---
metadata:
  - name: generator
    content: Diplodoc Platform v5.63.0
alternate:
  - en/concepts/create-instance
  - ru/concepts/create-instance
  - href: en/concepts/create-instance.md
    type: text/markdown
    title: Markdown version
csp:
  - script-src:
      - https://mc.yandex.ru
    img-src:
      - https://mc.yandex.ru
    connect-src:
      - https://mc.yandex.ru
      - wss://mc.yandex.ru
    child-src:
      - 'blob:'
      - https://mc.yandex.ru
    frame-src:
      - 'blob:'
      - https://mc.yandex.ru
    frame-ancestors:
      - 'blob:'
      - https://mc.yandex.ru
canonical: en/concepts/create-instance.html
title: How to deploy DataLens On-premises
description: Follow this guide to deploy DataLens On-premises.
vcsPath: en/concepts/create-instance.md
---


# Installing and running DataLens On-premises

## System requirements {#system-requirements}

1. Operating systems:

   * Ubuntu 20.04/22.04/24.04
   * Debian 10/11/12
   * CentOS 7
   * Astra Linux 1.7
   * Oracle Linux 8/9
   * RedHat Linux 8/9
   * CentOS Stream 8/9

   {% note info %}

   The solution was checked for operability only with Debian-based distributions.

   {% endnote %}

1. Minimum system requirements for deployment:

   * vCPUs: 8
   * RAM: 16 GB
   * SSD: 40 GB

1. Managed Service for PostgreSQL cluster requirements:

   {% note info %}

   We recommend using a separate Managed Service for PostgreSQL cluster in a fault-tolerant configuration (master + one replica).

   {% endnote %}

   * Minimum requirements for the cluster:

     * vCPUs: 4
     * RAM: 8 GB
     * SSD: 100 GB

   * When deploying a high load cluster, you should calculate the consumption based on the number of users.

   * The following extensions are required for the United Storage PostgreSQL database:

     * `pg_trgm`
     * `btree_gin`
     * `btree_gist`
     * `uuid-ossp`

     They are installed automatically if the user has the relevant permissions.

   * When deploying a Managed Service for PostgreSQL DB cluster in Yandex Cloud for United Storage:

     * Specify the above-listed extensions in the management console manually.
     * Set the `Collation (sorting) locale (LC_COLLATE)` and `Character set locale (LC_CTYPE)` parameters to `en_US.UTF-8`. This will ensure effective indexing to search for users.

## Deploying DataLens On-premises {#enterprise-deployment}

1. Use the provided link to download the DataLens On-premises distribution archive, e.g., like this:

   ```bash
   URL="..."
   curl -L -o datalens-enterprise.tar "${URL}"
   ```

1. Unpack the distribution into the `datalens-enterprise` directory.

   ```bash
   mkdir -p ./datalens-enterprise && tar -xvf datalens-enterprise.tar --directory ./datalens-enterprise
   ```

1. Navigate to the distribution directory:

   ```bash
   cd ./datalens-enterprise
   ```

   If deploying on a remote VM, consider executing all these commands at once:

   ```bash
   URL="..."
   curl -L "${URL}" -o datalens-enterprise.tar
   mkdir -p ./datalens-enterprise && tar -xvf datalens-enterprise.tar --directory ./datalens-enterprise
   cd ./datalens-enterprise
   ```

1. The distribution is deployed using the `./init.sh` script residing in the root of the archive. The script allows you to deploy DataLens On-premises in your existing Kubernetes cluster. If you do not have a Kubernetes cluster, the script is able to deploy it on your VM.

   You can run deployment from the linux/amd64 server the installation will take place on. You can also do so from a remote VM with access to a linux/amd64 or mac/arm64 Kubernetes cluster.

   Example of using the script:

   ```bash
   ./init.sh [arguments]
   ```

   How the script works:

   * The script checks the distribution for integrity each time by verifying checksums and saves the resulting values into deployment variables.
   * When the script is run with the `--k3s-install` argument, a K3S Kubernetes cluster is installed automatically without access to the public network.
   * When launched with the `--atomic` argument, the entire deployment (or update) operation is treated as a single transaction that either completes successfully or is rolled back entirely.
   * RSA keys for the authentication and authorization service are generated automatically on first installation if not explicitly specified otherwise.
   * Use the `--values` argument to specify the `values.yaml` custom file for redefinition of [Helm chart](https://helm.sh/docs/topics/charts/) deployment parameters and a more accurate environment set-up.

     {% note info %}

     Do not edit the original `./helm/values.yaml` file. Use a copy of the original file or a copy of the `./help/values.example.yaml` example file.

     {% endnote %}

   * If you set the `KUBECONFIG` environment variable before running the script, the script will connect to an already existing Kubernetes cluster for deployment.
   * The Helm chart does not specify CPU limits for application containers to prevent throttling of the whole application, as recommended in the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/).

After each deployment, a file named `./values.debug.yaml` is generated to store all parameters other than the secrets. This file can help you diagnose the system when contacting support.

### Specifics of deployment on Oracle Linux {#oracle-linux-deployment}

To run a K3s Kubernetes cluster on Oracle Linux 8/9, you must either disable [firewalld](https://firewalld.org/) completely or configure the relevant rules for correct operation of the Kubernetes network.

{% note info %}

When you deploy the distribution using the `./init.sh` script with K3s Kubernetes cluster installation, rules for Oracle Linux will be applied automatically.

```bash
sudo firewall-cmd --permanent --zone=trusted --add-interface=cni0
sudo firewall-cmd --permanent --zone=trusted --add-interface=flannel.1
sudo firewall-cmd --reload
```

{% endnote %}

Main ports used by K3s:

Port range | Protocol | Description
--- | --- | ---
`6443` | `TCP` | Main Kubernetes API server (master)
`2379-2380` | `TCP` | Etcd (for multi-master setup)
`10250` | `TCP` | Kubelet API
`8472` | `UDP` | VXLAN (Flannel network, if used)
`30000-32767` | `TCP` | Port range for NodePort

Examples for firewalld:

{% list tabs %}

- Disabling firewalld

  ```bash
  sudo systemctl stop firewalld
  sudo systemctl disable firewalld
  ```

- Configuring firewalld

  Add rules for the relevant ports or network interfaces:

  ```bash
  # traffic between k8s pod network subnets
  sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
  sudo firewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16
  # or
  sudo firewall-cmd --permanent --zone=trusted --add-interface=cni0
  sudo firewall-cmd --permanent --zone=trusted --add-interface=flannel.1


  # k8s api server access for all nodes (optional)
  sudo firewall-cmd --permanent --add-port=6443/tcp
  # client requests to etcd and peer communication between etcd members (optional)
  sudo firewall-cmd --permanent --add-port=2379-2380/tcp
  # kubelet api port on each node (optional)
  sudo firewall-cmd --permanent --add-port=10250/tcp
  # flannel vxlan pod network communication (optional)
  sudo firewall-cmd --permanent --add-port=8472/udp
  # node port external traffic (optional)
  sudo firewall-cmd --permanent --add-port=30000-32767/tcp

  sudo firewall-cmd --reload
  ```

{% endlist %}

If the firewall does not interfere with cluster operation, you may only want to configure the required ports rather than disable it entirely. This will help ensure basic system security with settings acceptable for Kubernetes.

## Available deployment arguments {#deployment-arguments}

Available script deployment arguments with examples for typical configurations:

### Deployment process {#deployment-itself}

| Argument                 | Default value | Description                                      |
| ------------------------ | --------------------- | --------------------------------------------- |
| `--atomic`               | `false`               | Deploying as a single transaction that either completes successfully or is fully rolled back. On rollback, Helm deletes the created resources, making it impossible to analyze the cause of the failure. We do not recommend using it for the first deployment. |

### Updating a distribution {#distribution-update}

| Argument                 | Default value | Description                                      |
| ------------------------ | --------------------- | --------------------------------------------- |
| `--update`               | `false`               | Updating the distribution based on the previous deployment settings. Before running the update, unpack the new distribution over the old one, replacing the files. Usage example: `./init.sh --update`  |

### Kubernetes (K3s) configuration {#k8s-k3s-config}

| Argument                 | Default value | Description                                                                                                                                                                  |
| ------------------------ | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--k3s-install`          | `false`               | Installing a Kubernetes K3s cluster                                                                                                                                         |
| `--k3s-image-load`       | `false`               | Uploading DataLens On-premises Docker images automatically to a K3s cluster (done automatically during the k3s cluster deployment via the `--k3s-install` flag) |
| `--k3s-external-ip <ip>` | —               | Granting access to a K3s cluster via a public IP address. The IP address is optional; if there is none, the VM’s global IP address is used.                                                                                              |
| `--get-k3s-kubeconfig` | —               |  Getting the file contents from the `KUBECONFIG` variable for remote connection to a cluster  |

### Helm chart configuration {#helm-config}

| Argument              | Default value | Description                                                                                                                                       |
| --------------------- | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| `--release-name`      | `datalens-enterprise` | Setting a release name when deploying a Helm chart                                                                                             |
| `--release-namespace` | `datalens-enterprise` | Setting a Kubernetes namespace for deployment                                                                                      |
| `--values <file>`     | —                     | Specifying a [custom file](#values-parameters) named `values.yaml` for Helm chart deployment                                     |
| `--values-merge`      | `false`               | Merging the partially populated custom values.yaml file with the provided configuration arguments |
| `--no-wait`           | `false`               | Not waiting for Helm chart deployment to complete |
| `--deploy-dir`        | `./`                  | Specifying a directory for deployment if the script is in another directory. You can use it for debuggin or updating |  |

### Docker image management {#docker-images-managing}

| Argument                           | Default value | Description                                                                                                                           |
| ---------------------------------- | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| `--docker-image-load`              | `false`               | Uploading Docker images from a tar file to a local Docker                                                                            |
| `--docker-image-push`              | `false`               | Pushing Docker images to the specified registry                                                                                         |
| `--docker-registry <registry url>` | —                     | Specifying the URL of the Docker image registry for sending and further uploading images during deployment                                   |
| `--docker-config <file>`           | —                     | Specifying the configuration file for access to the Docker image registry in JSON format (see example in the `./help/docker-config.example.json` file) |

### Configuration of the authentication and authorization service {#auth-service-config}

| Argument                         | Default value | Description                                                                                                             |
| -------------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------- |
| `--auth-rsa-gen`                 | `false`               | Generating new RSA keys for the authentication service (done automatically on first deployment)        |
| `--temporal-rsa-gen`             | `false`               | Generating new RSA keys for Temporal (done automatically on first deployment) |
| `--auth-providers-config <file>` | —                     | Specifying the authentication providers' configuration file (see example in the `./help/auth-provider-config.example.json` file) |
| `--get-admin-password`           | —                     | Getting the administrator password for the already deployed DataLens On-premises                                              |

### Ingress configuration {#ingress-config}

| Argument                   | Default value | Description                                                                                                                                                                    |
| -------------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--ingress-domain`         | `datalens.enterprise` | Specifying a domain for access to DataLens On-premises for an Ingress resource                                                                                                             |
| `--ingress-ip`             | —                     | Specifying an IP address for access to DataLens On-premises for an Ingress resource                                                                                                          |
| `--ingress-tls`            | `false`               | Enabling TLS for an Ingress resource. Cookie headers will be issued only when authenticating via HTTPS                                                                    |
| `--ingress-tls-gen`        | `false`               | Generating new self-signed TLS certificates for a domain. Certificates will be saved at `./certs`.                                                               |
| `--ingress-tls-crt <file>` | —                     | Specifying a file for the existing TLS certificate for an Ingress resource (no need to specify it again on updates; the certificate will be saved to Kubernetes cluster secrets) |
| `--ingress-tls-key <file>` | —                     | Specifying a TLS key file (no need to specify it again on updates; the key will be saved to Kubernetes cluster secrets)                                                 |

### Self-signed root certificates {#tls-ca}

| Argument                   | Default value | Description                                                                                                                                                                    |
| -------------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--postgres-tls-ca <path_to_certificate_file>`            | `null`               | Specifying the path to the CA certificate for PostgreSQL                                                                    |
| `--clickhouse-tls-ca <path_to_certificate_file>`            | `null`               | Specifying the path to the CA certificate for ClickHouse®                                                                    |
| `--redis-tls-ca <path_to_certificate_file>`            | `null`               | Specifying the path to the CA certificate for Valkey™                                                                    |
| `--s3-tls-ca <path_to_certificate_file>`            | `null`               | Specifying the path to the CA certificate for S3                                                                    |

### Key features {#functionality}

| Option                        | Default value                         | Description                                                            |
| ---------------------------- | --------------------------------------------- | ------------------------------------------------------------------- |
| `--yandex-map`               | `false`                                       | Enabling integration with Yandex Maps                                |
| `--yandex-map-token <token>` | —                                             | Specifying a [Yandex Maps token](https://yandex.ru/dev/jsapi-v2-1/doc/ru/)                                           |
| `--usage-tracking`           | `false`                                       | Enabling user event logging in Clickhouse via Fluent Bit |
| `--editor`                   | `false`                                       | Enabling Editor and connection via JSON (API Connector) |
| `--export`                   | `false`                                       | Enabling workbook import/export (also includes additional services, such as `meta-manager`, `ui-api`, `temporal`) |
| `--background-exports`       | `false`                                       | Enabling background data export in CSV and XLSX format for table charts |
| `--files`                    | `false`                                       | Enabling file connectors (also includes ClickHouse®, Valkey™, S3) |
| `--compeng-sidecar`          | `false`                                       | Enabling PostgreSQL sidecar for compute engine |
| `--disable-hc`               | Highcharts library enabled (`true`)       | Disabling the Highcharts library. If the [Highcharts](https://github.com/highcharts/highcharts/blob/master/readme.md) library is disabled in DataLens On-premises, the [Gravity UI Charts](https://github.com/gravity-ui/charts) library is used instead.                                  |
| `--disable-demo`             | Demo data enabled (`true`)                 | Disabling demo data: connections, datasets, charts, dashboards          |
| `--disable-postgres`         | Built-in PostgreSQL enabled (`true`) | Disabling built-in PostgreSQL to use an external cluster |
| `--disable-clickhouse`       | `false`                                       | Disabling built-in ClickHouse® to use an external cluster |
| `--disable-redis`            | `false`                                       | Disabling built-in Valkey™ to use an external cluster |
| `--disable-fluent-bit`       | `false`                                       | Disabling Fluent Bit user event collector |
| `--disable-temporal`         | `false`                                       | Disable Temporal to run pending tasks |
| `--disable-s3`               | `false`                                       | Disabling built-in S3 storage (MinIO) |
| `--cache`                    | `false`                                       | Enabling dataset caching |
| `--sec-embeds`               | `false`                                       | Enabling [private embeddings](../security/private-embedded-objects.md) |
| `--auth-cookie-domain http://<domain>`   | `false`                                       | Enabling [embeddings in a corporate domain](../security/embedded-objects.md), where `http://<domain>` is the domain where such embeddings will be allowed |
| `--auth-disable-wildcard-cookie`   | `false`                                       | Disabling cookie popup at the subdomain level |
| `--ai-endpoint <ai-endpoint>`      | `—`                                       | Specifying the base URL of an OpenAI-compatible API |
| `--ai-model-name <ai-model-name>`  | `—`                                       | Specifying the AI ​​model ID (as shown in the _model_ field) |
| `--ai-api-token <ai-api-token>`    | `—`                                       | Specifying the provider's API token |

### PostgreSQL database management {#pg}

| Option                        | Default value                         | Description                                                            |
| ---------------------------- | --------------------------------------------- | ------------------------------------------------------------------- |
| `--dump-postgres`               | `false`                                       | Creating PostgreSQL database dump                             |
| `--restore-postgres <file>`               | —                                       | Restoring PostgreSQL database from specified dump file                                |
| `--restore-postgres-with-clear`               | `false`                                       | Enabling full prior cleanup of old database objects before restoring the PostgreSQL database                                 |
| `--pg`               | `false`                                       | Starting interactive PostgreSQL shell                                |
| `--pg-sql`               | `false`                                       | Running PostgreSQL SQL client                                |

### Performance and scaling {#productivity-and-scaling}

| Option                        | Default value                         | Description                                                            |
| ---------------------------- | --------------------------------------------- | ------------------------------------------------------------------- |
| `--cpu-scale <factor>`               | `1.0`                                       | CPU resource scaling ratio for all components. You can scale down the CPU resource request within the cluster for all services at once by specifying `0.5`.                               |

### Command line tools {#command-line-tools}

| Option              | Default value | Description                                                                                                 |
| ------------------ | --------------------- | -------------------------------------------------------------------------------------------------------- |
| `--local-bin`      | `false`               | Using local CLI tools (`yq`, `kubectl`, `helm`, `helm-diff`, `stern`) instead of built-in ones |
| `--skip-meta-check`      | `false`               | Skipping metadata and checksum verification on deployment |
| `--stern <args>`   | `false`               | Running the `stern` log collector for the default namespace                                       |
| `--kubectl <args>` | `false`               | Running `kubectl` for the default namespace                                           |

### Examples of typical deployment commands {#deployment-commands-examples}

* Basic installation with K3s on a VM with automatic generation of self-signed certificates:

  ```sh
  ./init.sh \
  --k3s-install \
  --ingress-domain <domain> \
  --ingress-tls \
  --ingress-tls-gen
  ```

* Deployment on a domain with custom TLS certificates:

  ```sh
  ./init.sh \
  --k3s-install \
  --ingress-domain <domain> \
  --ingress-tls-crt <crt-file> \
  --ingress-tls-key <key-file>
  ```

* Mirroring images to a private Docker image registry:

  ```sh
  ./init.sh \
  --docker-image-load \
  --docker-image-push \
  --docker-registry <registry-url> \
  --docker-config <docker-config-json-file>
  ```

* Deployment with custom authentication providers configured:

  ```sh
  ./init.sh --auth-providers-config <auth-provider-config-json-file>
  ```

* Deployment with parameters configured via a custom `values.yaml` file:

  ```sh
  ./init.sh --values <values-file>
  ```

* Getting the administrator password from secrets after deployment:

  ```sh
  ./init.sh --get-admin-password
  ```

* Deployment with AI Assistant setup:

  ```sh
  ./init.sh --ai-endpoint <ai-endpoint> --ai-model-name <ai-model-name> --ai-api-token <ai-api-token> 
  ```

  e.g., for Yandex Cloud AI Studio:

  ```sh
  ./init.sh --ai-endpoint https://ai.api.cloud.yandex.net/v1 --ai-model-name gpt://<folder_id>/deepseek-v4-flash/latest --ai-api-token <API_key> 
  ```

### Examples of auxiliary commands {#aux-commands-examples}

* Getting all logs from all DataLens pods for debugging:

  ```sh
  ./init.sh --stern . -o extjson > datalens.enterprise.log
  ```

* Getting all Kubernetes cluster events for deployment error debugging:

  ```sh
  ./init.sh --kubectl events
  ```

## Description of all `values.yaml` parameters {#values-parameters}

The `values.yaml` file contains a configuration for DataLens On-premises deployment via Helm charts. The following parameters are available:

* [Docker image registry configuration](#docker-reestr-config)
* [Release version](#release-version)
* [Ingress resource configuration](#ingress-resource-config)
* [Infrastructure](#infrastructure)
* [Application configuration](#app-config)
* [Secrets](#secrets)
* [PostgreSQL configuration](#pg-config)
* [Visible connectors](#visible-connectors)
* [Key features](#functionality-values)
* [Checksum](#checksum)

### Docker image registry configuration {#docker-reestr-config}

```yaml
registry:
  private: true
  url: ''
```

| Argument           | Type     | Default value | Description                                                                                                                      |
| ------------------ | ------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| `registry.private` | boolean | `true`                | Specifies whether the Docker image is private and whether or not the `docker-config.json` access configuration file must be specified |
| `registry.url`     | string  | `''`                  | URL of the Docker image registry to receive the application images                                                             |

### Release version {#release-version}

```yaml
release_version: '25.6.0'
```

| Argument          | Type    | Default value | Description                                |
| ----------------- | ------ | --------------------- | --------------------------------------- |
| `release_version` | string | `'25.6.0'`            | DataLens On-premises distribution version |

### Ingress resource configuration {#ingress-resource-config}

```yaml
ingress:
  enabled: true
  domain: datalens.enterprise
  np: false
  tls:
    enabled: false
    secret:
      crt: null
      key: null
```

| Argument                 | Type     | Default value | Description                                                                                                                                               |
| ------------------------ | ------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `ingress.enabled`        | boolean | `true`                | Adds deployment of an Ingress resource in the cluster for accessing the application                                                                            |
| `ingress.domain`         | string  | `datalens.enterprise` | Domain used for accessing the application                                                                                                           |
| `ingress.ip`             | string  | `null`                | IP address used for accessing the application                                                                                                        |
| `ingress.np`             | boolean | `false`               | Using the `NodePort` configuration instead of `ClusterIP` for the UI service                                                                                |
| `ingress.tls.enabled`    | boolean | `false`               | Activating TLS for an Ingress resource for access only over a secure connection. Cookie headers will be issued only when authenticating via HTTPS |
| `ingress.tls.secret.crt` | string  | `null`                | TLS certificate contents in PEM format (see example in the `./help/values.example.yaml` file)                                                             |
| `ingress.tls.secret.key` | string  | `null`                | Private TLS key contents in PEM format (see example in the `./help/values.example.yaml` file)                                                        |

### Infrastructure {#infrastructure}

```yaml
infra:
  postgres:
    enabled: true
    extra_envs: []
    resources:
      requests:
        cpu: 1
        memory: 512Mi
        storage: 1Gi
      limits:
        memory: 1024Mi
    tls:
      enabled: false
      secret:
        ref: null
        ca: null
  clickhouse:
    enabled: false
    extra_envs: []
    resources:
      requests:
        cpu: 1
        memory: 512Mi
        storage: 10Gi
      limits:
        memory: 1024Mi
    tls:
      enabled: false
      secret:
        ref: null
        ca: null
  redis:
    enabled: false
    extra_envs: []
    resources:
      requests:
        cpu: 0.5
        memory: 128Mi
        storage: 512Mi
      limits:
        memory: 256Mi
    tls:
      enabled: false
      secret:
        ref: null
        ca: null
  s3:
    enabled: false
    extra_envs: []
    resources:
      requests:
        cpu: 0.5
        memory: 128Mi
        storage: 1Gi
      limits:
        memory: 256Mi
  temporal:
    enabled: false
    extra_envs: []
    resources:
      requests:
        cpu: 0.5
        memory: 256Mi
      limits:
        memory: 512Mi
  fluent_bit:
    enabled: false
    extra_envs: []
    resources:
      requests:
        cpu: 0.1
        memory: 128Mi
      limits:
        memory: 128Mi
```

| Argument                                   | Type           | Default value | Description                                        |
| ------------------------------------------ | ------------- | --------------------- | ----------------------------------------------- |
| `infra.postgres.enabled`                   | boolean       | `true`                | Deploying a built-in PostgreSQL database |
| `infra.postgres.extra_envs`                | list          | `[]`                  | List of variables and their values that allow overriding or expanding PostgreSQL environment variables |
| `infra.postgres.resources.requests.cpu`    | string/number | `1`                   | Number of CPUs requested for PostgreSQL     |
| `infra.postgres.resources.requests.memory` | string        | `512Mi`               | RAM requested for PostgreSQL       |
| `infra.postgres.resources.requests.storage` | string        | `1Gi`               | Storage size requested for PostgreSQL       |
| `infra.postgres.resources.limits.memory`   | string        | `1024Mi`              | RAM limit for PostgreSQL               |
| `infra.postgres.tls.enabled`                  | boolean       | `false`               | Enabling TLS for PostgreSQL                               |
| `infra.postgres.tls.secret.ref`               | string        | `null`                | Link to secret with TLS certificate                        |
| `infra.postgres.tls.secret.ca`                | string        | `null`                | CA certificate for PostgreSQL                               |
| `infra.clickhouse.enabled`                    | boolean       | `false`               | Deploying a built-in ClickHouse® database            |
| `infra.clickhouse.extra_envs`                   | list          | `[]`                  | List of variables and their values that allow overriding or expanding ClickHouse® environment variables |
| `infra.clickhouse.resources.requests.cpu`     | string/number | `1`                   | Number of CPUs requested for ClickHouse®                |
| `infra.clickhouse.resources.requests.memory`  | string        | `512Mi`               | RAM requested for ClickHouse®                  |
| `infra.clickhouse.resources.requests.storage` | string        | `10Gi`                | Storage size requested for ClickHouse®               |
| `infra.clickhouse.resources.limits.memory`    | string        | `1024Mi`              | RAM limit for ClickHouse®                          |
| `infra.clickhouse.tls.enabled`                | boolean       | `false`               | Enabling TLS for ClickHouse®                               |
| `infra.clickhouse.tls.secret.ref`             | string        | `null`                | Link to secret with TLS certificate                        |
| `infra.clickhouse.tls.secret.ca`              | string        | `null`                | CA certificate for ClickHouse®                               |
| `infra.redis.enabled`                         | boolean       | `false`               | Deploying built-in Valkey™                           |
| `infra.redis.extra_envs`                   | list          | `[]`                  | List of variables and their values that allow overriding or expanding Valkey™ environment variables |
| `infra.redis.resources.requests.cpu`          | string/number | `0.5`                 | Number of CPUs requested for Valkey™                   |
| `infra.redis.resources.requests.memory`       | string        | `128Mi`               | RAM requested for Valkey™                       |
| `infra.redis.resources.requests.storage`      | string        | `512Mi`               | Storage size requested for Valkey™                   |
| `infra.redis.resources.limits.memory`         | string        | `256Mi`               | RAM limit for Valkey™                               |
| `infra.redis.tls.enabled`                     | boolean       | `false`               | Enabling TLS for Valkey™                               |
| `infra.redis.tls.secret.ref`                  | string        | `null`                | Link to secret with TLS certificate                        |
| `infra.redis.tls.secret.ca`                   | string        | `null`                | CA certificate for Valkey™                               |
| `infra.s3.enabled`                            | boolean       | `false`               | Deploying built-in S3 (MinIO)                       |
| `infra.s3.extra_envs`                   | list          | `[]`                  | List of variables and their values that allow overriding or expanding S3 environment variables |
| `infra.s3.resources.requests.cpu`             | string/number | `0.5`                 | Number of CPUs requested for S3                        |
| `infra.s3.resources.requests.memory`          | string        | `128Mi`               | RAM requested for S3                          |
| `infra.s3.resources.requests.storage`         | string        | `1Gi`                 | Storage size requested for S3                       |
| `infra.s3.resources.limits.memory`            | string        | `256Mi`               | RAM limit for S3                                  |
| `infra.s3.tls.enabled`                        | boolean       | `false`               | Enabling TLS for S3                               |
| `infra.s3.tls.secret.ca`                      | string        | `null`                | CA certificate for S3                               |
| `infra.temporal.enabled`                      | boolean       | `false`               | Deploying Temporal                             |
| `infra.temporal.extra_envs`                   | list          | `[]`                  | List of variables and their values that allow overriding or expanding Temporal environment variables |
| `infra.temporal.resources.requests.cpu`       | string/number | `0.5`                 | Number of CPUs requested for Temporal                  |
| `infra.temporal.resources.requests.memory`    | string        | `256Mi`               | RAM requested for Temporal                    |
| `infra.temporal.resources.limits.memory`      | string        | `512Mi`               | RAM limit for Temporal                            |
| `infra.fluent_bit.enabled`                    | boolean       | `false`               | Deploying a Fluent Bit user event collector |
| `infra.fluent_bit.extra_envs`                   | list          | `[]`                  | List of variables and their values that allow overriding or expanding Fluent Bit environment variables |
| `infra.fluent_bit.resources.requests.cpu`     | string/number | `0.1`                 | Number of CPUs requested for Fluent Bit                |
| `infra.fluent_bit.resources.requests.memory`  | string        | `128Mi`               | RAM requested for Fluent Bit                  |
| `infra.fluent_bit.resources.limits.memory`    | string        | `128Mi`               | RAM limit for Fluent Bit                          |

Using the `extra_envs` parameter, you can override or expand environment variables, e.g., for PostgreSQL:

```yaml
  postgres:
    enabled: true
    extra_envs: 
      - name: MY_VAR
        value: test123
      - name: MY_VAR_SECRET
        valueFrom: 
          secretKeyRef:
            name: test-secret
            key: test-secret-key
```

### Application configuration {#app-config}

```yaml
application:
  control_api:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 1
        memory: 2048Mi
      limits:
        memory: 4096Mi
  data_api:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 1
        memory: 2048Mi
      limits:
        memory: 4096Mi
  ui:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 1
        memory: 512Mi
      limits:
        memory: 1024Mi
  ui_api:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 0.5
        memory: 256Mi
      limits:
        memory: 512Mi
  us:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 1
        memory: 512Mi
      limits:
        memory: 1024Mi
  auth:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 1
        memory: 512Mi
      limits:
        memory: 1024Mi
  meta_manager:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 0.5
        memory: 256Mi
      limits:
        memory: 512Mi
  file_secure_reader:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 0.5
        memory: 256Mi
      limits:
        memory: 512Mi
  file_uploader_worker:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 0.5
        memory: 256Mi
      limits:
        memory: 512Mi
  file_uploader_api:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: []
    resources:
      requests:
        cpu: 1
        memory: 256Mi
      limits:
        memory: 512Mi
```

Each app component has the following parameters:

| Argument                                            | Type           | Default value (varies) | Description                                                    |
| --------------------------------------------------- | ------------- | ------------------------------ | ----------------------------------------------------------- |
| `application.<component>.replicas`                  | number        | `1`                            | Number of replicas for the component                            |
| `application.<component>.version`                   | string        | varies                         | Component version                                           |
| `application.<component>.maxSurge`                  | string/number | `50%`                          | Maximum number of additional pods during an update |
| `application.<component>.maxUnavailable`            | string/number | `0`                            | Maximum number of pods deleted during an update      |
| `application.<component>.resources.requests.cpu`    | string/number | varies                         | Number of CPUs requested for the component                 |
| `application.<component>.resources.requests.memory` | string        | varies                         | RAM requested for the component                   |
| `application.<component>.resources.limits.memory`   | string        | varies                         | RAM limit for the component                           |
| `application.<component>.extra_envs`                | list          | `[]`                           | List of variables and their values that allow overriding or expanding the environment variables of an application component |

**Available application components:**
* `control_api`: Connection and dataset management service.
* `data_api`: Source query processing service.
* `ui`: User interface.
* `ui_api`: Utility service for private API of dashboards and charts.
* `us`: United Storage to manage the storage of all the system's operating data.
* `auth`: Authentication service.
* `meta_manager`: Deferred task processing manager.
* `file_secure_reader`: File secure reading service.
* `file_uploader_worker`: File uploading and processing service.
* `file_uploader_api`: File uploading API service.

Using the `extra_envs` parameter, you can allow override or expand the environment variables of an application component, e.g., for the `control_api` component:

```yaml
application:
  control_api:
    replicas: 1
    version: '...'
    maxSurge: 50%
    maxUnavailable: 0
    extra_envs: 
      - name: MY_VAR
        value: test123
      - name: MY_VAR_SECRET
        valueFrom: 
          secretKeyRef:
            name: test-secret
            key: test-secret-key
    resources:
      requests:
        cpu: 1
        memory: 2048Mi
      limits:
        memory: 4096Mi
```

### Secrets {#secrets}

```yaml
secrets:
  ref: null
  #
  AUTH_TOKEN_PRIVATE_KEY: null
  AUTH_TOKEN_PUBLIC_KEY: null
  AUTH_PROVIDERS_CONFIG: null
  AUTH_ADMIN_PASSWORD: null
  AUTH_CALLBACK_COOKIE_SECRET: null
  #
  CSRF_SECRET: null
  #
  AUTH_MASTER_TOKEN: null
  US_MASTER_TOKEN: null
  FILE_UPLOADER_MASTER_TOKEN: null
  EXPORT_DATA_VERIFICATION_KEY: null
  #
  CONTROL_API_CRYPTO_KEY: null
  #
  DOCKER_CONFIG_JSON: null
  #
  POSTGRES_PASSWORD_ROOT: null
  POSTGRES_PASSWORD_US: null
  POSTGRES_PASSWORD_COMPENG: null
  POSTGRES_PASSWORD_AUTH: null
  POSTGRES_PASSWORD_TEMPORAL: null
  POSTGRES_PASSWORD_META_MANAGER: null
  POSTGRES_PASSWORD_DEMO: null
  #
  TEMPORAL_AUTH_PRIVATE_KEY: null
  TEMPORAL_AUTH_PUBLIC_KEY: null
  #
  CLICKHOUSE_PASSWORD: null
  #
  REDIS_PASSWORD: null
  #
  S3_ACCESS_KEY_ID: null
  S3_SECRET_ACCESS_KEY: null
```


| Argument                                 | Type    | Default value | Description                                                     |
| ---------------------------------------- | ------ | --------------------- | ------------------------------------------------------------ |
| `secrets.ref`                            | string | `null`                | Kubernetes external secret link                          |
| `secrets.AUTH_TOKEN_PRIVATE_KEY`         | string | `null`                | Private RSA key for signing authentication tokens        |
| `secrets.AUTH_TOKEN_PUBLIC_KEY`          | string | `null`                | Public RSA key for checking authentication tokens       |
| `secrets.AUTH_PROVIDERS_CONFIG`          | string | `null`                | Configuration of authentication providers in JSON format       |
| `secrets.AUTH_ADMIN_PASSWORD`            | string | `null`                | Admin password                                        |
| `secrets.AUTH_CALLBACK_COOKIE_SECRET`    | string | `null`                | Cookie encryption key for authentication                    |
| `secrets.CSRF_SECRET`                    | string | `null`                | CSRF token encryption key                                  |
| `secrets.AUTH_MASTER_TOKEN`              | string | `null`                | Master token for the authentication service                      |
| `secrets.US_MASTER_TOKEN`                | string | `null`                | Master token for the meta information storage service            |
| `secrets.FILE_UPLOADER_MASTER_TOKEN`     | string | `null`                | Master token for the file uploading service                     |
| `secrets.EXPORT_DATA_VERIFICATION_KEY`   | string | `null`                | Integrity check key for import/export of workbooks     |
| `secrets.CONTROL_API_CRYPTO_KEY`         | string | `null`                | Encryption key for connections                              |
| `secrets.DOCKER_CONFIG_JSON`             | string | `null`                | Docker image registry access configuration in JSON format |
| `secrets.POSTGRES_PASSWORD_ROOT`         | string | `null`                | PostgreSQL root user password                          |
| `secrets.POSTGRES_PASSWORD_US`           | string | `null`                | Password for the meta information service database               |
| `secrets.POSTGRES_PASSWORD_COMPENG`      | string | `null`                | Password for the computation engine database                     |
| `secrets.POSTGRES_PASSWORD_AUTH`         | string | `null`                | Password for the authentication service database                |
| `secrets.POSTGRES_PASSWORD_TEMPORAL`     | string | `null`                | Temporal database password                              |
| `secrets.POSTGRES_PASSWORD_META_MANAGER` | string | `null`                | `meta-manager` database password                |
| `secrets.POSTGRES_PASSWORD_DEMO`         | string | `null`                | Demo database password                           |
| `secrets.TEMPORAL_AUTH_PRIVATE_KEY`      | string | `null`                | RSA private key for Temporal authentication               |
| `secrets.TEMPORAL_AUTH_PUBLIC_KEY`       | string | `null`                | RSA public key for Temporal authentication               |
| `secrets.CLICKHOUSE_PASSWORD`            | string | `null`                | Password for ClickHouse®                                        |
| `secrets.REDIS_PASSWORD`                 | string | `null`                | Password for Valkey™                                             |
| `secrets.S3_ACCESS_KEY_ID`               | string | `null`                | Access Key ID for S3                            |
| `secrets.S3_SECRET_ACCESS_KEY`           | string | `null`                | Secret Access Key for S3                        |

### PostgreSQL configuration {#pg-config}

```yaml
postgres:
  POSTGRES_HOST: postgres-cip
  POSTGRES_PORT: '5432'
  POSTGRES_USER_AUTH: pg-auth-user
  POSTGRES_DB_AUTH: pg-auth-db
  POSTGRES_USER_COMPENG: pg-compeng-user
  POSTGRES_DB_COMPENG: pg-compeng-db
  POSTGRES_USER_US: pg-us-user
  POSTGRES_DB_US: pg-us-db
  POSTGRES_USER_META_MANAGER: pg-meta-manager-user
  POSTGRES_DB_META_MANAGER: pg-meta-manager-db
  POSTGRES_USER_DEMO: pg-demo-user
  POSTGRES_DB_DEMO: pg-demo-db
  POSTGRES_USER_TEMPORAL: pg-temporal-user
  POSTGRES_DB_TEMPORAL: pg-temporal-db
  POSTGRES_DB_TEMPORAL_VISIBILITY: pg-temporal-visibility-db
```

| Argument                                   | Type    | Default value       | Description                                              |
| ------------------------------------------ | ------ | --------------------------- | ----------------------------------------------------- |
| `postgres.POSTGRES_HOST`                   | string | `postgres-cip`              | PostgreSQL host                                       |
| `postgres.POSTGRES_PORT`                   | string | `'5432'`                    | PostgreSQL port                                       |
| `postgres.POSTGRES_USER_AUTH`              | string | `pg-auth-user`              | Authentication service DB user            |
| `postgres.POSTGRES_DB_AUTH`                | string | `pg-auth-db`                | Authentication service DB name                         |
| `postgres.POSTGRES_USER_COMPENG`           | string | `pg-compeng-user`           | Computation engine DB user                 |
| `postgres.POSTGRES_DB_COMPENG`             | string | `pg-compeng-db`             | Computation engine DB name                              |
| `postgres.POSTGRES_USER_US`                | string | `pg-us-user`                | Meta information service DB user           |
| `postgres.POSTGRES_DB_US`                  | string | `pg-us-db`                  | Meta information service DB name                        |
| `postgres.POSTGRES_USER_META_MANAGER`      | string | `pg-meta-manager-user`      | User for Meta Manager DB                      |
| `postgres.POSTGRES_DB_META_MANAGER`        | string | `pg-meta-manager-db`        | Meta Manager DB name                                   |
| `postgres.POSTGRES_USER_DEMO`              | string | `pg-demo-user`              | Demo database user                       |
| `postgres.POSTGRES_DB_DEMO`                | string | `pg-demo-db`                | Demo database name                                    |
| `postgres.POSTGRES_USER_TEMPORAL`          | string | `pg-temporal-user`          | User for Temporal DB                          |
| `postgres.POSTGRES_DB_TEMPORAL`            | string | `pg-temporal-db`            | Temporal DB name                                       |
| `postgres.POSTGRES_DB_TEMPORAL_VISIBILITY` | string | `pg-temporal-visibility-db` | Name of the service DB for building indexes for Temporal |

### ClickHouse® configuration {#ch-config}

```yaml
clickhouse:
  CLICKHOUSE_HOST: clickhouse-cip
  CLICKHOUSE_PORT: '8123'
  CLICKHOUSE_USER: ch-user
  CLICKHOUSE_DB_USAGE_TRACKING: ch-usage-tracking-db
  CLICKHOUSE_TABLE_USAGE_TRACKING: ch-usage-tracking-table
```

| Argument                                     | Type    | Default value     | Description                                          |
| -------------------------------------------- | ------ | ------------------------- | ------------------------------------------------- |
| `clickhouse.CLICKHOUSE_HOST`                 | string | `clickhouse-cip`          | ClickHouse® host                                   |
| `clickhouse.CLICKHOUSE_PORT`                 | string | `'8123'`                  | ClickHouse® port                                   |
| `clickhouse.CLICKHOUSE_USER`                 | string | `ch-user`                 | ClickHouse® user                           |
| `clickhouse.CLICKHOUSE_DB_USAGE_TRACKING`    | string | `ch-usage-tracking-db`    | Name of DB for storing user events      |
| `clickhouse.CLICKHOUSE_TABLE_USAGE_TRACKING` | string | `ch-usage-tracking-table` | Name of table for storing user events |

### Valkey™ configuration {#rd-config}

```yaml
redis:
  REDIS_HOSTS:
    - redis-cip
  REDIS_PORT: '6379'
  REDIS_CLUSTER_NAME: null
  REDIS_DB_CACHE_DATA: '0'
  REDIS_DB_CACHE_MUTATIONS: '1'
  REDIS_DB_FILE_API: '9'
  REDIS_DB_FILE_WORKER: '11'
```

| Argument                          | Type          | Default value | Description                                                          |
| --------------------------------- | ------------ | --------------------- | ----------------------------------------------------------------- |
| `redis.REDIS_HOSTS`               | list(string) | `redis-cip`           | Hosts Valkey™                                                       |
| `redis.REDIS_PORT`                | string       | `'6379'`              | Valkey™ port                                                        |
| `redis.REDIS_CLUSTER_NAME`        | string       | `null`                | Valkey™ cluster name                                                |
| `redis.REDIS_DB_CACHE_DATA`       | string       | `'0'`                 | Valkey™ DB with data cache                                           |
| `redis.REDIS_DB_CACHE_MUTATIONS`  | string       | `'1'`                 | Valkey™ DB with dataset cache                                        |
| `redis.REDIS_DB_FILE_API`         | string       | `'9'`                 | Valkey™ DB for storing metadata when processing uploaded files |
| `redis.REDIS_DB_FILE_WORKER`      | string       | `'11'`                | Valkey™ DB for the file-uploader-worker task queue                   |


### S3 configuration {#s3-config}

```yaml
s3:
  S3_ENDPOINT: http://s3-cip:9000
  S3_BUCKET_TEMPORARY: dl-file-uploader-tmp
  S3_BUCKET_PERSISTENT: dl-file-uploader
```

| Argument                  | Type    | Default value  | Description                                                              |
| ------------------------- | ------ | ---------------------- | --------------------------------------------------------------------- |
| `s3.S3_ENDPOINT`          | string | `http://s3-cip:9000`   | S3 storage access address                                          |
| `s3.S3_BUCKET_TEMPORARY`  | string | `dl-file-uploader-tmp` | Name of the bucket for temporary file storage                            |
| `s3.S3_BUCKET_PERSISTENT` | string | `dl-file-uploader`     | Name of the bucket for storing uploaded files for file connections |

### Temporal configuration {#temporal-config}

```yaml
temporal:
  TEMPORAL_ENDPOINT: temporal-cip:7233
```

| Argument                     | Type    | Default value | Description               |
| ---------------------------- | ------ | --------------------- | ---------------------- |
| `temporal.TEMPORAL_ENDPOINT` | string | `temporal-cip:7233`   | Temporal address |


### Available connectors {#visible-connectors}

```yaml
visible_connectors:
  - clickhouse
  - postgres
  - chyt
  - ydb
  - mysql
  - greenplum
  - mssql
  - oracle
  - trino
  - metrika_api
  - appmetrica_api
```

| Argument             | Type   | Default value | Description                                                  |
| -------------------- | ----- | --------------------- | --------------------------------------------------------- |
| `visible_connectors` | array | (list)              | List of database connectors available in the interface |

### Key features {#functionality-values}

```yaml
features:
  auth:
    enabled: true
    local: true
    skip_local: false
    force_redirect_open_id: false
  meta_manager:
    enabled: false
  ui_api:
    enabled: false
  demo:
    enabled: true
  hc:
    enabled: true
    endpoint: ''
    protocol: ''
  yandex_map:
    enabled: false
    token: ''
  editor:
    enabled: false
  export:
    enabled: false
  background_exports:
    enabled: false
  compeng_sidecar:
    enabled: false
  usage_tracking:
    enabled: false
  files:
    enabled: false
  cache:
    enabled: false
  sec_embeds: 
    enabled: false
  auth_cookie:
    enabled: false
    domain: ''
  ai:
    enabled: false
    api_token: ''
    model_name: ''
    endpoint: ''
    model_context_window_size: ''
    extra_headers: ''
```

| Argument                           | Type     | Default value | Description                                                                                                                     |
| ---------------------------------- | ------- | --------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| `features.auth.enabled`            | boolean | `true`                | Enabling the authentication service                                                                                             |
| `features.auth.local`              | boolean | `true`                | Enabling local users. If false, you can log in to the system only via users of external IdP providers |
| `features.auth.skip_local`              | boolean | `false`                | Skips (does not disable) the local login step. If IdP providers are not specified (empty array in the configuration), this parameter has no effect |
| `features.auth.force_redirect_open_id`              | boolean | `false`                | Redirects to the OpenID authorization, if `features.auth.skip_local` is set to `true`, there is no LDAP provider, and only one OpenID provider is specified |
| `features.meta_manager.enabled`    | boolean | `false`               | Enabling `meta-manager` to process deferred tasks                                                              |
| `features.ui_api.enabled`          | boolean | `false`               | Enabling a service `ui-api`                                                                                                   |
| `features.demo.enabled`            | boolean | `true`                | Enabling demo data deployment                                                                                          |
| `features.hc.enabled`              | boolean | `true`                | Enabling the Highcharts library                                                                                |
| `features.hc.endpoint`             | string  | `''`                  | Host and port for downloading the Highcharts library resources                                                                    |
| `features.hc.protocol`             | string  | `''`                  | Protocol for downloading the Highcharts library resources `http`/`https`                                                        |
| `features.yandex_map.enabled`      | boolean | `false`               | Enabling integration with Yandex Maps                                                                                        |
| `features.yandex_map.token`        | string  | `''`                  | [Token for Yandex Maps](https://yandex.ru/dev/jsapi-v2-1/doc/ru/)                                                                                                        |
| `features.editor.enabled`          | boolean | `false`               | Enabling Editor and JSON (API Connector)                                                                           |
| `features.export.enabled`          | boolean | `false`               | Enabling workbook import/export                                                                        |
| `features.background_exports.enabled` | boolean | `false` | Enabling background data export in CSV and XLSX format for table charts |
| `features.compeng_sidecar.enabled` | boolean | `false`               | Deploying a PostgreSQL DB for computing as a sidecar                                                                    |
| `features.usage_tracking.enabled`  | boolean | `false`               | Enabling user event tracking                                                                  |
| `features.cache.enabled`             | boolean | `false`               | Enabling caching of query data and dataset metadata                                                                 |
| `features.sec_embeds.enabled`  | boolean | `false`               | Enabling [private object embedding](../security/private-embedded-objects.md)                                    |
| `features.auth_cookie.enabled`   | boolean | `false`               | Enabling [object embedding in a corporate domain](../security/embedded-objects.md)                       |
| `features.auth_cookie.domain`    | string     | `''`                     | Corporate domain for embedding objects, in `http://<domain>` format         |
| `features.ai.enabled`    | boolean     | `false`                     | Enables the use of AI if the following three variables are filled in         |
| `features.ai.api_token`    | string     | `''`                     | Provider API token         |
| `features.ai.model_name`    | string     | `''`                     | Model ID (as shown in the `model` field)         |
| `features.ai.endpoint`    | string     | `''`                     | Base URL of an OpenAI-compatible API         |
| `features.ai.model_context_window_size`    | string     | `''`                     | (optional) Context window size in tokens (default: 128,000)         |
| `features.ai.extra_headers`    | string     | `''`                     | (optional) Additional HTTP headers (server only, not sent to the browser)         |

### System configuration {#system-config}

```yaml
config:
  cpu_request_scale: 1.0
```

| Argument                   | Type    | Default value | Description                                                      |
| -------------------------- | ------ | --------------------- | ------------------------------------------------------------- |
| `config.cpu_request_scale` | number | `1.0`                 | CPU resource scaling ratio for all components |

### Checksum {#checksum}

```yaml
checksum: null
```

| Argument   | Type    | Default value | Description                                                                            |
| ---------- | ------ | --------------------- | ----------------------------------------------------------------------------------- |
| `checksum` | string | `null`                | Checksum of the integrity check distribution (filled automatically) |

## Notes

1. If the Highcharts library is disabled in DataLens On-premises, the [Gravity Charts](https://github.com/gravity-ui/charts) library is used instead.

1. After each deployment, a file named `./values.debug.yaml` is generated with all deployment parameters saved in it except for secrets. This file may be of use for initial system performance diagnostics when you contact support.

1. If `?full_login_page=true` is sent to the URL, all authentication methods available by default are displayed.

1. To use the Usage Tracking features with an external ClickHouse® database, create tables in the target cluster using the following query:

   ```sql
   CREATE TABLE $CLICKHOUSE_DB_USAGE_TRACKING.$CLICKHOUSE_TABLE_USAGE_TRACKING
   ON CLUSTER '{cluster}' (
       event_time DateTime64(9),
       event_date Date,
       source_entry_id String,
       dash_id Nullable(String),
       dash_tab_id Nullable(String),
       chart_id Nullable(String),
       chart_kind Nullable(String),
       response_status_code Nullable(UInt64),
       dataset_id Nullable(String),
       user_id Nullable(String),
       request_id Nullable(String),
       query Nullable(String),
       source Nullable(String),
       connection_id Nullable(String),
       dataset_mode Nullable(String),
       username Nullable(String),
       execution_time Int64,
       status Nullable(String),
       error Nullable(String),
       connection_type Nullable(String),
       host Nullable(String),
       cluster Nullable(String),
       clique_alias Nullable(String),
       cache_used UInt8,
       cache_full_hit UInt8,
       endpoint_code Nullable(String),
       query_type Nullable(String),
       err_code Nullable(String),
       workbook_id Nullable(String)
   ) ENGINE = ReplicatedMergeTree('/clickhouse/tables/{shard}/$CLICKHOUSE_DB_USAGE_TRACKING.$CLICKHOUSE_TABLE_USAGE_TRACKING', '{replica}')
   PARTITION BY toYYYYMM(event_date)
   ORDER BY (toStartOfHour(event_time), connection_id, dash_id, dataset_id, chart_id, user_id, event_time)
   TTL event_date + toIntervalMonth(6)
   SETTINGS index_granularity = 8192, allow_nullable_key = 1;
   ```

   Where `$CLICKHOUSE_DB_USAGE_TRACKING` and `$CLICKHOUSE_TABLE_USAGE_TRACKING` are the database name and the ClickHouse® table name in your cluster.