values.yaml

planeVersion: v2.6.2

dockerRegistry:
  enabled: false
  registry: 'index.docker.io/v1/'
  loginid: ''
  password: ''
  # Name of an existing Kubernetes secret containing docker registry credentials
  existingSecret: ''

license:
  licenseServer: https://prime.plane.so
  licenseDomain: 'plane.example.com'

airgapped:
  enabled: false
  # The boto module used by API does not use the CA bundles in the container, so we need to
  # mount the CA bundle into the API pod by passing it in as an environment
  # variable.
  # Preferred: list of Kubernetes Secrets containing CA certificates (supports multiple certs).
  # Example:
  # s3Secrets:
  #   - name: plane-s3-ca
  #     key: s3-custom-ca.crt
  #   - name: plane-s3-ca-2
  #     key: s3-custom-ca-2.crt
  s3Secrets: []

  # Deprecated (backward compatibility): use a single secret for custom S3 CA.
  # If set, used when s3Secrets is empty. Prefer migrating to s3Secrets.
  # Example:
  # s3SecretName: plane-s3-ca
  # s3SecretKey: s3-custom-ca.crt
  s3SecretName: ""
  s3SecretKey: ""

ingress:
  enabled: true
  minioHost: ''
  rabbitmqHost: ''
  ingressClass: 'traefik'
  # If using nginx ingress controller, set this to 'nginx' and add the appropriate annotations to set the proxy body size limit.
  # These annotations are ONLY rendered when ingressClass is 'nginx' (the nginx Ingress template is gated on
  # ingressClass == "nginx"); they have no effect with traefik. Example:
  # - proxy-body-size: nginx equivalent of traefik's maxRequestBodyBytes (upload size limit).
  # - proxy-buffer-size: size of the buffer for the response headers from upstream; bump this to avoid
  #   "502 upstream sent too big header" errors.
  # ingress_annotations: { "nginx.ingress.kubernetes.io/proxy-body-size": "5m", "nginx.ingress.kubernetes.io/proxy-buffer-size": "16k" }
  traefik:
    maxRequestBodyBytes: 20971520 # in bytes (default: 20 MiB)

ssl:
  tls_secret_name: '' # If you have a custom TLS secret name
  # If you want to use Let's Encrypt, set createIssuer and generateCerts to true
  createIssuer: false
  issuer: http # Allowed : cloudflare, digitalocean, http
  token: '' # not required for http
  server: https://acme-v02.api.letsencrypt.org/directory
  email: plane@example.com
  generateCerts: false

# ============================================================
# Pod Security (Kubernetes Pod Security Admission "restricted")
# ============================================================
# When enabled, applies a hardened pod- and container-level securityContext to
# all first-party Plane workloads: api, web, space, admin, live, worker,
# beat-worker, automation-consumer, outbox-poller, silo, monitor, iframely,
# runner, pi-api/beat/worker, and the migration Jobs (including their busybox
# init containers). Plane's images run fine as non-root, so these defaults
# satisfy the PSA "restricted" profile.
#
# NOT applied to:
#   - The bundled local infrastructure (postgres, redis, rabbitmq, minio,
#     opensearch): third-party images with their own UID/GID requirements,
#     intended for local/dev use. In hardened clusters run those externally
#     (managed RDS, ElastiCache, etc.) and leave local_setup off.
#   - The email service: its image pins UID 100 and keeps its own securityContext.
#
# Mirrors the kustomize `nonroot-security-context` component. Override runAsUser/
# runAsGroup/fsGroup below if your environment pins a specific UID (e.g. 10001).
securityContext:
  enabled: false
  # Rendered at spec.template.spec.securityContext (pod level).
  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  # Rendered at each container's / initContainer's securityContext.
  containerSecurityContext:
    allowPrivilegeEscalation: false
    runAsNonRoot: true
    runAsUser: 1000
    capabilities:
      drop:
      - ALL
    seccompProfile:
      type: RuntimeDefault

services:
  redis:
    local_setup: true
    image: valkey/valkey:7.2.11-alpine
    servicePort: 6379
    volumeSize: 500Mi
    pullPolicy: IfNotPresent
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  postgres:
    local_setup: true
    image: postgres:15.7-alpine
    servicePort: 5432
    volumeSize: 2Gi
    pullPolicy: IfNotPresent
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}
    read_replica:
      enabled: false
      remote_url: '' # INCASE OF REMOTE PG DB URL ONLY

  rabbitmq:
    local_setup: true
    image: rabbitmq:3.13.6-management-alpine
    servicePort: 5672
    managementPort: 15672
    volumeSize: 100Mi
    pullPolicy: IfNotPresent
    default_user: plane
    default_password: plane
    external_rabbitmq_url: ''
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  opensearch:
    local_setup: false
    image: opensearchproject/opensearch:3.3.2
    servicePort: 9200
    volumeSize: 5Gi
    pullPolicy: IfNotPresent
    username: plane
    password: Secure@Pass#123!%^&*
    memoryLimit: 3Gi
    cpuLimit: 750m
    memoryRequest: 2Gi
    cpuRequest: 500m
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  minio:
    local_setup: true
    image: minio/minio:latest
    image_mc: minio/mc:latest
    volumeSize: 3Gi
    pullPolicy: IfNotPresent
    root_user: admin
    root_password: password
    assign_cluster_ip: false
    env:
      minio_endpoint_ssl: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  iframely:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/iframely:v1.2.0
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  web:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/web-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  monitor:
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/monitor-commercial
    pullPolicy: Always
    volumeSize: 100Mi
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  space:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/space-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  admin:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/admin-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  live:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/live-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  api:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/backend-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  worker:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  beatworker:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  silo:
    enabled: true
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/silo-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}
    connectors:
      slack:
        enabled: false
        client_id: ''
        client_secret: ''
      github:
        enabled: false
        client_id: ''
        client_secret: ''
        app_name: ''
        app_id: ''
        private_key: ''
      gitlab:
        enabled: false
        client_id: ''
        client_secret: ''
      sentry:
        enabled: false
        base_url: ''
        client_id: ''
        client_secret: ''
        integration_slug: ''

  email_service:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/email-commercial
    pullPolicy: Always
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  outbox_poller:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  automation_consumer:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  pi:
    enabled: false
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    image: makeplane/plane-pi-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}
    ai_providers:
      openai:
        enabled: false
        base_url: ''
        api_key: ''
      claude:
        enabled: false
        base_url: ''
        api_key: ''
      groq:
        enabled: false
        base_url: ''
        api_key: ''
      cohere:
        enabled: false
        base_url: ''
        api_key: ''
      custom_llm:
        enabled: false
        api_key: ''
        base_url: ''
        model_key: 'gpt-oss-120b'
        name: 'GPT-OSS-120B'
        max_tokens: 128000
        provider: ''
        aws_region: ''
      embedding_model:
        enabled: false
        name: ''
        model_id: ''
        embedding_dimension: 1536
        aws_access_key: ''
        aws_secret_access_key: ''
        aws_region: 'us-east-1'
        aws_session_token: ''

  pi_beat_worker:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  pi_worker:
    replicas: 1
    memoryLimit: 1000Mi
    cpuLimit: 500m
    memoryRequest: 50Mi
    cpuRequest: 50m
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

  runner:
    enabled: false
    replicas: 1
    memoryLimit: 512Mi
    cpuLimit: 500m
    memoryRequest: 128Mi
    cpuRequest: 100m
    image: makeplane/node-runner-commercial
    pullPolicy: Always
    assign_cluster_ip: false
    nodeSelector: {}
    tolerations: []
    affinity: {}
    labels: {}
    annotations: {}

external_secrets:
  # Name of the existing Kubernetes Secret resource; see README for more details
  rabbitmq_existingSecret: ''
  pgdb_existingSecret: ''
  opensearch_existingSecret: ''
  doc_store_existingSecret: ''
  app_env_existingSecret: ''
  live_env_existingSecret: ''
  silo_env_existingSecret: ''
  pi_api_env_existingSecret: ''
  runner_env_existingSecret: ''

env:
  storageClass: ''

  # REDIS
  remote_redis_url: '' #INCASE OF REMOTE REDIS ONLY

  # POSTGRES DB VALUES
  pgdb_username: plane
  pgdb_password: plane
  pgdb_name: plane
  pg_pi_db_name: plane_pi
  pgdb_remote_url: '' #INCASE OF REMOTE PG DB URL ONLY
  pg_pi_db_remote_url: '' #INCASE OF REMOTE Plane AI (PI) PG DB URL ONLY

  # DATA STORE
  docstore_bucket: uploads
  doc_upload_size_limit: '5242880' # 5MB

  # REQUIRED IF MINIO LOCAL SETUP IS FALSE
  aws_access_key: ''
  aws_secret_access_key: ''
  aws_region: ''
  aws_s3_endpoint_url: ''

  use_storage_proxy: false
  allow_all_attachment_types: false
  enable_drf_spectacular: false

  # Self-hosted drawio endpoint for the Wiki editor's diagram extension.
  # Leave empty to use the diagrams.net cloud.
  drawio_embed_url: ''

  #OPENSEARCH ENVS
  opensearch_remote_url: ''
  opensearch_remote_username: ''
  opensearch_remote_password: ''
  opensearch_index_prefix: ''
  opensearch_embedding_dimension: 1536

  #API KEYS
  secret_key: "60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5"
  api_key_rate_limit: "60/minute"

  sentry_dsn: ''
  sentry_environment: ''

  cors_allowed_origins: ''
  instance_admin_email: ''
  web_url: ''

  live_sentry_dsn: ""
  live_sentry_environment: ""
  live_sentry_traces_sample_rate: ""
  live_server_secret_key: "htbqvBJAgpm9bzvf3r4urJer0ENReatceh"
  external_iframely_url: ""

  silo_envs:
    sentry_dsn: ''
    sentry_environment: ''
    sentry_traces_sample_rate: ''
    batch_size: 100
    mq_prefetch_count: 1
    request_interval: 400
    hmac_secret_key: 'gzb7MRLr0FoN129NyWARZEs84P9LzQ'
    aes_secret_key: 'dsOdt7YrvxsTIFJ37pOaEVvLxN8KGBCr'
    cors_allowed_origins: ''

  email_service_envs:
    smtp_domain: ''
    max_attachment_size: '10485760' # 10MB in bytes

  outbox_poller_envs:
    memory_limit_mb: 400
    interval_min: 0.25
    interval_max: 2
    batch_size: 250
    memory_check_interval: 30
    pool:
      size: 4
      min_size: 2
      max_size: 10
      timeout: 30.0
      max_idle: 300.0
      max_lifetime: 3600
      reconnect_timeout: 5.0
      health_check_interval: 60

  automation_consumer_envs:
    event_stream_queue_name: "plane.event_stream.automations"
    event_stream_prefetch: 10
    exchange_name: "plane.event_stream"
    event_types: "issue"

  runner_envs:
    execution_timeout_ms: "10000"
    init_timeout_ms: "5000"
    isolate_memory_mb: "128"
    control_service_base_url: ""
    hmac_secret_key: ""

  pi_envs:
    plane_oauth:
      state_expiry_seconds: 82800
    plane_api_host: ''
    follower_postgres_uri: ''
    cors_allowed_origins: ''
    internal_secret: 'tyfvfqvBJAgpm9bzvf3r4urJer0Ehfdubk'
    log_level: 'DEBUG'

    celery:
      vector_sync_enabled: false
      vector_sync_interval: 3
      workspace_plan_sync_enabled: false
      workspace_plan_sync_interval: 86400
      docs_sync_enabled: false
      docs_sync_interval: 86400

# Global extra environment variables that will be applied to all workloads
extraEnv: []
  # - name: HTTP_PROXY
  #   value: "http://proxy.example.com:8080"
  # - name: HTTPS_PROXY
  #   value: "http://proxy.example.com:8080"
  # - name: NO_PROXY
  #   value: "localhost,127.0.0.1,.example.com"