Add langfuse chart 1.0.0-rc.2

charts/langfuse/templates/_helpers.tpl

@@ -0,0 +1,449 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "langfuse.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "langfuse.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "langfuse.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "langfuse.labels" -}}
+helm.sh/chart: {{ include "langfuse.chart" . }}
+{{ include "langfuse.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "langfuse.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "langfuse.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "langfuse.serviceAccountName" -}}
+{{- if .Values.langfuse.serviceAccount.create }}
+{{- default (include "langfuse.fullname" .) .Values.langfuse.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.langfuse.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return PostgreSQL hostname
+*/}}
+{{- define "langfuse.postgresql.hostname" -}}
+{{- if .Values.postgresql.host }}
+{{- .Values.postgresql.host }}
+{{- else if .Values.postgresql.deploy }}
+{{- printf "%s-postgresql" (include "langfuse.fullname" .) -}}
+{{- end }}
+{{- end }}
+
+{{/*
+Return Redis hostname
+*/}}
+{{- define "langfuse.redis.hostname" -}}
+{{- if .Values.redis.host }}
+{{- .Values.redis.host }}
+{{- else if .Values.redis.deploy }}
+{{- printf "%s-%s-primary" (include "langfuse.fullname" .) (default "redis" .Values.redis.nameOverride) -}}
+{{- else }}
+{{- fail "redis.host must be set when redis.deploy is false" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return ClickHouse hostname
+*/}}
+{{- define "langfuse.clickhouse.hostname" -}}
+{{- if .Values.clickhouse.host }}
+{{- .Values.clickhouse.host }}
+{{- else if .Values.clickhouse.deploy }}
+{{- printf "%s-clickhouse" (include "langfuse.fullname" .) -}}
+{{- else }}
+{{- fail "clickhouse.host must be set when clickhouse.deploy is false" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return S3/MinIO endpoint -- if not set uses auto-discovery
+*/}}
+{{- define "langfuse.s3.endpoint" -}}
+{{- if or .Values.s3.eventUpload.endpoint .Values.s3.endpoint }}
+{{- .Values.s3.eventUpload.endpoint | default .Values.s3.endpoint }}
+{{- else if .Values.s3.deploy }}
+{{- printf "http://%s-%s:9000" (include "langfuse.fullname" .) (default "s3" .Values.s3.nameOverride) -}}
+{{- else }}
+{{- end }}
+{{- end }}
+
+{{/*
+Get a value from either a direct value or a secret reference, or nothing if neither is provided
+*/}}
+{{- define "langfuse.getValueOrSecret" -}}
+{{- if (and .value.secretKeyRef.name .value.secretKeyRef.key) -}}
+{{- if .value.value -}}
+{{- fail (printf ".value and .secretKeyRef are mutually exclusive for %s" .key) -}}
+{{- end -}}
+valueFrom:
+  secretKeyRef:
+    name: {{ .value.secretKeyRef.name }}
+    key: {{ .value.secretKeyRef.key }}
+{{- else if .value.value -}}
+value: {{ .value.value | quote }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+    Get a required value from either a direct value or a secret reference
+*/}}
+{{- define "langfuse.getRequiredValueOrSecret" -}}
+{{- with (include "langfuse.getValueOrSecret" .) -}}
+{{ . }}
+{{- else -}}
+{{ fail (printf "no valid value or secretKeyRef provided for %s" .key) }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get value of a specific environment variable from additionalEnv if it exists
+*/}}
+{{- define "langfuse.getEnvVar" -}}
+{{- $envVarName := .name -}}
+{{- range .env -}}
+{{- if eq .name $envVarName -}}
+{{ .value }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+    Database related configurations by environment variables
+    Compare with https://langfuse.com/self-hosting/configuration#environment-variables
+*/}}
+{{- define "langfuse.databaseEnv" -}}
+{{- with (include "langfuse.getEnvVar" (dict "env" .Values.langfuse.additionalEnv "name" "DATABASE_URL")) -}}
+- name: DATABASE_URL
+  value: {{ . | quote }}
+{{- else -}}
+- name: DATABASE_HOST
+  value: {{ include "langfuse.postgresql.hostname" . | quote }}
+{{- if .Values.postgresql.port }}
+- name: DATABASE_PORT
+  value: {{ .Values.postgresql.port | quote }}
+{{- end }}
+{{- if .Values.postgresql.auth.username }}
+- name: DATABASE_USERNAME
+  value: {{ .Values.postgresql.auth.username | quote }}
+{{- end }}
+- name: DATABASE_PASSWORD
+{{- if .Values.postgresql.auth.existingSecret }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.postgresql.auth.existingSecret }}
+      key: {{ required "postgresql.auth.secretKeys.userPasswordKey is required when using an existing secret" .Values.postgresql.auth.secretKeys.userPasswordKey }}
+{{- else }}
+  value: {{ required "Using an existing secret or postgresql.auth.password is required" .Values.postgresql.auth.password | quote }}
+{{- end }}
+{{- end }}
+{{- if .Values.postgresql.auth.database }}
+- name: DATABASE_NAME
+  value: {{ .Values.postgresql.auth.database | quote }}
+{{- end }}
+{{- if .Values.postgresql.args }}
+- name: DATABASE_ARGS
+  value: {{ .Values.postgresql.args | quote }}
+{{- end }}
+{{- if .Values.postgresql.directUrl }}
+- name: DIRECT_URL
+  value: {{ .Values.postgresql.directUrl | quote }}
+{{- end }}
+{{- if .Values.postgresql.shadowDatabaseUrl }}
+- name: SHADOW_DATABASE_URL
+  value: {{ .Values.postgresql.shadowDatabaseUrl | quote }}
+{{- end }}
+- name: LANGFUSE_AUTO_POSTGRES_MIGRATION_DISABLED
+  value: {{ not .Values.postgresql.migration.autoMigrate | quote }}
+{{- end -}}
+
+{{/*
+    Langfuse Server related configurations by environment variables
+    Compare with https://langfuse.com/self-hosting/configuration#environment-variables
+*/}}
+{{- define "langfuse.serverEnv" -}}
+- name: NODE_ENV
+  value: {{ .Values.langfuse.nodeEnv | quote }}
+- name: LANGFUSE_LOG_LEVEL
+  value: {{ .Values.langfuse.logging.level | quote }}
+- name: LANGFUSE_LOG_FORMAT
+  value: {{ .Values.langfuse.logging.format | quote }}
+{{- with (include "langfuse.getRequiredValueOrSecret" (dict "key" "langfuse.salt" "value" .Values.langfuse.salt) ) }}
+- name: SALT
+  {{- . | nindent 2 }}
+{{- end }}
+{{- with (include "langfuse.getValueOrSecret" (dict "key" "langfuse.encryptionKey" "value" .Values.langfuse.encryptionKey) ) }}
+- name: ENCRYPTION_KEY
+  {{- . | nindent 2 }}
+{{- end }}
+{{- with (include "langfuse.getValueOrSecret" (dict "key" "langfuse.licenseKey" "value" .Values.langfuse.licenseKey)) }}
+- name: LANGFUSE_EE_LICENSE_KEY
+  {{- . | nindent 2 }}
+{{- end }}
+- name: TELEMETRY_ENABLED
+  value: {{ .Values.langfuse.features.telemetryEnabled | quote }}
+- name: NEXT_PUBLIC_SIGN_UP_DISABLED
+  value: {{ .Values.langfuse.features.signUpDisabled | quote }}
+- name: ENABLE_EXPERIMENTAL_FEATURES
+  value: {{ .Values.langfuse.features.experimentalFeaturesEnabled | quote }}
+{{- end -}}
+
+{{/*
+    NextAuth related configurations by environment variables
+    Compare with https://langfuse.com/self-hosting/configuration#environment-variables
+*/}}
+{{- define "langfuse.nextauthEnv" -}}
+- name: NEXTAUTH_URL
+  value: {{ .Values.langfuse.nextauth.url | quote }}
+- name: NEXTAUTH_SECRET
+  {{- include "langfuse.getRequiredValueOrSecret" (dict "key" "langfuse.nextauth.secret" "value" .Values.langfuse.nextauth.secret) | nindent 2 }}
+{{- end -}}
+
+{{/*
+    Redis related configurations by environment variables
+    Compare with https://langfuse.com/self-hosting/configuration#environment-variables
+*/}}
+{{- define "langfuse.redisEnv" -}}
+- name: REDIS_PASSWORD
+{{- if .Values.redis.auth.existingSecret }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.redis.auth.existingSecret }}
+      key: {{ required "redis.auth.existingSecretPasswordKey is required when using an existing secret" .Values.redis.auth.existingSecretPasswordKey }}
+{{- else }}
+  value: {{ required "Using an existing secret or redis.auth.password is required" .Values.redis.auth.password | quote }}
+{{- end }}
+- name: REDIS_CONNECTION_STRING
+  value: "redis://{{ .Values.redis.auth.username | default "default" }}:$(REDIS_PASSWORD)@{{ include "langfuse.redis.hostname" . }}:{{ .Values.redis.port }}/{{ .Values.redis.auth.database }}"
+{{- end -}}
+
+
+{{/*
+    Clickhouse related configurations by environment variables
+    Compare with https://langfuse.com/self-hosting/configuration#environment-variables
+*/}}
+{{- define "langfuse.clickhouseEnv" -}}
+- name: CLICKHOUSE_MIGRATION_URL
+  value: "clickhouse://{{ include "langfuse.clickhouse.hostname" . }}:{{ .Values.clickhouse.nativePort }}"
+- name: CLICKHOUSE_URL
+  value: "http://{{ include "langfuse.clickhouse.hostname" . }}:{{ .Values.clickhouse.httpPort }}"
+- name: CLICKHOUSE_USER
+  value: {{ required "clickhouse.auth.username is required" .Values.clickhouse.auth.username | quote }}
+- name: CLICKHOUSE_PASSWORD
+{{- if .Values.clickhouse.auth.existingSecret }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.clickhouse.auth.existingSecret }}
+      key: {{ required "clickhouse.auth.existingSecretKey is required when using an existing secret" .Values.clickhouse.auth.existingSecretKey }}
+{{- else }}
+  value: {{ required "Configuring an existing secret or clickhouse.auth.password is required" .Values.clickhouse.auth.password | quote }}
+{{- end }}
+{{- if $.Values.clickhouse.replicaCount | int | eq 1 -}}
+- name: CLICKHOUSE_CLUSTER_ENABLED
+  value: "false"
+{{- end -}}
+{{- end -}}
+
+{{/*
+    Get a s3 related config by value or secret. Lookup the bucket value, if not found lookup the shared config.
+    If no value or secret is found, return an empty value (e.g. for role IRSA on AWS)
+*/}}
+{{- define "langfuse.getS3ValueOrSecret" -}}
+{{- with (include "langfuse.getValueOrSecret" (dict "key" (printf ".Values.s3.%s.%s" .bucket .key) "value" (index .values .bucket .key)) ) -}}
+{{- . }}
+{{- else }}
+{{- with (include "langfuse.getValueOrSecret" (dict "key" (printf ".Values.s3.%s" .key) "value" (index .values .key)) ) -}}
+{{- . }}
+{{- else -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+    S3/MinIO related configurations by environment variables
+    Compare with https://langfuse.com/self-hosting/configuration#environment-variables
+*/}}
+{{- define "langfuse.s3Env" -}}
+- name: LANGFUSE_S3_EVENT_UPLOAD_BUCKET
+{{- if $.Values.s3.deploy }}
+  value: {{ required "s3.[eventUpload].bucket is required" (coalesce .Values.s3.eventUpload.bucket .Values.s3.bucket .Values.s3.defaultBuckets) | quote }}
+{{- else }}
+  value: {{ required "s3.[eventUpload].bucket is required" (.Values.s3.eventUpload.bucket | default .Values.s3.bucket) | quote }}
+{{- end }}
+{{- if .Values.s3.eventUpload.prefix }}
+- name: LANGFUSE_S3_EVENT_UPLOAD_PREFIX
+  value: {{ .Values.s3.eventUpload.prefix | quote }}
+{{- end }}
+{{- if or .Values.s3.eventUpload.region .Values.s3.region }}
+- name: LANGFUSE_S3_EVENT_UPLOAD_REGION
+  value: {{ .Values.s3.eventUpload.region | default .Values.s3.region | quote }}
+{{- end }}
+{{- with (include "langfuse.s3.endpoint" .) }}
+- name: LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT
+  value: {{ . | quote }}
+{{- end }}
+{{- with (include "langfuse.getS3ValueOrSecret" (dict "key" "accessKeyId" "bucket" "eventUpload" "values" .Values.s3) ) }}
+- name: LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID
+  {{- . | nindent 2 }}
+{{- else }}
+{{- if .Values.s3.deploy }}
+- name: LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID
+  value: {{ .Values.s3.auth.rootUser | quote }}
+{{- end }}
+{{- end }}
+{{- with (include "langfuse.getS3ValueOrSecret" (dict "key" "secretAccessKey" "bucket" "eventUpload" "values" .Values.s3) ) }}
+- name: LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
+  {{- . | nindent 2 }}
+{{- else }}
+{{- if .Values.s3.deploy }}
+- name: LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
+  value: {{ .Values.s3.auth.rootPassword | quote }}
+{{- end }}
+{{- end }}
+{{- if or .Values.s3.eventUpload.forcePathStyle .Values.s3.forcePathStyle }}
+- name: LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE
+  value: {{ .Values.s3.eventUpload.forcePathStyle | default .Values.s3.forcePathStyle | quote }}
+{{- end }}
+- name: LANGFUSE_S3_BATCH_EXPORT_ENABLED
+  value: {{ .Values.s3.batchExport.enabled | quote }}
+{{- if $.Values.s3.batchExport.enabled }}
+- name: LANGFUSE_S3_BATCH_EXPORT_BUCKET
+{{- if $.Values.s3.deploy }}
+  value: {{ required "s3.[batchExport].bucket is required" (coalesce .Values.s3.batchExport.bucket .Values.s3.bucket .Values.s3.defaultBuckets) | quote }}
+{{- else }}
+  value: {{ required "s3.[batchExport].bucket is required" (.Values.s3.batchExport.bucket | default .Values.s3.bucket) | quote }}
+{{- end }}
+{{- if or .Values.s3.batchExport.prefix .Values.s3.prefix }}
+- name: LANGFUSE_S3_BATCH_EXPORT_PREFIX
+  value: {{ .Values.s3.batchExport.prefix | default .Values.s3.prefix | quote }}
+{{- end }}
+{{- if or .Values.s3.batchExport.region .Values.s3.region }}
+- name: LANGFUSE_S3_BATCH_EXPORT_REGION
+  value: {{ .Values.s3.batchExport.region | default .Values.s3.region | quote }}
+{{- end }}
+{{- with (include "langfuse.s3.endpoint" .) }}
+- name: LANGFUSE_S3_BATCH_EXPORT_ENDPOINT
+  value: {{ . | quote }}
+{{- end }}
+{{- with (include "langfuse.getS3ValueOrSecret" (dict "key" "accessKeyId" "bucket" "batchExport" "values" .Values.s3) ) }}
+- name: LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID
+  {{- . | nindent 2 }}
+{{- else }}
+{{- if .Values.s3.deploy }}
+- name: LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID
+  value: {{ .Values.s3.auth.rootUser | quote }}
+{{- end }}
+{{- end }}
+{{- with (include "langfuse.getS3ValueOrSecret" (dict "key" "secretAccessKey" "bucket" "batchExport" "values" .Values.s3) ) }}
+- name: LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY
+  {{- . | nindent 2 }}
+{{- else }}
+{{- if .Values.s3.deploy }}
+- name: LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY
+  value: {{ .Values.s3.auth.rootPassword | quote }}
+{{- end }}
+{{- end }}
+{{- if or .Values.s3.batchExport.forcePathStyle .Values.s3.forcePathStyle }}
+- name: LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE
+  value: {{ .Values.s3.batchExport.forcePathStyle | default .Values.s3.forcePathStyle | quote }}
+{{- end }}
+{{- end }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_BUCKET
+{{- if $.Values.s3.deploy }}
+  value: {{ required "s3.[mediaUpload].bucket is required" (coalesce .Values.s3.mediaUpload.bucket .Values.s3.bucket .Values.s3.defaultBuckets) | quote }}
+{{- else }}
+  value: {{ required "s3.[mediaUpload].bucket is required" (.Values.s3.mediaUpload.bucket | default .Values.s3.bucket) | quote }}
+{{- end }}
+{{- if or .Values.s3.mediaUpload.prefix .Values.s3.prefix }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_PREFIX
+  value: {{ .Values.s3.mediaUpload.prefix | default .Values.s3.prefix | quote }}
+{{- end }}
+{{- if or .Values.s3.mediaUpload.region .Values.s3.region }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_REGION
+  value: {{ .Values.s3.mediaUpload.region | default .Values.s3.region | quote }}
+{{- end }}
+{{- with (include "langfuse.s3.endpoint" .) }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT
+  value: {{ . | quote }}
+{{- end }}
+{{- with (include "langfuse.getS3ValueOrSecret" (dict "key" "accessKeyId" "bucket" "mediaUpload" "values" .Values.s3) ) }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID
+  {{- . | nindent 2 }}
+{{- else }}
+{{- if .Values.s3.deploy }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID
+  value: {{ .Values.s3.auth.rootUser | quote }}
+{{- end }}
+{{- end }}
+{{- with (include "langfuse.getS3ValueOrSecret" (dict "key" "secretAccessKey" "bucket" "mediaUpload" "values" .Values.s3) ) }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY
+  {{- . | nindent 2 }}
+{{- else }}
+{{- if .Values.s3.deploy }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY
+  value: {{ .Values.s3.auth.rootPassword | quote }}
+{{- end }}
+{{- end }}
+{{- if or .Values.s3.mediaUpload.forcePathStyle .Values.s3.forcePathStyle }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE
+  value: {{ .Values.s3.mediaUpload.forcePathStyle | default .Values.s3.forcePathStyle | quote }}
+{{- end }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_MAX_CONTENT_LENGTH
+  value: {{ .Values.s3.mediaUpload.maxContentLength | quote }}
+- name: LANGFUSE_S3_MEDIA_UPLOAD_DOWNLOAD_URL_EXPIRY_SECONDS
+  value: {{ .Values.s3.mediaUpload.downloadUrlExpirySeconds | quote }}
+{{- end -}}
+
+{{/*
+Common environment variables for all deployments
+*/}}
+{{- define "langfuse.commonEnv" -}}
+{{ include "langfuse.serverEnv" . }}
+{{ include "langfuse.nextauthEnv" . }}
+{{ include "langfuse.databaseEnv" . }}
+{{ include "langfuse.redisEnv" . }}
+{{ include "langfuse.clickhouseEnv" . }}
+{{ include "langfuse.s3Env" . }}
+{{- end -}}

charts/langfuse/templates/extra-manifests.yaml

@@ -0,0 +1,4 @@
+{{- range .Values.extraManifests }}
+---
+{{- toYaml .  }}
+{{- end }}

charts/langfuse/templates/ingress.yaml

@@ -0,0 +1,62 @@
+{{- if .Values.langfuse.ingress.enabled -}}
+{{- if and .Values.langfuse.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.langfuse.ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.langfuse.ingress.annotations "kubernetes.io/ingress.class" .Values.langfuse.ingress.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ include "langfuse.fullname" . }}
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+    {{- with .Values.langfuse.ingress.additionalLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.langfuse.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.langfuse.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.langfuse.ingress.className }}
+  {{- end }}
+  {{- if .Values.langfuse.ingress.tls.enabled }}
+  tls:
+    {{- if .Values.langfuse.ingress.tls.enabled }}
+    - hosts:
+        {{- range .Values.langfuse.ingress.hosts }}
+        - {{ .host | quote }}
+        {{- end }}
+      secretName: {{ .Values.langfuse.ingress.tls.secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.langfuse.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ include "langfuse.fullname" $ }}-web
+                port:
+                  name: http
+              {{- else }}
+              serviceName: {{ include "langfuse.fullname" $ }}-web
+              servicePort: http
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/langfuse/templates/nextauth-secret.yaml

@@ -0,0 +1,10 @@
+{{- if $.Values.langfuse.nextauth.secret.value }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "langfuse.fullname" . }}-nextauth
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+data:
+  nextauth-secret: {{ $.Values.langfuse.nextauth.secret.value | toString | b64enc }}
+{{- end }}

charts/langfuse/templates/postgresql-secret.yaml

@@ -0,0 +1,17 @@
+{{- if and (not .Values.postgresql.deploy) (.Values.postgresql.auth.password) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "langfuse.fullname" . }}-postgresql
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+type: Opaque
+data:
+  postgres-password: {{ .Values.postgresql.auth.password | toString | b64enc | quote }}
+  {{- if .Values.postgresql.directUrl }}
+  postgres-direct-url: {{ .Values.postgresql.directUrl | toString | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.postgresql.shadowDatabaseUrl }}
+  postgres-shadow-database-url: {{ .Values.postgresql.shadowDatabaseUrl | toString | b64enc | quote }}
+  {{- end }}
+{{- end }}

charts/langfuse/templates/serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.langfuse.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "langfuse.serviceAccountName" . }}
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+  {{- with .Values.langfuse.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/langfuse/templates/validations.yaml

@@ -0,0 +1,176 @@
+# Validate Langfuse Server settings
+{{- if not (has $.Values.langfuse.logging.level (list "trace" "debug" "info" "warn" "error" "fatal")) -}}
+    {{- fail "langfuse.logging.level must be one of: trace, debug, info, warn, error, fatal" -}}
+{{- end -}}
+{{- if not (has $.Values.langfuse.logging.format (list "text" "json")) -}}
+    {{- fail "langfuse.logging.format must be one of: text, json" -}}
+{{- end -}}
+
+
+# Validate ClickHouse settings
+{{- if ne ($.Values.clickhouse.shards | int) 1 -}}
+    {{- fail "Langfuse does not support ClickHouse with multiple shards. Set clickhouse.shards to 1 to continue." -}}
+{{- end -}}
+
+{{- if and (not $.Values.clickhouse.deploy) (not $.Values.clickhouse.host) -}}
+    {{- fail "ClickHouse host must be configured when using an external ClickHouse instance. Set clickhouse.host to continue." -}}
+{{- end -}}
+
+# Validate Redis settings
+{{- if and $.Values.redis.deploy (not (has "--maxmemory-policy noeviction" $.Values.redis.primary.extraFlags)) -}}
+    {{- fail "Langfuse requires valkey to be deployed with the `--maxmemory-policy noeviction` flag. Set redis.primary.extraFlags to include this flag to continue." -}}
+{{- end -}}
+
+{{- if and (not $.Values.redis.deploy) (not $.Values.redis.host) -}}
+    {{- fail "Redis host must be configured when using an external Redis instance. Set redis.host to continue." -}}
+{{- end -}}
+
+
+# Validate S3 settings
+#   Event Upload
+{{- if and $.Values.s3.deploy (not (or $.Values.s3.forcePathStyle $.Values.s3.eventUpload.forcePathStyle)) -}}
+    {{- fail "MinIO requires s3 to be deployed with a forcePathStyle. Set s3.forcePathStyle or s3.eventUpload.forcePathStyle to continue." -}}
+{{- end -}}
+
+{{- if and (not $.Values.s3.deploy) (not (or $.Values.s3.bucket $.Values.s3.eventUpload.bucket)) -}}
+    {{- fail "S3 bucket must be configured for external provider. Set s3.bucket or s3.eventUpload.bucket to continue." -}}
+{{- end -}}
+
+#   Batch Export
+{{- if $.Values.s3.batchExport.enabled -}}
+{{- if and $.Values.s3.deploy (not (or $.Values.s3.forcePathStyle $.Values.s3.batchExport.forcePathStyle)) -}}
+    {{- fail "MinIO requires s3 to be deployed with a forcePathStyle. Set s3.forcePathStyle or s3.batchExport.forcePathStyle to continue." -}}
+{{- end -}}
+
+{{- if and (not $.Values.s3.deploy) (not (or $.Values.s3.bucket $.Values.s3.batchExport.bucket)) -}}
+    {{- fail "S3 bucket must be configured for external provider. Set s3.bucket or s3.batchExport.bucket to continue." -}}
+{{- end -}}
+{{- end -}}
+
+#   Media Upload
+{{- if and $.Values.s3.deploy (not (or $.Values.s3.forcePathStyle $.Values.s3.mediaUpload.forcePathStyle)) -}}
+    {{- fail "MinIO requires s3 to be deployed with a forcePathStyle. Set s3.forcePathStyle or s3.mediaUpload.forcePathStyle to continue." -}}
+{{- end -}}
+
+{{- if and (not $.Values.s3.deploy) (not (or $.Values.s3.bucket $.Values.s3.mediaUpload.bucket)) -}}
+    {{- fail "S3 bucket must be configured for external provider. Set s3.bucket or s3.mediaUpload.bucket to continue." -}}
+{{- end -}}
+
+# Validate that only one of additionalEnv or new structure is configured for PostgreSQL
+{{- if and $.Values.postgresql.host (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "DATABASE_HOST")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either postgresql.host or langfuse.additionalEnv[name: DATABASE_HOST] to continue." -}}
+{{- end -}}
+{{- if and $.Values.postgresql.port (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "DATABASE_PORT")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either postgresql.port or langfuse.additionalEnv[name: DATABASE_PORT] to continue." -}}
+{{- end -}}
+{{- if and $.Values.postgresql.auth.username (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "DATABASE_USERNAME")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either postgresql.auth.username or langfuse.additionalEnv[name: DATABASE_USERNAME] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.postgresql.auth.password $.Values.postgresql.auth.existingSecret) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "DATABASE_PASSWORD")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either postgresql.auth.password/existingSecret or langfuse.additionalEnv[name: DATABASE_PASSWORD] to continue." -}}
+{{- end -}}
+{{- if and $.Values.postgresql.auth.database (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "DATABASE_NAME")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either postgresql.auth.database or langfuse.additionalEnv[name: DATABASE_NAME] to continue." -}}
+{{- end -}}
+
+# Validate that only one of additionalEnv or new structure is configured for Redis
+{{- if and $.Values.redis.host (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "REDIS_CONNECTION_STRING")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either redis configuration or langfuse.additionalEnv[name: REDIS_CONNECTION_STRING] to continue." -}}
+{{- end -}}
+
+# Validate that only one of additionalEnv or new structure is configured for ClickHouse
+{{- if and $.Values.clickhouse.host (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "CLICKHOUSE_MIGRATION_URL")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either clickhouse configuration or langfuse.additionalEnv[name: CLICKHOUSE_MIGRATION_URL] to continue." -}}
+{{- end -}}
+{{- if and $.Values.clickhouse.host (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "CLICKHOUSE_URL")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either clickhouse configuration or langfuse.additionalEnv[name: CLICKHOUSE_URL] to continue." -}}
+{{- end -}}
+{{- if and $.Values.clickhouse.auth.username (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "CLICKHOUSE_USER")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either clickhouse.auth.username or langfuse.additionalEnv[name: CLICKHOUSE_USER] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.clickhouse.auth.password $.Values.clickhouse.auth.existingSecret) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "CLICKHOUSE_PASSWORD")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either clickhouse.auth.password or langfuse.additionalEnv[name: CLICKHOUSE_PASSWORD] to continue." -}}
+{{- end -}}
+
+# Validate that only one of additionalEnv or new structure is configured for S3/MinIO
+## Event Upload - Check both specific and global settings
+{{- if and (or $.Values.s3.eventUpload.bucket $.Values.s3.bucket) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_EVENT_UPLOAD_BUCKET")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[eventUpload.]bucket or langfuse.additionalEnv[name: LANGFUSE_S3_EVENT_UPLOAD_BUCKET] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.s3.eventUpload.region $.Values.s3.region) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_EVENT_UPLOAD_REGION")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[eventUpload.]region or langfuse.additionalEnv[name: LANGFUSE_S3_EVENT_UPLOAD_REGION] to continue." -}}
+{{- end -}}
+{{- if and (or (or $.Values.s3.eventUpload.accessKeyId.value $.Values.s3.eventUpload.accessKeyId.secretKeyRef.name) (or $.Values.s3.accessKeyId.value $.Values.s3.accessKeyId.secretKeyRef.name)) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[eventUpload.]accessKeyId or langfuse.additionalEnv[name: LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID] to continue." -}}
+{{- end -}}
+{{- if and (or (or $.Values.s3.eventUpload.secretAccessKey.value $.Values.s3.eventUpload.secretAccessKey.secretKeyRef.name) (or $.Values.s3.secretAccessKey.value $.Values.s3.secretAccessKey.secretKeyRef.name)) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[eventUpload.]secretAccessKey or langfuse.additionalEnv[name: LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.s3.eventUpload.endpoint $.Values.s3.endpoint) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[eventUpload.]endpoint or langfuse.additionalEnv[name: LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.s3.eventUpload.forcePathStyle $.Values.s3.forcePathStyle) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[eventUpload.]forcePathStyle or langfuse.additionalEnv[name: LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE] to continue." -}}
+{{- end -}}
+
+## Batch Export - Check both specific and global settings
+{{- if and (or $.Values.s3.batchExport.bucket $.Values.s3.bucket) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_BATCH_EXPORT_BUCKET")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[batchExport.]bucket or langfuse.additionalEnv[name: LANGFUSE_S3_BATCH_EXPORT_BUCKET] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.s3.batchExport.region $.Values.s3.region) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_BATCH_EXPORT_REGION")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[batchExport.]region or langfuse.additionalEnv[name: LANGFUSE_S3_BATCH_EXPORT_REGION] to continue." -}}
+{{- end -}}
+{{- if and (or (or $.Values.s3.batchExport.accessKeyId.value $.Values.s3.batchExport.accessKeyId.secretKeyRef.name) (or $.Values.s3.accessKeyId.value $.Values.s3.accessKeyId.secretKeyRef.name)) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[batchExport.]accessKeyId or langfuse.additionalEnv[name: LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID] to continue." -}}
+{{- end -}}
+{{- if and (or (or $.Values.s3.batchExport.secretAccessKey.value $.Values.s3.batchExport.secretAccessKey.secretKeyRef.name) (or $.Values.s3.secretAccessKey.value $.Values.s3.secretAccessKey.secretKeyRef.name)) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[batchExport.]secretAccessKey or langfuse.additionalEnv[name: LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.s3.batchExport.endpoint $.Values.s3.endpoint) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_BATCH_EXPORT_ENDPOINT")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[batchExport.]endpoint or langfuse.additionalEnv[name: LANGFUSE_S3_BATCH_EXPORT_ENDPOINT] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.s3.batchExport.forcePathStyle $.Values.s3.forcePathStyle) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[batchExport.]forcePathStyle or langfuse.additionalEnv[name: LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE] to continue." -}}
+{{- end -}}
+
+## Media Upload - Check both specific and global settings
+{{- if and (or $.Values.s3.mediaUpload.bucket $.Values.s3.bucket) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_MEDIA_UPLOAD_BUCKET")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[mediaUpload.]bucket or langfuse.additionalEnv[name: LANGFUSE_S3_MEDIA_UPLOAD_BUCKET] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.s3.mediaUpload.region $.Values.s3.region) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_MEDIA_UPLOAD_REGION")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[mediaUpload.]region or langfuse.additionalEnv[name: LANGFUSE_S3_MEDIA_UPLOAD_REGION] to continue." -}}
+{{- end -}}
+{{- if and (or (or $.Values.s3.mediaUpload.accessKeyId.value $.Values.s3.mediaUpload.accessKeyId.secretKeyRef.name) (or $.Values.s3.accessKeyId.value $.Values.s3.accessKeyId.secretKeyRef.name)) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[mediaUpload.]accessKeyId or langfuse.additionalEnv[name: LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID] to continue." -}}
+{{- end -}}
+{{- if and (or (or $.Values.s3.mediaUpload.secretAccessKey.value $.Values.s3.mediaUpload.secretAccessKey.secretKeyRef.name) (or $.Values.s3.secretAccessKey.value $.Values.s3.secretAccessKey.secretKeyRef.name)) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[mediaUpload.]secretAccessKey or langfuse.additionalEnv[name: LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.s3.mediaUpload.endpoint $.Values.s3.endpoint) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[mediaUpload.]endpoint or langfuse.additionalEnv[name: LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT] to continue." -}}
+{{- end -}}
+{{- if and (or $.Values.s3.mediaUpload.forcePathStyle $.Values.s3.forcePathStyle) (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either s3.[mediaUpload.]forcePathStyle or langfuse.additionalEnv[name: LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE] to continue." -}}
+{{- end -}}
+
+# Validate that only one of additionalEnv or new structure is configured for Feature Flags
+{{- if and $.Values.langfuse.features.telemetryEnabled (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "TELEMETRY_ENABLED")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either langfuse.features.telemetryEnabled or langfuse.additionalEnv[name: TELEMETRY_ENABLED] to continue." -}}
+{{- end -}}
+{{- if and $.Values.langfuse.features.signUpDisabled (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "NEXT_PUBLIC_SIGN_UP_DISABLED")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either langfuse.features.signUpDisabled or langfuse.additionalEnv[name: NEXT_PUBLIC_SIGN_UP_DISABLED] to continue." -}}
+{{- end -}}
+{{- if and $.Values.langfuse.features.experimentalFeaturesEnabled (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "ENABLE_EXPERIMENTAL_FEATURES")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either langfuse.features.experimentalFeaturesEnabled or langfuse.additionalEnv[name: ENABLE_EXPERIMENTAL_FEATURES] to continue." -}}
+{{- end -}}
+
+# Validate that only one of additionalEnv or new structure is configured for Authentication and Security
+{{- if and $.Values.langfuse.salt (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "SALT")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either langfuse.salt or langfuse.additionalEnv[name: SALT] to continue." -}}
+{{- end -}}
+{{- if and $.Values.langfuse.encryptionKey (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "ENCRYPTION_KEY")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either langfuse.encryptionKey or langfuse.additionalEnv[name: ENCRYPTION_KEY] to continue." -}}
+{{- end -}}
+{{- if and $.Values.langfuse.nextauth.secret (include "langfuse.getEnvVar" (dict "env" $.Values.langfuse.additionalEnv "name" "NEXTAUTH_SECRET")) -}}
+    {{- fail "Only one of additionalEnv or the new structure can be configured. Set either langfuse.nextauth.secret or langfuse.additionalEnv[name: NEXTAUTH_SECRET] to continue." -}}
+{{- end -}}

charts/langfuse/templates/web/deployment.yaml

@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "langfuse.fullname" . }}-web
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.langfuse.web.hpa.enabled }}
+  replicas: {{ .Values.langfuse.web.replicas | default .Values.langfuse.replicas }}
+  {{- end }}
+  {{- if .Values.langfuse.web.hostAliases }}
+  hostAliases:
+    {{- toYaml .Values.langfuse.web.hostAliases | nindent 8 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "langfuse.selectorLabels" . | nindent 6 }}
+      app: web
+  template:
+    metadata:
+      {{- with .Values.langfuse.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "langfuse.selectorLabels" . | nindent 8 }}
+        app: web
+    spec:
+      {{- with (.Values.langfuse.web.image.pullSecrets | default .Values.langfuse.image.pullSecrets) }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "langfuse.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.langfuse.podSecurityContext | nindent 8 }}
+      {{- if .Values.langfuse.extraInitContainers }}
+      initContainers:
+        {{- toYaml .Values.langfuse.extraInitContainers | nindent 8 }}
+      {{- end }}
+      {{- if .Values.langfuse.extraVolumes }}
+      volumes:
+        {{- toYaml .Values.langfuse.extraVolumes | nindent 8 }}
+      {{- end }}
+      containers:
+        {{- if .Values.langfuse.extraContainers }}
+        {{- toYaml .Values.langfuse.extraContainers | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}-web
+          securityContext:
+            {{- toYaml .Values.langfuse.securityContext | nindent 12 }}
+          image: "{{ .Values.langfuse.web.image.repository }}:{{ coalesce .Values.langfuse.web.image.tag .Values.langfuse.image.tag .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.langfuse.web.image.pullPolicy | default .Values.langfuse.image.pullPolicy }}
+          env:
+            {{- include "langfuse.commonEnv" . | nindent 12 }}
+            - name: PORT
+              value: {{ .Values.langfuse.web.service.port | quote }}
+            - name: HOSTNAME
+              value: "0.0.0.0"
+            {{- if .Values.langfuse.additionalEnv }}
+              {{- toYaml .Values.langfuse.additionalEnv | nindent 12 }}
+            {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.langfuse.web.service.port }}
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.langfuse.web.livenessProbe.path | default "/api/public/health" }}
+              port: http
+            initialDelaySeconds: {{ .Values.langfuse.web.livenessProbe.initialDelaySeconds | default 20 }}
+            periodSeconds: {{ .Values.langfuse.web.livenessProbe.periodSeconds | default 10 }}
+            timeoutSeconds: {{ .Values.langfuse.web.livenessProbe.timeoutSeconds | default 5 }}
+            successThreshold: {{ .Values.langfuse.web.livenessProbe.successThreshold | default 1 }}
+            failureThreshold: {{ .Values.langfuse.web.livenessProbe.failureThreshold | default 5 }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.langfuse.web.readinessProbe.path | default "/api/public/ready" }}
+              port: http
+            initialDelaySeconds: {{ .Values.langfuse.web.readinessProbe.initialDelaySeconds | default 20 }}
+            periodSeconds: {{ .Values.langfuse.web.readinessProbe.periodSeconds | default 10 }}
+            timeoutSeconds: {{ .Values.langfuse.web.readinessProbe.timeoutSeconds | default 5 }}
+            successThreshold: {{ .Values.langfuse.web.readinessProbe.successThreshold | default 1 }}
+            failureThreshold: {{ .Values.langfuse.web.readinessProbe.failureThreshold | default 5 }}
+          resources:
+            {{- toYaml (.Values.langfuse.web.resources | default .Values.langfuse.resources) | nindent 12 }}
+          {{- if .Values.langfuse.extraVolumeMounts }}
+          volumeMounts:
+            {{- toYaml .Values.langfuse.extraVolumeMounts | nindent 12 }}
+          {{- end }}
+      {{- with .Values.langfuse.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.langfuse.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.langfuse.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/langfuse/templates/web/hpa.yaml

@@ -0,0 +1,32 @@
+{{- if ((.Values.langfuse.web).hpa).enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "langfuse.fullname" . }}-web
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "langfuse.fullname" . }}-web
+  minReplicas: {{ .Values.langfuse.web.hpa.minReplicas }}
+  maxReplicas: {{ .Values.langfuse.web.hpa.maxReplicas }}
+  metrics:
+    {{- with .Values.langfuse.web.hpa.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
+    {{- end }}
+    {{- with .Values.langfuse.web.hpa.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
+    {{- end }}
+{{- end }}

charts/langfuse/templates/web/service.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "langfuse.fullname" . }}-web
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+    {{- with .Values.langfuse.web.service.additionalLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+{{- with .Values.langfuse.web.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+{{- end }}
+spec:
+  type: {{ .Values.langfuse.web.service.type }}
+  ports:
+    - port: {{ .Values.langfuse.web.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+      nodePort: {{ .Values.langfuse.web.service.nodePort }}
+  selector:
+    {{- include "langfuse.selectorLabels" . | nindent 4 }}
+    app: web

charts/langfuse/templates/web/vpa.yaml

@@ -0,0 +1,34 @@
+{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1") .Values.langfuse.web.vpa.enabled }}
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: {{ include "langfuse.fullname" . }}-web
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+spec:
+  resourcePolicy:
+    containerPolicies:
+      - containerName: {{ .Chart.Name }}-web
+        {{- with .Values.langfuse.web.vpa.controlledResources }}
+        controlledResources:
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.langfuse.web.vpa.maxAllowed }}
+        maxAllowed:
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.langfuse.web.vpa.minAllowed }}
+        minAllowed:
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "langfuse.fullname" . }}-web
+  {{- if .Values.langfuse.web.vpa.updatePolicy }}
+  updatePolicy:
+    {{- with .Values.langfuse.web.vpa.updatePolicy.updateMode }}
+    updateMode: {{ . }}
+    {{- end }}
+  {{- end }}
+{{- end }}

charts/langfuse/templates/worker/deployment.yaml

@@ -0,0 +1,80 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "langfuse.fullname" . }}-worker
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.langfuse.worker.hpa.enabled }}
+  replicas: {{ .Values.langfuse.worker.replicas | default .Values.langfuse.replicas }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "langfuse.selectorLabels" . | nindent 6 }}
+      app: worker
+  template:
+    metadata:
+      {{- with .Values.langfuse.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "langfuse.selectorLabels" . | nindent 8 }}
+        app: worker
+    spec:
+      {{- with (.Values.langfuse.worker.image.pullSecrets | default .Values.langfuse.image.pullSecrets) }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "langfuse.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.langfuse.podSecurityContext | nindent 8 }}
+      {{- if .Values.langfuse.extraInitContainers }}
+      initContainers:
+        {{- toYaml .Values.langfuse.extraInitContainers | nindent 8 }}
+      {{- end }}
+      {{- if .Values.langfuse.extraVolumes }}
+      volumes:
+        {{- toYaml .Values.langfuse.extraVolumes | nindent 8 }}
+      {{- end }}
+      containers:
+        {{- if .Values.langfuse.extraContainers }}
+        {{- toYaml .Values.langfuse.extraContainers | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}-worker
+          securityContext:
+            {{- toYaml .Values.langfuse.securityContext | nindent 12 }}
+          image: "{{ .Values.langfuse.worker.image.repository }}:{{ coalesce .Values.langfuse.worker.image.tag .Values.langfuse.image.tag .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.langfuse.worker.image.pullPolicy | default .Values.langfuse.image.pullPolicy }}
+          env:
+            {{- include "langfuse.commonEnv" . | nindent 12 }}
+            {{- if .Values.langfuse.additionalEnv }}
+              {{- toYaml .Values.langfuse.additionalEnv | nindent 12 }}
+            {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: {{ .Values.langfuse.worker.livenessProbe.initialDelaySeconds | default 20 }}
+            periodSeconds: {{ .Values.langfuse.worker.livenessProbe.periodSeconds | default 10 }}
+            timeoutSeconds: {{ .Values.langfuse.worker.livenessProbe.timeoutSeconds | default 5 }}
+            successThreshold: {{ .Values.langfuse.worker.livenessProbe.successThreshold | default 1 }}
+            failureThreshold: {{ .Values.langfuse.worker.livenessProbe.failureThreshold | default 5 }}
+          resources:
+            {{- toYaml (.Values.langfuse.worker.resources | default .Values.langfuse.resources) | nindent 12 }}
+          {{- if .Values.langfuse.extraVolumeMounts }}
+          volumeMounts:
+            {{- toYaml .Values.langfuse.extraVolumeMounts | nindent 12 }}
+          {{- end }}
+      {{- with .Values.langfuse.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.langfuse.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.langfuse.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/langfuse/templates/worker/hpa.yaml

@@ -0,0 +1,32 @@
+{{- if ((.Values.langfuse.worker).hpa).enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "langfuse.fullname" . }}-worker
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "langfuse.fullname" . }}-worker
+  minReplicas: {{ .Values.langfuse.worker.hpa.minReplicas }}
+  maxReplicas: {{ .Values.langfuse.worker.hpa.maxReplicas }}
+  metrics:
+    {{- with .Values.langfuse.worker.hpa.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
+    {{- end }}
+    {{- with .Values.langfuse.worker.hpa.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
+    {{- end }}
+{{- end }}

charts/langfuse/templates/worker/vpa.yaml

@@ -0,0 +1,34 @@
+{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1") .Values.langfuse.worker.vpa.enabled }}
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: {{ include "langfuse.fullname" . }}-worker
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+spec:
+  resourcePolicy:
+    containerPolicies:
+      - containerName: {{ .Chart.Name }}-worker
+        {{- with .Values.langfuse.worker.vpa.controlledResources }}
+        controlledResources:
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.langfuse.worker.vpa.maxAllowed }}
+        maxAllowed:
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.langfuse.worker.vpa.minAllowed }}
+        minAllowed:
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "langfuse.fullname" . }}-worker
+  {{- if .Values.langfuse.worker.vpa.updatePolicy }}
+  updatePolicy:
+    {{- with .Values.langfuse.worker.vpa.updatePolicy.updateMode }}
+    updateMode: {{ . }}
+    {{- end }}
+  {{- end }}
+{{- end }}