Skip to main content
EigenPal reads process settings from environment variables and model connections from eigenpal.config.yaml. Helm mounts the YAML file and supplies environment variables to each workload.

​
Add a model

Add this to your Helm values. Replace the model and endpoint with values your gateway supports:
configEnv reaches both app and worker. Use app.extraEnv or worker.extraEnv for a setting that belongs to one process. Use a dedicated chart key when one exists. The first model assigned to a role is its default. Assign only roles the model supports. Scanned documents need an OCR or vision provider too; see model fields.

​
Keep secrets and access local

Store credentials in Kubernetes Secrets or your secrets manager. Configure API keys, webhook endpoints, email servers, groups and sharing in Studio, separately for each environment. Keep EIGENPAL_SECRETS_WRAPPING_KEY stable and identical on app and worker. It must decode to 32 bytes in base64url format. Back it up with the database: changing it can make stored integration credentials unreadable. Restart affected pods after changing process settings, provider YAML or mounted credentials.

​
Configuration details

Set EIGENPAL_CONFIG_PATH to the mounted YAML file. Without it, the loader searches the working directory, config/ and parent directories. The chart supplies an explicit path.${VARIABLE_NAME} interpolates an environment variable within a YAML string. Shell syntax such as ${NAME:-default} is unsupported. Supply every referenced variable.Overrides depend on the setting:
  • S3_REGION, S3_ACCESS_KEY and S3_SECRET_KEY override their AWS_* fallbacks.
  • EIGENPAL_MULTIPART_MAX_BYTES overrides deployment.multipartMaxBytes; none, null and unlimited keep transfers on the app server.
  • EIGENPAL_ARCHIVE_MAX_BYTES overrides deployment.archiveMaxBytes.
  • Provider environment variables supply credentials; models still need registry entries.
Use the Helm reference for chart defaults and the environment reference for process defaults.
Roles are workflowStep, workflowBuilder, agentInference, agentTraining, judge, vision and ocr. OCR entries use kind: ocr; LLM entries cannot take the ocr role. Model IDs must be unique. capabilityRank sorts the picker without changing role defaults.deployment.parsing.ocrProvider and visionProvider select model IDs. allowedProviders also contains model IDs, despite its name. Provider credentials, timeouts and supported fields are in the YAML reference.
Add this under config, and expose the credentials through configEnv. A connection in YAML is read-only in Studio. Omit it to manage that connection in Studio instead.Configure the same connection name in each environment that runs the workflow, with local endpoints and credentials. Promotion checks that the connection exists and leaves its credentials local.S3-compatible storage, Azure Blob and GPFS/GFR have provider-specific fields. GPFS also requires FILE_SOURCE_INTEGRATIONS=gpfs on app and worker.
EIGENPAL_DIRECT_FILE_UPLOADS=true enables storage-direct transfers. Configure bucket CORS and EIGENPAL_BROWSER_STORAGE_ORIGINS for browser access. The origin setting does not configure CORS on the bucket.The chart sets deployment.multipartMaxBytes: null. Without a chart or environment override, the app falls back to 4.5 MiB. The archive fallback is 5 GiB. EIGENPAL_REUSABLE_FILES_MAX_BYTES=0 disables the reusable-file quota; upload and archive limits still apply.Limits ending in BYTES use bytes; timeouts ending in MS use milliseconds. Database timeouts use seconds. Kubernetes resources use units such as Mi, Gi and millicores.