feat!: use ClickHouse operator and OSS-licensed subcharts (v2.0.0)

charts/langfuse/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: langfuse
-version: 1.5.41
+version: 2.0.0
 description: Open source LLM engineering platform - LLM observability, metrics, evaluations, prompt management.
 type: application
 keywords:
@@ -14,27 +14,21 @@ sources:
   - https://github.com/langfuse/langfuse
   - https://github.com/langfuse/langfuse-k8s
 dependencies:
-  - name: postgresql
-    version: 16.4.9
-    repository: oci://registry-1.docker.io/bitnamicharts
+  - name: postgres
+    version: 1.6.3
+    repository: https://groundhog2k.github.io/helm-charts/
     condition: postgresql.deploy
-  - name: clickhouse
-    version: 8.0.5
-    repository: oci://registry-1.docker.io/bitnamicharts
-    condition: clickhouse.deploy
+    alias: postgresql
   - name: valkey
-    version: 2.2.4
-    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 0.9.4
+    repository: https://valkey-io.github.io/valkey-helm
     condition: redis.deploy
     alias: redis
-  - name: minio
-    version: 14.10.5
-    repository: oci://registry-1.docker.io/bitnamicharts
+  - name: seaweedfs
+    version: 4.23.0
+    repository: https://seaweedfs.github.io/seaweedfs/helm
     condition: s3.deploy
     alias: s3
-  - name: common
-    version: 2.30.0
-    repository: oci://registry-1.docker.io/bitnamicharts
 maintainers:
   - name: langfuse
     email: contact@langfuse.com

charts/langfuse/templates/_helpers.tpl

@@ -79,7 +79,7 @@ Return Redis hostname
 {{- if .Values.redis.host }}
 {{- .Values.redis.host }}
 {{- else if .Values.redis.deploy }}
-{{- printf "%s-%s-primary" (include "langfuse.fullname" .) (default "redis" .Values.redis.nameOverride) -}}
+{{- printf "%s-%s" (include "langfuse.fullname" .) (default "redis" .Values.redis.nameOverride) -}}
 {{- end }}
 {{- end }}
 
@@ -96,7 +96,7 @@ Return ClickHouse hostname (without protocol)
 {{- .Values.clickhouse.host -}}
 {{- end -}}
 {{- else if .Values.clickhouse.deploy }}
-{{- printf "%s-clickhouse" (include "langfuse.fullname" .) -}}
+{{- printf "%s-clickhouse-headless" (include "langfuse.fullname" .) -}}
 {{- end }}
 {{- end }}
 
@@ -107,7 +107,7 @@ Return S3/MinIO endpoint -- if not set uses auto-discovery
 {{- if or .Values.s3.eventUpload.endpoint .Values.s3.endpoint }}
 {{- .Values.s3.eventUpload.endpoint | default .Values.s3.endpoint }}
 {{- else if .Values.s3.deploy }}
-{{- printf "http://%s-%s:9000" (include "langfuse.fullname" .) (default "s3" .Values.s3.nameOverride) -}}
+{{- printf "http://%s-%s-all-in-one:8333" (include "langfuse.fullname" .) (default "s3" .Values.s3.nameOverride) -}}
 {{- else }}
 {{- end }}
 {{- end }}
@@ -201,6 +201,11 @@ Get value of a specific environment variable from additionalEnv if it exists
     secretKeyRef:
       name: {{ .Values.postgresql.auth.existingSecret }}
       key: {{ required "postgresql.auth.secretKeys.userPasswordKey is required when using an existing secret" .Values.postgresql.auth.secretKeys.userPasswordKey }}
+{{- else if .Values.postgresql.deploy }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ printf "%s-postgresql-auth" (include "langfuse.fullname" .) | quote }}
+      key: USERDB_PASSWORD
 {{- else }}
   value: {{ required "Using an existing secret or postgresql.auth.password is required" .Values.postgresql.auth.password | quote }}
 {{- end }}
@@ -302,13 +307,18 @@ Get value of a specific environment variable from additionalEnv if it exists
     Compare with https://langfuse.com/self-hosting/configuration#environment-variables
 */}}
 {{- define "langfuse.redisEnv" -}}
-{{- if or .Values.redis.auth.existingSecret .Values.redis.auth.password }}
+{{- if or .Values.redis.auth.existingSecret .Values.redis.auth.password .Values.redis.deploy }}
 - name: REDIS_PASSWORD
 {{- if .Values.redis.auth.existingSecret }}
   valueFrom:
     secretKeyRef:
       name: {{ .Values.redis.auth.existingSecret }}
       key: {{ required "redis.auth.existingSecretPasswordKey is required when using an existing secret" .Values.redis.auth.existingSecretPasswordKey }}
+{{- else if .Values.redis.deploy }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ printf "%s-redis-auth" (include "langfuse.fullname" .) | quote }}
+      key: {{ .Values.redis.auth.username | quote }}
 {{- else }}
   value: {{ required "Using an existing secret or redis.auth.password is required" .Values.redis.auth.password | quote }}
 {{- end }}
@@ -389,7 +399,7 @@ Get value of a specific environment variable from additionalEnv if it exists
 - name: REDIS_TLS_ENABLED
   value: {{ .Values.redis.tls.enabled | quote }}
 - name: REDIS_CONNECTION_STRING
-{{- $hasPassword := or .Values.redis.auth.existingSecret .Values.redis.auth.password }}
+{{- $hasPassword := or .Values.redis.auth.existingSecret .Values.redis.auth.password .Values.redis.deploy }}
 {{- $hasUsername := .Values.redis.auth.username }}
 {{- $authPart := "" }}
 {{- if and $hasUsername $hasPassword }}
@@ -484,17 +494,15 @@ Return ClickHouse protocol (http or https)
 {{- else if .Values.clickhouse.auth.password }}
   value: {{ .Values.clickhouse.auth.password | quote }}
 {{- else if .Values.clickhouse.deploy }}
-  value: {{ required "Configuring an existing secret or clickhouse.auth.password is required" .Values.clickhouse.auth.password | quote }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ printf "%s-clickhouse-auth" (include "langfuse.fullname" .) | quote }}
+      key: "password"
 {{- end }}
 {{- end }}
-{{- if not .Values.clickhouse.clusterEnabled }}
-{{/* User explicitly disabled cluster mode */}}
-- name: CLICKHOUSE_CLUSTER_ENABLED
-  value: "false"
-{{- else if and .Values.clickhouse.deploy ($.Values.clickhouse.replicaCount | int | eq 1) }}
-{{/* Cluster enabled by default, but deploying single-replica ClickHouse */}}
+{{- if or .Values.clickhouse.host .Values.clickhouse.deploy }}
 - name: CLICKHOUSE_CLUSTER_ENABLED
-  value: "false"
+  value: {{ .Values.clickhouse.cluster.enabled | quote }}
 {{- end }}
 {{- if or (hasKey .Values.clickhouse.migration "autoMigrate") .Values.clickhouse.deploy }}
 - name: LANGFUSE_AUTO_CLICKHOUSE_MIGRATION_DISABLED
@@ -565,7 +573,10 @@ Return ClickHouse protocol (http or https)
       name: {{ .Values.s3.auth.existingSecret }}
       key: {{ .Values.s3.auth.rootUserSecretKey }}
   {{- else }}
-  value: {{ .Values.s3.auth.rootUser | quote }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ printf "%s-s3-auth" (include "langfuse.fullname" .) | quote }}
+      key: accessKey
   {{- end }}
 {{- end }}
 {{- end }}
@@ -581,7 +592,10 @@ Return ClickHouse protocol (http or https)
       name: {{ .Values.s3.auth.existingSecret }}
       key: {{ .Values.s3.auth.rootPasswordSecretKey }}
   {{- else }}
-  value: {{ .Values.s3.auth.rootPassword | quote }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ printf "%s-s3-auth" (include "langfuse.fullname" .) | quote }}
+      key: secretKey
   {{- end }}
 {{- end }}
 {{- end }}
@@ -622,7 +636,10 @@ Return ClickHouse protocol (http or https)
       name: {{ .Values.s3.auth.existingSecret }}
       key: {{ .Values.s3.auth.rootUserSecretKey }}
   {{- else }}
-  value: {{ .Values.s3.auth.rootUser | quote }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ printf "%s-s3-auth" (include "langfuse.fullname" .) | quote }}
+      key: accessKey
   {{- end }}
 {{- end }}
 {{- end }}
@@ -638,7 +655,10 @@ Return ClickHouse protocol (http or https)
       name: {{ .Values.s3.auth.existingSecret }}
       key: {{ .Values.s3.auth.rootPasswordSecretKey }}
   {{- else }}
-  value: {{ .Values.s3.auth.rootPassword | quote }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ printf "%s-s3-auth" (include "langfuse.fullname" .) | quote }}
+      key: secretKey
   {{- end }}
 {{- end }}
 {{- end }}
@@ -677,7 +697,10 @@ Return ClickHouse protocol (http or https)
       name: {{ .Values.s3.auth.existingSecret }}
       key: {{ .Values.s3.auth.rootUserSecretKey }}
   {{- else }}
-  value: {{ .Values.s3.auth.rootUser | quote }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ printf "%s-s3-auth" (include "langfuse.fullname" .) | quote }}
+      key: accessKey
   {{- end }}
 {{- end }}
 {{- end }}
@@ -693,7 +716,10 @@ Return ClickHouse protocol (http or https)
       name: {{ .Values.s3.auth.existingSecret }}
       key: {{ .Values.s3.auth.rootPasswordSecretKey }}
   {{- else }}
-  value: {{ .Values.s3.auth.rootPassword | quote }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ printf "%s-s3-auth" (include "langfuse.fullname" .) | quote }}
+      key: secretKey
   {{- end }}
 {{- end }}
 {{- end }}

charts/langfuse/templates/clickhouse/cluster.yaml

@@ -0,0 +1,61 @@
+{{- if .Values.clickhouse.deploy -}}
+apiVersion: clickhouse.com/v1alpha1
+kind: ClickHouseCluster
+metadata:
+  name: {{ include "langfuse.fullname" . }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.clickhouse.cluster.replicas }}
+  shards: 1
+  {{- if .Values.clickhouse.keeper.enabled }}
+  keeperClusterRef:
+    name: {{ include "langfuse.fullname" . }}
+  {{- end }}
+  dataVolumeClaimSpec:
+    accessModes:
+      {{- toYaml .Values.clickhouse.cluster.storage.accessModes | nindent 6 }}
+    {{- with .Values.clickhouse.cluster.storage.className }}
+    storageClassName: {{ . | quote }}
+    {{- end }}
+    resources:
+      requests:
+        storage: {{ .Values.clickhouse.cluster.storage.size | quote }}
+  containerTemplate:
+    image:
+      repository: {{ .Values.clickhouse.cluster.image.repository | quote }}
+      tag: {{ .Values.clickhouse.cluster.image.tag | quote }}
+    {{- with .Values.clickhouse.cluster.resources }}
+    resources:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  {{- if or .Values.clickhouse.cluster.nodeSelector .Values.clickhouse.cluster.tolerations .Values.clickhouse.cluster.affinity }}
+  podTemplate:
+    {{- with .Values.clickhouse.cluster.nodeSelector }}
+    nodeSelector:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.clickhouse.cluster.tolerations }}
+    tolerations:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.clickhouse.cluster.affinity }}
+    affinity:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  {{- end }}
+  settings:
+    defaultUserPassword:
+      secret:
+        name: {{ .Values.clickhouse.auth.existingSecret | default (printf "%s-clickhouse-auth" (include "langfuse.fullname" .)) | quote }}
+        key: {{ .Values.clickhouse.auth.existingSecretKey | default "password" | quote }}
+    {{- with .Values.clickhouse.cluster.settings }}
+    extraConfig:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.clickhouse.cluster.profileSettings }}
+    extraUsersConfig:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+{{- end }}

charts/langfuse/templates/clickhouse/keeper.yaml

@@ -0,0 +1,43 @@
+{{- if and .Values.clickhouse.deploy .Values.clickhouse.keeper.enabled -}}
+apiVersion: clickhouse.com/v1alpha1
+kind: KeeperCluster
+metadata:
+  name: {{ include "langfuse.fullname" . }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.clickhouse.keeper.replicas }}
+  dataVolumeClaimSpec:
+    accessModes:
+      {{- toYaml .Values.clickhouse.keeper.storage.accessModes | nindent 6 }}
+    {{- with .Values.clickhouse.keeper.storage.className }}
+    storageClassName: {{ . | quote }}
+    {{- end }}
+    resources:
+      requests:
+        storage: {{ .Values.clickhouse.keeper.storage.size | quote }}
+  containerTemplate:
+    image:
+      repository: {{ .Values.clickhouse.keeper.image.repository | quote }}
+      tag: {{ .Values.clickhouse.keeper.image.tag | quote }}
+    {{- with .Values.clickhouse.keeper.resources }}
+    resources:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  {{- if or .Values.clickhouse.keeper.nodeSelector .Values.clickhouse.keeper.tolerations .Values.clickhouse.keeper.affinity }}
+  podTemplate:
+    {{- with .Values.clickhouse.keeper.nodeSelector }}
+    nodeSelector:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.clickhouse.keeper.tolerations }}
+    tolerations:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.clickhouse.keeper.affinity }}
+    affinity:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}

charts/langfuse/templates/clickhouse/secret.yaml

@@ -0,0 +1,38 @@
+{{/*
+Chart-managed ClickHouse credential Secret.
+
+Used by:
+  - the bundled clickhouse-operator-rendered ClickHouseCluster CR via
+    `settings.defaultUserPassword.secret` (see clickhouse/cluster.yaml). The
+    operator hashes this password into the user XML.
+  - the Langfuse helper `langfuse.clickhouseEnv` (CLICKHOUSE_PASSWORD env var) —
+    the helper points the env var at this Secret's `password` key.
+
+Keys written:
+  password             — plaintext password for the ClickHouse user
+                         (auto-generated if `clickhouse.auth.password` is unset)
+
+Skipped when the user supplies their own `clickhouse.auth.existingSecret`.
+*/}}
+{{- if and .Values.clickhouse.deploy (not .Values.clickhouse.auth.existingSecret) -}}
+{{- $name := printf "%s-clickhouse-auth" (include "langfuse.fullname" .) -}}
+{{- $password := .Values.clickhouse.auth.password -}}
+{{- if not $password -}}
+  {{- $existing := lookup "v1" "Secret" .Release.Namespace $name -}}
+  {{- if and $existing (index $existing.data "password") -}}
+    {{- $password = index $existing.data "password" | b64dec -}}
+  {{- else -}}
+    {{- $password = randAlphaNum 40 -}}
+  {{- end -}}
+{{- end -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "langfuse.labels" . | nindent 4 }}
+type: Opaque
+data:
+  password: {{ $password | b64enc | quote }}
+{{- end }}