comet-ml--opik/deployment/helm_chart/opik/values.yaml

# Default values for opik public helm chart
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

global:
  argocd: false
  useHelmHooks: true
  security:
    allowInsecureImages: true

nameOverride: "opik"
fullnameOverride: ""

standalone: true
basicAuth: false

registry: &registry ghcr.io/comet-ml/opik

localFEAddress: "host.minikube.internal:5174"
localFE: false

serviceAccount:
  create: false
  name: ""
  annotations: {}

demoDataJob:
  enabled: true

chartMigration:
  # Enable this for the first upgrade that includes a migration from Bitnami charts and images
  # After successful migration, set this back to false
  enabled: true
  image: "alpine/kubectl:1.35.0"
  # Service account name (must have permissions to delete StatefulSets and Deployments)
  serviceAccountName: ""
  # Node selector for the migration job pod (falls back to global nodeSelector if not specified)
  nodeSelector: {}
  # Tolerations for the migration job pod (falls back to global tolerations if not specified)
  tolerations: []


nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []

caCerts:
  # -- (list) Additional Certificate Authority Certificates to trust.
  # Each list entry has two keys: `name` and `content`. `name` should be a
  # unique identifier. content Should be PEM formated Public Certificate
  # contents.
  additionalCACerts:

  # -- Certificates are Public Keys + Metadata, but some organizations may
  # still prefer storing these in Secrets.
  additionalCACertsInSecret: false

  # -- If there is an existing ConfigMap containing the additional CA
  # Certificates you can provide its name here instead of creatinga a new one.
  # If `additionalCACertsInSecret` is `true` we will look for this name in
  # Secrets.
  existingAdditionalCACertsRef:

  overwriteJavaCATrustStore:
    # -- If enabled we will not inject additional CA Certificates to the Java
    # TrustStore, but instead will mount a given volume containing a Java Trust
    # Store to replace the default one in the containers.
    enabled: false
    # -- A Kubernetes Volume definition which will contain a valid Java Trust
    # Store. See
    # https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/volume/
    # for valid parameters.
    volume: {}
    # -- The sub-path of the valid Java Trust Store to mount from the volume.
    subPath: cacerts


# Opik MCP OAuth Authorization Server
mcpOAuth:
  # -- Render nginx locations (AS endpoints, consent UI, discovery URL). Turn on together with
  # opik-backend MCP_OAUTH_ENABLED=true and a path-prefix OPIK_BASE_URL (e.g. https://www.comet.com/opik).
  enabled: false


component:
  backend:
    enabled: true
    serviceAccount:
      create: true
      name: opik-backend
    metrics:
      enabled: false
    image:
      repository: opik-backend
      pullPolicy: IfNotPresent
    replicaCount: 1
    autoscaling:
      enabled: false
      behavior:
        scaleDown:
          stabilizationWindowSeconds: 300
          policies:
          - type: Percent
            value: 50
            periodSeconds: 60
        scaleUp:
          stabilizationWindowSeconds: 60
          policies:
          - type: Pods
            value: 2
            periodSeconds: 60
          selectPolicy: Max
    backendConfigMap:
      enabled: true
    run_migration: true
    # Resource requests/limits for the `backend-migrations` init container.
    # Empty ({}) by default — no resources set.
    run_migration_resources: {}
    waitForClickhouse:
      clickhouse:
        host: clickhouse-opik-clickhouse
        port: 8123
        protocol: http
      image:
        registry: docker.io
        repository: curlimages/curl
        tag: 8.12.1
      # Resource requests/limits for the `wait-for-clickhouse-service` init container.
      # Empty ({}) by default — no resources set.
      resources: {}
    waitForMysql:
      enabled: false
      mysql:
        host: opik-mysql
        port: 3306
      image:
        registry: docker.io
        repository: busybox
        tag: 1.36
      # Resource requests/limits for the `wait-for-mysql-service` init container.
      # Empty ({}) by default — no resources set.
      resources: {}
    resources:
      requests:
        ephemeral-storage: 10Gi
    livenessProbe:
      httpGet:
        path: /health-check?name=all&type=alive
        port: 8080
        httpHeaders:
          - name: Accept
            value: application/json
    readinessProbe:
      httpGet:
        path: /health-check?name=all&type=ready
        port: 8080
        httpHeaders:
          - name: Accept
            value: application/json
      initialDelaySeconds: 20
    podDisruptionBudget:
      enabled: false
    env:
      STATE_DB_PROTOCOL: "jdbc:mysql://"
      STATE_DB_URL: "opik-mysql:3306/opik?rewriteBatchedStatements=true&connectionTimeZone=UTC&forceConnectionTimeZoneToSession=true"
      STATE_DB_DATABASE_NAME: "opik"
      STATE_DB_USER: opik
      ANALYTICS_DB_MIGRATIONS_URL: "jdbc:clickhouse://clickhouse-opik-clickhouse:8123"
      ANALYTICS_DB_MIGRATIONS_USER: "opik"
      ANALYTICS_DB_PROTOCOL: "HTTP"
      ANALYTICS_DB_HOST: "clickhouse-opik-clickhouse"
      ANALYTICS_DB_PORT: "8123"
      ANALYTICS_DB_USERNAME: "opik"
      ANALYTICS_DB_DATABASE_NAME: "opik"
      JAVA_OPTS: "-Dliquibase.propertySubstitutionEnabled=true -XX:+UseG1GC -XX:MaxRAMPercentage=80.0 -XX:MinRAMPercentage=75"
      REDIS_URL: redis://:wFSuJX9nDBdCa25sKZG7bh@opik-redis-master:6379/
      ANALYTICS_DB_MIGRATIONS_PASS: opik
      ANALYTICS_DB_PASS: opik
      STATE_DB_PASS: opik
      OPIK_OTEL_SDK_ENABLED: false
      OTEL_VERSION: 2.12.0
      OTEL_PROPAGATORS: "tracecontext,baggage,b3"
      OTEL_EXPERIMENTAL_EXPORTER_OTLP_RETRY_ENABLED: true
      OTEL_EXPORTER_OTLP_METRICS_DEFAULT_HISTOGRAM_AGGREGATION: BASE2_EXPONENTIAL_BUCKET_HISTOGRAM
      OTEL_EXPERIMENTAL_RESOURCE_DISABLED_KEYS: process.command_args
      OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE: delta
      PYTHON_EVALUATOR_URL: http://opik-python-backend:8000
      UI_DEFAULT_PAGE_SIZE: "100"
      # LLM model registry (see apps/opik-backend/config.yml:1309-1317).
      # Remote CDN fetch is opt-in: self-hosted / OSS deployments serve
      # the classpath YAML shipped with the release by default, no
      # outbound traffic. Operators who want fresh models between
      # releases can set LLM_MODEL_REGISTRY_REMOTE_ENABLED: "true" and
      # point LLM_MODEL_REGISTRY_REMOTE_URL at their preferred source.
      LLM_MODEL_REGISTRY_DEFAULT_RESOURCE: "llm-models-default.yaml"
      LLM_MODEL_REGISTRY_LOCAL_OVERRIDE_PATH: ""
      LLM_MODEL_REGISTRY_REMOTE_ENABLED: "false"
      LLM_MODEL_REGISTRY_REMOTE_URL: ""
      LLM_MODEL_REGISTRY_REFRESH_INTERVAL_SECONDS: "300"
    envFrom:
      - configMapRef:
          name: opik-backend
    service:
      type: ClusterIP
      ports:
      - name: http
        port:  8080
        protocol: TCP
        targetPort:  8080
      - name: swagger
        port:  3003
        protocol: TCP
        targetPort:  3003
    ingress:
      enabled: false
      ingressClassName: ""
      annotations: {}
      hosts: []
      tls:
        enabled: false
        hosts: []
        secretName: ""
    # @ignored
    usesJavaTrustStore: true

  python-backend:
    enabled: true
    serviceAccount:
      create: true
      name: opik-python-backend
    metrics:
      enabled: false
    image:
      repository: opik-python-backend
      pullPolicy: IfNotPresent
    replicaCount: 1
    autoscaling:
      enabled: false
      behavior:
        scaleDown:
          stabilizationWindowSeconds: 300
          policies:
          - type: Percent
            value: 50
            periodSeconds: 60
        scaleUp:
          stabilizationWindowSeconds: 60
          policies:
          - type: Pods
            value: 2
            periodSeconds: 60
          selectPolicy: Max
    backendConfigMap:
      enabled: true
    podDisruptionBudget:
      enabled: false
    env:
      PYTHON_CODE_EXECUTOR_IMAGE_REGISTRY: *registry
      PYTHON_CODE_EXECUTOR_IMAGE_NAME: "opik-sandbox-executor-python"
      # PYTHON_CODE_EXECUTOR_IMAGE_TAG defaults to Chart.AppVersion when not specified
      PYTHON_CODE_EXECUTOR_STRATEGY: "process"
      PYTHON_CODE_EXECUTOR_PARALLEL_NUM: "5"
      PYTHON_CODE_EXECUTOR_EXEC_TIMEOUT_IN_SECS: "3"
      PYTHON_CODE_EXECUTOR_ALLOW_NETWORK: "false"
      PYTHON_CODE_EXECUTOR_CPU_SHARES: "512"
      PYTHON_CODE_EXECUTOR_MEM_LIMIT: "256m"
      # PYTHON_CODE_EXECUTOR_CPU_LIMIT: "0.5"  # Hard CPU limit per executor container (in CPUs, e.g. "0.5" = half a core). Unset by default — no hard limit.
      PYTHON_CODE_EXECUTOR_METRICS_INTERVAL_IN_SECONDS: "60"
      OPIK_REVERSE_PROXY_URL: "http://opik-frontend:5173/api"
      OTEL_SERVICE_NAME: "opik-python-backend"
      OTEL_METRIC_EXPORT_INTERVAL: "60000"
      OTEL_PROPAGATORS: "tracecontext,baggage"
      OTEL_EXPERIMENTAL_EXPORTER_OTLP_RETRY_ENABLED: true
      OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE: cumulative
      # Opik SDK URL for optimizer to reach Java backend
      OPIK_URL_OVERRIDE: "http://opik-backend:8080"
      # Redis URL for Optimization Studio log streaming
      REDIS_URL: redis://:wFSuJX9nDBdCa25sKZG7bh@opik-redis-master:6379/

      # ============================================================
      # Optimization Studio Configuration (optional)
      # ============================================================
      # The Optimization Studio RQ worker runs in this service by default
      # (RQ_WORKER_ENABLED defaults to true). Set RQ_WORKER_ENABLED: "false"
      # to run an executor-only python-backend without the worker.
      # Maximum number of concurrent optimization jobs (default: 5)
      # Each job runs in a separate worker thread with isolated subprocess
      # OPTSTUDIO_MAX_CONCURRENT_JOBS: "5"
      # Number of dataset items to sample for optimization (default: 1000)
      # Limits memory usage for large datasets
      # OPTSTUDIO_DATASET_SAMPLES: "1000"
      # Terminal width for Rich log output formatting (default: 80)
      # OPTSTUDIO_LOG_TERM_WIDTH: "150"
      # Execution timeout for optimization jobs in seconds (default: 86400 = 24 hours)
      # OPTSTUDIO_EXECUTION_TIMEOUT: "86400"
      # Log level for the opik-optimizer SDK (default: DEBUG)
      # OPIK_OPTIMIZER_LOG_LEVEL: "DEBUG"
      # TTL for optimization logs in Redis in seconds (default: 86400 = 24 hours)
      # OPTSTUDIO_LOG_REDIS_TTL: "86400"
      # Default max output tokens for optimizer LLM calls (default: 8192)
      # Prevents truncation of structured JSON outputs from LLM
      # OPTSTUDIO_LLM_MAX_TOKENS: "8192"
      # TTL for failed RQ jobs in Redis in seconds (default: 86400 = 1 day)
      # RQ_WORKER_TTL_FAILURE: "86400"

    # LLM provider API keys are no longer injected via environment variables.
    # Configure them per workspace in the Opik UI under "AI Providers" — the
    # backend resolves the key from workspace settings when the Optimization
    # Studio and Playground make LLM calls.
    #
    # Optional: Reference external Kubernetes secrets for other sensitive
    # configuration (e.g. AWS credentials, DB credentials) from external secret
    # managers (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault).
    #
    # Customers can create secrets using:
    # - ExternalSecret Operator (recommended for production)
    # - Kubernetes Secrets CSI Driver
    # - Manual kubectl create secret
    #
    # Each secretRef will be added as an envFrom entry, making all key-value pairs
    # from the secret available as environment variables in the python-backend pod.
    #
    # Example configuration:
    # secretRefs:
    #   - name: "opik-aws-credentials"    # Contains AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
    secretRefs: []

    envFrom:
      - configMapRef:
          name: opik-python-backend

    securityContext:
      privileged: true
    networkPolicy:
      enabled: false
      annotations: {}
      additionalRules: []
      # example networks to block
      # # Allow egress to public internet, excluding private / reserved ranges
      #   - to:
      #     - ipBlock:
      #         cidr: 0.0.0.0/0
      #         except:
      #           # Standard RFC1918 Private Ranges
      #           - 10.0.0.0/8
      #           - 172.16.0.0/12
      #           - 192.168.0.0/16
      #           # EKS / Carrier Grade NAT
      #           - 100.64.0.0/10
      #           # AWS Metadata & Link Local (Very Important)
      #           - 169.254.0.0/16
      #           # Loopback range
      #           - 127.0.0.0/8
      #           # Reserved / Protocol Ranges
      #           - 192.0.0.0/24
      #           - 198.18.0.0/15
      #           # Multicast ranges
      #           - 224.0.0.0/4
      #           # Broadcast address
      #           - 255.255.255.255/32

    service:
      type: ClusterIP
      ports:
      - name: http
        port:  8000
        protocol: TCP
        targetPort:  8000

    ingress:
      enabled: false
      ingressClassName: ""
      annotations: {}
      hosts: []
      tls:
        enabled: false
        hosts: []
        secretName: ""

  frontend:
    enabled: true
    serviceAccount:
      create: true
      name: opik-frontend
    metrics:
      enabled: false
    image:
      repository: opik-frontend
      pullPolicy: IfNotPresent
    replicaCount: 1
    autoscaling:
      enabled: false
      behavior:
        scaleDown:
          stabilizationWindowSeconds: 300
          policies:
          - type: Percent
            value: 50
            periodSeconds: 60
        scaleUp:
          stabilizationWindowSeconds: 60
          policies:
          - type: Pods
            value: 2
            periodSeconds: 60
          selectPolicy: Max
    backendConfigMap:
      enabled: false
    resources:
      requests:
        ephemeral-storage: 10Gi
    service:
      type: ClusterIP
      ports:
      - name: http
        port:  5173
        protocol: TCP
        targetPort:  5173
    ingress:
      enabled: false
      ingressClassName: ""
      annotations: {}
      hosts: []
        # - host: opik.example.com
        #   paths:
        #     - path: /
        #       port: 5173
        #       pathType: Prefix
        #     - path: /api
        #       port: 5173
        #       pathType: Prefix
        #     - path: /opik-ai
        #       port: 5173
        #       pathType: Prefix
      tls:
        enabled: false
        hosts: []
        secretName: ""
    # throttled locations
    throttling: {}
    # map variables for use with throttling and other places
    maps: []
    # use internal aws resolvr on vpc
    awsResolver: false
    # Enable HSTS header (only enable when running behind HTTPS termination)
    # DEPRECATED: Use extraServerHeaders instead for more flexibility
    hstsEnabled: false
    # Cache control configuration for static assets
    # Defines max-age values for different file types based on deployment frequency
    # List of pattern/value pairs - order matters! First match wins in nginx map.
    # Patterns are evaluated in the order defined here.
    cacheControl:
      # JavaScript and CSS - 7 days cache (frequent deployments with versioned/hashed filenames)
      - pattern: "~assets/.*\\.(js|css)$"
        value: "public, max-age=604800, immutable"
      # Images - 30 days cache (static assets, but may update)
      - pattern: "~(images/.*|assets/.*)\\.(jpg|jpeg|png|gif|svg|webp|ico)$"
        value: "public, max-age=2592000"
      # Fonts - 30 days cache (rarely change, but shorter for frequent updates)
      - pattern: "~assets/.*\\.(woff|woff2|ttf|eot)$"
        value: "public, max-age=2592000"
      # JSON/data files - 1 day cache (may update frequently)
      - pattern: "~assets/.*\\.json$"
        value: "public, max-age=86400"
      # HTML files and everything else - always revalidate to get fresh content
      - pattern: "default"
        value: "no-cache, must-revalidate"
    # Extra server-level headers to add to all responses
    # Use this to add custom security headers or override defaults
    # Key is the header name, value can be a string or list of strings
    # If list, multiple add_header directives will be generated
    extraServerHeaders:
      # OWASP recommended security headers (defaults)
      X-Content-Type-Options: "nosniff"
      X-Frame-Options: "DENY"
      X-XSS-Protection: "0"
      # Add custom headers or override defaults:
      # X-Custom-Header: "custom-value"
      # Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
      # Multiple values example (list):
      # Link:
      #   - "</style.css>; rel=preload; as=style"
      #   - "</script.js>; rel=preload; as=script"
    # Content Security Policy (CSP) configuration
    # Customize these lists to allow additional external services (analytics, CDNs, etc.)
    # Note: The legacy 'csp.enabled' flag is still honored for backward compatibility.
    # If you previously set 'csp.enabled: false', CSP headers will not be added.
    contentSecurityPolicy:
      # Default source for all directives
      default-src:
        - "'self'"
      # Scripts allowed to execute
      script-src:
        - "'self'"
        - "'unsafe-inline'"
        - "'unsafe-eval'"
        # Add external services here, e.g.:
        # - "https://cdn.example.com"
      # Styles allowed to load
      style-src:
        - "'self'"
        - "'unsafe-inline'"
        - "https://fonts.googleapis.com"
      # Images allowed to load
      img-src:
        - "'self'"
        - "data:"
        - "blob:"
        - "https:"
        - "http:"
      # Media (audio/video) allowed to load
      media-src:
        - "'self'"
        - "data:"
        - "blob:"
        - "https:"
        - "http:"
      # Fonts allowed to load
      font-src:
        - "'self'"
        - "data:"
        - "https://fonts.gstatic.com"
      # XHR/Fetch/WebSocket connections allowed
      connect-src:
        - "'self'"
        - "ws:"
        - "wss:"
        - "https:"
        # Add external API endpoints here, e.g.:
        # - "https://api.example.com"
      # Objects/plugins (Flash, Java, etc.)
      object-src:
        - "'none'"
      # Base URI for relative URLs
      base-uri:
        - "'self'"
      # Frame ancestors (who can embed this site)
      frame-ancestors:
        - "'none'"
      # Child frames/workers
      child-src:
        - "'self'"
        - https://cdn.comet.com
      # Form submission targets
      form-action:
        - "'self'"
      # Manifest files
      manifest-src:
        - "'self'"
      # Worker, shared worker, service worker sources
      worker-src:
        - "'self'"
        - "blob:"
    upstreamConfig: {}
      # proxy_read_timeout: 60
      # proxy_connect_timeout: 60
      # proxy_send_timeout: 60
      # proxy_buffering: 'on'
      # proxy_request_buffering: 'on'
    # Cost Intelligence (cost-api): when enabled, the frontend nginx routes the
    # ai-spend subset (<rootPath>/api/v1/private/ai-spend/*) to the standalone
    # ai-cost-backend service instead of opik-backend, served same-origin so the
    # platform session cookie still reaches it. Off by default; the consuming
    # deployment turns it on the same way on both comet.com (comet-helm) and
    # single-tenant SaaS (comet-ml-helm-chart). rootPath-aware, so it works
    # whether opik is served at the root or under /opik.
    aiSpendBackend:
      enabled: false
      host: ai-cost-backend
      port: 8000
      # cost-api's ROOT_PATH — the rewrite target prefix. A request to
      # <rootPath>/api/v1/private/ai-spend/X is proxied as <costApiRootPath>/v1/private/ai-spend/X.
      costApiRootPath: /cost-api
    podDisruptionBudget:
      enabled: false

mysql:
  enabled: true
  fullnameOverride: opik-mysql
  auth:
    rootPassword: "opik"
  initdbScripts:
    createdb.sql: |-
      CREATE DATABASE IF NOT EXISTS opik DEFAULT CHARACTER SET utf8 DEFAULT COLLATE utf8_general_ci;
      CREATE USER IF NOT EXISTS 'opik'@'%' IDENTIFIED BY 'opik';
      GRANT ALL ON `opik`.* TO 'opik'@'%';
      FLUSH PRIVILEGES;
  primary:
    # Use Bitnami MySQL data directory path for compatibility
    dataDir: /bitnami/mysql/data
    persistence:
      enabled: true
      size: 20Gi

minio:
  enabled: true
  image:
    registry: docker.io
    repository: cloudpirates/image-minio
    tag: "RELEASE.2025-10-15T17-29-55Z-hardened"
    imagePullPolicy: IfNotPresent
  replicaCount: 1
  config:
    browserEnabled: false
  persistence:
    enabled: true
    size: 50Gi
  auth:
    rootUser: "THAAIOSFODNN7EXAMPLE"
    rootPassword: "LESlrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
  defaultBuckets: "public:download"
  fullnameOverride: opik-minio


redis:
  enabled: true
  # Use bitnami redis fullnameOverride for compatibility
  fullnameOverride: opik-redis-master
  architecture: standalone
  metrics:
    enabled: false
  auth:
    enabled: true
    password: "wFSuJX9nDBdCa25sKZG7bh"
  image:
    registry: docker.io
    repository: redis/redis-stack-server
    tag: "7.2.0-v10"
    pullPolicy: IfNotPresent
  resources:
    requests:
      cpu: 15m
      memory: 105M
    limits:
      memory: 1Gi
  config:
    content: |
      # Redis Stack configuration
      dir /data
      maxmemory 105M
      maxmemory-policy allkeys-lru
      # Redis Stack modules are automatically loaded by the redis-stack-server image
  persistence:
    enabled: true
    size: 8Gi

altinity-clickhouse-operator:
  enabled: true
  metrics:
    enabled: false
  serviceMonitor:
    enabled: false
    interval: '' # workaround for https://github.com/Altinity/clickhouse-operator/issues/1759

clickhouse:
  enabled: true
  shardsCount: 1
  replicasCount: 1
  image: altinity/clickhouse-server:25.8.16.10002.altinitystable
  storage: 50Gi
  logsLevel: information
  # Custom health checks with longer timeouts for major version upgrades
  livenessProbe:
    httpGet:
      path: /ping
      port: 8123
    initialDelaySeconds: 60
    periodSeconds: 30
    timeoutSeconds: 5
    failureThreshold: 10
  readinessProbe:
    httpGet:
      path: /ping
      port: 8123
    initialDelaySeconds: 30
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 30
  configuration:
    files:
      conf.d/memory.xml: |
        <yandex>
          <max_server_memory_usage_to_ram_ratio>0.85</max_server_memory_usage_to_ram_ratio>
        </yandex>
      conf.d/profiles.xml: |
        <clickhouse>
          <profiles>
            <default>
                <max_bytes_ratio_before_external_sort>0.2</max_bytes_ratio_before_external_sort>
                <max_bytes_ratio_before_external_group_by>0.2</max_bytes_ratio_before_external_group_by>
                <!-- CH 25.8 made the experimental Time type opt-in; required for fresh installs to replay migration 000030. -->
                <enable_time_time64_type>1</enable_time_time64_type>
                <!-- the new CH 25.x default (1) makes FINAL reads on skip-indexed tables over-read massively; our queries already prune on the PK/project_id, so exact mode isn't needed. -->
                <use_skip_indexes_if_final_exact_mode>0</use_skip_indexes_if_final_exact_mode>
            </default>
          </profiles>
        </clickhouse>
      # Remove or add TTL to system tables that are not needed
      conf.d/system_tables.xml: |
        <clickhouse>
          <opentelemetry_span_log remove="1"/>
          <asynchronous_metric_log remove="1"/>
          <processors_profile_log remove="1"/>
          <text_log remove="1"/>
          <trace_log remove="1"/>
          <blob_storage_log remove="1"/>
          <error_log>
              <engine>
                  ENGINE MergeTree
                  PARTITION BY toYYYYMM(event_date)
                  ORDER BY (event_date, event_time)
                  TTL event_date + toIntervalDay(30)
                  SETTINGS index_granularity = 8192
              </engine>
              <database>system</database>
              <table>error_log</table>
          </error_log>
          <latency_log>
              <engine>
                  ENGINE = MergeTree
                  PARTITION BY toYYYYMM(event_date)
                  ORDER BY (event_date, event_time)
                  TTL event_date + toIntervalDay(30)
                  SETTINGS index_granularity = 8192
              </engine>
              <database>system</database>
              <table>latency_log</table>
          </latency_log>
          <metric_log>
              <engine>
                  ENGINE = MergeTree
                  PARTITION BY toYYYYMM(event_date)
                  ORDER BY (event_date, event_time)
                  TTL event_date + toIntervalDay(30)
                  SETTINGS index_granularity = 8192
              </engine>
              <database>system</database>
              <table>metric_log</table>
          </metric_log>
          <query_metric_log>
              <engine>
                  ENGINE = MergeTree
                  PARTITION BY toYYYYMM(event_date)
                  ORDER BY (event_date, event_time)
                  TTL event_date + toIntervalDay(30)
                  SETTINGS index_granularity = 8192
              </engine>
              <database>system</database>
              <table>query_metric_log</table>
          </query_metric_log>
        </clickhouse>
  service:
    serviceTemplate: clickhouse-cluster-svc-template
  templates:
    podTemplate: clickhouse-cluster-pod-template
    replicaServiceTemplate: clickhouse-replica-svc-template
    serviceTemplate: clickhouse-cluster-svc-template
    volumeClaimTemplate: storage-vc-template
  extraServiceTemplates: []
  extraPodTemplates: []
  extraVolumeClaimTemplates: []
  # -- (list) Additional volume mounts for the ClickHouse server container.
  # Use this to mount volumes that ClickHouse server needs direct access to,
  # such as a backup disk for embedded backups (BACKUP TO Disk(...)).
  # The mount name can reference a CHI volumeClaimTemplate defined in
  # `clickhouse.extraVolumeClaimTemplates` (matched by name automatically by
  # the ClickHouse operator), or a volume defined in `clickhouse.extraVolumes`.
  extraVolumeMounts: []
  # -- (list) Additional pod-level volumes for the ClickHouse pod, independent
  # of the backup server sidecar. Use this for non-PVC volume types (configMap,
  # secret, emptyDir, hostPath, etc.) that should be available to the ClickHouse
  # server container. For persistent storage, prefer defining a CHI-managed PVC
  # via `clickhouse.extraVolumeClaimTemplates` and referencing it by name in
  # `extraVolumeMounts` above.
  extraVolumes: []
  adminUser:
    useSecret:
      enabled: false
    username: opik
    password: opik
  serviceAccount:
    annotations: {}
    create: false
    name: ""
  zookeeper:
      host: opik-zookeeper
  backup:
    enabled: false
    successfulJobsHistoryLimit: 1
    serviceAccount:
      annotations: {}
      create: false
      name: ""
    schedule: "0 0 * * *" # daily at midnight
    extraEnv: {}
    command:
      - /bin/bash
      - '-cx'
      - |-
        export backupname=backup$(date +'%Y%m%d%H%M')
        echo "BACKUP ALL EXCEPT DATABASE system TO S3('${CLICKHOUSE_BACKUP_BUCKET}/${backupname}/', '$ACCESS_KEY', '$SECRET_KEY');" > /tmp/backQuery.sql
        clickhouse-client -h clickhouse-opik-clickhouse --send_timeout 600000 --receive_timeout 600000 --port 9000 --queries-file=/tmp/backQuery.sql
  backupServer:
    enabled: false
    image: altinity/clickhouse-backup:2.6.39
    port: 7171
    monitoring:
      enabled: false
      additionalLabels: {}
      annotations: {}
      service:
        type: ClusterIP
        ports:
          - name: ch-backup-rest
            port: 80
            targetPort: 7171
      serviceMonitor:
        enabled: false
        additionalLabels: {}
        annotations: {}
        namespace: ""
        portName: ""
        interval: "60s"
        scrapeTimeout: "30s"
        relabelings: []
        metricRelabelings: []
        podTargetLabels: []
        honorLabels: false
    # -- (list) Additional volumes to add to the ClickHouse pod when the backup
    # server is enabled. Use this for non-PVC volume types (emptyDir, configMap,
    # secret, hostPath, etc.). For persistent storage, prefer using
    # `clickhouse.extraVolumeClaimTemplates` to define a CHI-managed PVC and
    # reference its name directly in `extraVolumeMounts` below (the clickhouse
    # operator matches volumeMount names to volumeClaimTemplate names
    # automatically). Note that `clickhouse-backup` writes local backups to
    # `/var/lib/clickhouse/backup/` by default (on the same filesystem as
    # ClickHouse data to preserve hard links). Mounting a separate volume at
    # that path will cause backups to use full copies instead of hard links.
    extraVolumes: []
    # -- (list) Additional volume mounts for the `clickhouse-backup` container.
    # The mount name can reference a CHI `volumeClaimTemplate` defined in
    # `clickhouse.extraVolumeClaimTemplates` (matched by name), or a volume
    # defined in `extraVolumes` above.
    extraVolumeMounts: []
    env:
      LOG_LEVEL: info
      ALLOW_EMPTY_BACKUPS: true
      API_LISTEN: 0.0.0.0:7171
      API_CREATE_INTEGRATION_TABLES: true
  monitoring:
    enabled: false
    username: opikmon # readonly user
    password: opikmon
    useSecret:
      enabled: false
    # resources:
    #   requests:
    #     cpu: 300m
    #     memory: 1Gi
    #   limits:
    #     memory: 1Gi
    additionalLabels: {}
    annotations: {}
    port: 9363
    service:
      type: ClusterIP
      ports:
        - name: prometheus-metrics
          port: 80
          targetPort: 9363
    serviceMonitor:
      enabled: false
      additionalLabels: {}
      annotations: {}
      namespace: ""
      portName: ""
      interval: "60s"
      scrapeTimeout: "30s"
      relabelings: []
      metricRelabelings: []
      podTargetLabels: []
      honorLabels: false
  namespaceDomainPattern:  ""

zookeeper:
  enabled: true
  fullnameOverride: opik-zookeeper
  # Server ID offset for Zookeeper cluster. Default is 1 for compatibility with
  # previous Bitnami-based installations. Set to 0 only for fresh installs.
  serverIdOffset: 1
  image:
    registry: docker.io
    repository: zookeeper
    tag: "3.9.4"
    imagePullPolicy: IfNotPresent
  replicaCount: 1
  podDisruptionBudget:
    enabled: true
  persistence:
    # Use bitnami zookeeper data directory path for compatibility
    mountPath: /bitnami/zookeeper
    dataDir: /bitnami/zookeeper/data
    enabled: true
    size: "50Gi"
  headless:
    publishNotReadyAddresses: true
  extraEnvVars:
    - name: ZK_HEAP_SIZE
      value: "512M"
    - name: ZOO_DATA_DIR
      value: "/bitnami/zookeeper/data"
  commonLabels:
    app.kubernetes.io/name: zookeeper-opik

    # resources:
    #   requests:
    #     cpu: 300m
    #     memory: 1500Mi
    #   limits:
    #     memory: 2Gi