Environment Variables

Application Configuration

envVars.APPLICATION_HOST

string

default:"localhost"

Hostname where the application is accessible.Required: YesExamples:

Production: "crewai.company.com"
Development: "localhost:2603"
LoadBalancer: "a1b2c3-1234.us-west-2.elb.amazonaws.com"

Impact: Used for generating URLs, OAuth callbacks, CORS validation, and webhook endpoints.Important: Must match actual access URL. Incorrect value causes:

OAuth authentication failures
Invalid webhook URLs
CORS rejection

envVars.APPLICATION_INTERNAL_URL

string

default:"auto-generated"

Internal URL for inter-service communication within the Kubernetes cluster.Auto-Generated: By default, this value is automatically generated using the format:

<protocol>://<release-name>-web.<namespace>.svc.cluster.local:<port>

Protocol Detection:

https:// when web.enableSslFromPuma: true
http:// when web.enableSslFromPuma: false

Override When:

Using custom internal service discovery
Routing through internal proxy or service mesh
Non-standard networking configuration

Examples:

Auto-generated: "http://crewai-platform-web.crewai.svc.cluster.local:3000"
Auto-generated (TLS): "https://crewai-platform-web.crewai.svc.cluster.local:3000"
Custom: "https://crewai-internal.company.local"

Leave Empty: To use auto-generated value (recommended for most deployments).

envVars.RAILS_ENV

string

default:"production"

Rails environment mode.Valid Values:

"production" - Production mode (optimized, logging minimized)
"development" - Development mode (detailed logging, auto-reload)
"staging" - Staging mode (production-like with extra logging)
"test" - Test mode (not for deployment)

Production: Always use "production" for production deployments.

envVars.CREWAI_FACTORY

boolean

default:"true"

Enable CrewAI Factory features.Purpose: Required for core CrewAI Platform functionality.

envVars.RAILS_LOG_LEVEL

string

default:"info"

Rails application log level.Valid Values: "debug", "info", "warn", "error", "fatal"Recommendations:

Production: "info" or "warn"
Staging: "info"
Development: "debug"

Performance Impact: "debug" generates significantly more log output and can impact performance.

envVars.DEFAULT_REGION

string

default:"us-west-2"

Default AWS region for regional services.

envVars.LOGS_BUCKET

string

default:""

S3 bucket for application log shipping.Optional: Leave empty to disable log shipping to S3.

envVars.RAILS_RELATIVE_URL_ROOT

string

URL prefix for mounting Rails application at a subpath.Default: Commented outExample:

envVars:
  RAILS_RELATIVE_URL_ROOT: "/crewai"

Use Case: Deploying at https://company.com/crewai/ instead of https://company.com/.

CrewAI Built-in Integration

envVars.CREWAI_OAUTH_API_BASE_URL

string

default:"auto-generated"

Internal URL for Built-in Integrations service communication.Auto-Generated: When oauth.enabled: true, this value is automatically generated using the format:

http://<release-name>-oauth.<namespace>.svc.cluster.local:<port>

Purpose: The Rails application uses this URL to communicate internally with the Built-in Integrations service for third-party integration management (Gmail, Google Calendar, Microsoft Outlook, etc.).Default Generated Value: "http://crewai-oauth.crewai.svc.cluster.local:8787"Auto-Generation Details:

Protocol: Always http:// (internal cluster communication)
Service name: <release-name>-oauth
Namespace: Current release namespace
Port: 8787 (default Built-in Integrations service port)

Override When:

Using custom service mesh routing
Built-in Integrations service hosted externally
Non-standard internal networking

Examples:

Auto-generated (default): "http://crewai-oauth.crewai.svc.cluster.local:8787"
Custom: "http://oauth-service.custom-namespace.svc.cluster.local:8080"

Important:

This is for internal service-to-service communication
External OAuth callbacks use the Ingress configuration (oauth.ingress.host)
Communication is authenticated using CREWAI_OAUTH_API_KEY secret

Leave Empty: To use auto-generated value (recommended for most deployments).Related Configuration:

Built-in Integrations service configuration: See CrewAI Built-in Integrations Reference
OAuth secrets: secrets.OAUTH_INTERNAL_API_KEY (auto-populated as CREWAI_OAUTH_API_KEY for Rails)

Authentication Configuration

envVars.AUTH_PROVIDER

string

default:""

Authentication provider type.Required: YesValid Values:

"local" - Local username/password authentication
"entra_id" - Microsoft Entra ID (Azure AD) authentication
"okta" - Okta authentication
"workos" - WorkOS authentication
"keycloak" - Keycloak authentication

Requirements by Provider:local:

No additional configuration needed
Users managed in CrewAI Platform database

entra_id:

envVars.ENTRA_ID_CLIENT_ID required
envVars.ENTRA_ID_TENANT_ID required
secrets.ENTRA_ID_CLIENT_SECRET required
envVars.ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID optional (for CLI authentication)
envVars.ENTRA_ID_CUSTOM_OPENID_SCOPE optional
Azure AD application configured with redirect URI: https://your-domain/auth/entra_id/callback
Users authenticated via Microsoft

okta:

envVars.OKTA_SITE required
envVars.OKTA_CLIENT_ID required
secrets.OKTA_CLIENT_SECRET required
envVars.OKTA_AUTHORIZATION_SERVER required
envVars.OKTA_AUDIENCE required
envVars.OKTA_DEVICE_AUTHORIZATION_CLIENT_ID optional (for CLI authentication)
envVars.OKTA_USE_ORG_AUTH_SERVER optional (default: "false")
Okta application configured with redirect URI: https://your-domain/auth/okta/callback
Users authenticated via Okta

workos:

envVars.WORKOS_CLIENT_ID required
secrets.WORKOS_API_KEY required
envVars.WORKOS_AUTHKIT_DOMAIN required
envVars.WORKOS_COOKIE_PASSWORD required
WorkOS application configured with redirect URI: https://your-domain/auth/workos/callback
Users authenticated via WorkOS

keycloak:

envVars.KEYCLOAK_CLIENT_ID required
envVars.KEYCLOAK_SITE required
envVars.KEYCLOAK_BASE_URL optional (only for custom context paths)
envVars.KEYCLOAK_REALM required
secrets.KEYCLOAK_CLIENT_SECRET required
Keycloak client configured with redirect URI: https://your-domain/auth/keycloak/callback
Users authenticated via Keycloak
See Keycloak SSO Configuration Guide for detailed setup instructions

Okta Configuration

envVars.OKTA_SITE

string

default:""

Okta organization URL.Format: https://your-domain.okta.com or https://your-domain.oktapreview.comWhen Required: AUTH_PROVIDER: oktaPurpose: Base URL where the Okta admin console is accessible.Example:

envVars:
  AUTH_PROVIDER: "okta"
  OKTA_SITE: "https://company.okta.com"
  OKTA_CLIENT_ID: "0oa1234567890abcdef"
  OKTA_AUTHORIZATION_SERVER: "default"
  OKTA_AUDIENCE: "api://default"
  OKTA_DEVICE_AUTHORIZATION_CLIENT_ID: "0oa9876543210fedcba"
  OKTA_USE_ORG_AUTH_SERVER: "false"

secrets:
  OKTA_CLIENT_SECRET: "your-client-secret"

envVars.OKTA_CLIENT_ID

string

default:""

Okta application client ID for web application authentication.When Required: AUTH_PROVIDER: oktaObtaining: Found in Okta Admin Console under Applications > Your App > General Settings.Note: This client ID is for web application authentication. CLI authentication requires a separate client configured in OKTA_DEVICE_AUTHORIZATION_CLIENT_ID.

envVars.OKTA_AUTHORIZATION_SERVER

string

default:""

Okta authorization server identifier.Purpose: Specifies which authorization server to use for authenticating users assigned to the web application.Common Values:

"default" - Default authorization server
"aus1234567890abcdef" - Custom authorization server ID

When Required: AUTH_PROVIDER: oktaFinding: Okta Admin Console > Security > API > Authorization Servers.

envVars.OKTA_AUDIENCE

string

default:""

Okta API audience identifier.Purpose: Audience used by the authorization server to authenticate users assigned to the web application. Must match the audience configured in the authorization server specified by OKTA_AUTHORIZATION_SERVER.Common Values:

"api://default" - Default audience
"https://your-domain.okta.com" - Custom audience

When Required: AUTH_PROVIDER: oktaFinding: Okta Admin Console > Security > API > Authorization Servers. Choose the audience from the same authorization server as configured in OKTA_AUTHORIZATION_SERVER.

envVars.OKTA_DEVICE_AUTHORIZATION_CLIENT_ID

string

default:""

Okta client ID for CLI device authorization flow.When Required: AUTH_PROVIDER: okta and CLI authentication neededPurpose: Enables CLI authentication using OAuth 2.0 Device Authorization Grant flow.Important: Okta requires a separate, dedicated application for the device authorization flow. This client ID must be different from the web application client (OKTA_CLIENT_ID).Client Configuration Requirements:

Create a dedicated application in Okta for device authorization
Configure the application with device authorization flow enabled
This must be a different application from the web application

Obtaining: Found in Okta Admin Console under Applications > Your CLI App > General Settings.Example:

envVars:
  OKTA_CLIENT_ID: "0oa1234567890abcdef"                        # Web app client
  OKTA_DEVICE_AUTHORIZATION_CLIENT_ID: "0oa9876543210fedcba"   # CLI client

Leave Empty: If CLI authentication is not required.

envVars.OKTA_USE_ORG_AUTH_SERVER

string

default:"false"

Use Okta organization authorization server instead of custom authorization server.Valid Values:

"true" - Use the organization authorization server
"false" - Use a custom authorization server (default)

Default: "false" (uses custom authorization server)Purpose: Specifies whether to use Okta’s “organization authorization server” or a “custom authorization server” for authentication.When to Set to “true”:

Using Okta’s default organization authorization server
Not using a custom authorization server configuration

When to Keep “false”:

Using a custom authorization server (most common)
Default configuration

Example:

envVars:
  OKTA_USE_ORG_AUTH_SERVER: "true"

Entra ID Configuration

envVars.ENTRA_ID_CLIENT_ID

string

default:""

Microsoft Entra ID (Azure AD) application (client) ID for web application authentication.Format: UUID (e.g., 12345678-1234-1234-1234-123456789012)When Required: AUTH_PROVIDER: entra_idObtaining: Azure Portal > App Registrations > Your App > Overview > Application (client) ID.Example:

envVars:
  AUTH_PROVIDER: "entra_id"
  ENTRA_ID_CLIENT_ID: "12345678-1234-1234-1234-123456789012"
  ENTRA_ID_TENANT_ID: "87654321-4321-4321-4321-210987654321"
  ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID: "98765432-5678-5678-5678-876543210987"
  ENTRA_ID_CUSTOM_OPENID_SCOPE: "api://12345678-1234-1234-1234-123456789012/access"

secrets:
  ENTRA_ID_CLIENT_SECRET: "your-client-secret"

Note: This client ID is for web application authentication. CLI authentication can use the same application or a separate one via ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID.

envVars.ENTRA_ID_TENANT_ID

string

default:""

Microsoft Entra ID (Azure AD) directory (tenant) ID.Format: UUID (e.g., 87654321-4321-4321-4321-210987654321)When Required: AUTH_PROVIDER: entra_idObtaining: Azure Portal > App Registrations > Your App > Overview > Directory (tenant) ID.

envVars.ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID

string

default:""

Microsoft Entra ID client ID for CLI device authorization flow.When Required: AUTH_PROVIDER: entra_id and CLI authentication neededPurpose: Enables CLI authentication using OAuth 2.0 Device Authorization Grant flow.Flexibility: Entra ID allows using the same application for authenticating both web and CLI. You can either:

Use the same client ID as ENTRA_ID_CLIENT_ID (simpler, single application)
Use a dedicated application with a different client ID (more granular control)

Obtaining: Azure Portal > App Registrations > Your App > Overview > Application (client) ID.Example - Same Application:

envVars:
  ENTRA_ID_CLIENT_ID: "12345678-1234-1234-1234-123456789012"
  ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID: "12345678-1234-1234-1234-123456789012"  # Same as web

Example - Separate Application:

envVars:
  ENTRA_ID_CLIENT_ID: "12345678-1234-1234-1234-123456789012"                      # Web app
  ENTRA_ID_DEVICE_AUTHORIZATION_CLIENT_ID: "98765432-5678-5678-5678-876543210987" # CLI app

Leave Empty: If CLI authentication is not required.

envVars.ENTRA_ID_CUSTOM_OPENID_SCOPE

string

default:""

Custom OpenID scope for Entra ID authentication.When Required: AUTH_PROVIDER: entra_id (optional but recommended)Purpose: Specifies a custom API scope exposed by your Entra ID application for enhanced authentication.Format: api://<application-id>/<scope-name> (e.g., api://12345678-1234-1234-1234-123456789012/access)Obtaining: Azure Portal > App Registrations > Your App > Expose an API > Scopes.Common Scope Names:

access - General access scope
user_impersonation - User impersonation scope
Custom scope names defined in your application

Example:

envVars:
  ENTRA_ID_CUSTOM_OPENID_SCOPE: "api://12345678-1234-1234-1234-123456789012/access"

Leave Empty: To use default OpenID scopes without custom API scopes.

WorkOS Configuration

envVars.WORKOS_CLIENT_ID

string

default:""

WorkOS application client ID.When Required: AUTH_PROVIDER: workosObtaining: WorkOS Dashboard > Main Page > Client ID.Example:

envVars:
  AUTH_PROVIDER: "workos"
  WORKOS_CLIENT_ID: "client_01HXYZ123ABC456"
  WORKOS_AUTHKIT_DOMAIN: "company.authkit.com"
  WORKOS_COOKIE_PASSWORD: "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"

secrets:
  WORKOS_API_KEY: "sk_live_abc123..."

envVars.WORKOS_AUTHKIT_DOMAIN

string

default:""

WorkOS AuthKit domain for authentication.Format: your-domain.authkit.com (custom domain) or WorkOS-provided default domainWhen Required: AUTH_PROVIDER: workosPurpose: Specifies the AuthKit domain used for WorkOS authentication flows.Obtaining: WorkOS Dashboard > Developer > Domains. Can be a custom domain or the default one provided by WorkOS.Example - Custom Domain:

envVars:
  WORKOS_AUTHKIT_DOMAIN: "company.authkit.com"

Example - Default Domain:

envVars:
  WORKOS_AUTHKIT_DOMAIN: "auth-12345.workos.com"

Cookie encryption password for WorkOS authentication.When Required: AUTH_PROVIDER: workosPurpose: Used to encrypt cookies stored in the browser during WorkOS authentication flows.Format: Random string, maximum 32 charactersSecurity: Must be a cryptographically secure random string. Generate using:

openssl rand -base64 32 | cut -c -32

Example:

envVars:
  WORKOS_COOKIE_PASSWORD: "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"

Important:

Keep this value secret and secure
Use a different value for each environment (dev, staging, production)
Changing this value will invalidate all existing user sessions
Never commit this value to version control

Keycloak Configuration

envVars.KEYCLOAK_CLIENT_ID

string

default:""

Keycloak client ID for web application authentication.When Required: AUTH_PROVIDER: keycloakObtaining: Found in Keycloak Admin Console under Clients > Your Client > Settings.Example:

envVars:
  AUTH_PROVIDER: "keycloak"
  KEYCLOAK_CLIENT_ID: "crewai-factory"
  KEYCLOAK_SITE: "https://keycloak.company.com"
  KEYCLOAK_BASE_URL: "/auth"  # Optional: only if using custom base path
  KEYCLOAK_REALM: "crewai"
  KEYCLOAK_AUDIENCE: "account"
  KEYCLOAK_DEVICE_AUTHORIZATION_CLIENT_ID: "crewai-factory-cli"

secrets:
  KEYCLOAK_CLIENT_SECRET: "your-client-secret"

Note: This client ID is for web application authentication. CLI authentication requires a separate client configured in KEYCLOAK_DEVICE_AUTHORIZATION_CLIENT_ID.

envVars.KEYCLOAK_SITE

string

default:""

Keycloak server URL.Format: https://keycloak.yourdomain.com or http://localhost:8080 (development)When Required: AUTH_PROVIDER: keycloakPurpose: Base URL where the Keycloak admin console is accessible.Example:

envVars:
  KEYCLOAK_SITE: "https://keycloak.company.com"

envVars.KEYCLOAK_BASE_URL

string

default:""

Keycloak default context path.Default: "" (empty string)When Required: AUTH_PROVIDER: keycloak (optional - only needed for specific Keycloak configurations)Purpose: Specifies the base context path for your Keycloak instance. This is used when Keycloak is configured with a custom base path, typically from older versions or custom deployments.When to Set:

Using Keycloak versions older than 17 (default was /auth)
Migrated from Keycloak 17+ but kept the old /auth path for backwards compatibility
Keycloak started with --http-relative-path parameter

When to Leave Empty:

Using Keycloak 17+ without custom context path (most common)
Authorization URLs look like: https://keycloak.yourdomain.com/realms/crewai

Determining Your Base URL:Check your Keycloak authorization URL structure:

If it looks like: https://keycloak.yourdomain.com/auth/realms/crewai → Set to "/auth"
If it looks like: https://keycloak.yourdomain.com/realms/crewai → Leave empty ""

Example - Keycloak with /auth path:

envVars:
  KEYCLOAK_SITE: "https://keycloak.company.com"
  KEYCLOAK_BASE_URL: "/auth"
  KEYCLOAK_REALM: "crewai"

Example - Keycloak 17+ (no base path):

envVars:
  KEYCLOAK_SITE: "https://keycloak.company.com"
  KEYCLOAK_BASE_URL: ""  # or omit this field
  KEYCLOAK_REALM: "crewai"

Note: This value corresponds to the --http-relative-path parameter used when starting Keycloak. If you didn’t specify this parameter during Keycloak startup, leave this field empty.

envVars.KEYCLOAK_REALM

string

default:""

Keycloak realm name.When Required: AUTH_PROVIDER: keycloakObtaining: Found in Keycloak Admin Console - visible in the realm dropdown or URL path.Common Values:

"master" - Default Keycloak realm
"crewai" - Custom realm for CrewAI
"company" - Organization-specific realm

Example:

envVars:
  KEYCLOAK_REALM: "crewai"

envVars.KEYCLOAK_AUDIENCE

string

default:"account"

Keycloak audience value for token validation.Default: "account"Purpose: Validates the aud claim in access tokens issued by Keycloak.Default Behavior: Keycloak includes "account" as the default audience in access tokens, representing the built-in account management service. This default value works for most installations without additional Keycloak configuration.When to Override:

Your organization requires a custom audience value
You have configured custom audience mappers in Keycloak

Warning:Changing this value requires corresponding Keycloak configuration using client scopes and audience mappers. Misconfigured audience values will cause authentication failures, particularly for CLI authentication.Example with Custom Audience:

envVars:
  KEYCLOAK_AUDIENCE: "crewai-platform"

Important: Only change this value if you have specifically configured a custom audience in your Keycloak client settings. The default "account" value works for standard Keycloak installations.See Also: Keycloak SSO Configuration Guide - Configuring the Audience for detailed information on custom audience configuration.

envVars.KEYCLOAK_DEVICE_AUTHORIZATION_CLIENT_ID

string

default:""

Keycloak client ID for CLI device authorization flow.When Required: AUTH_PROVIDER: keycloak and CLI authentication neededPurpose: Enables CLI authentication using OAuth 2.0 Device Authorization Grant flow.Important: This must be a separate client from the web application client (KEYCLOAK_CLIENT_ID). The device authorization client must be configured as a public client with only the “OAuth 2.0 Device Authorization Grant” authentication flow enabled.Client Configuration Requirements:

Client authentication: Off (public client)
Authentication flow: Only “OAuth 2.0 Device Authorization Grant” enabled
Standard flow: Must be disabled

Example:

envVars:
  KEYCLOAK_CLIENT_ID: "crewai-factory"                    # Web app client
  KEYCLOAK_DEVICE_AUTHORIZATION_CLIENT_ID: "crewai-factory-cli"  # CLI client

Setup Guide: See Keycloak SSO Configuration Guide - CLI Authentication for detailed client creation steps.Leave Empty: If CLI authentication is not required.

Crew Deployment Configuration

envVars.PROVIDER

string

default:"BUILDKIT_KUBERNETES"

Crew container build and deployment provider.Valid Values:

"BUILDKIT_KUBERNETES" - Use BuildKit service for builds (recommended)

When Using BUILDKIT_KUBERNETES:

Requires buildkit.enabled: true
Builds occur in-cluster
No external dependencies

envVars.BUILDKIT_IMAGE_OVERRIDE

string

default:"auto-generated"

BuildKit image reference for container builds.Auto-Generated: When buildkit.enabled: true, this value is automatically generated from the BuildKit image configuration:

BUILDKIT_IMAGE_OVERRIDE = <buildkit.image.host>/<buildkit.image.name>:<buildkit.image.tag>

Purpose: Ensures the application uses the same BuildKit image version as the deployed BuildKit service, maintaining version consistency.Default Generated Value:

images.crewai.com/proxy/crewai/crewai/crewai/buildkit:v2026.0130.11

Override Behavior:

When buildkit.enabled: true, the auto-generated value takes precedence
Custom values in envVars.BUILDKIT_IMAGE_OVERRIDE are ignored to prevent version mismatches
To change the BuildKit image, configure buildkit.image.* values instead

Example:

buildkit:
  enabled: true
  image:
    host: "registry.company.com"
    name: "buildkit/buildkit"
    tag: "v2026.0130.11"

Automatically generates: "registry.company.com/buildkit/buildkit:v2026.0130.11"Leave Empty: To use auto-generated value (recommended when BuildKit is enabled).

Container Registry Configuration

envVars.CONTAINER_REGISTRY_HOSTNAME

string

default:"auto-generated"

Container registry hostname for pulling Docker Hub images.Auto-Generated: By default, this value is automatically generated using one of these formats:Without global.imageNamePrefixOverride:

<global.imageRegistry>/proxy/dockerhub

With global.imageNamePrefixOverride:

<global.imageRegistry>/<imageNamePrefixOverride>

Default Generated Value: "images.crewai.com/proxy/dockerhub" (when global.imageRegistry: "images.crewai.com" and no override)Purpose: Configures where the application pulls base images from Docker Hub. This is particularly important for air-gapped environments or when using a private registry mirror.Fallback Behavior:When CONTAINER_REGISTRY_HOSTNAME is empty or not set:

If global.imageNamePrefixOverride is set, uses <imageRegistry>/<imageNamePrefixOverride>
Otherwise, uses <imageRegistry>/proxy/dockerhub

This ensures Docker Hub images are pulled through the same registry as other platform components with consistent path structure.Example with imageNamePrefixOverride:

global:
  imageRegistry: "123456789012.dkr.ecr.us-west-2.amazonaws.com"
  imageNamePrefixOverride: "crewai/"

Auto-generates: "123456789012.dkr.ecr.us-west-2.amazonaws.com/crewai/"When to Override:

Air-gapped deployments with internal registry
Using a pull-through cache registry
Corporate registry requirements
Private Docker Hub mirror with different path structure
Custom path structure not covered by imageNamePrefixOverride

Examples:

Auto-generated (default): Leave empty to use "images.crewai.com/proxy/dockerhub"
Auto-generated (with override): Leave empty to use "<imageRegistry>/<imageNamePrefixOverride>"
Internal registry: "registry.company.com/dockerhub-mirror"
Harbor registry: "harbor.company.com/proxy-cache/dockerhub"
Direct Docker Hub (not recommended): "docker.io"

Automatic Generation: This value is automatically generated by the chart’s template logic when not explicitly set.Note: This affects base images used during crew container builds.Leave Empty: To use auto-generated value (recommended for most deployments).

envVars.CREW_IMAGE_REGISTRY_OVERRIDE

string

default:""

Registry where built crew container images are stored.Required: Yes - Chart installation will fail if this value is not set.Validation: The Helm chart includes validation that enforces this requirement. If envVars.CREW_IMAGE_REGISTRY_OVERRIDE is empty or not provided, the deployment will fail with an error message during installation.Purpose: Specifies the registry where CrewAI Platform pushes built crew images. The suffix /crewai-enterprise is automatically appended.Behavior:

Images are pushed to: <CREW_IMAGE_REGISTRY_OVERRIDE>/crewai-enterprise/<image-name>:<tag>
Registry must be accessible from both build pods and runtime pods
Requires appropriate push/pull credentials
Validation occurs at deployment time (before resources are created)

Examples:

AWS ECR: "123456789012.dkr.ecr.us-west-2.amazonaws.com"
Azure ACR: "mycompany.azurecr.io"
Google Artifact Registry (GAR): "us-west1-docker.pkg.dev/my-project/my-repo"
JFrog Artifactory: "acme.jfrog.io"
Internal registry: "registry.company.local:5000"

Important: The registry must exist and the platform must have push permissions. CrewAI Platform automatically appends /crewai-enterprise, so ensure the resulting repository path exists and accepts pushes.Error Message: If not set, you will see:

"envVars.CREW_IMAGE_REGISTRY_OVERRIDE is required. See: https://enterprise-docs.crewai.com/reference/chart-values/environment-variables#param-env-vars-crew-image-registry-override"

envVars.AUTOMATION_BASE_IMAGE_REGISTRY_OVERRIDE

string

default:"auto-generated"

Registry hostname for automation base images.Default Generated Value: "images.crewai.com" (when global.imageRegistry: "images.crewai.com")Purpose: Specifies the registry where automation base images are stored. This is used in combination with AUTOMATION_ECR_REPOSITORY_PREFIX and AUTOMATION_BASE_IMAGE_NAME to construct the full image path for crew container builds.

envVars.AUTOMATION_ECR_REPOSITORY_PREFIX

string

default:"auto-generated"

Repository prefix for automation base images in the registry.Auto-Generated: By default, this value is automatically generated using one of these values:With global.imageNamePrefixOverride:

<imageNamePrefixOverride>

Without global.imageNamePrefixOverride:

proxy/crewai/crewai/

Default Generated Value: "proxy/crewai/crewai/" (when no override is set)Purpose: Adds an organizational prefix to automation base image paths within the registry. This prefix is prepended to the automation base image name when constructing the full image path.Fallback Behavior:When AUTOMATION_ECR_REPOSITORY_PREFIX is empty or not set:

If global.imageNamePrefixOverride is set, uses that value
Otherwise, uses "proxy/crewai/crewai/"

This ensures automation base images use the same path structure as other platform components when mirroring to a private registry.Full Image Path Construction:

<AUTOMATION_BASE_IMAGE_REGISTRY_OVERRIDE>/<AUTOMATION_ECR_REPOSITORY_PREFIX><AUTOMATION_BASE_IMAGE_NAME>

Example - Default Configuration:

envVars:
  AUTOMATION_BASE_IMAGE_REGISTRY_OVERRIDE: "images.crewai.com"
  AUTOMATION_ECR_REPOSITORY_PREFIX: "" # Auto-generates to "proxy/crewai/crewai/"
  AUTOMATION_BASE_IMAGE_NAME: "crewai-enterprise-preinstalled-v2:latest"

Results in: images.crewai.com/proxy/crewai/crewai/crewai-enterprise-preinstalled-v2:latestExample - With imageNamePrefixOverride:

global:
  imageRegistry: "123456789012.dkr.ecr.us-west-2.amazonaws.com"
  imageNamePrefixOverride: "crewai/"

envVars:
  AUTOMATION_BASE_IMAGE_REGISTRY_OVERRIDE: "" # Auto-generates to imageRegistry
  AUTOMATION_ECR_REPOSITORY_PREFIX: "" # Auto-generates to "crewai/"
  AUTOMATION_BASE_IMAGE_NAME: "crewai-enterprise-preinstalled-v2:latest"

Results in: 123456789012.dkr.ecr.us-west-2.amazonaws.com/crewai/crewai-enterprise-preinstalled-v2:latestWhen to Override:

Custom path structure not covered by imageNamePrefixOverride
Different prefix for automation images vs. platform images
Migration from one naming scheme to another

Automatic Generation: This value is automatically generated by the chart’s template logic when not explicitly set.Use Cases:

Aligning with Replicated proxy path structure for consistency
Multi-tenant registry organization
Namespace separation in shared registries
Compliance with corporate naming conventions
Maintaining path structure consistency with proxy registries
Simplified paths when using imageNamePrefixOverride

Leave Empty: To use auto-generated value (recommended for most deployments).

envVars.AUTOMATION_BASE_IMAGE_NAME

string

default:"crewai-enterprise-preinstalled-v2:latest"

Base image name used for building crew containers.Purpose: Specifies the foundational image containing CrewAI dependencies and runtime.Default: "crewai-enterprise-preinstalled-v2:latest"Format: <image-name>:<tag>When to Change:

Using custom base image with additional dependencies
Pinning to specific version for consistency
Testing new base image versions

Example - Version Pinning:

envVars:
  AUTOMATION_BASE_IMAGE_NAME: "crewai-enterprise-preinstalled-v2:0.9.9"

Note: The base image must be accessible from the configured registry and contain all required CrewAI runtime dependencies.

Storage Configuration

envVars.STORAGE_SERVICE

string

default:""

File storage backend service.Required: Yes (unless using MinIO)Valid Values:

"amazon" - Amazon S3 or S3-compatible storage
"microsoft" - Azure Blob Storage

When Using amazon:

Requires envVars.AWS_REGION
Requires envVars.AWS_BUCKET
Requires secrets.AWS_ACCESS_KEY_ID and secrets.AWS_SECRET_ACCESS_KEY (or IRSA)
Optional envVars.AWS_ENDPOINT for S3-compatible services

When Using microsoft:

Requires envVars.AZURE_STORAGE_ACCOUNT_NAME
Requires secrets.AZURE_STORAGE_ACCESS_KEY

envVars.AWS_ENDPOINT

string

default:""

S3-compatible storage endpoint URL.When to Set:

Using MinIO: "http://crewai-minio:9000"
Using Wasabi: "https://s3.wasabisys.com"
Using DigitalOcean Spaces: "https://nyc3.digitaloceanspaces.com"

When to Leave Empty:

Using AWS S3 (uses regional endpoint automatically)

envVars.AWS_REGION

string

default:""

AWS region for S3 bucket.Examples: "us-west-2", "eu-central-1", "ap-southeast-1"Required For: STORAGE_SERVICE: amazon

envVars.AWS_BUCKET

string

default:""

S3 bucket name for file storage.Examples: "crewai-prod-storage", "company-crewai-files"Required For: STORAGE_SERVICE: amazon

envVars.AZURE_STORAGE_ACCOUNT_NAME

string

default:""

Azure Storage account name.Required For: STORAGE_SERVICE: microsoft

Built-in LLM Configuration

envVars.BUILT_IN_LLM_PROVIDER

string

default:"openai"

LLM provider for built-in platform AI features.Purpose: Specifies which LLM provider to use for internal platform features such as:

Improving Studio prompts
Generating automation descriptions
Chatting with flows
Other AI-assisted platform capabilities

Valid Values:

"openai" - OpenAI provider (GPT models)
"anthropic" - Anthropic provider (Claude models)

Requirements:

Requires secrets.BUILT_IN_LLM_API_KEY to be set with a valid API key for the chosen provider
Requires envVars.BUILT_IN_LLM_MODEL to be set with a supported model for the provider

Example:

envVars:
  BUILT_IN_LLM_PROVIDER: "openai"
  BUILT_IN_LLM_MODEL: "gpt-4o-mini"

secrets:
  BUILT_IN_LLM_API_KEY: "sk-proj-abc123..."

envVars.BUILT_IN_LLM_MODEL

string

default:"gpt-4.1-mini"

Model name for built-in LLM provider.Purpose: Specifies which model to use for internal platform AI features.OpenAI Models (BUILT_IN_LLM_PROVIDER: “openai”):

"gpt-4o-mini" - Recommended for most use cases (cost-effective, fast)
"gpt-4o" - More capable, higher cost
"gpt-4-turbo" - Previous generation flagship
"gpt-3.5-turbo" - Older, budget option

Anthropic Models (BUILT_IN_LLM_PROVIDER: “anthropic”):

"claude-3-5-sonnet-20241022" - Latest Sonnet model (recommended)
"claude-3-5-haiku-20241022" - Fast and cost-effective
"claude-3-opus-20240229" - Most capable (higher cost)

Considerations:

Balance cost vs. capability based on your usage patterns
Internal platform features typically work well with smaller, faster models
Larger models may provide better results for complex prompt improvements

Example:

envVars:
  BUILT_IN_LLM_PROVIDER: "anthropic"
  BUILT_IN_LLM_MODEL: "claude-3-5-sonnet-20241022"

secrets:
  BUILT_IN_LLM_API_KEY: "sk-ant-abc123..."

Database Configuration

envVars.DB_HOST

string

default:""

PostgreSQL database hostname or IP address.Auto-Override: When postgres.enabled: true, this value is automatically overridden to the internal PostgreSQL service name (<fullname>-postgres).Required For: External database (postgres.enabled: false)Examples:

AWS RDS: "crewai-prod.cluster-abc.us-west-2.rds.amazonaws.com"
Azure Database: "crewai-prod.postgres.database.azure.com"
Google Cloud SQL: "10.1.2.3" (via Cloud SQL proxy)

envVars.DB_PORT

string

default:"5432"

PostgreSQL database port.Standard: "5432" (PostgreSQL default)

envVars.DB_USER

string

default:"postgres"

PostgreSQL username.Recommendation: Use a dedicated database user (not postgres superuser) for production.

envVars.POSTGRES_DB

string

default:"crewai_plus_production"

PostgreSQL main database name.Purpose: Primary database for application data, schema migrations, and business logic.Must Match: Database created during PostgreSQL initialization.

envVars.POSTGRES_CABLE_DB

string

default:"crewai_plus_cable_production"

PostgreSQL database name for ActionCable (WebSocket connections).Purpose: Separate database for real-time WebSocket communication and pub/sub messaging.Must Match: Cable database created during PostgreSQL initialization.Note: ActionCable uses a separate database to isolate real-time communication from main application data.

envVars.POSTGRES_OAUTH_DB

string

default:"oauth_db"

PostgreSQL database name for the Built-in Integrations service.Purpose: Separate database for storing encrypted OAuth tokens for third-party integrations (Gmail, Google Calendar, Microsoft Outlook, etc.).Default: "oauth_db" - Only used when postgres.enabled: false and oauth.enabled: true.Behavior:

When postgres.enabled: true: Uses postgres.oauthDatabase value (database is auto-created)
When postgres.enabled: false: Uses this value for connecting to the external database

External Database Setup:When using an external database, you must manually create the database before deploying:

CREATE DATABASE oauth_db;

Example with External Database:

postgres:
  enabled: false

envVars:
  DB_HOST: "crewai-prod.cluster-xyz.rds.amazonaws.com"
  DB_PORT: "5432"
  DB_USER: "crewai"
  POSTGRES_DB: "crewai_plus_production"
  POSTGRES_CABLE_DB: "crewai_plus_cable_production"
  POSTGRES_OAUTH_DB: "oauth_db"

secrets:
  DB_PASSWORD: "your-password"

oauth:
  enabled: true

Note: The Built-in Integrations service uses its own database separate from the main CrewAI application database for security isolation. All database connections use the same DB_HOST, DB_PORT, DB_USER, and DB_PASSWORD configuration.

envVars.SKIP_DB_MIGRATIONS

string

default:"true"

Skip database migrations during application startup.Default: "true"Purpose: Database migrations are handled by a dedicated pre-upgrade Helm hook job (helm/templates/jobs/pre-upgrade-migration.yaml:1) that runs before each upgrade, ensuring migrations complete successfully before the application starts.Migration Strategy:

Pre-upgrade hook runs rails db:migrate before deployment
Pre-upgrade hook runs rails db:migrate:cable for Action Cable database
Hook waits for PostgreSQL availability (when using internal PostgreSQL)
Hook has 3 retry attempts on failure
Application pods skip migrations to prevent race conditions

When to Change to “false”:

Custom deployment workflows that don’t use Helm upgrades
Manual migration management outside of Helm
Debugging migration issues

Warning: Setting to "false" can cause race conditions if multiple pods attempt migrations simultaneously. The pre-upgrade hook pattern ensures single-execution migration runs.Example - Disable Migration Hook:

envVars:
  SKIP_DB_MIGRATIONS: "false"

Related Configuration: migrationJob.nodeSelector (docs/reference/chart-values/reference.mdx:258) - Configure node placement for migration jobs.

Whitelabeling Configuration

envVars.PLATFORM_SHORT_NAME

string

default:""

Short name for platform branding customization.Purpose: Customize the platform’s short name displayed throughout the user interface for whitelabeling purposes.Default: "" (empty) - Uses default “CrewAI” brandingWhen to Set:

Whitelabeling the platform with your company or product name
Creating a branded experience for end users
Partner or reseller deployments

Examples:

"Acme" - Short company name
"MyPlatform" - Product short name
"" - Use default branding

Note: This appears in locations where space is limited (navigation bars, headers, etc.).Leave Empty: To use default CrewAI branding.

envVars.PLATFORM_NAME

string

default:""

Full display name for platform branding customization.Purpose: Customize the platform’s full display name shown throughout the user interface for whitelabeling purposes.Default: "" (empty) - Uses default “CrewAI Platform” brandingWhen to Set:

Whitelabeling the platform with your company or product name
Creating a branded experience for end users
Partner or reseller deployments

Examples:

"Acme AI Platform" - Full branded name
"MyCompany Automation Platform" - Custom product name
"" - Use default branding

Note: This appears in page titles, documentation references, and other locations where the full platform name is displayed.Best Practice: Use in combination with PLATFORM_SHORT_NAME for consistent branding across the interface.Leave Empty: To use default CrewAI Platform branding.

Concurrency Settings

envVars.RAILS_MAX_THREADS

integer

Maximum threads per Rails process.Default: Commented out (uses Rails default of 5)Tuning:

Lower (2-3): Reduce memory usage, lower concurrency
Higher (10-15): Increase concurrency, higher memory usage

Note: Must balance with database connection pool size.

envVars.WEB_CONCURRENCY

integer

Number of Puma worker processes.Default: Commented out (auto-calculated based on available CPU cores)Tuning:

Single-core containers: 1
Multi-core containers: 2-4

Memory Impact: Each worker process consumes full memory footprint. Total memory = WEB_CONCURRENCY x per-worker memory.

envVars.WORKER_TIMEOUT

integer

Background job timeout in seconds.Default: Commented out (60 seconds)Adjust For:

Long-running jobs: Increase timeout
Quick jobs: Keep default or lower

envVars.WORKER_BOOT_TIMEOUT

integer

Worker process boot timeout in seconds.Default: Commented out (120 seconds)Increase If: Workers fail to start within default timeout.

GitHub Configuration

envVars.GITHUB_USER

string

default:"joaomdmoura"

GitHub username or organization for repository access.Auto-Populated: From Replicated license fieldPurpose: Required to pull crewai enterprise repositories.

envVars.GITHUB_CLIENT_ID

string

default:""

GitHub OAuth application client ID.Required For: GitHub OAuth authentication.

envVars.GITHUB_APP_URL

string

default:""

GitHub App installation URL.

envVars.GITHUB_APP_ID

string

default:""

GitHub App ID.

Installation

Configuration

Cloud Providers

Operations

Feature Guides

Reference

Application Configuration

CrewAI Built-in Integration

Authentication Configuration

Okta Configuration

Entra ID Configuration

WorkOS Configuration

Keycloak Configuration

Crew Deployment Configuration

Container Registry Configuration

Storage Configuration

Built-in LLM Configuration

Database Configuration

Whitelabeling Configuration

Concurrency Settings

GitHub Configuration

Installation

Configuration

Cloud Providers

Operations

Feature Guides

Reference

​Application Configuration

​CrewAI Built-in Integration

​Authentication Configuration

​Okta Configuration

​Entra ID Configuration

​WorkOS Configuration

​Keycloak Configuration

​Crew Deployment Configuration

​Container Registry Configuration

​Storage Configuration

​Built-in LLM Configuration

​Database Configuration

​Whitelabeling Configuration

​Concurrency Settings

​GitHub Configuration

Application Configuration

CrewAI Built-in Integration

Authentication Configuration

Okta Configuration

Entra ID Configuration

WorkOS Configuration

Keycloak Configuration

Crew Deployment Configuration

Container Registry Configuration

Storage Configuration

Built-in LLM Configuration

Database Configuration

Whitelabeling Configuration

Concurrency Settings

GitHub Configuration