values.yaml

nameOverride: ""
fullnameOverride: ""

namespace:
  create: false
  name: llm-observability

cluster:
  name: k3s-nvidia-edge

runtime:
  # Set by values profiles or by .generated/values.runtime-detected.yaml.
  # Supported values: nvidia, cpu.
  accelerator: nvidia

notes:
  requireNvidiaDevicePlugin: true

monitoring:
  # Enable kube-prometheus-stack in this umbrella chart before enabling these CRs.
  enabled: false
  labels:
    release: kube-prometheus-stack
  serviceMonitor:
    enabled: true
    interval: 15s
    scrapeTimeout: 10s
  blackbox:
    enabled: true
    proberUrl: prometheus-blackbox-exporter.monitoring.svc.cluster.local:9115
    module: http_2xx
    interval: 30s
    targets:
      - 'http://ollama-gateway.{{ .Values.namespace.name }}.svc.cluster.local:8000/healthz'
      - 'http://ollama.{{ .Values.namespace.name }}.svc.cluster.local:11434/api/tags'
      - 'http://open-webui.{{ .Values.namespace.name }}.svc.cluster.local:8080/health'
  prometheusRules:
    enabled: true
    highErrorRatePercent: 5
    highP95LatencySeconds: 10
    gpuHighTemperatureCelsius: 85
    gpuHighMemoryPercent: 95
  grafanaDashboards:
    enabled: true
  dcgmExporter:
    # GPU Operator usually creates this ServiceMonitor itself. Enable only when importing
    # an exporter Service that is not already discovered by Prometheus.
    serviceMonitor:
      enabled: false
      namespace: gpu-operator
      interval: 15s
      port: gpu-metrics
      path: /metrics
      selector:
        app: nvidia-dcgm-exporter
  nim:
    # NIM exposes OpenMetrics on /v1/metrics. Set selector labels to match the NIM Service.
    serviceMonitor:
      enabled: false
      namespace: nim-service
      interval: 15s
      port: http
      path: /v1/metrics
      selector:
        app.kubernetes.io/name: nim-llm

networkPolicy:
  enabled: false
  monitoringNamespace: monitoring

nvidia:
  runtimeClassName: nvidia
  # Use nvidia.com/gpu.shared on MPS-enabled nodes.
  gpuResourceName: nvidia.com/gpu
  # Keep at 1 for MPS shared mode unless your device-plugin config explicitly allows >1 per pod.
  gpuCount: 1

gpu-operator:
  # Legacy compatibility key only. The chart no longer vendors or installs GPU Operator.
  # Use k3s-nvidia-edge, normally through edge-cli, to own the NVIDIA substrate.
  enabled: false
  nfd:
    enabled: true
  driver:
    enabled: false
  toolkit:
    enabled: false
  devicePlugin:
    enabled: true
  dcgmExporter:
    enabled: true
    serviceMonitor:
      enabled: true

nvidia-device-plugin:
  # Legacy compatibility key only. The chart no longer installs the NVIDIA device plugin.
  enabled: false
  allowDefaultNamespace: true
  fullnameOverride: nvidia-device-plugin
  namespaceOverride: ""
  runtimeClassName: nvidia
  migStrategy: none
  deviceListStrategy: envvar
  nfd:
    enabled: false
  gfd:
    enabled: false
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 250m
      memory: 256Mi

dcgm-exporter:
  # Legacy compatibility key only. The chart no longer installs DCGM exporter.
  # Use monitoring.dcgmExporter.serviceMonitor to observe an existing exporter.
  enabled: false
  fullnameOverride: dcgm-exporter
  runtimeClassName: nvidia
  serviceMonitor:
    enabled: true
    interval: 15s
    scrapeTimeout: 10s
    additionalLabels:
      release: kube-prometheus-stack
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi

kube-prometheus-stack:
  enabled: false
  fullnameOverride: kube-prometheus-stack
  namespaceOverride: ""
  crds:
    enabled: true
  alertmanager:
    enabled: true
  grafana:
    enabled: true
    adminUser: admin
    adminPassword: admin
    defaultDashboardsEnabled: true
    sidecar:
      dashboards:
        enabled: true
        label: grafana_dashboard
        labelValue: "1"
        searchNamespace: ALL
  prometheus:
    enabled: true
    prometheusSpec:
      serviceMonitorSelectorNilUsesHelmValues: false
      podMonitorSelectorNilUsesHelmValues: false
      probeSelectorNilUsesHelmValues: false
      ruleSelectorNilUsesHelmValues: false
      scrapeConfigSelectorNilUsesHelmValues: false
  # Keep these defaults explicit for CI clean checkouts where this umbrella chart
  # packages kube-prometheus-stack from a local file dependency before nested
  # subchart defaults are available to parent templates.
  prometheus-node-exporter:
    kubeRBACProxy:
      enabled: false
  kube-state-metrics:
    kubeRBACProxy:
      enabled: false

opentelemetry-operator:
  enabled: false
  fullnameOverride: opentelemetry-operator
  admissionWebhooks:
    certManager:
      enabled: false
    autoGenerateCert:
      enabled: true
  manager:
    collectorImage:
      repository: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-k8s
      tag: 0.153.0
    serviceMonitor:
      enabled: true
      extraLabels:
        release: kube-prometheus-stack

opentelemetry-collector:
  enabled: true
  fullnameOverride: opentelemetry-collector
  mode: deployment
  replicaCount: 1
  image:
    repository: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-k8s
    tag: 0.153.0
    pullPolicy: IfNotPresent
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi
  ports:
    otlp:
      enabled: true
      containerPort: 4317
      servicePort: 4317
      protocol: TCP
      appProtocol: grpc
    otlp-http:
      enabled: true
      containerPort: 4318
      servicePort: 4318
      protocol: TCP
    jaeger-compact:
      enabled: false
    jaeger-thrift:
      enabled: false
    jaeger-grpc:
      enabled: false
    zipkin:
      enabled: false
    metrics:
      enabled: true
      containerPort: 8888
      servicePort: 8888
      protocol: TCP
  service:
    type: ClusterIP
  serviceMonitor:
    enabled: false
    extraLabels:
      release: kube-prometheus-stack
  alternateConfig:
    exporters:
      debug: {}
    extensions:
      health_check:
        endpoint: ${env:MY_POD_IP}:13133
    processors:
      batch: {}
      memory_limiter:
        check_interval: 5s
        limit_percentage: 80
        spike_limit_percentage: 25
    receivers:
      otlp:
        protocols:
          grpc:
            endpoint: ${env:MY_POD_IP}:4317
          http:
            endpoint: ${env:MY_POD_IP}:4318
    service:
      telemetry:
        metrics:
          readers:
            - pull:
                exporter:
                  prometheus:
                    host: ${env:MY_POD_IP}
                    port: 8888
      extensions:
        - health_check
      pipelines:
        traces:
          receivers:
            - otlp
          processors:
            - memory_limiter
            - batch
          exporters:
            - debug
        metrics:
          receivers:
            - otlp
          processors:
            - memory_limiter
            - batch
          exporters:
            - debug
        logs:
          receivers:
            - otlp
          processors:
            - memory_limiter
            - batch
          exporters:
            - debug

ollamaModel:
  enabled: true
  # Final Ollama model name visible from `ollama list`
  name: gemma3-1b-it-gguf-local
  createAtStartup: true
  warmupPrompt: Say hello in one short sentence.
  gguf:
    enabled: true
    # IMPORTANT: change this to the absolute path of the directory that contains the GGUF file on your Xubuntu host.
    # Example:
    # hostPath: /media/waqasm86/External1/Project-Nvidia-Office/models
    hostPath: /absolute/path/on/your/xubuntu22-host/gguf-models
    filename: gemma-3-1b-it-gguf.gguf
    mountPath: /models/gguf
  modelfile:
    # When set, the chart reads this repository file instead of the inline content below.
    file: Modelfile.gemma-3-1b-it-gguf
    # This template is rendered into a ConfigMap and consumed by the vendored Ollama chart.
    content: |
      FROM __GGUF_PATH__
      TEMPLATE """{{- $systemPromptAdded := false }}
      {{- range $i, $_ := .Messages }}
      {{- $last := eq (len (slice $.Messages $i)) 1 }}
      {{- if eq .Role "user" }}<start_of_turn>user
      {{- if (and (not $systemPromptAdded) $.System) }}
      {{- $systemPromptAdded = true }}
      {{ $.System }}
      {{ end }}
      {{ .Content }}<end_of_turn>
      {{ if $last }}<start_of_turn>model
      {{ end }}
      {{- else if eq .Role "assistant" }}<start_of_turn>model
      {{ .Content }}{{ if not $last }}<end_of_turn>
      {{ end }}
      {{- end }}
      {{- end }}"""
      PARAMETER min_p 0.01
      PARAMETER repeat_penalty 1
      PARAMETER top_k 64
      PARAMETER top_p 0.95
      PARAMETER num_predict 128
      PARAMETER stop <end_of_turn>
      PARAMETER stop <eos>
      PARAMETER temperature 1
      PARAMETER num_gpu 23
      PARAMETER num_ctx 256
      PARAMETER num_batch 1

ollama:
  enabled: true
  fullnameOverride: ollama
  replicaCount: 1
  runtimeClassName: nvidia
  image:
    repository: ollama/ollama
    tag: 0.17.7
    pullPolicy: IfNotPresent
  ollama:
    gpu:
      enabled: true
      type: nvidia
      # Keep at 1 for most MPS shared configurations.
      number: 1
      nvidiaResource: nvidia.com/gpu
    models:
      pull: []
      run:
        - gemma3-1b-it-gguf-local
      runPrompt: "Reply with exactly: model ready"
      create:
        - name: gemma3-1b-it-gguf-local
          configMapRef: ollama-local-modelfile
          configMapKeyRef: Modelfile
  persistentVolume:
    enabled: true
    size: 20Gi
    storageClass: local-path
    annotations:
      "helm.sh/resource-policy": keep
  service:
    type: ClusterIP
    port: 11434
  resources:
    requests:
      cpu: 1000m
      memory: 2Gi
    limits:
      cpu: 4000m
      memory: 8Gi
  volumeMounts:
    - name: local-gguf-model
      mountPath: /models/gguf
      readOnly: true
  volumes:
    - name: local-gguf-model
      hostPath:
        path: /absolute/path/on/your/xubuntu22-host/gguf-models
        type: Directory
  extraEnv:
    - name: OLLAMA_KEEP_ALIVE
      value: "-1"
    - name: OLLAMA_NUM_PARALLEL
      value: "1"
    - name: OLLAMA_MAX_LOADED_MODELS
      value: "1"
    - name: OLLAMA_CONTEXT_LENGTH
      value: "1024"

openWebUI:
  enabled: true
  fullnameOverride: open-webui
  # Route Open WebUI through the OpenTelemetry-instrumented Ollama proxy.
  ollamaBaseUrl: http://ollama-gateway:8000/ollama
  # Leave empty to auto-generate a strong value when chart-managed secret mode is used.
  # If you provide a value here, it is used as-is.
  webuiSecretKey: ""
  # Legacy wrapper field retained for compatibility. If set, it must match open-webui.webuiSecret.existingSecretName.
  existingSecret: ""
  # Legacy wrapper field retained for compatibility. If set, it must match open-webui.webuiSecret.existingSecretKey.
  existingSecretKey: WEBUI_SECRET_KEY
  auth: false
  persistence:
    enabled: true
    size: 5Gi
    storageClass: local-path
  service:
    type: ClusterIP
    port: 8080
  ingress:
    enabled: false

open-webui:
  enabled: true
  fullnameOverride: open-webui
  image:
    repository: ghcr.io/open-webui/open-webui
    tag: 0.8.10
    pullPolicy: IfNotPresent
  ollama:
    enabled: false
  pipelines:
    enabled: false
  tika:
    enabled: false
  websocket:
    enabled: true
    # Keep empty to use chart-generated default (`open-webui-redis`).
    # Set in environment-specific values when using a custom Redis URL.
    url: ""
    redis:
      enabled: true
  ollamaUrls:
    - http://ollama-gateway:8000/ollama
  enableOpenaiApi: false
  openaiBaseApiUrl: ""
  openaiApiKey: ""
  webuiSecret:
    enabled: true
    # Set this to consume a pre-created secret and disable chart-managed secret generation.
    # Must match openWebUI.existingSecret when legacy field is used.
    existingSecretName: ""
    # Secret key for WEBUI secret value.
    # Must match openWebUI.existingSecretKey when legacy field is used.
    existingSecretKey: WEBUI_SECRET_KEY
  persistence:
    enabled: true
    size: 5Gi
    storageClass: local-path
  service:
    type: ClusterIP
    port: 8080
    containerPort: 8080
  runtimeClassName: ""
  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: 1500m
      memory: 2Gi
  extraEnvVars:
    - name: OLLAMA_BASE_URL
      value: http://ollama-gateway:8000/ollama
    - name: ENABLE_PERSISTENT_CONFIG
      value: "False"
    - name: WEBUI_AUTH
      value: "False"
    - name: ENABLE_VERSION_UPDATE_CHECK
      value: "False"
    - name: RAG_EMBEDDING_ENGINE
      value: ollama
    - name: RAG_EMBEDDING_MODEL
      value: gemma3-1b-it-gguf-local
    - name: RAG_EMBEDDING_MODEL_AUTO_UPDATE
      value: "False"
    - name: RAG_RERANKING_MODEL_AUTO_UPDATE
      value: "False"
    - name: WHISPER_MODEL_AUTO_UPDATE
      value: "False"

redis:
  # Custom internal Redis for Open WebUI websocket manager.
  # Keep disabled by default. Enable in local override when you want to use `templates/redis-deployment.yaml`.
  enabled: false
  fullnameOverride: redis
  replicaCount: 1
  image:
    repository: redis
    tag: 7-alpine
    pullPolicy: IfNotPresent
  service:
    type: ClusterIP
    port: 6379
  persistence:
    enabled: true
    storageClass: local-path
    size: 5Gi
  config:
    maxmemory: 256mb
    maxmemoryPolicy: allkeys-lru
    saveRules:
      - "900 1"
      - "300 10"
      - "60 10000"
  auth:
    # When enabled=true, set credentials only in environment-specific values (not here).
    enabled: false
    existingSecret: ""
    usernameKey: REDIS_USERNAME
    passwordKey: REDIS_PASSWORD
    username: ""
    password: ""
  resources:
    requests:
      cpu: 250m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 512Mi

ollamaGateway:
  enabled: true
  nameOverride: ollama-gateway
  serviceAccount:
    create: true
    name: ""
  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  securityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: false
    capabilities:
      drop:
        - ALL
  image:
    repository: ollama-gateway
    tag: 0.2.0
    pullPolicy: IfNotPresent
  app:
    port: 8000
  probes:
    startup:
      enabled: true
      path: /healthz
      initialDelaySeconds: 30
      periodSeconds: 10
      timeoutSeconds: 3
      # Startup can be slow on constrained local nodes.
      failureThreshold: 60
    readiness:
      enabled: true
      path: /healthz
      initialDelaySeconds: 20
      periodSeconds: 10
      timeoutSeconds: 3
      failureThreshold: 6
    liveness:
      enabled: true
      path: /healthz
      # Give in-flight proxy calls more time before liveness restarts.
      initialDelaySeconds: 60
      periodSeconds: 20
      timeoutSeconds: 3
      failureThreshold: 6
  service:
    type: ClusterIP
    port: 8000
  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: 1000m
      memory: 1Gi
  extraEnv: []

opentelemetry:
  enabled: true
  endpoint: http://opentelemetry-collector:4317
  tracing:
    enabled: true
    genAI:
      enabled: true
  # Legacy operator-managed CR path. The default collector is the vendored
  # opentelemetry-collector subchart above.
  operatorCollector:
    enabled: false
    name: opentelemetry
    mode: deployment
    replicas: 1
    image: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-k8s:0.153.0
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        cpu: 500m
        memory: 512Mi
    config:
      exporters:
        debug: {}
      processors:
        batch: {}
        memory_limiter:
          check_interval: 5s
          limit_percentage: 80
          spike_limit_percentage: 25
      receivers:
        otlp:
          protocols:
            grpc:
              endpoint: 0.0.0.0:4317
            http:
              endpoint: 0.0.0.0:4318
      service:
        pipelines:
          traces:
            receivers:
              - otlp
            processors:
              - memory_limiter
              - batch
            exporters:
              - debug
          metrics:
            receivers:
              - otlp
            processors:
              - memory_limiter
              - batch
            exporters:
              - debug
          logs:
            receivers:
              - otlp
            processors:
              - memory_limiter
              - batch
            exporters:
              - debug


edgeToolbox:
  enabled: true
  runtimeClassName: ""
  image:
    repository: edge-toolbox
    tag: 0.2.0
    pullPolicy: IfNotPresent
  command:
    - /usr/local/bin/edge-toolbox
    - serve
  resources:
    requests:
      cpu: 50m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 384Mi
  extraEnv: []

otelTraceSeeder:
  enabled: false
  # Runs a short native Go job every 5 minutes to keep OpenTelemetry GenAI traces flowing.
  schedule: "*/5 * * * *"
  suspend: false
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 2
  failedJobsHistoryLimit: 2
  startingDeadlineSeconds: 120
  backoffLimit: 1
  ttlSecondsAfterFinished: 600
  runtimeClassName: ""
  image:
    repository: ""
    tag: ""
    pullPolicy: ""
  command:
    - /usr/local/bin/edge-toolbox
    - seed
  env:
    inferenceApiUrl: http://ollama:11434/api/chat
    callCount: "2"
    timeoutSeconds: "180"
  resources:
    requests:
      cpu: 25m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 384Mi
  extraEnv: []

etcd:
  # Keep disabled unless you are actively testing a backing-store failure scenario.
  enabled: false
  fullnameOverride: etcd
  replicaCount: 1
  image:
    repository: quay.io/coreos/etcd
    tag: v3.5.21
    pullPolicy: IfNotPresent
  auth:
    enabled: false
  service:
    clientPort: 2379
    peerPort: 2380
  persistence:
    enabled: true
    storageClass: local-path
    size: 8Gi
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 512Mi
  extraEnv: []