This is the list of configuration parameters used in the AGENTIC STAR marketplace Helm charts.
The "Source" column for each parameter indicates how the value is set.
| Source | Description |
|---|
| Fixed | Default fixed value. Typically no change needed |
| UI Input | Value specified in the deployment form at purchase time |
| Auto-Retrieved | Automatically retrieved from Azure resources during deployment |
| Auto-Generated | Randomly generated secret created during deployment |
Overview of Auto-Retrieved & Auto-Generated Parameters
Each service section below lists the source per parameter, but to verify "did everything get set correctly?" after deployment, use the consolidated tables here. In particular, librechat-env-secret is the main application's central secret bundle; most of its values are auto-retrieved or auto-generated by the installer.
Auto-Retrieved Parameters (sourced from Azure resources)
| Parameter | Source | Primary location |
|---|
global.azure.subscriptionId | az account show | Each service ConfigMap |
global.azure.resourceGroupName | ARM template | Each service ConfigMap |
aks.nodeResourceGroup | az aks show --query nodeResourceGroup | Each service ConfigMap |
global.postgresql.host | PostgreSQL Flexible Server FQDN | *-env-secret |
global.postgresql.database | ARM template output | *-env-secret |
global.objectStorage.azure.connectionString | az storage account show-connection-string (Private Storage) | librechat-env-secret (key: AZURE_STORAGE_CONNECTION_STRING) |
global.objectStorage.azure.storageAccountName | ARM template | ConfigMap |
global.objectStorage.azure.customDomain | <storageAccountName>.blob.core.windows.net | ConfigMap |
publicStorage.connectionString | az storage account show-connection-string (Public Storage) | Public storage Secret |
appConfig.authBaseUrl / domainClient / domainServer | Derived from the UI domain (auto-generated from the AKS External IP when not provided) | librechat-env-secret, ConfigMap |
env.APP_URL / LIBRECHAT_URL / ADMIN_CONSOLE_URL | Same as above | librechat-auth-secret, agenticai-admin-secret |
env.WEBAUTHN_RP_ID | Derived from the auth domain | librechat-auth-secret |
env.ALLOWED_ORIGINS / AFD_CHATBOARD_FRONT_AUTH_DOMAIN / AFD_CHATBOARD_ADMIN_DOMAIN / CHATBOARD_FRONT_DOMAIN | Derived from domain settings | extauth-service ConfigMap |
internalHosts.storageHosts | Internal storage FQDNs | extauth-service ConfigMap |
Auto-Generated Parameters (random secrets)
| Purpose | Representative keys | Generation method |
|---|
| JWT signing / refresh | JWT_SECRET / JWT_REFRESH_SECRET | openssl rand -hex 16 / -hex 32 |
| Credential encryption | CREDS_KEY / CREDS_IV | openssl rand -hex 32 / -hex 16 |
| Token encryption | TOKEN_ENCRYPTION_KEY | openssl rand -hex 32 |
| Gate / external API | GATE_API_KEY / EXT_API_KEY / EXT_API_WEBHOOK_SECRET / CBF_S2S_API_KEY | openssl rand -hex 32 |
| Keycloak admin | KEYCLOAK_ADMIN_PASSWORD | openssl rand -base64 12 |
| Keycloak client | KEYCLOAK_CLIENT_ID / KEYCLOAK_CLIENT_SECRET | openssl rand -hex 8 / -hex 32 |
| Service Account | SERVICE_ACCOUNT_CLIENT_ID / SERVICE_ACCOUNT_CLIENT_SECRET | UUID / openssl rand -hex 32 |
| Redis authentication | REDIS_PASSWORD | openssl rand -base64 32 |
| Search sync / webhook | SEARCH_SYNC_SECRET / WEBHOOK_SECRET | openssl rand -hex 32 |
| Gate encryption | secrets.encryptionKey (gate-services) | openssl rand -hex 32 |
Verification After Deployment
To confirm the deployment populated values correctly, read the relevant Secrets directly. The most important check is whether AZURE_STORAGE_CONNECTION_STRING holds a valid connection string.
kubectl get secret librechat-env-secret -n autonomous-agent \
-o jsonpath='{.data.AZURE_STORAGE_CONNECTION_STRING}' | base64 -d
You should see a value of the form DefaultEndpointsProtocol=https;AccountName=...;AccountKey=...;EndpointSuffix=core.windows.net.
If the value is empty, starts with CHANGE_ME_*, or looks like <placeholder>, the installer failed to retrieve the value from the Azure resource. Check the installer logs or contact support.
kubectl get secret librechat-env-secret -n autonomous-agent \
-o jsonpath='{.data.JWT_SECRET}' | base64 -d | wc -c
Common Settings (common-values)
Settings shared across all services.
Environment Settings
| Parameter | Default | Source | Description |
|---|
global.environment | — | UI Input | Environment name |
global.customerEnvironment | — | UI Input | Same value as Environment Name |
global.primary.language | ja | UI Input | UI display language (ja / en / fr / es / th) |
Container Registry
| Parameter | Default | Source | Description |
|---|
global.imagePullSecret.enabled | false | Fixed | Enable image pull secret |
global.imagePullSecret.name | "" | Fixed | Secret name |
global.imagePullSecret.registry | "" | Fixed | Registry URL |
PostgreSQL
| Parameter | Default | Source | Description |
|---|
global.postgresql.host | — | Auto-Retrieved | PostgreSQL server FQDN |
global.postgresql.port | 5432 | Fixed | Port number |
global.postgresql.database | — | Auto-Retrieved | Database name |
global.postgresql.username | — | UI Input | Administrator username |
global.postgresql.password | — | UI Input | Administrator password |
global.postgresql.useAzureAd | false | Fixed | Use Azure AD authentication |
global.postgresql.poolMinSize | 5 | Fixed | Connection pool minimum size |
global.postgresql.poolMaxSize | 20 | Fixed | Connection pool maximum size |
global.postgresql.commandTimeout | 60 | Fixed | Command timeout (seconds) |
global.postgresql.poolTimeout | 30 | Fixed | Pool timeout (seconds) |
global.postgresql.maxOverflow | 10 | Fixed | Maximum overflow connections |
Azure Settings
| Parameter | Default | Source | Description |
|---|
global.azure.subscriptionId | — | Auto-Retrieved | Azure subscription ID |
global.azure.resourceGroupName | — | Auto-Retrieved | Resource group name |
Object Storage
| Parameter | Default | Source | Description |
|---|
global.objectStorage.provider | azure | Fixed | Storage provider |
global.objectStorage.azure.container | autonomous-agent-files | Fixed | Azure Blob container name |
global.objectStorage.azure.connectionString | — | Auto-Retrieved | Connection string |
global.objectStorage.azure.storageAccountName | — | Auto-Retrieved | Storage account name |
global.objectStorage.azure.customDomain | — | Auto-Retrieved | Custom domain |
Ingress TLS
| Parameter | Default | Source | Description |
|---|
global.ingress.tls.enabled | true | Fixed | Enable TLS |
global.ingress.tls.secretName | selfsigned-tls-cert | Fixed | TLS certificate Secret name |
global.ingress.tls.useCertManager | false | Fixed | Use cert-manager |
global.ingress.tls.clusterIssuer | "" | Fixed | ClusterIssuer name |
Kubernetes
| Parameter | Default | Source | Description |
|---|
global.kubernetes.namespace | autonomous-agent | Fixed | Default Namespace |
global.kubernetes.serviceAccount | default | Fixed | Service account name |
global.kubernetes.rbac.create | true | Fixed | Create RBAC resources |
Main Application (librechat)
| Parameter | Default | Source | Description |
|---|
image.tag | — | Fixed (version-dependent) | Image tag |
global.domain | front.agentic.internal | Fixed | Internal domain |
vectordb.enabled | true | Fixed | Enable vector DB |
nginx-ingress.enabled | false | Fixed | Disable built-in Ingress (uses existing) |
appConfig.buildMode | mp | Fixed | Build mode (marketplace) |
appConfig.authBaseUrl | — | Auto-Retrieved | Authentication service URL |
appConfig.domainClient | — | Auto-Retrieved | Client domain |
appConfig.domainServer | — | Auto-Retrieved | Server domain |
appConfig.jwtSecret | — | Auto-Generated | JWT secret |
appConfig.jwtRefreshSecret | — | Auto-Generated | JWT refresh secret |
appConfig.credsKey | — | Auto-Generated | Credential encryption key |
appConfig.credsIv | — | Auto-Generated | Credential encryption IV |
appConfig.tokenEncryptionKey | — | Auto-Generated | Token encryption key |
appConfig.searchSyncSecret | — | Auto-Generated | Search sync secret |
appConfig.gateApiKey | — | Auto-Generated | Gate API key |
appConfig.extApiKey | — | Auto-Generated | External API key |
appConfig.extApiWebhookSecret | — | Auto-Generated | Webhook secret |
mongodb.podAntiAffinityPreset | soft | Fixed | MongoDB AntiAffinity |
api.hpa.minReplicas | 1 | Fixed | Minimum replica count |
Authentication Service (librechat-auth)
| Parameter | Default | Source | Description |
|---|
image.tag | — | Fixed (version-dependent) | Image tag |
env.APP_URL | — | Auto-Retrieved | Authentication service URL |
env.LIBRECHAT_URL | — | Auto-Retrieved | Main application URL |
env.ADMIN_CONSOLE_URL | — | Auto-Retrieved | Admin console URL |
env.KEYCLOAK_REALM | agenticstar | Fixed | Keycloak realm name |
env.KEYCLOAK_ADMIN | admin | Fixed | Keycloak administrator name |
env.POSTGRES_DB | keycloak_db | Fixed | Keycloak database name |
env.BUILD_MODE | mp | Fixed | Build mode |
env.EMAIL_AUTH_ENABLED | true | Fixed | Enable authentication email |
env.NEXT_PUBLIC_REQUIRE_OAUTH | true | Fixed | Require OAuth |
env.WEBAUTHN_RP_NAME | AGENTIC STAR | Fixed | WebAuthn display name |
env.WEBAUTHN_RP_ID | — | Auto-Retrieved | WebAuthn RP ID (authentication domain) |
secrets.JWT_SECRET | — | Auto-Generated | JWT secret |
secrets.TOKEN_ENCRYPTION_KEY | — | Auto-Generated | Token encryption key |
secrets.KEYCLOAK_ADMIN_PASSWORD | — | Auto-Generated | Keycloak administrator password |
secrets.KEYCLOAK_CLIENT_SECRET | — | Auto-Generated | Keycloak client secret |
autoscaling.minReplicas | 1 | Fixed | Minimum replica count |
keycloakx.replicas | 1 | Fixed | Keycloak replica count |
Admin Console (agenticai-admin)
| Parameter | Default | Source | Description |
|---|
image.tag | — | Fixed (version-dependent) | Image tag |
env.GEO_BLOCKING_EXCLUDED_COUNTRIES | JP | Fixed | Geo-blocking excluded countries (ISO 3166-1) |
env.ALLOWED_ORIGINS | — | Auto-Retrieved | Allowed origins |
env.AFD_CHATBOARD_FRONT_AUTH_DOMAIN | — | Auto-Retrieved | Authentication and front domain |
env.AFD_CHATBOARD_ADMIN_DOMAIN | — | Auto-Retrieved | Admin console domain |
env.CHATBOARD_FRONT_DOMAIN | — | Auto-Retrieved | Front domain |
secrets.KEYCLOAK_DB | keycloak_db | Fixed | Keycloak database name |
secrets.TOKEN_ENCRYPTION_KEY | — | Auto-Generated | Token encryption key |
replicaCount | 1 | Fixed | Replica count |
autoscaling.minReplicas | 1 | Fixed | Minimum replica count |
rbac.create | true | Fixed | Create RBAC resources |
| Parameter | Default | Source | Description |
|---|
image.tag | — | Fixed (version-dependent) | Image tag |
memory.graphiti.enabled | false | Fixed | Enable Graphiti memory (disabled as FalkorDB is not included) |
deployment.replicas | 1 | Fixed | Replica count |
hpa.minReplicas | 1 | Fixed | HPA minimum replica count |
External API (agenticai-extapi)
| Parameter | Default | Source | Description |
|---|
image.tag | — | Fixed (version-dependent) | Image tag |
config.LOG_LEVEL | INFO | Fixed | Log level |
secrets.CBF_S2S_API_KEY | — | Auto-Generated | S2S API key |
secrets.WEBHOOK_SECRET | — | Auto-Generated | Webhook secret |
replicaCount | 1 | Fixed | Replica count |
autoscaling.minReplicas | 1 | Fixed | Minimum replica count |
Gateway (gate-services)
| Parameter | Default | Source | Description |
|---|
image.tag | — | Fixed (version-dependent) | Image tag |
appConfig.defaultFromName | "" | Fixed | Email sender name |
secrets.apiKey | — | Auto-Generated | Gate API key |
secrets.encryptionKey | — | Auto-Generated | Encryption key |
secrets.azureConnectionString | "" | Fixed | Azure connection string (unused) |
replicaCount | 1 | Fixed | Replica count |
autoscaling.minReplicas | 1 | Fixed | Minimum replica count |
Zero-Trust Authorization Service (extauth-service)
| Parameter | Default | Source | Description |
|---|
image.tag | — | Fixed (version-dependent) | Image tag |
webhook.enabled | true | Fixed | Enable Webhook |
webhook.image.tag | — | Fixed (version-dependent) | Webhook image tag |
webhook.replicaCount | 1 | Fixed | Webhook replica count |
webhook.pdb.enabled | false | Fixed | Enable Webhook PDB |
webhook.mutating.failurePolicy | Ignore | Fixed | Webhook failure policy |
webhook.affinity | null | Fixed | AntiAffinity disabled (single replica) |
cert-manager.enabled | false | Fixed | Disable cert-manager (already installed separately) |
cert-manager.installCRDs | false | Fixed | Disable CRD installation |
replicaCount | 1 | Fixed | Replica count |
autoscaling.minReplicas | 1 | Fixed | Minimum replica count |
pdb.enabled | false | Fixed | Enable PDB |
affinity | null | Fixed | AntiAffinity disabled (single replica) |
internalHosts.storageHosts | — | Auto-Retrieved | Internal storage hostnames (authorization bypass targets) |
For instructions on changing replica counts, PDB, and failurePolicy for security hardening, see the Security Guide.
Vector DB (qdrant)
| Parameter | Default | Source | Description |
|---|
qdrant.replicaCount | 1 | Fixed | Replica count |
qdrant.config.cluster.enabled | false | Fixed | Enable cluster mode |
loadBalancer.enabled | false | Fixed | Enable LoadBalancer |
dashboard.enabled | false | Fixed | Enable dashboard |
loadBalancer.enabled and dashboard.enabled must be set to false in production environments. Enabling them allows external access, creating a risk of data leakage.
Database Migration (db-migration)
| Parameter | Default | Source | Description |
|---|
image.tag | — | Fixed (version-dependent) | Image tag |
secrets.create | true | Fixed | Auto-create Secrets |
secrets.keycloakDb | keycloak_db | Fixed | Keycloak database name |
jobs.migrate.enabled | true | Fixed | Enable migration job |
jobs.migrate.backoffLimit | 0 | Fixed | Retry count |
jobs.migrate.target | head | Fixed | Migration target |
jobs.downgrade.enabled | false | Fixed | Enable downgrade job |
masterData.enabled | true | Fixed | Enable master data seeding |
qdrant.enabled | true | Fixed | Enable Qdrant initial data seeding |
Services Not Listed
The values for the following services are not included in this reference. These are monitoring and infrastructure services whose settings typically do not need to be changed by users.
| Service | Description |
|---|
| kube-prometheus-stack | Prometheus monitoring stack |
| prometheus-adapter | Custom metrics API |
| ingress-nginx | Ingress controller |
| loki | Log storage |
| alloy-logs / alloy-metrics | Log and metrics collectors |
| k8s-monitoring | Kubernetes monitoring |
| agenticai-observability | Grafana / Jaeger |
| agenticai-datadog | Datadog integration |
| pvc-lifecycle-manager | PVC lifecycle management |
| init-platform | Platform initialization job |
To view the settings for these services, run helm get values <release-name> -n <namespace> to check the current values.