apps/open-webui/main.yaml

apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: open-webui
    app.kubernetes.io/instance: open-webui
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: open-webui
    app.kubernetes.io/version: 0.6.36
    helm.sh/chart: open-webui-8.14.0
  name: existing-sa
  namespace: open-webui
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: open-webui-pipelines
    app.kubernetes.io/instance: open-webui
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: pipelines
    app.kubernetes.io/version: alpha
    helm.sh/chart: pipelines-0.10.0
  name: open-webui-pipelines
  namespace: open-webui
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: open-webui
    app.kubernetes.io/instance: open-webui
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: open-webui
    app.kubernetes.io/version: 0.6.36
    helm.sh/chart: open-webui-8.14.0
  name: open-webui
  namespace: open-webui
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
  selector:
    app.kubernetes.io/component: open-webui
    app.kubernetes.io/instance: open-webui
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: open-webui-pipelines
    app.kubernetes.io/instance: open-webui
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: pipelines
    app.kubernetes.io/version: alpha
    helm.sh/chart: pipelines-0.10.0
  name: open-webui-pipelines
  namespace: open-webui
spec:
  ports:
  - name: http
    port: 9099
    protocol: TCP
    targetPort: http
  selector:
    app.kubernetes.io/component: open-webui-pipelines
    app.kubernetes.io/instance: open-webui
  type: ClusterIP
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    app.kubernetes.io/component: open-webui
    app.kubernetes.io/instance: open-webui
  name: open-webui
  namespace: open-webui
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName: openebs-3-replicas
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    app.kubernetes.io/component: open-webui-pipelines
    app.kubernetes.io/instance: open-webui
  name: open-webui-pipelines
  namespace: open-webui
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName: openebs-3-replicas
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: open-webui-pipelines
    app.kubernetes.io/instance: open-webui
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: pipelines
    app.kubernetes.io/version: alpha
    helm.sh/chart: pipelines-0.10.0
  name: open-webui-pipelines
  namespace: open-webui
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: open-webui-pipelines
      app.kubernetes.io/instance: open-webui
  template:
    metadata:
      labels:
        app.kubernetes.io/component: open-webui-pipelines
        app.kubernetes.io/instance: open-webui
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: pipelines
        app.kubernetes.io/version: alpha
        helm.sh/chart: pipelines-0.10.0
    spec:
      automountServiceAccountToken: false
      containers:
      - env: null
        image: ghcr.io/open-webui/pipelines:main
        imagePullPolicy: Always
        name: pipelines
        ports:
        - containerPort: 9099
          name: http
        tty: true
        volumeMounts:
        - mountPath: /app/pipelines
          name: data
      enableServiceLinks: false
      serviceAccountName: open-webui-pipelines
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: open-webui-pipelines
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/component: open-webui
    app.kubernetes.io/instance: open-webui
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: open-webui
    app.kubernetes.io/version: 0.6.36
    helm.sh/chart: open-webui-8.14.0
  name: open-webui
  namespace: open-webui
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: open-webui
      app.kubernetes.io/instance: open-webui
  serviceName: open-webui
  template:
    metadata:
      labels:
        app.kubernetes.io/component: open-webui
        app.kubernetes.io/instance: open-webui
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: open-webui
        app.kubernetes.io/version: 0.6.36
        helm.sh/chart: open-webui-8.14.0
    spec:
      automountServiceAccountToken: false
      containers:
      - env:
        - name: ENABLE_OLLAMA_API
          value: "False"
        - name: OPENAI_API_BASE_URLS
          value: http://open-webui-pipelines.open-webui.svc.cluster.local:9099;https://api.openai.com/v1
        - name: ENABLE_WEBSOCKET_SUPPORT
          value: "True"
        - name: WEBSOCKET_MANAGER
          value: redis
        - name: WEBSOCKET_REDIS_URL
          value: redis://:${VALKEY_PASSWORD}@valkey.valkey.svc.cluster.local:6379/5
        - name: ENABLE_OAUTH_SIGNUP
          value: "True"
        - name: OAUTH_MERGE_ACCOUNTS_BY_EMAIL
          value: "True"
        - name: OAUTH_CLIENT_ID
          value: open-webui
        - name: OAUTH_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              key: iam_client_secret
              name: open-webui
        - name: OPENID_PROVIDER_URL
          value: https://iam.borninpain.de/realms/home/.well-known/openid-configuration
        - name: OAUTH_PROVIDER_NAME
          value: Keycloak
        - name: OAUTH_SCOPES
          value: openid email profile
        - name: ENABLE_OAUTH_ROLE_MANAGEMENT
          value: "True"
        - name: OAUTH_ROLES_CLAIM
          value: realm_access.roles
        - name: OAUTH_ALLOWED_ROLES
          value: default-roles-home
        - name: OAUTH_ADMIN_ROLES
          value: ADMIN
        - name: VALKEY_PASSWORD
          valueFrom:
            secretKeyRef:
              key: valkey_password
              name: open-webui
        image: ghcr.io/open-webui/open-webui:0.6.36
        imagePullPolicy: IfNotPresent
        name: open-webui
        ports:
        - containerPort: 8080
          name: http
        tty: true
        volumeMounts:
        - mountPath: /app/backend/data
          name: data
      enableServiceLinks: false
      initContainers:
      - command:
        - sh
        - -c
        - cp -R -n /app/backend/data/* /tmp/app-data/
        image: ghcr.io/open-webui/open-webui:0.6.36
        imagePullPolicy: IfNotPresent
        name: copy-app-data
        volumeMounts:
        - mountPath: /tmp/app-data
          name: data
      serviceAccountName: existing-sa
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: open-webui