Configuration

Configure the LangCache Data Plane, Control Plane, and Identity Service through Helm values and config overlay Secrets.

The langcache chart splits configuration into two layers for the Data Plane, the Control Plane, and (in bundled mode) the Identity Service:

• Non-secret structure, set as Helm values (dataplane.configData, controlplane.configData, identityService.bundled.configData) and rendered into a ConfigMap by default.
• Redis URLs, the database registry, and the embedding credential, which never go in values.yaml or a rendered ConfigMap. Each component reads its own pre-created overlay Secret, deep-merged over its rendered base config at container startup. The chart passes each overlay as an additional --config flag, so later files win.

You always create the overlay Secrets yourself; the chart only tells each component where to mount and read them.

Data Plane overlay

Create dp-overlay.yaml. Provide Metadata Redis and, when dataplane.embedding.credentials.type: static, the embedding credential. The Data Plane has no database registry of its own — it resolves each cache's Cache Redis target from the databaseUrls the Control Plane already persisted in Metadata Redis at cache-creation time.

metadata:
  urls:
    - rediss://default:<password>@metadata-redis:6380

embedding:
  credentials:
    api_key: "<embedding-api-key>"

kubectl -n <namespace-name> create secret generic dp-overlay \
  --from-file=overlay.yaml=./dp-overlay.yaml

Point the chart at it, alongside the public (non-secret) embedding facts:

dataplane:
  secrets:
    secretName: dp-overlay
  embedding:
    provider: openai
    endpoint:
      baseURL: https://api.openai.com/v1
    credentials:
      type: static
    models:
      defaultEmbeddingModel: text-embedding-3-small
      dimensions: 1536

Control Plane overlay

Create cp-overlay.yaml. Provide the same Metadata Redis as the Data Plane, plus the databases registry — one entry per Cache Redis target, keyed by a logical ID you choose. The Control Plane never receives an embedding credential; it only needs the public provider/model/dimensions contract that the chart renders from dataplane.embedding.*.

metadata:
  urls:
    - rediss://default:<password>@metadata-redis:6380

databases:
  cache-primary:
    name: cache-primary
    urls:
      - rediss://default:<password>@cache-primary:6380

kubectl -n <namespace-name> create secret generic cp-overlay \
  --from-file=overlay.yaml=./cp-overlay.yaml

controlplane:
  secrets:
    secretName: cp-overlay
  configData:
    profile: prod

The databases map must use the same logical IDs your operators will pass as databaseId when creating caches through the Control Plane API. The chart derives the Control Plane's embedders config from dataplane.embedding.provider and dataplane.embedding.models.*. On-prem cache creation uses that single provider/model/dimensions contract and does not accept per-cache embedding credentials.

Identity Service metadata (bundled mode only)

When identityService.mode: bundled is set, the bundled Identity Service needs its own Metadata Redis connection. This connection can be the same Redis instance as the Control Plane's Metadata Redis, in a separate namespace.

metadata:
  urls:
    - rediss://default:<password>@metadata-redis:6380

kubectl -n <namespace-name> create secret generic ids-metadata \
  --from-file=metadata.yaml=./ids-metadata.yaml

identityService:
  mode: bundled
  bundled:
    metadata:
      existingSecret: ids-metadata

If you use identityService.mode: external instead, there is no Identity Service overlay to create here; see Authentication and authorization.

Multiple overlay Secrets

dataplane.secrets.additionalSecrets and controlplane.secrets.additionalSecrets accept a list of extra pre-created Secret names, layered in order after the primary overlay (later wins). Use this to split, for example, Redis connection details from the embedding credential across separately rotated Secrets.

Treat overlay content as sensitive

Store dp-overlay.yaml, cp-overlay.yaml, and ids-metadata.yaml outside your values files and outside git, the same as any other credential material.

Next steps

With your overlay Secrets and values ready, continue to Deploy self-managed LangCache.