YAML Reference

This page is a reference for the configuration values in the Rulebricks Helm chart, organized by component. Conceptual guides live elsewhere; each section links to the relevant one. For the exhaustive list of every value (including subchart internals), see the chart's values.yaml (opens in a new tab) and values.schema.json (opens in a new tab).

Core Configuration

Version Pinning

Production deployments should pin two versions: a Helm chart version (via helm install --version) and a Rulebricks product version (via global.version). The chart version controls Kubernetes packaging and infrastructure templates; global.version selects the application images. See Installing Updates.

global:
  version: '1.8.17'

Domain Configuration

Your domain should follow the pattern: rulebricks.yourdomain.com

When self-hosting Supabase, an additional subdomain is created: supabase.rulebricks.yourdomain.com

global:
  domain: 'rulebricks.acme.com'
  email: 'devops@acme.com'

SMTP Configuration

SMTP is required for user authentication flows (invitations, password resets, email verification).

Production SMTP Providers

global:
  smtp:
    host: 'email-smtp.us-east-1.amazonaws.com'
    port: 587
    user: 'AKIAIOSFODNN7EXAMPLE'
    pass: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
    from: 'no-reply@yourdomain.com'
    fromName: 'Your Company - Rulebricks'

Supabase Keys

These JWT keys are used for authentication between components.

Managed Supabase (Cloud)

When using Supabase Cloud instead of self-hosting:

global:
  supabase:
    url: 'https://abcd1234.supabase.co'
    anonKey: '<from-supabase-dashboard>'
    serviceKey: '<from-supabase-dashboard>'
    accessToken: '<personal-access-token>'
 
supabase:
  enabled: false # Disable self-hosted Supabase

Email Templates

Customize authentication email subjects and templates:

global:
  supabase:
    emails:
      subjects:
        invite: 'Join your team on Rulebricks'
        confirmation: 'Confirm Your Email'
        recovery: 'Reset Your Password'
        emailChange: 'Confirm Email Change'
      templates:
        invite: 'https://your-cdn.com/templates/invite.html'
        confirmation: 'https://your-cdn.com/templates/verify.html'
        recovery: 'https://your-cdn.com/templates/password_change.html'
        emailChange: 'https://your-cdn.com/templates/email_change.html'

AI Features

Enable AI-powered rule generation (optional):

global:
  ai:
    enabled: true
    openaiApiKey: 'sk-...'

SSO Configuration

Enable Single Sign-On (SSO) via OpenID Connect (OIDC). For how user provisioning, claim mapping, and token passthrough work, see Authentication & SSO.

Provider Types

You will need to go to your Supabase dashboard, and configure your provider in the Authentication tab. If you don't see your provider, use Keycloak; our proxy uses it as a bridge.

• Native Providers (azure, google, okta, keycloak): Supabase handles authentication directly.
• Custom Providers (ory, other): The app uses a built-in OIDC proxy we manage to translate paths for your IdP.

Identity Provider Setup

You must configure your Identity Provider (IdP) with the following settings:

• Scopes: openid, email, profile
• Response Type: code
• Grant Types: authorization_code, refresh_token
• Auth Method: http body
• Redirect URIs:
  1. https://<your-domain>/api/sso-proxy/callback
  2. <your-supabase-url>/auth/v1/callback

External Secrets

For enterprise deployments using external secret management:

global:
  secrets:
    secretRef: 'rulebricks-external-secrets'
    secretRefKeys:
      licenseKey: 'RULEBRICKS_LICENSE'
      smtpUser: 'SMTP_USERNAME'
      smtpPass: 'SMTP_PASSWORD'
      supabaseAnonKey: 'SUPABASE_ANON'
      supabaseServiceKey: 'SUPABASE_SERVICE'
      supabaseAccessToken: 'SUPABASE_TOKEN'
      openaiApiKey: 'OPENAI_KEY'
      ssoClientId: 'SSO_CLIENT_ID'
      ssoClientSecret: 'SSO_CLIENT_SECRET'

External Authentication (Token Passthrough)

For deployments behind an identity-aware proxy that has already authenticated the user, global.externalAuth.* (enabled, header, claims.id/email/name, publicPaths) delegates authentication to the upstream proxy. This carries real security implications; read Token Passthrough before enabling.

Scheduling, Labels, and Annotations

Rulebricks workloads and migration jobs honor global.scheduling; dependency subcharts (Kafka, Supabase, cert-manager, Traefik, KEDA, Vector) may require their own scheduling values. Most components also accept per-component podLabels and podDisruptionBudget blocks for clusters with admission policies.

Object Storage & Backups

Full tables, identity options per provider, and the backup/restore workflow live in Storage & Backups.

Rulebricks Application

The core application and high-performance solver (HPS).

Application Image

Image tags are selected by global.version, the single product semver shared by the app, HPS, and HPS worker images. There is no per-component tag to set.

Logging Configuration

For how decision logs flow through the system, see Decision Logs. For external Kafka authentication (including AWS MSK IAM and Azure Event Hubs examples), see External Kafka & Redis.

Ingress

Gateway API mode requires an implementation (Envoy Gateway, Cilium, Istio) in your cluster.

Redis

Redis is used for caching and session management.

To use a managed Redis instance (ElastiCache, Memorystore, Upstash, and so on) instead of the bundled deployment, set rulebricks.redis.enabled: false and configure the external block:

See External Kafka & Redis for how each component connects.

High Performance Server (HPS)

HPS handles rule execution with horizontal scaling. For the sizing model behind these values (partition ceilings, worker resources, KEDA thresholds), see Performance & Scaling.

HPS Image

HPS and worker image tags are derived from global.version (<version> and worker-<version> respectively).

HPS Resources

Database (Supabase)

Self-Hosted vs. Managed

Self-Hosted Configuration

Database Resources

External PostgreSQL

The Supabase services can run in-cluster while pointing at an external PostgreSQL server (e.g. a managed instance). Set supabase.db.enabled: false and configure the connection once:

Migration jobs reach the same server through migrations.externalDb.*.

Kong Ingress

Studio and Auth URLs

Supabase Studio can be exposed on its own hostname via supabase.studio.ingress.* (enabled, type, className, hostname, defaulting to studio.<global.domain>); dashboard credentials come from supabase.secret.dashboard.*. When your application hostname differs from the base domain, override the computed auth URLs with supabase.auth.siteUrl, supabase.auth.externalUrl, and supabase.auth.additionalRedirectUrls.

Migrations

Migration pods inherit global.scheduling and accept their own nodeSelector, tolerations, and annotations.

Message Queue (Kafka)

Kafka handles async rule execution and logging.

Basic Settings

Controller/Broker Configuration

The chart also ships pre-tuned broker settings (JVM options, network threads, socket buffers, message size limits) as kafka.controller.extraEnvVars and kafka.overrideConfiguration. These defaults are correct for the topics the chart provisions; override them only with a specific reason, using the chart's values.yaml (opens in a new tab) as the reference.

Kafka Topic Provisioning

The chart manages application topics explicitly rather than relying on broker auto-creation. The kafka.provisioning block is consumed by two post-install/post-upgrade Jobs: the Kafka subchart's provisioning Job creates topics if they don't exist, and the parent chart's kafka-topic-align Job idempotently converges pre-existing topics (partition increases, retention and size configs) so upgrades of existing installs don't require manual steps.

The defaults provision solution, solution-response, and logs topics with per-topic retention and size limits. Each entry looks like:

kafka:
  provisioning:
    enabled: true
    topics:
      - name: com.rulebricks.solution
        partitions: 64
        replicationFactor: 1
        config:
          retention.ms: '300000'
      # ... see the chart's values.yaml for the full default topic list

When using external Kafka (kafka.enabled: false), provisioning is disabled and topics are customer-managed. See External Kafka & Redis.

Kafka Bridge (Token-Auth External Kafka)

When external Kafka uses a token-based SASL mechanism (AWS MSK IAM, GCP OAUTHBEARER), Vector consumes through a kafka-proxy bridge sidecar that authenticates upstream via workload identity:

The CLI sets all of this automatically when you externalize Kafka. See External Kafka & Redis.

High Availability

kafka:
  controller:
    replicaCount: 3
  overrideConfiguration:
    default.replication.factor: '3'
    min.insync.replicas: '2'

Ingress (Traefik)

Traefik handles all incoming traffic and TLS termination.

Traefik resources, ports, and persistence follow the upstream subchart's values under traefik.*; the chart's defaults expose 80/443 and need no changes for typical deployments.

Autoscaling (KEDA)

KEDA provides event-driven autoscaling for HPS workers. Scaling behavior is configured per-worker under rulebricks.hps.workers.keda.*; see Performance & Scaling.

Certificates (cert-manager)

cert-manager provisions TLS certificates from Let's Encrypt.

The chart creates a ClusterIssuer for Let's Encrypt production and Certificate resources for your domain(s).

Decision Logging (Vector & ClickHouse)

Vector's Kafka connection (brokers, TLS, SASL, and the prefixed log topic) is templated automatically into a vector-kafka-env ConfigMap from rulebricks.app.logging.*; you don't set it by hand. How the pipeline fits together, the values tables, and custom sink examples live in Decision Logs.

DNS (external-dns)

external-dns automatically creates DNS records for your ingresses.

Provider Configuration

AWS Route53

external-dns:
  enabled: true
  provider: route53
  # Uses IRSA - ensure service account has Route53 permissions

Cloudflare

external-dns:
  enabled: true
  provider: cloudflare
  extraEnvVars:
    - name: CF_API_TOKEN
      valueFrom:
        secretKeyRef:
          name: cloudflare-api-token
          key: api-token

Google Cloud DNS

external-dns:
  enabled: true
  provider: google
  google:
    project: 'your-gcp-project'

Azure DNS

external-dns:
  enabled: true
  provider: azure
  azure:
    resourceGroup: 'your-resource-group'
    subscriptionId: 'your-subscription-id'

Monitoring (Prometheus)

What's scraped, the metric label policy, remote write, and retention examples live in Monitoring.

Storage

StorageClass

The chart can create a gp3 StorageClass for AWS EBS:

For non-AWS clusters, set storageClass.create: false and ensure a compatible StorageClass exists. Provider-specific examples are in Quick Start.