open-webui/helm-charts
1
0
Fork 0
mirror of https://github.com/open-webui/helm-charts.git synced 2026-07-22 18:05:24 -04:00
Code Issues 13 Packages Projects Releases 10 Wiki Activity

[PR #197] [MERGED] feat: [open-webui/pipelines] add support for adding extra init containers #241

New Issue
Closed
opened 2026-02-15 19:17:01 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 19:17:01 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/open-webui/helm-charts/pull/197
Author: @saraangelmurphy
Created: 3/10/2025
Status: ✅ Merged
Merged: 3/11/2025
Merged by: @westbrook-ai

Base: main ← Head: feature/add-extra-init-containers

📝 Commits (4)

  • 934c4ff feat: add support for extra init containers
  • 7f23390 fix: set description for enableOpenaiApi correctly
  • df3d4a4 feat: add support for extra init containers to pipelines chart
  • ab693ef Merge branch 'main' into feature/add-extra-init-containers

📊 Changes

8 files changed (+36 additions, -7 deletions)

View changed files

📝 charts/open-webui/Chart.yaml (+1 -1)
📝 charts/open-webui/README.md (+3 -2)
📝 charts/open-webui/templates/workload-manager.yaml (+3 -0)
📝 charts/open-webui/values.yaml (+11 -1)
📝 charts/pipelines/Chart.yaml (+1 -1)
📝 charts/pipelines/README.md (+3 -2)
📝 charts/pipelines/templates/deployment.yaml (+4 -0)
📝 charts/pipelines/values.yaml (+10 -0)

📄 Description

This PR adds support for adding extra init containers alongside the existing init container. I am personally using this to add some extra private CAs to the system trust store.

Changes:

  • Added extraInitContainers section to values.yaml
  • Updated workload-manager.yaml to include extra init containers
  • Updated README.md with documentation for the new feature
  • Incremented chart version from 5.21.0 to 5.22.0

Testing:

  • helm template ./charts/open-webui'
  • helm template ./charts/open-webui --set 'extraInitContainers[0].name=test-init,extraInitContainers[0].image=busybox:latest'
  • helm template ./charts/pipelines'
  • helm template ./charts/pipelines --set 'extraInitContainers[0].name=test-init,extraInitContainers[0].image=busybox:latest'

I have also deployed this successfully to a live kubernetes cluster.

Example values.yaml (note - the k8s secret containing my secret values + the k8s configmap with my certs are created separately.):

openaiBaseApiUrl: "https://litellm.dev.example.com"
replicaCount: 3 # defaults to 1.

image:
  repository: ghcr.io/open-webui/open-webui
  tag: "0.5.20"
  pullPolicy: "IfNotPresent"

# Add the corp CAs to the system trust store
extraInitContainers:
  - name: copy-ca-certs
    # Same as the open-webui WebUI backend image
    # See: https://github.com/open-webui/open-webui/blob/main/Dockerfile#L36
    image: python:3.11-slim-bookworm
    command:
      - "/bin/bash"
      - "-c"
      - |
        # Create directory for the combined certificates
        echo "Creating directory for the combined certificates"
        mkdir -p /certs-shared
        
        # Copy the system CA certificates file
        echo "Copying system CA certificates file"
        cp /etc/ssl/certs/ca-certificates.crt /certs-shared/
        
        # Append the CA certificates to the ca-certificates.crt file
        echo "Appending CA certificates to the ca-certificates.crt file"
        cat /my-certs/my-ca-certificates.crt >> /certs-shared/ca-certificates.crt
        
        # Set proper permissions
        echo "Setting proper permissions"
        chmod 644 /certs-shared/ca-certificates.crt
    volumeMounts:
      - name: certs-shared
        mountPath: /certs-shared
      - name: my-certs
        mountPath: /my-certs
        readOnly: true

# -- Configure container volume mounts
# ref: <https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/>
volumeMounts:
  initContainer: []
  container:
    - name: certs-shared
      mountPath: /etc/ssl/certs/ca-certificates.crt
      subPath: ca-certificates.crt
      readOnly: true

# -- Configure pod volumes
# ref: <https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/>
volumes:
  - name: certs-shared
    emptyDir: {}
  - name: my-certs
    configMap:
      name: open-webui-my-certs

serviceAccount:
  enable: true
  name: "open-webui"
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::{{ requiredEnv "AWS_ACCOUNT_ID" }}:role/open-webui-role-{{ requiredEnv "ENV_SLUG" }}
  automountServiceAccountToken: false
ollama:
  # -- Automatically install Ollama Helm chart from https://otwld.github.io/ollama-helm/. Use [Helm Values](https://github.com/otwld/ollama-helm/#helm-values) to configure
  enabled: false # Temporarily disabled until we run a cluster with a GPU.
  # -- If enabling embedded Ollama, update fullnameOverride to your desired Ollama name value, or else it will use the default ollama.name value from the Ollama chart
  fullnameOverride: "open-webui-ollama"
  # -- Example Ollama configuration with nvidia GPU enabled, automatically downloading a model, and deploying a PVC for model persistence
  # ollama:
  #   gpu:
  #     enabled: true
  #     type: 'nvidia'
  #     number: 1
  #   models:
  #     pull:
  #       - llama3
  #     run:
  #       - llama3
  # runtimeClassName: nvidia
  # persistentVolume:
  #   enabled: true
  #   volumeName: "example-pre-existing-pv-created-by-smb-csi"

pipelines:
  # -- Automatically install Pipelines chart to extend Open WebUI functionality using Pipelines: https://github.com/open-webui/pipelines
  enabled: false # Enabled by default. Disabled for now as we explore the usecases.
  # -- This section can be used to pass required environment variables to your pipelines (e.g. Langfuse hostname)
  extraEnvVars: []

# Installs Apache Tika for content/text extraction.
# See https://github.com/apache/tika-helm?tab=readme-ov-file for configuration options.
tika:
  enabled: true

# We are disabling the websocket configuration here, and configuring redis in the extraEnvVars section below instead.
# This is because we need to get the redis url from a kubernetes secret since it needs to include the username/password combination
# Defining the redis host here, even using vault to hide it from the VCS, will still expose the secret in the environment and in CI
websocket:
  # -- Enables websocket support in Open WebUI with env `ENABLE_WEBSOCKET_SUPPORT`
  enabled: false
  # -- Specifies the websocket manager to use with env `WEBSOCKET_MANAGER`: redis (default)
  manager: redis
  # -- Specifies the URL of the Redis instance for websocket communication. Template with `redis://[:<password>@]<hostname>:<port>/<db>`
  url: redis://open-webui-redis:6379/0
  # -- Deploys a redis
  redis:
    # -- Enable redis installation
    # Disabled as we are using aws elasticache redis.
    enabled: false

rag:
  # -- Enable RAG
  # ref: https://docs.openwebui.com/getting-started/env-configuration#retrieval-augmented-generation-rag
  enabled: true
  # -- Vector database configuration
  # ref: https://docs.openwebui.com/getting-started/env-configuration#vector_db
  vectorDB: "pgvector"
  # -- Embedding engine to use for RAG with env `RAG_EMBEDDING_ENGINE`: ""(empty), "ollama", "openai"
  # ref: https://docs.openwebui.com/getting-started/env-configuration#rag_embedding_engine
  embeddingEngine: "openai"
  # -- Embedding model to use for RAG with env `RAG_EMBEDDING_MODEL`
  # ref: https://docs.openwebui.com/getting-started/env-configuration#rag_embedding_model
  embeddingModel: "text-embedding-3-small"

# This requires an EFS block volume w/ the EFS csi driver installed.
# However, there should not be many components remaining that require a persistent volume.
# Most persistent elements are stored in RDS
persistence:
  enabled: false

extraEnvVars:
  # -- Default API key value for Pipelines. Should be updated in a production deployment, or be changed to the required API key if not using Pipelines
  - name: OPENAI_API_KEY # Persistent. Can only be updated in the UI or the database.
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: openai-api-key # From the litellm UI at https://litellm.dev.example.com/ui
  - name: WEBUI_SECRET_KEY
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: open-webui-secret-key # randomly generated with keeper and stored in vault. used to encrypt session tokens. this needs to be consistent across all instances for HA.
  - name: K8S_FLAG
    value: "True" # sets the OLLAMA_BASE_URL to http://ollama-service.open-webui.svc.cluster.local:11434
  - name: ENV
    value: "dev" # Enables fastapi docs endpoint at /docs
  - name: WEBUI_URL # Persistent. Can only be updated in the UI or the database.
    value: "https://open-webui.dev.example.com/"
  - name: ADMIN_EMAIL # Persistent. Can only be updated in the UI or the database.
    value: "infrastructure@example.com"
  - name: ENABLE_ADMIN_CHAT_ACCESS
    value: "False" # this defaults to true. while this is technically available in the backing DB, for privacy's sake it does not need to be enabled in the UI.
  - name: DEFAULT_USER_ROLE # Persistent. Can only be updated in the UI or the database.
    value: "user" # New users are automatically activated with regular user permissions. By default new users need to be manually approved.
  - name: AUDIO_STT_ENGINE # Persistent. Can only be updated in the UI or the database.
    value: "openai" # Invoked through litellm
  - name: AUDIO_STT_MODEL # Persistent. Can only be updated in the UI or the database.
    value: "whisper" # Deployed in Azure OpenAI and available through litellm
  - name: AUDIO_STT_OPENAI_API_BASE_URL # Persistent. Can only be updated in the UI or the database.
    value: "https://litellm.dev.example.com"
  - name: AUDIO_STT_OPENAI_API_KEY # Persistent. Can only be updated in the UI or the database.
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: openai-api-key # Created in the litellm UI at https://litellm.dev.example.com/ui
  - name: AUDIO_TTS_API_KEY # Persistent. Can only be updated in the UI or the database.
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: openai-api-key # Created in the litellm UI at https://litellm.dev.example.com/ui
  - name: AUDIO_TTS_OPENAI_API_BASE_URL # Persistent. Can only be updated in the UI or the database.
    value: "https://litellm.dev.example.com"
  - name: AUDIO_TTS_OPENAI_API_KEY # Persistent. Can only be updated in the UI or the database.
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: openai-api-key # Created in the litellm UI at https://litellm.dev.example.com/ui
  - name: AUDIO_TTS_ENGINE # Persistent. Can only be updated in the UI or the database.
    value: "openai" # Invoked through litellm
  - name: AUDIO_TTS_MODEL # Persistent. Can only be updated in the UI or the database.
    value: "tts" # Deployed in Azure OpenAI and available through litellm
  - name: AUDIO_TTS_VOICE # persistent. can only be updated in the UI or the database.
    value: "alloy" # see: https://learn.microsoft.com/en-us/azure/ai-services/openai/reference-preview#properties-for-audio
  - name: ENABLE_IMAGE_GENERATION # Persistent. Can only be updated in the UI or the database.
    value: "True" # Disabled by default.
  - name: IMAGES_OPENAI_API_BASE_URL # Persistent. Can only be updated in the UI or the database.
    value: "https://litellm.dev.example.com"
  - name: IMAGES_OPENAI_API_KEY # Persistent. Can only be updated in the UI or the database.
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: openai-api-key # Created in the litellm UI at https://litellm.dev.example.com/ui
  - name: IMAGE_GENERATION_ENGINE # Persistent. Can only be updated in the UI or the database.
    value: "openai" # Invoked through litellm
  - name: IMAGE_GENERATION_MODEL # Persistent. Can only be updated in the UI or the database.
    value: "dall-e-3" # Deployed in Azure OpenAI and available through litellm
  - name: IMAGE_SIZE # Persistent. Can only be updated in the UI or the database.
    value: "1024x1024" # Default: 512x512
  - name: ENABLE_WEBSOCKET_SUPPORT 
    value: "True" # enables websocket support for HA scaling with redis
  - name: WEBSOCKET_MANAGER
    value: "redis" # redis is the only supported manager.
  - name: SOCKET_LOG_LEVEL
    value: "DEBUG" # Only for testing
  - name: WEBSOCKET_REDIS_URL
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: redis-connection-string # Deployed in AWS Elasticache via terraform
  - name: REDIS_URL
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: redis-connection-string # Deployed in AWS Elasticache via terraform. Open-WebUI docs recommend setting both REDIS_URL and WEBSOCKET_REDIS_URL to the same value.
  - name: VECTOR_DB
    value: "pgvector"
  - name: RAG_EMBEDDING_ENGINE # Persistent. Can only be updated in the UI or the database.
    value: "openai"
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: rds-connection-string
  - name: PGVECTOR_DB_URL
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: rds-connection-string
  # Larger models need a larger vector dimension.
  # text-embedding-ada-002 has a vector dimension of 1536
  # This needs to be persisted in the database
  # to migrate the vector dimension, run the utils/update_vector_dimension.sql script.
  # see the script comments for more details.
  # see also: https://community.openai.com/t/how-to-deal-with-different-vector-dimensions-for-embeddings-and-search-with-pgvector/602141
  - name: PGVECTOR_INITIALIZE_MAX_VECTOR_LENGTH
    value: "1536"
  # Open-WebUI uses an aws aurora postgres serverless database that scales from 1 to 16 "Amazon Compute Units", each with 2GB of memory
  # Each ACU supports up to 1000 connections in total, but do not want to maintain too many idle connections
  - name: DATABASE_POOL_SIZE
    value: "20"
  # With Aurora Serverless, you want to handle sudden traffic spikes without preventing scale-down operations. A moderate overflow allows handling traffic bursts while the database scales up, 
  # without keeping too many idle connections during normal operation.
  # see: https://docs.sqlalchemy.org/en/20/core/pooling.html#sqlalchemy.pool.QueuePool.params.max_overflow
  - name: DATABASE_POOL_MAX_OVERFLOW
    value: "20"
  # Aurora Serverless can experience brief pauses during scaling operations. 
  # A shorter timeout helps prevent request queuing during these scaling events
  # we want to fail fast and retry if needed.
  # see: https://docs.sqlalchemy.org/en/20/core/pooling.html#sqlalchemy.pool.QueuePool.params.timeout
  - name: DATABASE_POOL_TIMEOUT
    value: "15"
  # Recycling connections more frequently helps prevent "connection has been closed" errors that can occur after scaling events
  # see: https://docs.sqlalchemy.org/en/20/core/pooling.html#setting-pool-recycle
  - name: DATABASE_POOL_RECYCLE
    value: "600"
  - name: S3_ENDPOINT_URL
    value: "https://s3.us-east-1.amazonaws.com"
  - name: STORAGE_PROVIDER
    value: s3
  - name: S3_REGION_NAME
    value: "us-east-1"
  # Created in terraform, authentication via EKS workload identity
  - name: S3_BUCKET_NAME
    value: "my-bucket"
  - name: CORS_ALLOW_ORIGIN
    value: "*"
  - name: SSL_CERT_FILE
    value: "/etc/ssl/certs/ca-certificates.crt"
  - name: REQUESTS_CA_BUNDLE
    value: "/etc/ssl/certs/ca-certificates.crt"
  - name: RAG_OPENAI_API_BASE_URL  # Persistent. Can only be updated in the UI or the database.
    value: "https://litellm.dev.example.com"
  - name: RAG_OPENAI_API_KEY  # Persistent. Can only be updated in the UI or the database.
    valueFrom:
      secretKeyRef:
        name: open-webui-secrets
        key: openai-api-key # From the litellm UI at https://litellm.dev.example.com/ui

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/helm-charts/pull/197 **Author:** [@saraangelmurphy](https://github.com/saraangelmurphy) **Created:** 3/10/2025 **Status:** ✅ Merged **Merged:** 3/11/2025 **Merged by:** [@westbrook-ai](https://github.com/westbrook-ai) **Base:** `main` ← **Head:** `feature/add-extra-init-containers` --- ### 📝 Commits (4) - [`934c4ff`](https://github.com/open-webui/helm-charts/commit/934c4ff6004cc22eb6f23ea8d4b061f3a14ca488) feat: add support for extra init containers - [`7f23390`](https://github.com/open-webui/helm-charts/commit/7f23390df4445b6752050d1d77cea732d51266ab) fix: set description for enableOpenaiApi correctly - [`df3d4a4`](https://github.com/open-webui/helm-charts/commit/df3d4a48ce80422ea5c61047d552b06264ac7af6) feat: add support for extra init containers to pipelines chart - [`ab693ef`](https://github.com/open-webui/helm-charts/commit/ab693efe7632338303b0b53bd307ee628499b683) Merge branch 'main' into feature/add-extra-init-containers ### 📊 Changes **8 files changed** (+36 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `charts/open-webui/Chart.yaml` (+1 -1) 📝 `charts/open-webui/README.md` (+3 -2) 📝 `charts/open-webui/templates/workload-manager.yaml` (+3 -0) 📝 `charts/open-webui/values.yaml` (+11 -1) 📝 `charts/pipelines/Chart.yaml` (+1 -1) 📝 `charts/pipelines/README.md` (+3 -2) 📝 `charts/pipelines/templates/deployment.yaml` (+4 -0) 📝 `charts/pipelines/values.yaml` (+10 -0) </details> ### 📄 Description This PR adds support for adding extra init containers alongside the existing init container. I am personally using this to add some extra private CAs to the system trust store. Changes: - Added `extraInitContainers` section to values.yaml - Updated workload-manager.yaml to include extra init containers - Updated README.md with documentation for the new feature - Incremented chart version from 5.21.0 to 5.22.0 Testing: - `helm template ./charts/open-webui'` - `helm template ./charts/open-webui --set 'extraInitContainers[0].name=test-init,extraInitContainers[0].image=busybox:latest'` - `helm template ./charts/pipelines'` - `helm template ./charts/pipelines --set 'extraInitContainers[0].name=test-init,extraInitContainers[0].image=busybox:latest'` I have also deployed this successfully to a live kubernetes cluster. Example values.yaml (note - the k8s secret containing my secret values + the k8s configmap with my certs are created separately.): ``` openaiBaseApiUrl: "https://litellm.dev.example.com" replicaCount: 3 # defaults to 1. image: repository: ghcr.io/open-webui/open-webui tag: "0.5.20" pullPolicy: "IfNotPresent" # Add the corp CAs to the system trust store extraInitContainers: - name: copy-ca-certs # Same as the open-webui WebUI backend image # See: https://github.com/open-webui/open-webui/blob/main/Dockerfile#L36 image: python:3.11-slim-bookworm command: - "/bin/bash" - "-c" - | # Create directory for the combined certificates echo "Creating directory for the combined certificates" mkdir -p /certs-shared # Copy the system CA certificates file echo "Copying system CA certificates file" cp /etc/ssl/certs/ca-certificates.crt /certs-shared/ # Append the CA certificates to the ca-certificates.crt file echo "Appending CA certificates to the ca-certificates.crt file" cat /my-certs/my-ca-certificates.crt >> /certs-shared/ca-certificates.crt # Set proper permissions echo "Setting proper permissions" chmod 644 /certs-shared/ca-certificates.crt volumeMounts: - name: certs-shared mountPath: /certs-shared - name: my-certs mountPath: /my-certs readOnly: true # -- Configure container volume mounts # ref: <https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/> volumeMounts: initContainer: [] container: - name: certs-shared mountPath: /etc/ssl/certs/ca-certificates.crt subPath: ca-certificates.crt readOnly: true # -- Configure pod volumes # ref: <https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/> volumes: - name: certs-shared emptyDir: {} - name: my-certs configMap: name: open-webui-my-certs serviceAccount: enable: true name: "open-webui" annotations: eks.amazonaws.com/role-arn: arn:aws:iam::{{ requiredEnv "AWS_ACCOUNT_ID" }}:role/open-webui-role-{{ requiredEnv "ENV_SLUG" }} automountServiceAccountToken: false ollama: # -- Automatically install Ollama Helm chart from https://otwld.github.io/ollama-helm/. Use [Helm Values](https://github.com/otwld/ollama-helm/#helm-values) to configure enabled: false # Temporarily disabled until we run a cluster with a GPU. # -- If enabling embedded Ollama, update fullnameOverride to your desired Ollama name value, or else it will use the default ollama.name value from the Ollama chart fullnameOverride: "open-webui-ollama" # -- Example Ollama configuration with nvidia GPU enabled, automatically downloading a model, and deploying a PVC for model persistence # ollama: # gpu: # enabled: true # type: 'nvidia' # number: 1 # models: # pull: # - llama3 # run: # - llama3 # runtimeClassName: nvidia # persistentVolume: # enabled: true # volumeName: "example-pre-existing-pv-created-by-smb-csi" pipelines: # -- Automatically install Pipelines chart to extend Open WebUI functionality using Pipelines: https://github.com/open-webui/pipelines enabled: false # Enabled by default. Disabled for now as we explore the usecases. # -- This section can be used to pass required environment variables to your pipelines (e.g. Langfuse hostname) extraEnvVars: [] # Installs Apache Tika for content/text extraction. # See https://github.com/apache/tika-helm?tab=readme-ov-file for configuration options. tika: enabled: true # We are disabling the websocket configuration here, and configuring redis in the extraEnvVars section below instead. # This is because we need to get the redis url from a kubernetes secret since it needs to include the username/password combination # Defining the redis host here, even using vault to hide it from the VCS, will still expose the secret in the environment and in CI websocket: # -- Enables websocket support in Open WebUI with env `ENABLE_WEBSOCKET_SUPPORT` enabled: false # -- Specifies the websocket manager to use with env `WEBSOCKET_MANAGER`: redis (default) manager: redis # -- Specifies the URL of the Redis instance for websocket communication. Template with `redis://[:<password>@]<hostname>:<port>/<db>` url: redis://open-webui-redis:6379/0 # -- Deploys a redis redis: # -- Enable redis installation # Disabled as we are using aws elasticache redis. enabled: false rag: # -- Enable RAG # ref: https://docs.openwebui.com/getting-started/env-configuration#retrieval-augmented-generation-rag enabled: true # -- Vector database configuration # ref: https://docs.openwebui.com/getting-started/env-configuration#vector_db vectorDB: "pgvector" # -- Embedding engine to use for RAG with env `RAG_EMBEDDING_ENGINE`: ""(empty), "ollama", "openai" # ref: https://docs.openwebui.com/getting-started/env-configuration#rag_embedding_engine embeddingEngine: "openai" # -- Embedding model to use for RAG with env `RAG_EMBEDDING_MODEL` # ref: https://docs.openwebui.com/getting-started/env-configuration#rag_embedding_model embeddingModel: "text-embedding-3-small" # This requires an EFS block volume w/ the EFS csi driver installed. # However, there should not be many components remaining that require a persistent volume. # Most persistent elements are stored in RDS persistence: enabled: false extraEnvVars: # -- Default API key value for Pipelines. Should be updated in a production deployment, or be changed to the required API key if not using Pipelines - name: OPENAI_API_KEY # Persistent. Can only be updated in the UI or the database. valueFrom: secretKeyRef: name: open-webui-secrets key: openai-api-key # From the litellm UI at https://litellm.dev.example.com/ui - name: WEBUI_SECRET_KEY valueFrom: secretKeyRef: name: open-webui-secrets key: open-webui-secret-key # randomly generated with keeper and stored in vault. used to encrypt session tokens. this needs to be consistent across all instances for HA. - name: K8S_FLAG value: "True" # sets the OLLAMA_BASE_URL to http://ollama-service.open-webui.svc.cluster.local:11434 - name: ENV value: "dev" # Enables fastapi docs endpoint at /docs - name: WEBUI_URL # Persistent. Can only be updated in the UI or the database. value: "https://open-webui.dev.example.com/" - name: ADMIN_EMAIL # Persistent. Can only be updated in the UI or the database. value: "infrastructure@example.com" - name: ENABLE_ADMIN_CHAT_ACCESS value: "False" # this defaults to true. while this is technically available in the backing DB, for privacy's sake it does not need to be enabled in the UI. - name: DEFAULT_USER_ROLE # Persistent. Can only be updated in the UI or the database. value: "user" # New users are automatically activated with regular user permissions. By default new users need to be manually approved. - name: AUDIO_STT_ENGINE # Persistent. Can only be updated in the UI or the database. value: "openai" # Invoked through litellm - name: AUDIO_STT_MODEL # Persistent. Can only be updated in the UI or the database. value: "whisper" # Deployed in Azure OpenAI and available through litellm - name: AUDIO_STT_OPENAI_API_BASE_URL # Persistent. Can only be updated in the UI or the database. value: "https://litellm.dev.example.com" - name: AUDIO_STT_OPENAI_API_KEY # Persistent. Can only be updated in the UI or the database. valueFrom: secretKeyRef: name: open-webui-secrets key: openai-api-key # Created in the litellm UI at https://litellm.dev.example.com/ui - name: AUDIO_TTS_API_KEY # Persistent. Can only be updated in the UI or the database. valueFrom: secretKeyRef: name: open-webui-secrets key: openai-api-key # Created in the litellm UI at https://litellm.dev.example.com/ui - name: AUDIO_TTS_OPENAI_API_BASE_URL # Persistent. Can only be updated in the UI or the database. value: "https://litellm.dev.example.com" - name: AUDIO_TTS_OPENAI_API_KEY # Persistent. Can only be updated in the UI or the database. valueFrom: secretKeyRef: name: open-webui-secrets key: openai-api-key # Created in the litellm UI at https://litellm.dev.example.com/ui - name: AUDIO_TTS_ENGINE # Persistent. Can only be updated in the UI or the database. value: "openai" # Invoked through litellm - name: AUDIO_TTS_MODEL # Persistent. Can only be updated in the UI or the database. value: "tts" # Deployed in Azure OpenAI and available through litellm - name: AUDIO_TTS_VOICE # persistent. can only be updated in the UI or the database. value: "alloy" # see: https://learn.microsoft.com/en-us/azure/ai-services/openai/reference-preview#properties-for-audio - name: ENABLE_IMAGE_GENERATION # Persistent. Can only be updated in the UI or the database. value: "True" # Disabled by default. - name: IMAGES_OPENAI_API_BASE_URL # Persistent. Can only be updated in the UI or the database. value: "https://litellm.dev.example.com" - name: IMAGES_OPENAI_API_KEY # Persistent. Can only be updated in the UI or the database. valueFrom: secretKeyRef: name: open-webui-secrets key: openai-api-key # Created in the litellm UI at https://litellm.dev.example.com/ui - name: IMAGE_GENERATION_ENGINE # Persistent. Can only be updated in the UI or the database. value: "openai" # Invoked through litellm - name: IMAGE_GENERATION_MODEL # Persistent. Can only be updated in the UI or the database. value: "dall-e-3" # Deployed in Azure OpenAI and available through litellm - name: IMAGE_SIZE # Persistent. Can only be updated in the UI or the database. value: "1024x1024" # Default: 512x512 - name: ENABLE_WEBSOCKET_SUPPORT value: "True" # enables websocket support for HA scaling with redis - name: WEBSOCKET_MANAGER value: "redis" # redis is the only supported manager. - name: SOCKET_LOG_LEVEL value: "DEBUG" # Only for testing - name: WEBSOCKET_REDIS_URL valueFrom: secretKeyRef: name: open-webui-secrets key: redis-connection-string # Deployed in AWS Elasticache via terraform - name: REDIS_URL valueFrom: secretKeyRef: name: open-webui-secrets key: redis-connection-string # Deployed in AWS Elasticache via terraform. Open-WebUI docs recommend setting both REDIS_URL and WEBSOCKET_REDIS_URL to the same value. - name: VECTOR_DB value: "pgvector" - name: RAG_EMBEDDING_ENGINE # Persistent. Can only be updated in the UI or the database. value: "openai" - name: DATABASE_URL valueFrom: secretKeyRef: name: open-webui-secrets key: rds-connection-string - name: PGVECTOR_DB_URL valueFrom: secretKeyRef: name: open-webui-secrets key: rds-connection-string # Larger models need a larger vector dimension. # text-embedding-ada-002 has a vector dimension of 1536 # This needs to be persisted in the database # to migrate the vector dimension, run the utils/update_vector_dimension.sql script. # see the script comments for more details. # see also: https://community.openai.com/t/how-to-deal-with-different-vector-dimensions-for-embeddings-and-search-with-pgvector/602141 - name: PGVECTOR_INITIALIZE_MAX_VECTOR_LENGTH value: "1536" # Open-WebUI uses an aws aurora postgres serverless database that scales from 1 to 16 "Amazon Compute Units", each with 2GB of memory # Each ACU supports up to 1000 connections in total, but do not want to maintain too many idle connections - name: DATABASE_POOL_SIZE value: "20" # With Aurora Serverless, you want to handle sudden traffic spikes without preventing scale-down operations. A moderate overflow allows handling traffic bursts while the database scales up, # without keeping too many idle connections during normal operation. # see: https://docs.sqlalchemy.org/en/20/core/pooling.html#sqlalchemy.pool.QueuePool.params.max_overflow - name: DATABASE_POOL_MAX_OVERFLOW value: "20" # Aurora Serverless can experience brief pauses during scaling operations. # A shorter timeout helps prevent request queuing during these scaling events # we want to fail fast and retry if needed. # see: https://docs.sqlalchemy.org/en/20/core/pooling.html#sqlalchemy.pool.QueuePool.params.timeout - name: DATABASE_POOL_TIMEOUT value: "15" # Recycling connections more frequently helps prevent "connection has been closed" errors that can occur after scaling events # see: https://docs.sqlalchemy.org/en/20/core/pooling.html#setting-pool-recycle - name: DATABASE_POOL_RECYCLE value: "600" - name: S3_ENDPOINT_URL value: "https://s3.us-east-1.amazonaws.com" - name: STORAGE_PROVIDER value: s3 - name: S3_REGION_NAME value: "us-east-1" # Created in terraform, authentication via EKS workload identity - name: S3_BUCKET_NAME value: "my-bucket" - name: CORS_ALLOW_ORIGIN value: "*" - name: SSL_CERT_FILE value: "/etc/ssl/certs/ca-certificates.crt" - name: REQUESTS_CA_BUNDLE value: "/etc/ssl/certs/ca-certificates.crt" - name: RAG_OPENAI_API_BASE_URL # Persistent. Can only be updated in the UI or the database. value: "https://litellm.dev.example.com" - name: RAG_OPENAI_API_KEY # Persistent. Can only be updated in the UI or the database. valueFrom: secretKeyRef: name: open-webui-secrets key: openai-api-key # From the litellm UI at https://litellm.dev.example.com/ui ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 19:17:01 -05:00
yindo closed this issue 2026-02-15 19:17:01 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
awaiting-user-feedback
awaiting-user-feedback
bug
bug
documentation
enhancement
good first issue
help wanted
pull-request
Mirrored from GitHub Pull Request
 question
upstream
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: open-webui/helm-charts#241
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?