Values Reference

This page covers every top-level parameter group in the Bifrost Helm chart’s values.yaml, how to supply values via --set vs -f, and where to find ready-made example files.

The full values schema is available at https://getbifrost.ai/schema. All values.yaml fields map directly to config.json fields generated by the chart.

Supplying Values

One-liner with `--set`

Good for a single field or quick experiments:

helm install bifrost bifrost/bifrost \
  --set image.tag=v1.4.11 \
  --set replicaCount=3 \
  --set bifrost.client.initialPoolSize=500

Values file with `-f`

Recommended for anything beyond a couple of fields:

# Create your values file
cat > my-values.yaml <<'EOF'
image:
  tag: "v1.4.11"

replicaCount: 2

bifrost:
  encryptionKey: "your-32-byte-encryption-key-here"
  client:
    initialPoolSize: 500
    enableLogging: true
EOF

# Install
helm install bifrost bifrost/bifrost -f my-values.yaml

# Upgrade later
helm upgrade bifrost bifrost/bifrost -f my-values.yaml

# Upgrade and reuse all previously set values, overriding only one field
helm upgrade bifrost bifrost/bifrost \
  --reuse-values \
  --set replicaCount=5

Multiple values files

Later files override earlier ones - useful for a base + environment-specific overlay:

helm install bifrost bifrost/bifrost \
  -f base-values.yaml \
  -f production-overrides.yaml

Key Parameters Reference

Image

Parameter	Description	Default
`image.repository`	Container image repository	`docker.io/maximhq/bifrost`
`image.tag`	Required. Image version (e.g. `v1.4.11`)	`""`
`image.pullPolicy`	Image pull policy	`IfNotPresent`
`imagePullSecrets`	List of pull secret names for private registries	`[]`

# Always specify the tag - the chart will not start without it
helm install bifrost bifrost/bifrost --set image.tag=v1.4.11

Replicas & Autoscaling

Parameter	Description	Default
`replicaCount`	Static replica count (ignored when HPA is enabled)	`1`
`autoscaling.enabled`	Enable Horizontal Pod Autoscaler	`false`
`autoscaling.minReplicas`	Minimum replicas	`1`
`autoscaling.maxReplicas`	Maximum replicas	`10`
`autoscaling.targetCPUUtilizationPercentage`	CPU target for scaling	`80`
`autoscaling.targetMemoryUtilizationPercentage`	Memory target for scaling	`80`
`autoscaling.behavior.scaleDown.stabilizationWindowSeconds`	Cooldown before scale-down (important for SSE streams)	`300`
`autoscaling.behavior.scaleDown.policies[0].value`	Max pods removed per period	`1`

Resources

Parameter	Description	Default
`resources.requests.cpu`	CPU request	`500m`
`resources.requests.memory`	Memory request	`512Mi`
`resources.limits.cpu`	CPU limit	`2000m`
`resources.limits.memory`	Memory limit	`2Gi`

Service

Parameter	Description	Default
`service.type`	`ClusterIP`, `LoadBalancer`, or `NodePort`	`ClusterIP`
`service.port`	Service port	`8080`

Ingress

Parameter	Description	Default
`ingress.enabled`	Enable ingress	`false`
`ingress.className`	Ingress class (e.g. `nginx`, `traefik`)	`""`
`ingress.annotations`	Ingress annotations	`{}`
`ingress.hosts`	Host rules	see values.yaml
`ingress.tls`	TLS configuration	`[]`

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/proxy-body-size: "100m"
  hosts:
    - host: bifrost.yourdomain.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: bifrost-tls
      hosts:
        - bifrost.yourdomain.com

Probes

Parameter	Description	Default
`livenessProbe.initialDelaySeconds`	Seconds before first liveness check	`30`
`livenessProbe.periodSeconds`	Liveness check interval	`30`
`readinessProbe.initialDelaySeconds`	Seconds before first readiness check	`10`
`readinessProbe.periodSeconds`	Readiness check interval	`10`

Both probes hit GET /health.

Graceful Shutdown

Bifrost supports long-lived SSE streaming connections. The default preStop hook and termination grace period let in-flight streams finish before the pod is killed:

Parameter	Description	Default
`terminationGracePeriodSeconds`	Total grace period	`60`
`lifecycle.preStop.exec.command`	Sleep before SIGTERM so load balancer drains	`["sh", "-c", "sleep 15"]`

Increase terminationGracePeriodSeconds if your typical stream responses take longer than 45 seconds.

Service Account

Parameter	Description	Default
`serviceAccount.create`	Create a dedicated service account	`true`
`serviceAccount.annotations`	Annotations (e.g. for IRSA, Workload Identity)	`{}`
`serviceAccount.name`	Override the generated name	`""`

Pod Scheduling

# Spread replicas across nodes
affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/name: bifrost
        topologyKey: kubernetes.io/hostname

# Pin to specific node pool
nodeSelector:
  node-type: ai-workload

# Tolerate GPU taints
tolerations:
  - key: "gpu"
    operator: "Equal"
    value: "true"
    effect: "NoSchedule"

Spreading replicas across zones and nodes topologySpreadConstraints is rendered into the Bifrost pod spec (Deployment or StatefulSet) to spread replicas across nodes or zones, which reduces the chance that losing one takes every replica down. Unlike a required pod anti-affinity rule, it still lets you run more replicas than you have nodes. It does not guarantee a spread: ScheduleAnyway only prefers one, and DoNotSchedule without minDomains can still place every replica in the only eligible domain.

topologySpreadConstraints:
  # Hard rule: zone replica counts may differ by at most 1. A pod stays Pending rather than break it.
  - maxSkew: 1
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: DoNotSchedule
  # Soft rule: prefer spreading across nodes, but never block scheduling.
  - maxSkew: 1
    topologyKey: kubernetes.io/hostname
    whenUnsatisfiable: ScheduleAnyway

Field	Description
`maxSkew`	Maximum difference in Bifrost pods between any two domains (required, at least `1`)
`topologyKey`	Node label that defines a domain, e.g. `topology.kubernetes.io/zone` or `kubernetes.io/hostname` (required)
`whenUnsatisfiable`	`DoNotSchedule` keeps the pod Pending rather than break the skew; `ScheduleAnyway` only prefers spreading (required)
`labelSelector`	Pods counted per domain. Omit it and the chart fills in this release’s server pod labels, so only Bifrost’s own replicas are counted. An explicit selector, including `{}` (every pod in the namespace), is kept as written
`minDomains`	Minimum number of eligible domains. Requires `whenUnsatisfiable: DoNotSchedule`; the chart rejects it with `ScheduleAnyway`
`matchLabelKeys`, `nodeAffinityPolicy`, `nodeTaintsPolicy`	Passed through unchanged; see the Kubernetes docs

With DoNotSchedule, a domain whose nodes are cordoned or tainted still counts toward the skew (the default nodeTaintsPolicy: Ignore), so scaling up can leave pods Pending. Use ScheduleAnyway, or set nodeTaintsPolicy: Honor, when that is not what you want.

Extra Environment Variables

Three ways to inject env vars:

# Inline key/value pairs
env:
  - name: HTTP_PROXY
    value: "http://proxy.corp.example.com:3128"

# Map syntax (appended after env)
extraEnv:
  NO_PROXY: "169.254.169.254,10.0.0.0/8"

# Bulk-load from existing Secrets or ConfigMaps
envFrom:
  - secretRef:
      name: my-corp-secrets
  - configMapRef:
      name: my-app-config

Init Containers

initContainers:
  - name: wait-for-db
    image: busybox:1.35
    command: ["sh", "-c", "until nc -z postgres-svc 5432; do sleep 2; done"]

Sidecar Containers

Add sidecars the way Kubernetes defines them; the chart has no separate sidecar setting. Every container in the pod shares its network, so a sidecar reaches Bifrost on localhost:8080. Native sidecars (Kubernetes 1.29+) are init containers with restartPolicy: Always, as described in the Kubernetes sidecar docs. Add them under initContainers. Kubernetes starts a native sidecar before the init containers listed after it and before Bifrost, keeps it running beside Bifrost, restarts it if it exits, and stops it only after Bifrost has shut down. Use one for anything Bifrost needs from startup to shutdown, such as a database proxy. This one runs the Cloud SQL Auth Proxy and points Bifrost’s external PostgreSQL at it:

initContainers:
  - name: cloud-sql-proxy
    image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.1
    restartPolicy: Always      # makes this init container a native sidecar
    args:
      - "--port=5432"                       # Postgres listener, on 127.0.0.1 only
      - "--health-check"                    # serve /startup, /liveness and /readiness
      - "--http-address=0.0.0.0"            # health endpoints must be reachable by the kubelet on the pod IP
      - "--http-port=9801"
      - "my-project:us-central1:bifrost-db" # your instance connection name
    startupProbe:              # later init containers and Bifrost wait until the proxy has started
      httpGet:
        path: /startup
        port: 9801
      periodSeconds: 1
      failureThreshold: 30

storage:
  mode: postgres               # store config and logs in PostgreSQL, reached through the proxy

postgresql:
  external:
    enabled: true
    host: "127.0.0.1"          # the proxy, inside the pod
    port: 5432

Init containers run in list order, so put a native sidecar before any init container that needs it (for example, a migration step that connects through the proxy). Kubernetes moves on once a native sidecar has started, not once its service is ready: when something depends on the sidecar being ready, give it a startupProbe, and Kubernetes waits for the probe to succeed first. The kubelet sends probes to the pod IP, so a sidecar that listens only on 127.0.0.1 (like the proxy’s Postgres port) needs a probe on a listener the kubelet can reach, such as the proxy’s health endpoint above. On a cluster older than 1.29, the chart refuses to render an init container with restartPolicy: Always rather than leave the pod stuck behind an init container that never exits. Regular sidecars go in extraContainers, which the chart appends to the pod’s containers after Bifrost. They start and stop alongside Bifrost with no ordering guarantee, and work on any Kubernetes version. This one serves Bifrost on a second pod port by forwarding raw TCP:

extraContainers:
  - name: port-forwarder
    image: alpine/socat:1.8.0.0
    args: ["TCP-LISTEN:9090,fork,reuseaddr", "TCP:localhost:8080"]
    ports:
      - containerPort: 9090
        name: http-alt

A TCP forwarder passes every route on port 8080, the full API included, with the same authentication; it is not a metrics-only endpoint. To expose only /metrics on its own port, use an HTTP proxy that allows that path alone.

Kind	Where to add it	Starts	Stops	Kubernetes
Native sidecar	`initContainers`, with `restartPolicy: Always`	Before later init containers and Bifrost	After Bifrost	1.29+
Regular sidecar	`extraContainers`	With Bifrost	With Bifrost	Any

Share files between Bifrost and a sidecar by declaring the volume under volumes, mounting it into Bifrost with volumeMounts, and mounting it into the sidecar in its own volumeMounts.

Values Examples

The chart ships ready-made example files under helm-charts/bifrost/values-examples/:

File	Use case
`sqlite-only.yaml`	Minimal local/dev setup
`postgres-only.yaml`	Single-store Postgres
`production-ha.yaml`	HA: 3 replicas, Postgres, Weaviate, HPA, Ingress
`providers-and-virtual-keys.yaml`	All 23 providers + 7 virtual key patterns
`secrets-from-k8s.yaml`	All sensitive values from Kubernetes Secrets
`external-postgres.yaml`	Point at an existing Postgres instance
`postgres-redis.yaml`	Postgres + Redis vector store
`postgres-weaviate.yaml`	Postgres + Weaviate vector store
`postgres-qdrant.yaml`	Postgres + Qdrant vector store
`semantic-cache-secret-example.yaml`	Semantic cache with secret injection
`mixed-backend.yaml`	Config store = postgres, logs store = sqlite

Install from an example file directly:

helm install bifrost bifrost/bifrost \
  -f https://raw.githubusercontent.com/maximhq/bifrost/main/helm-charts/bifrost/values-examples/production-ha.yaml \
  --set image.tag=v1.4.11

Helm Operations

View current values

helm get values bifrost

Diff before upgrading (requires helm-diff plugin)

helm diff upgrade bifrost bifrost/bifrost -f my-values.yaml

Rollback

helm history bifrost
helm rollback bifrost       # to previous revision
helm rollback bifrost 2     # to revision 2

Uninstall

helm uninstall bifrost

# Also remove PVCs (deletes all data)
kubectl delete pvc -l app.kubernetes.io/instance=bifrost

All Key Parameters

A quick-reference table of the most commonly used top-level parameters:

Parameter	Description	Default
`image.tag`	Required. Bifrost image version (e.g., `v1.4.11`)	`""`
`replicaCount`	Number of replicas	`1`
`storage.mode`	Storage backend (`sqlite` or `postgres`)	`sqlite`
`storage.persistence.size`	PVC size for SQLite	`10Gi`
`postgresql.enabled`	Deploy embedded PostgreSQL	`false`
`vectorStore.enabled`	Enable vector store	`false`
`vectorStore.type`	Vector store type (`weaviate`, `redis`, `qdrant`)	`none`
`bifrost.encryptionKey`	Optional encryption key (use `encryptionKeySecret` in production). If omitted, data is stored in plaintext.	`""`
`ingress.enabled`	Enable ingress	`false`
`autoscaling.enabled`	Enable HPA	`false`

Secret Reference Parameters

Use existing Kubernetes Secrets instead of plain-text values. Every sensitive field in the chart has a corresponding existingSecret / secretRef alternative:

Parameter	Description	Default
`bifrost.encryptionKeySecret.name`	Secret name for encryption key	`""`
`bifrost.encryptionKeySecret.key`	Key within the secret	`"encryption-key"`
`postgresql.external.existingSecret`	Secret name for PostgreSQL password	`""`
`postgresql.external.passwordKey`	Key within the secret	`"password"`
`vectorStore.redis.external.existingSecret`	Secret name for Redis password	`""`
`vectorStore.redis.external.passwordKey`	Key within the secret	`"password"`
`vectorStore.weaviate.external.existingSecret`	Secret name for Weaviate API key	`""`
`vectorStore.weaviate.external.apiKeyKey`	Key within the secret	`"api-key"`
`vectorStore.qdrant.external.existingSecret`	Secret name for Qdrant API key	`""`
`vectorStore.qdrant.external.apiKeyKey`	Key within the secret	`"api-key"`
`bifrost.plugins.maxim.secretRef.name`	Secret name for Maxim API key	`""`
`bifrost.plugins.maxim.secretRef.key`	Key within the secret	`"api-key"`
`bifrost.providerSecrets.<provider>.existingSecret`	Secret name for provider API key	`""`
`bifrost.providerSecrets.<provider>.key`	Key within the secret	`"api-key"`
`bifrost.providerSecrets.<provider>.envVar`	Environment variable name to inject	`""`

Advanced Configuration

Comprehensive Example

A production-ready values file combining the most common settings:

# my-values.yaml
image:
  tag: "v1.4.11"

replicaCount: 3

storage:
  mode: postgres

postgresql:
  enabled: true
  auth:
    password: "secure-password"   # use existingSecret in production

autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 10

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: bifrost.example.com
      paths:
        - path: /
          pathType: Prefix

bifrost:
  encryptionKeySecret:
    name: "bifrost-encryption"
    key: "key"
  providers:
    openai:
      keys:
        - name: "primary"
          value: "env.OPENAI_API_KEY"
          weight: 1
  providerSecrets:
    openai:
      existingSecret: "provider-api-keys"
      key: "openai-api-key"
      envVar: "OPENAI_API_KEY"

helm install bifrost bifrost/bifrost -f my-values.yaml

Node Affinity & Scheduling

Deploy to specific nodes and spread replicas across hosts:

nodeSelector:
  node-type: ai-workload

affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/name: bifrost
        topologyKey: kubernetes.io/hostname

tolerations:
  - key: "gpu"
    operator: "Equal"
    value: "true"
    effect: "NoSchedule"

Deployment & Pod Annotations

Useful for tooling like Keel for automatic image updates or Datadog APM injection:

deploymentAnnotations:
  keel.sh/policy: force
  keel.sh/trigger: poll

podAnnotations:
  ad.datadoghq.com/bifrost.logs: '[{"source":"bifrost","service":"bifrost"}]'

Common Patterns

Ready-made values files for the most common deployment scenarios. Each pattern builds on the quickstart.

Development
Multi-Provider
External Database
AI Workloads
Kubernetes Secrets Only

Simple setup for local testing. SQLite, single replica, no autoscaling.

helm install bifrost bifrost/bifrost \
  --set image.tag=v1.4.11 \
  --set 'bifrost.providers.openai.keys[0].name=dev-key' \
  --set 'bifrost.providers.openai.keys[0].value=sk-your-key' \
  --set 'bifrost.providers.openai.keys[0].weight=1'

# Access
kubectl port-forward svc/bifrost 8080:8080

Multiple LLM providers with weighted load balancing.

kubectl create secret generic provider-keys \
  --from-literal=openai-api-key='sk-...' \
  --from-literal=anthropic-api-key='sk-ant-...' \
  --from-literal=gemini-api-key='your-gemini-key'

# multi-provider.yaml
image:
  tag: "v1.4.11"

bifrost:
  encryptionKey: "your-encryption-key"

  client:
    enableLogging: true

  providers:
    openai:
      keys:
        - name: "openai-primary"
          value: "env.OPENAI_API_KEY"
          weight: 2    # 50% of traffic
    anthropic:
      keys:
        - name: "anthropic-primary"
          value: "env.ANTHROPIC_API_KEY"
          weight: 1    # 25%
    gemini:
      keys:
        - name: "gemini-primary"
          value: "env.GEMINI_API_KEY"
          weight: 1    # 25%

  providerSecrets:
    openai:
      existingSecret: "provider-keys"
      key: "openai-api-key"
      envVar: "OPENAI_API_KEY"
    anthropic:
      existingSecret: "provider-keys"
      key: "anthropic-api-key"
      envVar: "ANTHROPIC_API_KEY"
    gemini:
      existingSecret: "provider-keys"
      key: "gemini-api-key"
      envVar: "GEMINI_API_KEY"

  plugins:
    telemetry:
      enabled: true
    logging:
      enabled: true

helm install bifrost bifrost/bifrost -f multi-provider.yaml

Use an existing PostgreSQL instance - RDS, Cloud SQL, Azure Database, or self-managed.

kubectl create secret generic postgres-credentials \
  --from-literal=password='your-external-postgres-password'

# external-db.yaml
image:
  tag: "v1.4.11"

storage:
  mode: postgres

postgresql:
  enabled: false
  external:
    enabled: true
    host: "your-rds-endpoint.us-east-1.rds.amazonaws.com"
    port: 5432
    user: "bifrost"
    database: "bifrost"
    sslMode: "require"
    existingSecret: "postgres-credentials"
    passwordKey: "password"

bifrost:
  encryptionKey: "your-encryption-key"

  providers:
    openai:
      keys:
        - name: "openai-primary"
          value: "sk-..."
          weight: 1

helm install bifrost bifrost/bifrost -f external-db.yaml

Semantic response caching for high-volume AI inference.

kubectl create secret generic bifrost-encryption \
  --from-literal=key='your-32-byte-encryption-key'

kubectl create secret generic provider-keys \
  --from-literal=openai-api-key='sk-your-key'

# ai-workload.yaml
image:
  tag: "v1.4.11"

storage:
  mode: postgres

postgresql:
  enabled: true
  auth:
    password: "secure-password"
  primary:
    persistence:
      size: 50Gi

vectorStore:
  enabled: true
  type: weaviate
  weaviate:
    enabled: true
    persistence:
      size: 50Gi

bifrost:
  encryptionKeySecret:
    name: "bifrost-encryption"
    key: "key"

  providers:
    openai:
      keys:
        - name: "openai-primary"
          value: "env.OPENAI_API_KEY"
          weight: 1

  providerSecrets:
    openai:
      existingSecret: "provider-keys"
      key: "openai-api-key"
      envVar: "OPENAI_API_KEY"

  plugins:
    semanticCache:
      enabled: true
      config:
        provider: "openai"
        keys:
          - value: "env.OPENAI_API_KEY"
            weight: 1
        embedding_model: "text-embedding-3-small"
        dimension: 1536
        threshold: 0.85
        ttl: "1h"
        cache_by_model: true
        cache_by_provider: true

helm install bifrost bifrost/bifrost -f ai-workload.yaml

Zero credentials in values files - all sensitive data in Kubernetes Secrets.

kubectl create secret generic postgres-credentials \
  --from-literal=password='your-postgres-password'

kubectl create secret generic bifrost-encryption \
  --from-literal=key='your-encryption-key'

kubectl create secret generic provider-keys \
  --from-literal=openai-api-key='sk-...' \
  --from-literal=anthropic-api-key='sk-ant-...'

kubectl create secret generic qdrant-credentials \
  --from-literal=api-key='your-qdrant-api-key'

# secrets-only.yaml
image:
  tag: "v1.4.11"

storage:
  mode: postgres

postgresql:
  enabled: false
  external:
    enabled: true
    host: "postgres.example.com"
    port: 5432
    user: "bifrost"
    database: "bifrost"
    sslMode: "require"
    existingSecret: "postgres-credentials"
    passwordKey: "password"

vectorStore:
  enabled: true
  type: qdrant
  qdrant:
    enabled: false
    external:
      enabled: true
      host: "qdrant.example.com"
      port: 6334
      existingSecret: "qdrant-credentials"
      apiKeyKey: "api-key"

bifrost:
  encryptionKeySecret:
    name: "bifrost-encryption"
    key: "key"

  providers:
    openai:
      keys:
        - name: "openai-primary"
          value: "env.OPENAI_API_KEY"
          weight: 1
    anthropic:
      keys:
        - name: "anthropic-primary"
          value: "env.ANTHROPIC_API_KEY"
          weight: 1

  providerSecrets:
    openai:
      existingSecret: "provider-keys"
      key: "openai-api-key"
      envVar: "OPENAI_API_KEY"
    anthropic:
      existingSecret: "provider-keys"
      key: "anthropic-api-key"
      envVar: "ANTHROPIC_API_KEY"

helm install bifrost bifrost/bifrost -f secrets-only.yaml

Managed Kubernetes

Hosted Containers

Config as Code

Enterprise Deployment

Common setup instructions

Values Reference

Supplying Values

One-liner with `--set`

Values file with `-f`

Multiple values files

Key Parameters Reference

Image

Replicas & Autoscaling

Resources

Service

Ingress

Probes

Graceful Shutdown

Service Account

Pod Scheduling

Extra Environment Variables

Init Containers

Sidecar Containers

Values Examples

Helm Operations

View current values

Diff before upgrading (requires helm-diff plugin)

Rollback

Uninstall

All Key Parameters

Secret Reference Parameters

Advanced Configuration

Comprehensive Example

Node Affinity & Scheduling

Deployment & Pod Annotations

Common Patterns

​Supplying Values

​One-liner with --set

​Values file with -f

​Multiple values files

​Key Parameters Reference

​Image

​Replicas & Autoscaling

​Resources

​Service

​Ingress

​Probes

​Graceful Shutdown

​Service Account

​Pod Scheduling

​Extra Environment Variables

​Init Containers

​Sidecar Containers

​Values Examples

​Helm Operations

​View current values

​Diff before upgrading (requires helm-diff plugin)

​Rollback

​Uninstall

​All Key Parameters

​Secret Reference Parameters

​Advanced Configuration

​Comprehensive Example

​Node Affinity & Scheduling

​Deployment & Pod Annotations

​Common Patterns

Supplying Values

One-liner with `--set`

Values file with `-f`

Multiple values files

Key Parameters Reference

Image

Replicas & Autoscaling

Resources

Service

Ingress

Probes

Graceful Shutdown

Service Account

Pod Scheduling

Extra Environment Variables

Init Containers

Sidecar Containers

Values Examples

Helm Operations

View current values

Diff before upgrading (requires helm-diff plugin)

Rollback

Uninstall

All Key Parameters

Secret Reference Parameters

Advanced Configuration

Comprehensive Example

Node Affinity & Scheduling

Deployment & Pod Annotations

Common Patterns