Application Configuration
Hostname where the application is accessible.Required: YesExamples:
- Production:
"crewai.company.com" - Development:
"localhost:2603" - LoadBalancer:
"a1b2c3-1234.us-west-2.elb.amazonaws.com"
- OAuth authentication failures
- Invalid webhook URLs
- CORS rejection
Internal URL for inter-service communication within the Kubernetes cluster.Auto-Generated: By default, this value is automatically generated using the format:Protocol Detection:
https://whenweb.enableSslFromPuma: truehttp://whenweb.enableSslFromPuma: false
- Using custom internal service discovery
- Routing through internal proxy or service mesh
- Non-standard networking configuration
- Auto-generated:
"http://crewai-platform-web.crewai.svc.cluster.local:3000" - Auto-generated (TLS):
"https://crewai-platform-web.crewai.svc.cluster.local:3000" - Custom:
"https://crewai-internal.company.local"
Rails environment mode.Valid Values:
"production"- Production mode (optimized, logging minimized)"development"- Development mode (detailed logging, auto-reload)"staging"- Staging mode (production-like with extra logging)"test"- Test mode (not for deployment)
"production" for production deployments.Enable CrewAI Factory features.Purpose: Required for core CrewAI Platform functionality.
Rails application log level.Valid Values:
"debug", "info", "warn", "error", "fatal"Recommendations:- Production:
"info"or"warn" - Staging:
"info" - Development:
"debug"
"debug" generates significantly more log output and can impact performance.Default AWS region for regional services.
S3 bucket for application log shipping.Optional: Leave empty to disable log shipping to S3.
URL prefix for mounting Rails application at a subpath.Default: Commented outExample:Use Case: Deploying at
https://company.com/crewai/ instead of https://company.com/.CrewAI Built-in Integration
Internal URL for Built-in Integrations service communication.Auto-Generated: When Purpose: The Rails application uses this URL to communicate internally with the Built-in Integrations service for third-party integration management (Gmail, Google Calendar, Microsoft Outlook, etc.).Default Generated Value:
oauth.enabled: true, this value is automatically generated using the format:"http://crewai-oauth.crewai.svc.cluster.local:8787"Auto-Generation Details:- Protocol: Always
http://(internal cluster communication) - Service name:
<release-name>-oauth - Namespace: Current release namespace
- Port:
8787(default Built-in Integrations service port)
- Using custom service mesh routing
- Built-in Integrations service hosted externally
- Non-standard internal networking
- Auto-generated (default):
"http://crewai-oauth.crewai.svc.cluster.local:8787" - Custom:
"http://oauth-service.custom-namespace.svc.cluster.local:8080"
- This is for internal service-to-service communication
- External OAuth callbacks use the Ingress configuration (
oauth.ingress.host) - Communication is authenticated using
CREWAI_OAUTH_API_KEYsecret
- Built-in Integrations service configuration: See CrewAI Built-in Integrations Reference
- OAuth secrets:
secrets.OAUTH_INTERNAL_API_KEY(auto-populated asCREWAI_OAUTH_API_KEYfor Rails)
Authentication Configuration
Authentication provider type.Required: YesValid Values:
"local"- Local username/password authentication"entra_id"- Microsoft Entra ID (Azure AD) authentication"okta"- Okta authentication"workos"- WorkOS authentication
- No additional configuration needed
- Users managed in CrewAI Platform database
envVars.ENTRA_ID_CLIENT_IDrequiredenvVars.ENTRA_ID_TENANT_IDrequiredsecrets.ENTRA_ID_CLIENT_SECRETrequired- Azure AD application configured with redirect URI:
https://your-domain/auth/entra_id/callback - Users authenticated via Microsoft
envVars.OKTA_SITErequiredenvVars.OKTA_CLIENT_IDrequiredenvVars.OKTA_AUTHORIZATION_SERVERrequiredenvVars.OKTA_AUDIENCErequired- Okta application configured with redirect URI:
https://your-domain/auth/okta/callback - Users authenticated via Okta
envVars.WORKOS_CLIENT_IDrequiredenvVars.WORKOS_AUTHKIT_DOMAINrequired- WorkOS application configured with redirect URI:
https://your-domain/auth/workos/callback - Users authenticated via WorkOS
Okta Configuration
Okta organization URL.Format:
https://your-domain.okta.com or https://your-domain.oktapreview.comWhen Required: AUTH_PROVIDER: oktaExample:Okta application client ID.When Required:
AUTH_PROVIDER: oktaObtaining: Found in Okta Admin Console under Applications > Your App > General Settings.Okta authorization server identifier.Common Values:
"default"- Default authorization server"aus1234567890abcdef"- Custom authorization server ID
AUTH_PROVIDER: oktaFinding: Okta Admin Console > Security > API > Authorization Servers.Okta API audience identifier.Common Values:
"api://default"- Default audience"https://your-domain.okta.com"- Custom audience
AUTH_PROVIDER: oktaConfiguration: Set in the authorization server configuration.Entra ID Configuration
Microsoft Entra ID (Azure AD) application (client) ID.Format: UUID (e.g.,
12345678-1234-1234-1234-123456789012)When Required: AUTH_PROVIDER: entra_idObtaining: Azure Portal > App Registrations > Your App > Overview > Application (client) ID.Example:Microsoft Entra ID (Azure AD) directory (tenant) ID.Format: UUID (e.g.,
87654321-4321-4321-4321-210987654321)When Required: AUTH_PROVIDER: entra_idObtaining: Azure Portal > App Registrations > Your App > Overview > Directory (tenant) ID.WorkOS Configuration
WorkOS application client ID.When Required:
AUTH_PROVIDER: workosObtaining: WorkOS Dashboard > Your Application > Configuration > Client ID.Example:WorkOS AuthKit domain for authentication.Format:
your-domain.authkit.comWhen Required: AUTH_PROVIDER: workosConfiguration: Set up in WorkOS Dashboard under AuthKit settings.Example:Crew Deployment Configuration
Crew container build and deployment provider.Valid Values:
"BUILDKIT_KUBERNETES"- Use BuildKit service for builds (recommended)
- Requires
buildkit.enabled: true - Builds occur in-cluster
- No external dependencies
BuildKit image reference for container builds.Auto-Generated: When Purpose: Ensures the application uses the same BuildKit image version as the deployed BuildKit service, maintaining version consistency.Default Generated Value:Override Behavior:Automatically generates:
buildkit.enabled: true, this value is automatically generated from the BuildKit image configuration:- When
buildkit.enabled: true, the auto-generated value takes precedence - Custom values in
envVars.BUILDKIT_IMAGE_OVERRIDEare ignored to prevent version mismatches - To change the BuildKit image, configure
buildkit.image.*values instead
"registry.company.com/buildkit/buildkit:v0.25.1-rev6-e35d3a13"Leave Empty: To use auto-generated value (recommended when BuildKit is enabled).Container Registry Configuration
Container registry hostname for pulling Docker Hub images.Auto-Generated: By default, this value is automatically generated using one of these formats:Without With Default Generated Value: Auto-generates:
global.imageNamePrefixOverride:global.imageNamePrefixOverride:"images.crewai.com/proxy/dockerhub" (when global.imageRegistry: "images.crewai.com" and no override)Purpose: Configures where the application pulls base images from Docker Hub. This is particularly important for air-gapped environments or when using a private registry mirror.Fallback Behavior:When CONTAINER_REGISTRY_HOSTNAME is empty or not set:- If
global.imageNamePrefixOverrideis set, uses<imageRegistry>/<imageNamePrefixOverride> - Otherwise, uses
<imageRegistry>/proxy/dockerhub
"123456789012.dkr.ecr.us-west-2.amazonaws.com/crewai/"When to Override:- Air-gapped deployments with internal registry
- Using a pull-through cache registry
- Corporate registry requirements
- Private Docker Hub mirror with different path structure
- Custom path structure not covered by
imageNamePrefixOverride
- Auto-generated (default): Leave empty to use
"images.crewai.com/proxy/dockerhub" - Auto-generated (with override): Leave empty to use
"<imageRegistry>/<imageNamePrefixOverride>" - Internal registry:
"registry.company.com/dockerhub-mirror" - Harbor registry:
"harbor.company.com/proxy-cache/dockerhub" - Direct Docker Hub (not recommended):
"docker.io"
Registry where built crew container images are stored.Required: Yes - Chart installation will fail if this value is not set.Validation: The Helm chart includes validation that enforces this requirement. If
envVars.CREW_IMAGE_REGISTRY_OVERRIDE is empty or not provided, the deployment will fail with an error message during installation.Purpose: Specifies the registry where CrewAI Platform pushes built crew images. The suffix /crewai-enterprise is automatically appended.Behavior:- Images are pushed to:
<CREW_IMAGE_REGISTRY_OVERRIDE>/crewai-enterprise/<image-name>:<tag> - Registry must be accessible from both build pods and runtime pods
- Requires appropriate push/pull credentials
- Validation occurs at deployment time (before resources are created)
- AWS ECR:
"123456789012.dkr.ecr.us-west-2.amazonaws.com" - Azure ACR:
"mycompany.azurecr.io" - Internal registry:
"registry.company.local:5000"
/crewai-enterprise/* prefix.Error Message: If not set, you will see: "envVars.CREW_IMAGE_REGISTRY_OVERRIDE is required. See: https://enterprise-docs.crewai.com/reference/chart-values/environment-variables#param-env-vars-crew-image-registry-override"Registry hostname for automation base images.Default Generated Value:
"images.crewai.com" (when global.imageRegistry: "images.crewai.com")Purpose: Specifies the registry where automation base images are stored. This is used in combination with AUTOMATION_ECR_REPOSITORY_PREFIX and AUTOMATION_BASE_IMAGE_NAME to construct the full image path for crew container builds.Repository prefix for automation base images in the registry.Auto-Generated: By default, this value is automatically generated using one of these values:With Without Default Generated Value: Example - Default Configuration:Results in: Results in:
global.imageNamePrefixOverride:global.imageNamePrefixOverride:"proxy/crewai/crewai/" (when no override is set)Purpose: Adds an organizational prefix to automation base image paths within the registry. This prefix is prepended to the automation base image name when constructing the full image path.Fallback Behavior:When AUTOMATION_ECR_REPOSITORY_PREFIX is empty or not set:- If
global.imageNamePrefixOverrideis set, uses that value - Otherwise, uses
"proxy/crewai/crewai/"
images.crewai.com/proxy/crewai/crewai/crewai-enterprise-preinstalled-v2:latestExample - With imageNamePrefixOverride:123456789012.dkr.ecr.us-west-2.amazonaws.com/crewai/crewai-enterprise-preinstalled-v2:latestWhen to Override:- Custom path structure not covered by
imageNamePrefixOverride - Different prefix for automation images vs. platform images
- Migration from one naming scheme to another
- Aligning with Replicated proxy path structure for consistency
- Multi-tenant registry organization
- Namespace separation in shared registries
- Compliance with corporate naming conventions
- Maintaining path structure consistency with proxy registries
- Simplified paths when using
imageNamePrefixOverride
Base image name used for building crew containers.Purpose: Specifies the foundational image containing CrewAI dependencies and runtime.Default: Note: The base image must be accessible from the configured registry and contain all required CrewAI runtime dependencies.
"crewai-enterprise-preinstalled-v2:latest"Format: <image-name>:<tag>When to Change:- Using custom base image with additional dependencies
- Pinning to specific version for consistency
- Testing new base image versions
Storage Configuration
File storage backend service.Required: Yes (unless using MinIO)Valid Values:
"amazon"- Amazon S3 or S3-compatible storage"microsoft"- Azure Blob Storage
- Requires
envVars.AWS_REGION - Requires
envVars.AWS_BUCKET - Requires
secrets.AWS_ACCESS_KEY_IDandsecrets.AWS_SECRET_ACCESS_KEY(or IRSA) - Optional
envVars.AWS_ENDPOINTfor S3-compatible services
- Requires
envVars.AZURE_STORAGE_ACCOUNT_NAME - Requires
secrets.AZURE_STORAGE_ACCESS_KEY
S3-compatible storage endpoint URL.When to Set:
- Using MinIO:
"http://crewai-minio:9000" - Using Wasabi:
"https://s3.wasabisys.com" - Using DigitalOcean Spaces:
"https://nyc3.digitaloceanspaces.com"
- Using AWS S3 (uses regional endpoint automatically)
AWS region for S3 bucket.Examples:
"us-west-2", "eu-central-1", "ap-southeast-1"Required For: STORAGE_SERVICE: amazonS3 bucket name for file storage.Examples:
"crewai-prod-storage", "company-crewai-files"Required For: STORAGE_SERVICE: amazonAzure Storage account name.Required For:
STORAGE_SERVICE: microsoftBuilt-in LLM Configuration
LLM provider for built-in platform AI features.Purpose: Specifies which LLM provider to use for internal platform features such as:
- Improving Studio prompts
- Generating automation descriptions
- Chatting with flows
- Other AI-assisted platform capabilities
"openai"- OpenAI provider (GPT models)"anthropic"- Anthropic provider (Claude models)
- Requires
secrets.BUILT_IN_LLM_API_KEYto be set with a valid API key for the chosen provider - Requires
envVars.BUILT_IN_LLM_MODELto be set with a supported model for the provider
Model name for built-in LLM provider.Purpose: Specifies which model to use for internal platform AI features.OpenAI Models (BUILT_IN_LLM_PROVIDER: “openai”):
"gpt-4o-mini"- Recommended for most use cases (cost-effective, fast)"gpt-4o"- More capable, higher cost"gpt-4-turbo"- Previous generation flagship"gpt-3.5-turbo"- Older, budget option
"claude-3-5-sonnet-20241022"- Latest Sonnet model (recommended)"claude-3-5-haiku-20241022"- Fast and cost-effective"claude-3-opus-20240229"- Most capable (higher cost)
- Balance cost vs. capability based on your usage patterns
- Internal platform features typically work well with smaller, faster models
- Larger models may provide better results for complex prompt improvements
Database Configuration
PostgreSQL database hostname or IP address.Auto-Override: When
postgres.enabled: true, this value is automatically overridden to the internal PostgreSQL service name (<fullname>-postgres).Required For: External database (postgres.enabled: false)Examples:- AWS RDS:
"crewai-prod.cluster-abc.us-west-2.rds.amazonaws.com" - Azure Database:
"crewai-prod.postgres.database.azure.com" - Google Cloud SQL:
"10.1.2.3"(via Cloud SQL proxy)
PostgreSQL database port.Standard:
"5432" (PostgreSQL default)PostgreSQL username.Recommendation: Use a dedicated database user (not
postgres superuser) for production.PostgreSQL main database name.Purpose: Primary database for application data, schema migrations, and business logic.Must Match: Database created during PostgreSQL initialization.
PostgreSQL database name for ActionCable (WebSocket connections).Purpose: Separate database for real-time WebSocket communication and pub/sub messaging.Must Match: Cable database created during PostgreSQL initialization.Note: ActionCable uses a separate database to isolate real-time communication from main application data.
Skip database migrations during application startup.Default: Related Configuration:
"true"Purpose: Database migrations are handled by a dedicated pre-upgrade Helm hook job (helm/templates/jobs/pre-upgrade-migration.yaml:1) that runs before each upgrade, ensuring migrations complete successfully before the application starts.Migration Strategy:- Pre-upgrade hook runs
rails db:migratebefore deployment - Pre-upgrade hook runs
rails db:migrate:cablefor Action Cable database - Hook waits for PostgreSQL availability (when using internal PostgreSQL)
- Hook has 3 retry attempts on failure
- Application pods skip migrations to prevent race conditions
- Custom deployment workflows that don’t use Helm upgrades
- Manual migration management outside of Helm
- Debugging migration issues
"false" can cause race conditions if multiple pods attempt migrations simultaneously. The pre-upgrade hook pattern ensures single-execution migration runs.Example - Disable Migration Hook:migrationJob.nodeSelector (docs/reference/chart-values/reference.mdx:258) - Configure node placement for migration jobs.Concurrency Settings
Maximum threads per Rails process.Default: Commented out (uses Rails default of
5)Tuning:- Lower (2-3): Reduce memory usage, lower concurrency
- Higher (10-15): Increase concurrency, higher memory usage
Number of Puma worker processes.Default: Commented out (auto-calculated based on available CPU cores)Tuning:
- Single-core containers:
1 - Multi-core containers:
2-4
WEB_CONCURRENCY x per-worker memory.Background job timeout in seconds.Default: Commented out (
60 seconds)Adjust For:- Long-running jobs: Increase timeout
- Quick jobs: Keep default or lower
Worker process boot timeout in seconds.Default: Commented out (
120 seconds)Increase If: Workers fail to start within default timeout.GitHub Configuration
GitHub username or organization for repository access.Auto-Populated: From Replicated license fieldPurpose: Required to pull crewai enterprise repositories.
GitHub OAuth application client ID.Required For: GitHub OAuth authentication.
GitHub App installation URL.
GitHub App ID.
