica, the minimum recommended resources configuration is as follows:
  # - cpu: 2048m
  # - memory: 4096Mi
  # If you only have 1 replica, please double the above numbers.
  limits:
    cpu: 4096m
    memory: 8192Mi
  requests:
    cpu: 2048m
    memory: 4096Mi

priorityClassName: ""

# Affinity for pod assignment
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: "app.kubernetes.io/name"
                operator: In
                values:
                  - retool
          topologyKey: "kubernetes.io/hostname"

# Tolerations for pod assignment
# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
tolerations: []

# Node labels for pod assignment
# Ref: https://kubernetes.io/docs/user-guide/node-selection/
nodeSelector:
  kubernetes.io/arch: amd64

# Common annotations for all pods.
podAnnotations: {}

revisionHistoryLimit: 3

# Optional pod disruption budget, for ensuring higher availability of the
# Retool application.  Specify either minAvailable or maxUnavailable, as
# either an integer pod count (1) or a string percentage ("50%").
# Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
#
# Example:
# podDisruptionBudget:
#   maxUnavailable: 1

# Common labels for all pods (backend and job runner) for pod assignment
podLabels: {}

# Increasing replica count will deploy a separate pod for backend and jobs
# Example 1: with 1 replicas, you will end up with 1 combined backend and jobs pod (unless jobRunner.enabled is true, see below)
# Example 2: with 2 replicas, you will end up with 2 backends + 1 jobs pod
# Example 3: with 3 replicas, you will end up with 3 backends + 1 jobs pod
replicaCount: 2

jobRunner:
  # explicitly enable this pod if exactly 1 api backend container and
  # 1 jobs runner container is desired. otherwise a replicaCount of 2
  # will already launch a job runner pod
  # enabled: true

  # If necessary, specify the resources to provision the jobRunner pod separately from the main backend pods.
  resources:
    limits:
      cpu: 2000m
      memory: 4096Mi
    requests:
      cpu: 1000m
      memory: 2048Mi

  # Annotations for job runner pods
  annotations: {}

  # Labels for job runner pods
  labels: {}

backend:
  # Annotations for backend pods
  annotations: {}

  # Labels for backend pods
  labels: {}

  # Make backend pods wait the specified time before kubernetes will forcibly kill them when they need to be rescheduled
  # By default this is a 2 minutes + 15 seconds + 1 second (136) grace period to allow outstanding queries to complete
  # Change this to 10 minutes 15 seconds + 1 second (616) if you are using long-running queries with a 10 minute timeout
  terminationGracePeriodSeconds: 136

ui:
  # Annotations for ui pods
  annotations: {}

  # Labels for ui pods
  labels: {}

workflows:
  # enabled by default from Chart version 6.0.2 and Retool image 3.6.11 onwards
  # explicitly set other fields as needed

  # enabled: true

  # ADVANCED: The temporal cluster can be scaled separately in the subchart (charts/retool-temporal-services-helm/values.yaml)
  # If your needs require scaling temporal, reach out to us for guidance -- it is likely the bottleneck is DB or worker replicaCount
  worker:
    # A replicaCount of 1 will launch 6 pods -- 1 workflow backend, 1 workflow worker, and 4 pods that make up the executor temporal cluster
    # Scaling this number will increase the number of workflow workers, e.g. a replicaCount of 4
    # will launch 9 pods -- 1 workflow backend, 4 workflow workers, and 4 for temporal cluster
    replicaCount: 1
    # Override the connection pool size used by workflow workers when calling the dbconnector service
    postgresPoolMaxSize: 100

  backend:
    # A replicaCount of 1 will launch 6 pods -- 1 workflow backend, 1 workflow worker, and 4 pods that make up the executor temporal cluster
    # Scaling this number will increase the number of workflow backends, e.g. a replicaCount of 4
    # will launch 9 pods -- 4 workflow backend, 1 workflow workers, and 4 for temporal cluster
    replicaCount: 1
    # Override the connection pool size used by workflow backends when calling the dbconnector service
    postgresPoolMaxSize: 100

    # If necessary, specify the resources to provision the workflows-backend pod separately from the main backend pods.
    # resources:
    #   limits:
    #     cpu: 4096m
    #     memory: 8192Mi
    #   requests:
    #     cpu: 2048m
    #     memory: 4096Mi

  # Timeout for queries, in ms. This will set the timeout for workflows-related pods only
  # If this value is not set but config.dbConnectorTimeout is, we will set workflows pod timeouts
  # to .Values.config.dbConnectorTimeout
  # dbConnectorTimeout: 120000

  # Annotations for workflows worker and workflow backend pods
  annotations: {}

  # Labels for workflows worker and workflow backend pods
  labels: {}

  # Config for workflows worker pods. Node heap size limits can be overridden here
  # otelCollector can be set to an OpenTelemetry Collector in your k8s cluster. This will configure Temporal metrics collection which
  # provides observability into Workflows worker performance, particularly useful in high QPS use-cases
  # environmentVariables will only be set on the workflows worker
  # only change the CONCURRENT_*_LIMIT values if you have higher load usecases and deploy
  # code_executor. Otherwise, the worker may OOM if the Workflows blocks use too much memory.
  config: {}
  # config: {
  #   nodeOptions: --max_old_space_size=1024
  #   otelCollector: {
  #     enabled: true
  #     endpoint: http://$(HOST_IP):4317
  #   }
  #   environmentVariables: []
  #   - name: WORKFLOW_TEMPORAL_CONCURRENT_TASKS_LIMIT
  #     value: "100"
  #   - name: WORKFLOW_TEMPORAL_CONCURRENT_ACTIVITIES_LIMIT
  #     value: "100"
  # }

  # Resources for the workflow worker only - these are sane inputs that bias towards stability
  # Can adjust but may see OOM errors if memory too low for heavy workflow load
  # To make adjustments to workflows backend, use workflows.backend.resources key.
  resources:
    limits:
      cpu: 2000m
      memory: 8192Mi
    requests:
      cpu: 1000m
      memory: 2048Mi

# Config for optional standalone dbconnector deployment.
dbconnector:
  # By default (disabled), the main backend makes resource queries directly; if
  # enabled, only dbconnector pods will make resource queries on behalf of main
  # backend and workflow-backend pods.
  enabled: false

  java:
    # Disable this to disable Retool's Java dbconnector. Applies whether
    # dbconnector.enabled is true or false.
    enabled: true
    port: 3007

  # Desired pod count for dbconnector deployment.
  replicas: 1

  # (Optional) If set, make dbconnector pods wait the specified time before
  # kubernetes will forcibly kill them when they need to be rescheduled. Setting
  # this to a long duration will minimize disruption to any long-running
  # resource queries during updates, at the cost of making updates take longer.
  # terminationGracePeriodSeconds: 960

  # If necessary, specify the resources to provision the workflows-backend pod
  # separately from the main backend pods. If unspecified, uses the same
  # resources configured for main backend.
  # resources:
  #   limits:
  #     cpu: 4096m
  #     memory: 8192Mi
  #   requests:
  #     cpu: 2048m
  #     memory: 4096Mi

  config:
    nodeOptions: '--max_old_space_size=1024'
    postgresPoolMaxSize: 100
    httpAgentMaxSockets: 1000

  # Which port to listen on. Used for both Pods and Service for dbconnector.
  port: 3002

  # Extra annotations specific to standalone dbconnector pods.
  annotations: {}


multiplayer:
  # Enable this to use Retool's experimental multiplayer editing feature.
  # This feature is not ready for production use; please check with the Retool team before enablement.
  enabled: false

  replicaCount: 1

  # Resources for multiplayer pods
  resources:
    requests:
      cpu: "200m"
      memory: "256Mi"
    limits:
      memory: "2048Mi"

  # Set environment variables for multiplayer pods, e.g. defining which origin to use
  # environmentVariables:
  #   WEBSOCKET_ALLOWED_ORIGIN: "retool.foo.com"

  # Annotations for multiplayer pods
  annotations: {}

  # Labels for multiplayer pods
  labels: {}

  # Paths to route to multiplayer pods; defaults to /api/multiplayer. Can specify both path and port.
  ingress:
    # This conditional is dependent on multiplayer.enabled.
    enabled: true
    paths:
      - path: /api/multiplayer
        port: 80

  # HTTPRoute rules for multiplayer when using Gateway API instead of ingress
  httpRoute:
    # This conditional is dependent on multiplayer.enabled.
    enabled: true
    rules:
      - path: /api/multiplayer
        port: 80

  service:
    externalPort: 80
    internalPort: 3001
    annotations: {}
    labels: {}

# MCP enablement examples:
#
# Simplest: use the chart-managed OAuth introspection token. BASE_DOMAIN must
# be the public Retool origin already served by your ingress:
#
# env:
#   BASE_DOMAIN: https://retool.example.com
# mcp:
#   enabled: true
#
# With an explicit public host and an existing Kubernetes Secret:
#
# mcp:
#   enabled: true
#   config:
#     oauthMainDomain: retool.example.com
#     oauthIntrospectionAuthTokenSecretName: retool-mcp-oauth
#     oauthIntrospectionAuthTokenSecretKey: token
#
# The chart injects the token into both MCP and the backend. The MCP ingress
# routes below are enabled by default; reproduce their mapping when ingress is
# managed outside this chart.
mcp:
  # Set to true to deploy the MCP server.
  enabled: false

  replicaCount: 1

  annotations: {}

  labels: {}

  # Additional MCP environment variables, including valueFrom entries.
  # Use for settings not exposed under mcp.config.
  environmentVariables: []

  # MCP settings translated to environment variables. RETOOL_BACKEND_URL
  # defaults to http://<fullname>:<service.externalPort>. Other unset settings
  # use the MCP runtime defaults:
  #   maxTransportSessions: 1000
  #   sessionIdleTimeoutMs: 3600000 (1 hour)
  #   sessionSweepIntervalMs: 60000 (1 minute)
  #   sessionGaugeEmitIntervalMs: 30000 (30 seconds)
  config: {}
  # Example overrides:
  # config:
  #   # Internal URL used by the MCP server to call the Retool backend.
  #   # Defaults to the release's internal Retool service when unset.
  #   retoolBackendUrl:
  #
  #   # Optional override for MCP git-server API calls. When unset:
  #   #   - If rr.gitServer.separate.enabled is true, the chart automatically
  #   #     sets RETOOL_GIT_SERVER_URL to the split git-server Service URL.
  #   #   - If rr.gitServer.separate.enabled is false, MCP automatically uses
  #   #     retoolBackendUrl.
  #   retoolGitServerUrl:
  #
  #   # Public Retool origin for client-facing upload URLs when the request Host
  #   # header is insufficient. Do not include /mcp.
  #   mcpServiceExternalUrl:
  #
  #   # Deprecated alias for mcpServiceExternalUrl.
  #   retoolUrl:
  #
  #   # Public Retool host serving OAuth metadata and /api/oauth2/*. Defaults to
  #   # env.BASE_DOMAIN and is usually the Retool application host, not an
  #   # oauth.* subdomain. URL-shaped values are accepted with the scheme removed.
  #   oauthMainDomain:
  #
  #   # Secret containing the OAuth introspection token shared by MCP and the
  #   # backend. When chart-owned secrets are enabled, omitting this generates a
  #   # token. If the token is instead set through mcp.environmentVariables, set
  #   # the same backend value through top-level env, environmentVariables, or
  #   # environmentSecrets.
  #   oauthIntrospectionAuthTokenSecretName:
  #   oauthIntrospectionAuthTokenSecretKey: oauthIntrospectionAuthToken
  #
  #   # Literal token for development only; prefer the secret-backed setting.
  #   oauthIntrospectionAuthToken:
  #
  #   # Secret containing the private key used to sign agent sandbox requests.
  #   # Defaults to the rr.agentSandbox external Secret and jwt-private-key key.
  #   agentSandboxJwtPrivateKeySecretName:
  #   agentSandboxJwtPrivateKeySecretKey: jwt-private-key
  #
  #   # Literal private key for development only. Defaults to
  #   # rr.agentSandbox.jwtPrivateKey when the agent sandbox is enabled.
  #   agentSandboxJwtPrivateKey:
  #
  #   # Node.js options for the MCP server process.
  #   nodeOptions: --max_old_space_size=1024
  #
  #   # Restrict the enabled toolsets. All available toolsets are enabled when unset.
  #   enabledToolsets:
  #     - apps
  #     - resources
  #   # Maximum concurrent transport sessions.
  #   maxTransportSessions: 1000
  #   sessionIdleTimeoutMs: 1800000
  #   sessionSweepIntervalMs: 60000
  #   sessionGaugeEmitIntervalMs: 30000

  # MCP pod resources. The server does not horizontally scale yet, so its
  # default memory limit is higher than multiplayer's.
  resources:
    requests:
      cpu: "200m"
      memory: "256Mi"
    limits:
      memory: "4096Mi"

  # Backend API Service for the OAuth authorization-server metadata route.
  backendMetadata:
    service:
      enabled: true
      portName: http-api
      externalPort: 3001
      internalPort: 3001
      annotations: {}
      labels: {}

  # Retool 4.0.7 and later support a simplified ingress setup: route all public
  # paths, including /mcp and /.well-known, to the main Retool Service on port
  # 3000. The main backend must also be able to relay /mcp to the in-cluster MCP
  # Service. When mcp.enabled is true, the chart configures the backend with
  # MCP_SERVICE_INGRESS_DOMAIN=http://<fullname>-mcp:<service.externalPort>.
  # You can override it through the top-level env, environmentSecrets, or
  # environmentVariables settings.
  #
  # With that setting, omit or disable the MCP-specific ingress or HTTPRoute
  # rules below and keep only the normal "/" route to <fullname>:3000. Replace
  # <fullname> with this chart release's full name.
  #
  # Retool versions before 4.0.7 require the explicit MCP routes below,
  # rendered before the main Retool route. External ingress must preserve this
  # order and target mapping:
  #   Exact  /.well-known/oauth-authorization-server -> <fullname>-backend-internal:3001
  #   Exact  /.well-known/oauth-protected-resource    -> <fullname>-mcp:4010
  #   Prefix /mcp                                     -> <fullname>-mcp:4010
  #   Prefix /                                         -> <fullname>:3000
  ingress:
    # Also requires mcp.enabled.
    enabled: true
    paths:
      - path: /.well-known/oauth-authorization-server
        pathType: Exact
        target: backendInternal
      - path: /.well-known/oauth-protected-resource
        pathType: Exact
      - path: /mcp
        pathType: Prefix

  # Equivalent Gateway API routes.
  httpRoute:
    # Also requires mcp.enabled.
    enabled: true
    rules:
      - path: /.well-known/oauth-authorization-server
        pathType: Exact
        target: backendInternal
      - path: /.well-known/oauth-protected-resource
        pathType: Exact
      - path: /mcp

  service:
    externalPort: 4010
    internalPort: 4010
    annotations: {}
    labels: {}

codeExecutor:
  # Code executor normally tracks the top-level `image` parameters. Override the
  # tag only when you need a one-off or patched build (e.g. a support build whose
  # tag differs from the backend's); running a code executor version that does not
  # match the backend is not generally supported.

  image:
    repository: tryretool/code-executor-service
    # defaults to top level image.tag
    tag: null
    # pull policy will use the value set in the top-level image.pullPolicy

  replicaCount: 1

  # Annotations for code executor pods
  annotations: {}

  # Labels for code executor pods
  labels: {}

  # Config for code executor. Node heap size limits can be overridden here
  config: {}
  # config: {
  #   nodeOptions: --max_old_space_size=1024
  # }
  volumes: {}
  volumeMounts: {}

  # Config affinity and anti-affinity rules for the code executor pods
  affinity: {}

  # Resources for the code executor. Most common issues will be seen with CPU usage as this will
  # most likely be CPU bound. Adjust the CPU if latency increases under load.
  resources:
    limits:
      cpu: 2000m
      memory: 2048Mi
    requests:
      cpu: 1000m
      memory: 1024Mi

  # The code executor runs workflow code inside nsjail sandboxes, which require
  # elevated privileges to create. By default these are granted by running the
  # container as privileged (securityContext.privileged: true). Set
  # useSeccompProfile: true to instead grant only what nsjail needs, far more
  # granularly than the privileged flag: a slightly relaxed version of Docker's
  # default seccomp profile, the NET_ADMIN capability for network isolation, and an
  # unmasked /proc for process resource monitoring. This requires Kubernetes 1.33 or
  # higher (for the ProcMountType and UserNamespacesSupport feature gates) -- do not
  # enable it on older clusters. Pinning codeExecutor.securityContext overrides both
  # paths and is used verbatim.
  useSeccompProfile: false
  seccompLocalhostProfile: profiles/nsjail-seccomp.json

  # Deploy a DaemonSet that loads AppArmor profiles for nsjail on every node.
  # When enabled, the code-executor and js-executor annotations switch from
  # "unconfined" to "localhost/retool-executor", which satisfies Ubuntu 24.04+'s
  # kernel.apparmor_restrict_unprivileged_userns=1 restriction by providing an
  # explicit userns rule. Requires useSeccompProfile: true for code-executor to
  # take effect (js-executor always uses the seccomp/AppArmor path). The
  # DaemonSet itself renders whenever this is true and either workflows is
  # enabled (for code-executor) or rr.jsExecutor is enabled -- it is not tied
  # to workflows alone, since js-executor doesn't require workflows to run.
  appArmorProfileInstaller: false

# === RR (Retool agent runtime) =============================================
# Master switch for the whole RR stack. Set `rr.enabled: true` to turn on the
# components nested below — jsExecutor, agent, and agentSandbox — with a
# single line. Each component's own `enabled` (left null by default) inherits
# this switch; set a component's `enabled` to true/false to override the master
# for that component only. The gitServer and blobStorage blocks below
# provide the React Retool git server and the object storage the stack needs.
rr:
  enabled: false

  # JS Executor
  jsExecutor:
    # Inherits .Values.rr.enabled when left unset (null); set true/false to override.
    enabled: null

    image:
      repository: tryretool/js-executor-service
      # defaults to top level image.tag
      tag: null
      pullPolicy: IfNotPresent

    replicaCount: 1

    seccompLocalhostProfile: profiles/nsjail-seccomp.json

    # JS-executor-specific environment; not inherited from the top-level
    # .Values.env / .Values.environmentSecrets / .Values.environmentVariables.
    env: {}
    environmentSecrets: []
    environmentVariables: []

    # Annotations for JS executor pods
    annotations: {}

    # Labels for JS executor pods
    labels: {}

    volumes: {}
    volumeMounts: {}

    # Config affinity and anti-affinity rules for the JS executor pods
    affinity: {}

    # Resources for the JS executor. Memory request and limit are kept equal:
    # JSE reads its memory limit and rejects requests at 80% of it, so the
    # request must reserve the full amount to avoid premature rejections.
    resources:
      limits:
        cpu: '2'
        memory: 6Gi
      requests:
        cpu: '2'
        memory: 6Gi

  # RR Agent: server-side agent loop worker (independent from agents above).
  agent:
    # Inherits .Values.rr.enabled when left unset (null); set true/false to override.
    enabled: null

    # Labels for RR agent worker pods
    labels: {}

    # RR agent configuration
    config: {}

    # Annotations for RR agent worker pods
    annotations: {}

    # RR agent worker configuration
    worker:
      replicaCount: 1

      resources:
        limits:
          cpu: 2000m
          memory: 4096Mi
        requests:
          cpu: 1000m
          memory: 2048Mi

  # Agent Sandbox Service: sandboxed code execution for AI agents.
  # Deploys a controller (manages sandbox lifecycle), proxy (HTTP proxy for sandbox egress),
  # and ephemeral Job-based sandboxes. Uses Postgres for controller/proxy state.
  agentSandbox:
    # Inherits .Values.rr.enabled when left unset (null); set true/false to override.
    enabled: null

    image:
      repository: tryretool/agent-sandbox-service
      # defaults to top level image.tag
      tag: null
      pullPolicy: IfNotPresent

    # Lightweight init image used by the prepuller and seccomp DaemonSets.
    # Pinning by digest is recommended for production.
    initImage:
      repository: busybox
      tag: '1.37.0'
      # Manifest list digest — set to '' in test environments where images are
      # pre-loaded (containerd 2.0 can't resolve digest references for side-loaded images).
      digest: ''

    # DaemonSets set hostNetwork: true by default
    hostNetwork: true

    # Annotations for agent sandbox pods
    annotations: {}

    # Labels for agent sandbox pods
    labels: {}

    # === Secrets ============================================================
    # Provide each secret as a plaintext value below, OR set externalSecret.name
    # to a pre-existing Secret with keys jwt-public-key, jwt-private-key,
    # encryption-key, api-secret. A plaintext value always wins over the external
    # secret for that key. externalSecret.name covers ONLY these app secrets --
    # it does not source Postgres. To read a DSN from that same Secret, point
    # postgres.urlSecretName at it (see Postgres Option 3 below).
    externalSecret:
      name: ''                 # optional: existing Secret holding the keys below

    jwtPublicKey: ''           # REQUIRED (ES256) unless provided via externalSecret
    jwtPrivateKey: ''          # REQUIRED (ES256) unless provided via externalSecret
    encryptionKey: ''          # REQUIRED: 64 hex chars (openssl rand -hex 32, NOT base64). Proxy throws when serving a sandbox without it; must match the backend's AGENT_SANDBOX_ENCRYPTION_KEY. May instead be supplied via externalSecret.name (encryption-key entry).
    apiSecret: ''              # optional: admin/test endpoints

    # === Postgres state backend =============================================
    # By DEFAULT (all options below left blank) the agent sandbox reuses the
    # backend's Postgres connection from config.postgresql / the postgresql
    # subchart -- same instance and database, separate schema (see schema below).
    # So enabling it on an existing deployment needs nothing here. (Exception:
    # if the backend's DB password is supplied via external secrets / envFrom, it
    # can't be inherited by a separate pod -- set an option below in that case.)
    # To point the sandbox at a different database, set exactly ONE option:
    postgres:
      # -- Option 1: plaintext DSN --
      url: ''

      # -- Option 2: assemble from fields --
      # The password is passed via PGPASSWORD (never embedded in the URL), so any
      # characters are safe and a password-only secret can be reused as-is.
      # Set either password or passwordSecretName.
      # user/database are embedded in the DSN verbatim (user may contain '@', e.g.
      # Azure user@servername); for values with : / ? # use Option 1 or 3.
      host: ''
      port: 5432
      database: ''
      user: ''
      password: ''
      passwordSecretName: ''
      passwordSecretKey: 'password'

      # -- Option 3: DSN from an existing Secret --
      # Set urlSecretName (urlSecretKey defaults to postgres-url). To reuse the
      # Secret in rr.agentSandbox.externalSecret.name, just point urlSecretName at
      # it -- externalSecret.name itself never sources Postgres.
      # The DSN may omit the password; supply it separately via passwordSecretName
      # (above) so an auto-rotated password isn't duplicated into the DSN secret.
      urlSecretName: ''
      urlSecretKey: 'postgres-url'

      # If options 1-3 are ALL unset, the default (inherit config.postgresql)
      # applies -- see the note at the top of this block.

      # -- Optional tuning (defaults shown) --
      schema: 'agent_executor'
      poolMax: 10
      sweeperIntervalMs: 60000

    # Sandbox network access via pasta userspace networking.
    # When enabled, sandboxes get isolated outbound access with L7 filtering.
    sandboxNetwork:
      enabled: true
      # Request smarter-devices/net_tun via resources.limits on sandbox pods.
      # When true, the kubelet grants /dev/net/tun device cgroup access without
      # privileged mode. Requires smarter-device-manager to be running on each
      # node (see deployDaemonSet below).
      devicePlugin: true
      # Deploy the smarter-device-manager DaemonSet from this Helm release.
      # Set to false when another release (or external process) already manages
      # the DaemonSet — only one instance should run per node.
      deployDaemonSet: true
      # HTTP proxy for sandbox egress L7 filtering. Defaults to the in-cluster
      # agent-sandbox-proxy service URL when empty.
      httpProxy: ''

    # smarter-device-manager: registers /dev/net/tun with the kubelet so sandbox
    # pods can request it via resources.limits.
    devicePlugin:
      image:
        repository: ghcr.io/smarter-project/smarter-device-manager
        tag: v1.20.12
      # Number of /dev/net/tun device slots to register.
      # Set high enough to accommodate maxTotalJobs + prewarm pool.
      maxDevices: 130

      # When possible, we want the devicePlugin daemonset to preempt normal pods.
      # Note: in some cases this is inconvenient or unsupported, i.e. in GKE which
      # requires a custom ResourceQuota to use the `system-node-critical`
      # PriorityClass in user namespaces. In those cases, set this to `null`.
      priorityClassName: system-node-critical

    # Seccomp profile path relative to /var/lib/kubelet/seccomp/.
    # The seccomp node-installer DaemonSet copies the profile to this path
    # on every node automatically.
    seccompProfile: retool/gvisor-seccomp.json

    # Deploy an AppArmor profile for agent-sandbox pods. When enabled, the
    # node-installer DaemonSet loads a retool-agent-sandbox profile on every
    # node, and sandbox Jobs use it instead of Unconfined. Required on
    # Ubuntu 24.04+ hosts with kernel.apparmor_restrict_unprivileged_userns=1.
    appArmorProfileInstaller: false

    # S3-compatible snapshot storage.
    # When s3Bucket is set, snapshots are persisted to S3 and survive pod restarts.
    snapshotStorage:
      s3Bucket: ''
      s3Endpoint: ''
      s3Region: 'us-east-1'
      # Name of a K8s Secret containing keys awsAccessKeyId and awsSecretAccessKey.
      # If empty, falls back to the main agent sandbox secret.
      credentialsSecretName: ''

    # Sandbox (Job) configuration
    sandbox:
      port: 3017
      resources:
        requests:
          cpu: 1
          memory: 2Gi
        limits:
          cpu: '2'
          memory: 4Gi
      # Idle timeout (ms) before an unassigned sandbox self-terminates.
      sandboxIdleTimeoutMs: 600000
      # Hard ceiling (ms) on total sandbox lifetime, regardless of activity. When
      # reached, the sandbox is destroyed (deferred until the current agent loop
      # ends). Defaults to 2.5 hours.
      sandboxGlobalLifetimeMs: 9000000
      # Time (ms) the controller waits for a freshly-started sandbox to connect
      # before failing the request. Interactive sandbox boot (gVisor + bundle
      # load) can take ~20-25s; raise this (e.g. 45000) if you see "did not
      # connect within <n>ms" errors on cold starts.
      sandboxReadyTimeoutMs: 20000
      tmpDirSizeLimit: 20Gi
      # Separate limit for the rootfs-appjob volume — the sandbox root filesystem
      # is a static ~600MB extraction, so 2Gi provides headroom without the 20Gi
      # allocated for /tmp.
      rootfsSizeLimit: 2Gi
      # Additional environment variables for sandbox containers.
      extraEnv: []

      # Annotations applied to sandbox Job pods (the pods that run user code).
      # Two do-not-disrupt annotations are applied by default so sandbox pods
      # are protected from eviction on both Karpenter and cluster-autoscaler
      # clusters (GKE, EKS, etc.) out of the box:
      #   karpenter.sh/do-not-disrupt: "true"
      #   cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
      # Each is a no-op when the matching autoscaler isn't present. Entries
      # below override a default of the same key and can add new annotations;
      # to allow disruption on a specific autoscaler, override its key (e.g.
      # set cluster-autoscaler.kubernetes.io/safe-to-evict: "true").
      annotations: {}

    # Controller: tracks capacity, assigns sandbox pods, manages scaling
    controller:
      replicaCount: 1
      port: 3018
      resources:
        requests:
          cpu: 250m
          memory: 256Mi
        limits:
          cpu: 500m
          memory: 512Mi
      scaling:
        prewarmPoolSize: 5
        maxTotalJobs: 50
        maxConcurrentCreates: 3
        jobRetentionSeconds: 300
        assignedSandboxTtlSeconds: 3600
        reconcileIntervalMs: 5000
        leaderTtlMs: 10000
        leaderRenewMs: 3000
        perUserSandboxLimit: 5

    # Proxy: HTTP proxy for sandbox egress with credential injection.
    # The proxy must be reachable by frontend browsers for WebSocket connections.
    proxy:
      replicaCount: 1
      port: 3019
      resources:
        requests:
          cpu: 250m
          memory: 256Mi
        limits:
          cpu: '1'
          memory: 512Mi
      allowedDomains: ''
      # URL the proxy uses to reach the Retool backend for token exchange.
      # Defaults to http://<fullname>:3000 (same-cluster backend service).
      backendUrl: ''
      backendDomainSuffixes: ''
      sandboxProxyTimeoutMs: '180000'  # 3 minutes
      # Where the proxy fetches public npm packages. Leave url empty to use
      # registry.npmjs.org. Set it to an internal mirror when sandboxes have no public
      # npm egress — note the *proxy pod* dials it, not the sandboxes, so that is the
      # only network path that has to reach the mirror.
      npmRegistry:
        url: ''
        # bearer | none. `bearer` (the default) attaches a token and refuses to send
        # the request at all when none is available, so a Secret that fails to mount
        # can't silently downgrade to unauthenticated. Use `none` only for a mirror
        # that genuinely allows anonymous reads.
        authMode: bearer
        # Credential for authMode: bearer. Inline, or from an existing Secret, or from
        # a mounted file. Prefer the file when the token rotates — it is re-read on a
        # TTL, so rotation needs no proxy restart. All three are unused by authMode: none.
        authToken: ''
        authTokenSecret:
          name: ''
          key: ''
        authTokenFile: ''
        authTokenTtlMs: ''
      service:
        # Set to LoadBalancer or NodePort to expose the proxy externally.
        type: ClusterIP
        annotations: {}
      # Optional ingress to expose the proxy to frontend browsers for WebSocket connections.
      # This is separate from the main Retool ingress since the proxy typically runs on its own domain.
      ingress:
        enabled: false
        # ingressClassName:
        annotations: {}
        # kubernetes.io/ingress.class: nginx
        # nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
        # nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
        host: ''
        # e.g. sandbox.yourdomain.com
        tls: []
        # - secretName: sandbox-tls
        #   hosts:
        #     - sandbox.yourdomain.com

    # Backend integration: these tell server-side Retool callers how to reach agent executor.
    # controllerUrl defaults to the internal controller service URL when empty.
    # proxyUrl defaults to the namespace-qualified in-cluster proxy Service URL:
    # http://<release-fullname>-agent-sandbox-proxy.<namespace>.svc.cluster.local:<proxy.port>
    controllerUrl: ''
    proxyUrl: ''
    # Public URL for frontend browsers to reach the proxy via WebSocket.
    # Leave EMPTY for self-hosted: the backend then serves the sandbox same-origin
    # as the editor (your Retool base URL) and the front server reverse-proxies the
    # /sandbox/* WS+Vite paths to the in-cluster proxy Service — so no dedicated
    # proxy domain or ingress is required, and your catch-all ingress is untouched.
    # Only set this (e.g. https://sandbox.yourdomain.com) if you deliberately want
    # the proxy on a separate domain, in which case also enable proxy.ingress above.
    frontendWsProxyDomain: ''
    # Public URL for proxy domain. Defaults to frontendWsProxyDomain if empty.
    proxyDomain: ''

    # NetworkPolicy: restrict sandbox, controller, and proxy pod traffic.
    # Strongly recommended for production to isolate sandbox egress.
    networkPolicy:
      enabled: false
      # CIDR ranges to block in proxy egress rules. Must stay in sync with
      # DEFAULT_BLOCKED_CIDRS in the agent-executor source.
      blockedRanges:
        - 169.254.0.0/16    # link-local / cloud metadata
        - 10.0.0.0/8        # private (RFC 1918)
        - 172.16.0.0/12     # private (RFC 1918)
        - 192.168.0.0/16    # private (RFC 1918)
        - 100.64.0.0/10     # carrier-grade NAT (RFC 6598)
        - 127.0.0.0/8       # loopback
        - 0.0.0.0/8         # "this network" (RFC 791)
      blockedRanges6:
        - fc00::/7           # IPv6 unique local addresses
        - fe80::/10          # IPv6 link-local
        - '::1/128'         # IPv6 loopback
      # Restrict DNS egress to pods matching this selector (typically kube-dns/coredns).
      # Set to empty to allow DNS to any destination (not recommended).
      dnsSelector:
        namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: kube-system
        podSelector:
          matchLabels:
            k8s-app: kube-dns
      extraEgress: []
      # CIDRs allowed in proxy egress even if they fall within blockedRanges
      # (e.g. private backend endpoint).
      backendAllowlist: []
      # Override sandbox ingress source selector (defaults to retool backend pods).
      ingressFrom: []

    # Node placement overrides (falls back to global nodeSelector/tolerations if empty)
    nodeSelector: {}
    tolerations: []
    affinity: {}

  gitServer:
    # Runs the React Retool Git Server in-process on the main backend pod
    # (SERVICE_TYPE=...,RR_GIT_SERVER). The main backend internally proxies
    # /api/ai/rr/git/v2/* to localhost:RR_GIT_SERVER_PORT, so no extra ingress
    # routing is required. Required for the rr / React Retool app pipeline.
    #
    # When enabled, exactly one of blobStorage.s3, blobStorage.gcs, or
    # blobStorage.azure must be configured below — git_server stores all
    # objects/packs in blob storage. If it isn't, the render FAILS (set
    # skipBlobStorageValidation below to downgrade that to a NOTES.txt warning).
    #
    # Tri-state, like jsExecutor/agent/agentSandbox: leave null to INHERIT the
    # rr.enabled master switch; set true|false to override explicitly.
    enabled: null

    # Optional: number of loose objects before git_server triggers a repack.
    # Backend default is 100; unset to inherit it.
    repackThreshold: ~

    # Escape hatch for the blob-storage validation below. The chart can only
    # inspect blobStorage, env, environmentVariables, and environmentSecrets at
    # template time; it cannot see env vars injected via envFrom (Secret/ConfigMap
    # splat). Set this to true to DOWNGRADE the hard-fail to a non-fatal NOTES.txt
    # warning when RR_BLOB_STORAGE_PROVIDER / RR_DEFAULT_* are provided that way.
    skipBlobStorageValidation: false

    # Optionally split the git server out of the main backend into its own
    # deployment + service (mirrors how the workload is split in Retool Cloud).
    # Requires the git server to be enabled (rr.gitServer.enabled: true, or
    # inherited from rr.enabled). When enabled:
    #   - a dedicated <fullname>-git-server Deployment runs SERVICE_TYPE=RR_GIT_SERVER
    #     (truncated to fit Kubernetes' 63-character DNS label limit when needed)
    #   - the main backend drops RR_GIT_SERVER from its SERVICE_TYPE and proxies git
    #     traffic to the service via RR_GIT_SERVER_HOST / RR_GIT_SERVER_PORT
    #   - the MCP server (if enabled) is auto-pointed at the same service unless
    #     mcp.config.retoolGitServerUrl is set explicitly
    # The blobStorage config below is rendered onto the git-server pod instead of
    # the main backend in this mode.
    separate:
      enabled: false
      replicaCount: 1
      # Port the git server listens on (RR_GIT_SERVER_PORT) and that its service exposes.
      port: 3010
      # Pod resource requests/limits. Falls back to top-level `resources` if unset.
      resources: {}
      # Falls back to top-level `affinity` if unset.
      affinity: {}
      # Annotations/labels applied to the git-server pod template.
      annotations: {}
      labels: {}
      # Annotations/labels applied to the git-server Service (kept separate from
      # the pod ones above).
      service:
        annotations: {}
        labels: {}

  # Shared blob-storage config used by git_server (and other features that
  # need object storage, e.g. snapshots). Set exactly one of s3, gcs, azure.
  # Renders RR_BLOB_STORAGE_PROVIDER + RR_DEFAULT_<provider>_* env vars on
  # the backend deployment.
  #
  # This block can be omitted entirely if RR_BLOB_STORAGE_PROVIDER and the
  # RR_DEFAULT_*_* env vars are provided directly via environmentVariables /
  # environmentSecrets above — the chart detects that and skips this guard.
  #
  # Keyless auth: each provider can authenticate as the pod's own identity
  # instead of a static credential. Leave the credential field unset and set
  # serviceAccount.annotations so the pod carries the right identity:
  #   - s3:    omit accessKeyId/secret -> AWS default chain (EKS IRSA via the
  #            eks.amazonaws.com/role-arn annotation, instance profile, ECS role)
  #   - gcs:   omit credentials -> Application Default Credentials (GKE Workload
  #            Identity via the iam.gke.io/gcp-service-account annotation)
  #   - azure: set accountUrl instead of a connection string -> managed identity
  #            (azure.workload.identity/client-id annotation + the
  #            azure.workload.identity/use: "true" pod label)
  blobStorage: {}
    # s3:
    #   bucket: my-rr-bucket
    #   region: us-east-1
    #   endpoint: ""                              # optional, for S3-compatible (MinIO, R2, etc.)
    #   # Omit accessKeyId + secret to use the AWS default credential chain (IAM role / IRSA).
    #   accessKeyId: AKIA...
    #   # Provide secretAccessKey OR the secretName/secretKey pair below.
    #   secretAccessKey: ""
    #   secretAccessKeySecretName: ""
    #   secretAccessKeySecretKey: secret-access-key
    #
    # gcs:
    #   bucket: my-rr-bucket
    #   # Omit credentials to use Application Default Credentials (Workload Identity).
    #   credentials: ""
    #   credentialsSecretName: ""
    #   credentialsSecretKey: credentials.json
    #
    # azure:
    #   container: my-rr-container
    #   # Provide connectionString OR the secretName/secretKey pair below, OR set
    #   # accountUrl on its own to authenticate via managed identity.
    #   connectionString: ""
    #   connectionStringSecretName: ""
    #   connectionStringSecretKey: connection-string
    #   accountUrl: ""                            # e.g. https://<account>.blob.core.windows.net

agents:
  # Enable AI Agents
  enabled: false

  # Labels for agent worker pods
  labels: {}

  # Agent configuration (can be overriden per worker type)
  config: {}

  # Agent worker configuration
  worker:
    replicaCount: 1

    resources:
      limits:
        cpu: 2000m
        memory: 4096Mi
      requests:
        cpu: 1000m
        memory: 2048Mi

  # Agent eval worker configuration
  evalWorker:
    replicaCount: 1

    resources:
      limits:
        cpu: 2000m
        memory: 4096Mi
      requests:
        cpu: 1000m
        memory: 2048Mi

  # Annotations for agent worker pods
  annotations: {}

# SHARED TEMPORAL CONFIGURATION
# This configuration is shared between all workers.
# In order to use workers, temporal must be configured.

# IMPORTANT: Incompatible with retool-temporal-services-helm subchart
# Set enabled to true if using a pre-existing temporal cluster instead of deploying a new one.
temporal:
  # set enabled to true if using a pre-existing temporal cluster
  enabled: false
  # discoverable service name for the temporal frontend service
  # host:
  # discoverable service port for the temporal frontend service
  # port:
  # temporal namespace to use for Temporal Workflows related to Retool
  # namespace:
  # whether to use TLS/SSL when connecting to Temporal
  # sslEnabled: false
  # base64 encoded string of TLS/SSL client certificate to use for mTLS
  # sslCert:
  # base64 encoded string of TLS/SSL client certificate secret key to use for mTLS
  # sslKey:
  # recommended alternative to sslKey. Name and key of k8s secret containing base64 encoded sslKey
  # sslKeySecretName:
  # sslKeySecretKey

retool-temporal-services-helm:
  # Enable to spin up a new Temporal Cluster alongside Retool
  enabled: false
  server:
    # Defines image to be used for temporal server
    image:
      repository: tryretool/one-offs
      tag: retool-temporal-1.1.5
      pullPolicy: IfNotPresent
    # this configures grpc_health_probe (https://github.com/grpc-ecosystem/grpc-health-probe)
    # for healthchecks instead of native k8s.
    # Set this to true if deploying in a k8s cluster on version <1.24
    useLegacyHealthProbe: false
    config:
      # the below values specify the database for temporal internals and workflow state
      # both can point to the same db, and even the same as retool main above, although throughput
      # will be limited. We strongly suggest using two total DBs: one for retool-main and one
      # for default and visibility below
      persistence:
        default:
          sql:
            # host:
            # port:
            # the dbname used for temporal
            # database: temporal
            # user:
            # password:
            # existingSecret is the name of the secret where password is stored
            # existingSecret:
            # secretKey is the key in the k8s secret
            # secretKey:
            # options for SSL connections to database
            # tls:
            #   enabled: true
            #   сaFile:
            #   certFile:
            #   keyFile:
            #   enableHostVerification: false
            #   serverName:
        visibility:
          sql:
            # host:
            # port:
            # the dbname used for temporal visibility
            # database: temporal_visibility
            # user:
            # password:
            # existingSecret is the name of the secret where password is stored
            # existingSecret:
            # secretKey is the key in the k8s secret
            # secretKey:
            # options for SSL connections to database
            # tls:
            #   enabled: true
            #   сaFile:
            #   certFile:
            #   keyFile:
            #   enableHostVerification: false
            #   serverName:

      # use-cases with very high throughput demands (>10k workflow blocks/sec) can modify
      # below value to be higher, such as 512 or 1024
      numHistoryShards: 128

    # define resources for each temporal service -- these are sane starting points that allow
    # for scaling to ~3 workflow workers without hitting bottlenecks
    resources:
      limits:
        cpu: 500m
        memory: 1024Mi
      requests:
        cpu: 100m
        memory: 128Mi
    # example of setting service-specific resources, here we increase memory limit for history server
    history:
      resources:
        limits:
          cpu: 500m
          memory: 2Gi
        requests:
          cpu: 100m
          memory: 128Mi

  # Set environment variables for temporal pods, e.g. skipping DB creation step at startup
  # environmentVariables:
  #   - name: SKIP_DB_CREATE
  #     value: "true"

  # Setting this value to true will spin up the temporal web UI, admintools,
  # along with prometheus and grafana clusters for debugging performance
  # TODO: define this in _helpers.tpl
  # visibilityDebugMode: false
  # DEBUGGING: below pods can be used for debugging and watching metrics
  # launches prometheus pods and listeners on temporal services and worker
  prometheus:
    enabled: false
  # launches a grafana pod with helpful workflows executor metrics and graphs
  grafana:
    enabled: false
  # launches the temporal web UI, which allows you to see which workflows are currently running
  web:
    enabled: false
  # launches the temporal admintools pod, which allows you to manage your cluster, e.g. terminate workflows
  admintools:
    enabled: false

persistentVolumeClaim:
  # set to true to use pvc
  enabled: false
  # set to the name of the existing pvc
  existingClaim: ""
  annotations: {}
  accessModes:
    - ReadWriteOnce
  size: "15Gi"
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  storageClass: ""
  mountPath: /retool_backend/pv-data

# default security context
securityContext:
  enabled: false
  runAsUser: 1000
  fsGroup: 2000
  # Use this section to define additional pod security context values for primary Retool pods not provided by default.
  # See this doc for options allowed here (ensure the Kubernetes version matches the version of the Kubernetes cluster you are deploying to): https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#podsecuritycontext-v1-core
  extraSecurityContext: {}
  # Use this section to define additional container security context values for primary Retool pods not provided by default.
  # See this doc for options allowed here (ensure the Kubernetes version matches the version of the Kubernetes cluster you are deploying to): https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#securitycontext-v1-core
  extraContainerSecurityContext: {}

extraConfigMapMounts: []

initContainers: {}

extraManifests: []
# extraManifests:
#  - apiVersion: cloud.google.com/v1beta1
#    kind: BackendConfig
#    metadata:
#      name: "{{ .Release.Name }}-testing"
#    spec:
#      securityPolicy:
#        name: "my-gcp-cloud-armor-policy"

# Support for AWS Security groups for pods
# Ref: https://docs.aws.amazon.com/eks/latest/userguide/security-groups-for-pods.html
securityGroupPolicy:
  enabled: false
  groupIds: []

hostAliases: {}
# Support hostAliases on the backend deployment
# hostAliases:
#   - ip: 1.1.1.1
#     hostnames:
#     - test.com
#     - anothertest.com

telemetry:
  # When enabled, will collect metrics and logs from the other pods in the
  # chart. These will be forwarded to Retool for proactive monitoring and bug
  # identification when `telemetry.sendToRetool.enabled = true`, and can also
  # optionally be sent to a user-managed destination via
  # `telemetry.customVectorConfig`.
  enabled: false

  sendToRetool:
    # Only relevant when `telemetry.enabled = true`. When enabled, telemetry
    # from pods in this chart will be forwarded to Retool for proactive
    # monitoring and bug identification.
    enabled: true

    # Should not be changed except for chart testing.
    address: "https://telemetry.retool.com:443"

    # Only relevant when `telemetry.sendToRetool.enabled = true`.
    # Specify which inputs to send to Retool. Must not be empty.
    # Available inputs are:
    #   container_logs  - logs from all pods
    #   metrics         - app and infra metrics
    #   otlp_traces     - app request traces
    inputs:
      - metrics

  image:
    repository: "tryretool/telemetry"

    # Default to same as top level `image.tag`.
    tag: null

    pullPolicy: "IfNotPresent"

  resources:
    requests:
      cpu: 128m
      memory: 128Mi
    limits:
      cpu: 256m
      memory: 256Mi

  # When present, any vector config here gets added to the telemetry pod (via a
  # created configmap) and added to the internal [vector](https://vector.dev/)
  # instance which runs inside. This can enable adding additional user-specified
  # sinks for collected telemetry data.
  #
  # See [vector sinks
  # documentation](https://vector.dev/docs/reference/configuration/sinks/) for
  # more details.
  customVectorConfig: {}

  # When present, any grafana-agent config here gets added to the telemetry pod
  # (via a created configmap) and added to the internal
  # [grafana-agent](https://grafana.com/docs/agent/latest/) instance which runs
  # inside. This can enable adding additional user-specified sources of extra
  # telemetry data.
  #
  # The internal grafana-agent runs in Flow mode, so the config here must use
  # river syntax. See [grafana-agent Flow mode
  # documentation](https://grafana.com/docs/agent/latest/flow/) for more
  # details.
  customGrafanaAgentConfig:

  serviceAccount:
    create: true
    name:
    automountToken: true

  rbac:
    create: true

  extraEnv: []
  extraAnnotations: {}
  extraPodSpec: {}
  extraVolumes: []
  extraVolumeMounts: []
  extraPorts: []
  extraContainerSpec: {}