Advanced configuration

Optional configuration behind the defaults the deployment derives. Nothing on this page is needed for a standard install: the values file in the deployment guide is the supported shape, and everything here overrides a default that already works.

Audience: IT (the enabler)

URLs derived from applicationUrl

applicationUrl is available from application version 3.1.2. It is the address users open the application at: scheme, host, and an optional port, with no path. The chart derives every URL the platform needs about itself from it, so the hostname appears once there and once in ingress.host:

Key	Derived value
`api.config.auth.webAppUrl`	`<applicationUrl>`
`api.config.auth.allowedOrigins`	`["<applicationUrl>"]`
`api.config.auth.oidc.redirectUri`	`<applicationUrl>/api/v1/auth/callback`
`api.config.realtime.webhookPublicBaseUrl`	`<applicationUrl>`
`api.config.email.outlook.webhookUrl`	`<applicationUrl>/api/v1/email/outlook/webhook`
`api.config.workspaceApps.gmailPush.verifyAudience`	`<applicationUrl>/api/v1/webhooks/gmail/push`

Setting any of these keys explicitly replaces the derived value whole. The one to know about is allowedOrigins: an explicit list must include the application origin itself, or requests from the application's own address to the sign-in endpoints are refused.

api:
  config:
    auth:
      allowedOrigins: '["https://<hostname>","https://<second-hostname>"]'

An applicationUrl that is not a bare http(s)://host[:port] (a path, query, fragment, or userinfo) fails helm template with a message naming the key. Realtime setup is on by default and needs a public base URL, so a values file with neither applicationUrl nor api.config.realtime.webhookPublicBaseUrl also fails the render, rather than starting pods that cannot boot.

A custom StorageClass for the data root

On AWS (infrastructure.platform: aws in the values file) the deployment creates a default StorageClass for the data root: gp3 on the EBS CSI driver, encrypted with your KMS key, at gp3's baseline performance (3,000 IOPS, 125 MiB/s). Most deployments need nothing else.

If you want a class of your own — provisioned IOPS or throughput above the baseline, volume tags, or a class your organization already operates — create one that meets the contract in Storage for the data root and name it in the values file, which suppresses the created default:

vfs:
  dataRoot:
    storageClassName: <your-class>

On platforms where no default is created, this is also how the data root is provisioned in the first place.

Resize semantics, changing the class later, and the trade-offs of the cluster's built-in gp2 class are in the Operations reference. If the class encrypts with a customer-managed KMS key, the EBS CSI driver needs a KMS grant, exactly as for the created default.

Letting the chart create the service account

By default you create the service account for AWS access and set serviceAccount.create: false. To let the chart create it instead, set create: true and give it a name. With EKS Pod Identity, create the association for the application namespace and that name. With IAM roles for service accounts (IRSA), add the role annotation:

serviceAccount:
  create: true
  name: sema4ai
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<account>:role/<role>

Network endpoints Operations reference