Concatenate platformEnvVars ahead of extraEnvVars

braintrust/ci/values-google.yaml

@@ -42,7 +42,9 @@ api:
   backfillDisableNonhistorical: false
   allowInvalidBase64: false
   nodeMemoryPercent: "80"
-  extraEnvVars: []
+  extraEnvVars:
+    - name: AWS_REGION
+      value: "us-central1"
   nodeSelector: {}
   tolerations: []
   affinity: {}

braintrust/templates/_api-deployment.tpl

@@ -231,6 +231,9 @@ spec:
             - name: PIP_CERT
               value: {{ $customCAPath | quote }}
             {{- end }}
+            {{- with $api.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
             {{- with $api.extraEnvVars }}
             {{- toYaml . | nindent 12 }}
             {{- end }}

braintrust/templates/_helpers.tpl

@@ -65,16 +65,23 @@ http://{{ .Values.api.service.name | default .Values.api.name }}.{{ include "bra
 
 {{/*
 Build one API pool from the shared api values plus pool-specific overrides.
-Pool extraEnvVars are appended so shared provider configuration is retained.
+Pool platformEnvVars and extraEnvVars are appended so shared provider
+configuration is retained. platformEnvVars stay ahead of extraEnvVars.
+The kubelet keeps the last duplicate env name, so a user extraEnvVars
+entry overrides a platformEnvVars entry of the same name.
 */}}
 {{- define "braintrust.apiPoolConfig" -}}
 {{- $base := deepCopy .root.Values.api -}}
 {{- $_ := unset $base "workloadIsolation" -}}
 {{- $overrides := deepCopy (.overrides | default dict) -}}
+{{- $basePlatformEnvVars := get $base "platformEnvVars" | default (list) -}}
+{{- $poolPlatformEnvVars := get $overrides "platformEnvVars" | default (list) -}}
+{{- $_ := unset $overrides "platformEnvVars" -}}
 {{- $baseExtraEnvVars := get $base "extraEnvVars" | default (list) -}}
 {{- $poolExtraEnvVars := get $overrides "extraEnvVars" | default (list) -}}
 {{- $_ := unset $overrides "extraEnvVars" -}}
 {{- $pool := mergeOverwrite $base $overrides -}}
+{{- $_ := set $pool "platformEnvVars" (concat $basePlatformEnvVars $poolPlatformEnvVars) -}}
 {{- $_ := set $pool "extraEnvVars" (concat $baseExtraEnvVars $poolExtraEnvVars) -}}
 {{- toYaml $pool -}}
 {{- end -}}
@@ -238,6 +245,7 @@ ephemeralStorage:
 tmpVolume:
   enabled: false
   sizeLimit: ""
+platformEnvVars: []
 extraEnvVars: []
 nodeSelector: {}
 tolerations: []

braintrust/templates/ai-gateway-deployment.yaml

@@ -83,8 +83,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: BRAINSTORE_LICENSE_KEY
-            {{- if .Values.aiGateway.extraEnvVars }}
-            {{- toYaml .Values.aiGateway.extraEnvVars | nindent 12 }}
+            {{- with .Values.aiGateway.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.aiGateway.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
       {{- with .Values.aiGateway.extraContainers }}
       {{- toYaml . | nindent 8 }}

braintrust/templates/api-configmap.yaml

@@ -1,13 +1,29 @@
 {{- $orgName := .Values.global.orgName | default "" | toString | trim -}}
 {{- $primaryOrgName := .Values.global.primaryOrgName | default "" | toString | trim -}}
-{{- $hasPrimaryOrgNameExtraEnv := false -}}
-{{- range .Values.api.extraEnvVars -}}
-{{- if eq (.name | default "" | toString) "PRIMARY_ORG_NAME" -}}
-{{- $hasPrimaryOrgNameExtraEnv = true -}}
+{{- $apiEnvVars := concat (.Values.api.platformEnvVars | default (list)) (.Values.api.extraEnvVars | default (list)) -}}
+{{- $hasPrimaryOrgNameEnv := false -}}
+{{- $hasAwsRegionEnv := false -}}
+{{- range $apiEnvVars -}}
+{{- $envName := .name | default "" | toString | trim -}}
+{{- if eq $envName "PRIMARY_ORG_NAME" -}}
+{{- $hasPrimaryOrgNameEnv = true -}}
 {{- end -}}
+{{- if eq $envName "AWS_REGION" -}}
+{{- /* Last duplicate wins, matching kubelet env precedence. A later blank literal clears an earlier region. valueFrom is accepted without inspecting the secret. */ -}}
+{{- if .valueFrom -}}
+{{- $hasAwsRegionEnv = true -}}
+{{- else if ne (.value | default "" | toString | trim) "" -}}
+{{- $hasAwsRegionEnv = true -}}
+{{- else -}}
+{{- $hasAwsRegionEnv = false -}}
 {{- end -}}
-{{- if and (or (eq $orgName "") (eq $orgName "*")) (eq $primaryOrgName "") (not $hasPrimaryOrgNameExtraEnv) -}}
-{{- fail "global.primaryOrgName or api.extraEnvVars PRIMARY_ORG_NAME is required when global.orgName is empty or \"*\"; self-hosted service-token management needs a primary organization." -}}
+{{- end -}}
+{{- end -}}
+{{- if and (or (eq $orgName "") (eq $orgName "*")) (eq $primaryOrgName "") (not $hasPrimaryOrgNameEnv) -}}
+{{- fail "global.primaryOrgName or PRIMARY_ORG_NAME in api.platformEnvVars or api.extraEnvVars is required when global.orgName is empty or \"*\"; self-hosted service-token management needs a primary organization." -}}
+{{- end -}}
+{{- if and (eq (.Values.cloud | default "") "google") (not .Values.api.enableGcsAuth) (not $hasAwsRegionEnv) -}}
+{{- fail "api.platformEnvVars or api.extraEnvVars AWS_REGION is required when cloud is google and api.enableGcsAuth is false; S3-compatible GCS needs a region." -}}
 {{- end -}}
 {{- $allowedOrgIds := .Values.global.allowedOrgIds | default "" | toString | trim -}}
 {{- $btqlStrictOrgIds := .Values.btqlAuditLogsStrictOrgIds | default list -}}

braintrust/templates/brainstore-automationwriter-deployment.yaml

@@ -157,8 +157,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: FUNCTION_SECRET_KEY
-            {{- if $aw.extraEnvVars }}
-            {{- toYaml $aw.extraEnvVars | nindent 12 }}
+            {{- with $aw.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with $aw.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
           volumeMounts:
             - name: cache-volume

braintrust/templates/brainstore-fastreader-deployment.yaml

@@ -142,8 +142,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: FUNCTION_SECRET_KEY
-            {{- if .Values.brainstore.fastreader.extraEnvVars }}
-            {{- toYaml .Values.brainstore.fastreader.extraEnvVars | nindent 12 }}
+            {{- with .Values.brainstore.fastreader.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.brainstore.fastreader.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
           volumeMounts:
             - name: cache-volume

braintrust/templates/brainstore-reader-deployment.yaml

@@ -142,8 +142,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: FUNCTION_SECRET_KEY
-            {{- if .Values.brainstore.reader.extraEnvVars }}
-            {{- toYaml .Values.brainstore.reader.extraEnvVars | nindent 12 }}
+            {{- with .Values.brainstore.reader.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.brainstore.reader.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
           volumeMounts:
             - name: cache-volume

braintrust/templates/brainstore-writer-deployment.yaml

@@ -142,8 +142,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: FUNCTION_SECRET_KEY
-            {{- if .Values.brainstore.writer.extraEnvVars }}
-            {{- toYaml .Values.brainstore.writer.extraEnvVars | nindent 12 }}
+            {{- with .Values.brainstore.writer.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.brainstore.writer.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
           volumeMounts:
             - name: cache-volume

braintrust/tests/__fixtures__/google-values.yaml

@@ -11,6 +11,11 @@ objectStorage:
     brainstoreBucket: "test-brainstore-bucket"
     apiBucket: "test-api-bucket"
 
+api:
+  extraEnvVars:
+    - name: AWS_REGION
+      value: "us-central1"
+
 brainstore:
   serviceAccount:
     googleServiceAccount: "test@project.iam.gserviceaccount.com"

braintrust/tests/api-autoscaling_test.yaml

@@ -14,6 +14,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: false
     release:
       namespace: "braintrust"
@@ -27,6 +30,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: false
     release:
       namespace: "braintrust"
@@ -53,6 +59,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
     release:
       namespace: "braintrust"
@@ -96,6 +105,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
     release:
       namespace: "braintrust"
@@ -157,6 +169,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.replicas: 4
     release:
@@ -184,6 +199,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.extraEnvVars:
         - name: ENABLE_PROMETHEUS_METRICS
@@ -206,6 +224,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: false
       api.replicas: 4
     release:
@@ -230,6 +251,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -244,6 +268,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -268,6 +295,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -295,6 +325,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -319,6 +352,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -340,6 +376,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -362,6 +401,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
       api.workloadIsolation.ingest.autoscaling.enabled: false
@@ -382,6 +424,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
       api.workloadIsolation.ingest.autoscaling.enabled: false
@@ -397,6 +442,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
       api.workloadIsolation.ingest.autoscaling.enabled: false
@@ -422,6 +470,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
       api.workloadIsolation.ingest.autoscaling.enabled: false