openwebui values¶
Every value of chart openwebui 0.3.2, read from values.yaml and values.schema.json. A map is listed with its keys; a map without a description of its own is listed by its keys only. Every value has a default: the chart installs with none given.
| Value | Type | Default | Description |
|---|---|---|---|
team |
string | "" |
Team of the tenant the app serves: the chart puts every object into <tenant>-<team>, a namespace the team already has. Empty: the release namespace |
tenant |
string | "" |
Tenant the app belongs to; required with team |
person.name |
string | "" |
short lowercase name; objects are named <name>-openwebui. Empty: the release name |
person.email |
string | "" |
OpenShift user name (an email) of the owner, who logs in and becomes admin |
route.host |
string | "" |
empty: OpenShift assigns a host under the default application domain |
route.labels |
object | {} |
extra labels on the Route only, for example to pick a router shard |
route.timeout |
string | 3600s |
answers stream; the router must not cut long requests |
route.annotations |
object | used when a host is set; certificate issued by cert-manager | |
route.annotations.cert-manager.io/issuer-kind |
string | ClusterIssuer |
|
route.annotations.cert-manager.io/issuer-name |
string | letsencrypt |
|
oauth.ownerEmail |
string | "" |
OpenShift user name (an email) of the only person admitted. Empty: person.email; both empty: everyone who may edit the project |
oauth.allowedGroups |
array | [] |
OpenShift groups admitted, strictly (with an owner: the owner must be in one) |
oauth.loginClusterRole |
string | "" |
ClusterRole holding the verb login on services/proxy that allowedGroups are bound to. Empty: the chart's own Role, which only an installer holding that verb (a cluster admin) can create |
secrets.type |
string | kubernetes |
kubernetes: Secrets from the values below. externalSecret: from a secret store One of: kubernetes, externalSecret. |
secrets.cookieSecret |
string | "" |
login cookie key. Empty: generated once and kept on upgrade. A value that is not 16, 24 or 32 characters long is hashed to 32 |
secrets.secretKey |
string | "" |
Open WebUI session signing key (WEBUI_SECRET_KEY). Empty: generated once |
secrets.externalSecret.storeKind |
string | ClusterSecretStore |
One of: ClusterSecretStore, SecretStore. |
secrets.externalSecret.storeName |
string | "" |
|
secrets.externalSecret.refreshInterval |
string | 1h |
|
secrets.externalSecret.items |
object | one vault item per secret; the value is read from the item's password. Empty name: <name>-openwebui-<secret> | |
secrets.externalSecret.items.cookieSecret |
string | "" |
|
secrets.externalSecret.items.secretKey |
string | "" |
|
gateway.upstream |
string | "" |
OpenAI-compatible model gateway the token proxy forwards to, for example https://api.example.com (Open WebUI calls <upstream>/v1) |
gateway.audience |
string | "" |
audience of the instance's ServiceAccount token. Empty: the host of upstream |
openwebui.image |
string | ghcr.io/open-webui/open-webui:v0.12.3 |
Open WebUI image |
openwebui.title |
string | "" |
title in the browser (WEBUI_NAME); empty: the Open WebUI default |
openwebui.persistentConfig |
boolean | true |
true: settings changed in the admin panel win over these values after the first start |
openwebui.env |
object | {} |
extra environment (name: value), see the Open WebUI environment reference |
openwebui.resources |
object | requests and limits; the first start loads a local embedding model | |
openwebui.resources.requests.cpu |
string | 100m |
|
openwebui.resources.requests.memory |
string | 2Gi |
|
openwebui.resources.limits.cpu |
string | 4 |
|
openwebui.resources.limits.memory |
string | 16Gi |
|
mcp.enabled |
boolean | false |
MCP endpoints of the gateway (<upstream>/mcp/<endpoint>) as tool servers for every user, called through the token proxy. Needs persistentConfig false to apply after the first start |
mcp.endpoints |
array | [] |
empty: the release namespace (tool prefix team) and public |
workbench.image |
string | "" |
image with open-terminal and jupyter-server on PATH; the terminal and notebook code see what this image holds. Both sidecars keep HOME in workspace/ on the data volume |
workbench.terminal.enabled |
boolean | false |
Open Terminal sidecar on 127.0.0.1, a terminal for every user in the chat |
workbench.terminal.port |
integer | 8000 |
|
workbench.jupyter.enabled |
boolean | false |
Jupyter server sidecar on 127.0.0.1 as code execution and code interpreter engine |
workbench.jupyter.port |
integer | 8888 |
|
workbench.resources.requests.cpu |
string | 50m |
|
workbench.resources.requests.memory |
string | 256Mi |
|
workbench.resources.limits.memory |
string | 4Gi |
|
oauthProxy.image |
string | image-registry.openshift-image-registry.svc:5000/openshift/oauth-proxy:v4.4 |
OpenShift oauth-proxy in front of the UI; the cluster keeps this tag current |
oauthProxy.port |
integer | 4180 |
UI port of the pod |
oauthProxy.resources |
object | login proxy requests and limits | |
oauthProxy.resources.requests.cpu |
string | 10m |
|
oauthProxy.resources.requests.memory |
string | 32Mi |
|
oauthProxy.resources.limits.memory |
string | 256Mi |
|
tokenProxy.image |
string | registry.access.redhat.com/ubi9/python-312-minimal |
image that runs the token proxy script |
tokenProxy.port |
integer | 8099 |
loopback port Open WebUI sends model calls to |
tokenProxy.agentToken |
object | calls under paths carry the instance's own OpenID Connect token instead of the ServiceAccount token: a client_credentials grant at tokenUrl, authenticated with a ServiceAccount token for audience (federated client authentication). Empty: off | |
tokenProxy.agentToken.tokenUrl |
string | "" |
|
tokenProxy.agentToken.audience |
string | "" |
usually the realm's issuer URL |
tokenProxy.agentToken.paths |
array | ["/mcp"] |
|
tokenProxy.resources |
object | token proxy requests and limits | |
tokenProxy.resources.requests.cpu |
string | 10m |
|
tokenProxy.resources.requests.memory |
string | 32Mi |
|
tokenProxy.resources.limits.memory |
string | 256Mi |
|
serviceAccount.labels |
object | {} |
labels on the instance's ServiceAccount, for example the one a platform uses to register it as an OpenID Connect client |
storage.size |
string | 10Gi |
chats, uploads, settings (SQLite) and the embedding model cache |
storage.accessMode |
string | ReadWriteOnce |
ReadWriteOnce or ReadWriteMany; the Deployment stops the old pod first either way One of: ReadWriteOnce, ReadWriteMany. |
storage.className |
string | "" |
empty: the default storage class |
networkPolicy.enabled |
boolean | true |
admit the login proxy from the router only |