Configuration

Most Centaur settings come from Helm values and are rendered into service environment variables by service-specific templates under contrib/chart/templates/.

Use these as the main extension points:

Tool credentials are not listed here. Tool plugins declare their own secrets in tools/**/pyproject.toml; Centaur resolves them through secret(...) and iron-proxy instead of treating them as global platform configuration.

Required

These must exist for the normal Helm deployment. For local development, just bootstrap-secrets creates centaur-infra-env from your shell.

Optional required-by-mode variables:

Console and Permission Control Plane

The Console stores principals, roles, grants, sandbox capabilities, and encrypted secret-source configuration. The chart renders its internal URL and admin API key into api-rs. See Advanced Permissioning for the operator workflow.

Default roles and default sandbox capabilities are stored in the Console, not as Helm values. Configure them in System Settings before new principals are created. Changing a default does not rewrite existing principals.

API

API-RS

Sandbox lifecycle:

There is no separate suspended-only delete timer. Pausing is controlled by the per-execution idle timeout; deletion is controlled by sandbox max lifetime.

Execution tuning:

Slackbot

Teamsbot

Sandbox

API-set variables:

Kubernetes backend:

Sandbox entrypoint and wrappers:

Workflows

Slack ETL workflows:

The bundled PostgreSQL image provides pgvector. External PostgreSQL deployments must make the vector extension available before migrations run. The workflow uses the shared Python workflow-host database connection, OpenAI credential, and OPENAI_BASE_URL. No workflow-specific PostgreSQL role or DSN is required. The database migration creates the embedding column as vector(1536). Before using another dimension, migrate that column and rebuild its HNSW index, then re-embed the stored documents. Changing the chart value does not alter the database schema.

Google Workspace ETL workflows:

Linear ETL workflows:

Observability and Retention

Stdout Event Retention

Retention is disabled by default. Its index is installed separately from API-RS startup migrations, so an index build failure does not prevent the API from starting. Create the index before enabling retention.

Connect psql to the application database with an account that owns session_events. Use your normal libpq connection settings and credential file. From the repository root, run:

psql -X --set ON_ERROR_STOP=1 \
  --file services/api-rs/crates/centaur-session-sqlx/manual-migrations/session_events_retention_index.sql

The script creates a partial index concurrently. Run it outside a transaction; do not use psql --single-transaction. Ordinary reads and writes can continue, but the build adds database load and can wait for existing transactions.

Verify the index after the command succeeds:

SELECT indexrelid::regclass AS index_name, indisvalid, indisready, indislive
FROM pg_catalog.pg_index
WHERE indexrelid = to_regclass('session_events_stdout_created_at_idx')
  AND indrelid = 'session_events'::regclass;

Expect one row with all three flags set to true. Then set apiRs.sessionEventsRetentionDays or SESSION_EVENTS_RETENTION_DAYS to a value from 1 through 3650. An execution's stdout becomes eligible after its completion time passes the retention cutoff. Deletions remain batched, so a large backlog can take several sweeps to drain.

If a build fails, inspect the index before retrying. No row means the index is absent and the creation script can be retried after addressing the failure. If the index exists but is invalid, repair it outside a transaction:

REINDEX INDEX CONCURRENTLY session_events_stdout_created_at_idx;

Verify the flags again after repair. The creation script deliberately fails if the name already exists, so a retry cannot silently accept an invalid index. An already valid index does not need to be recreated.

Each retention sweep checks the index. If it is missing or invalid, the worker logs session_events_retention_skipped and deletes nothing. API-RS stays available. After the index is repaired, the next sweep can proceed without another restart. Setting retention back to 0 disables the worker.

Local Scripts