docs(langflow): rewrite for v1.10.2 community chart (chart-wrap)#805
Merged
Conversation
Starting with Langflow v1.10.1 the platform ships an OLM OperatorBundle (chart-wrap of the upstream langflow-ai/langflow-helm-charts/langflow-ide chart) instead of a bespoke Alauda fork chart (aml/langflow v1.6.4). The config surface changed accordingly: - Install path: OperatorHub + Langflow custom resource, not Applications / Catalog form - Values paths shift: `langflow.foo` -> `spec.langflow.backend.foo` (wrap CR spec mirrors the upstream chart's values.yaml) - SQLite volume: `langflow.sqlite.volume.storageClassName` becomes `spec.langflow.backend.sqlite.volume.existingStorageClassName`, with the magic string `"default"` meaning "use cluster-default SC" - External DB: `langflow.externalDatabase` becomes `spec.langflow.backend.externalDatabase`; startup shim rewrites LANGFLOW_DATABASE_URL from the LF_CHART_EXTERNALDB_* env vars - Auth: the upstream chart has no structured `auth.enabled` block; use backend env vars (LANGFLOW_AUTO_LOGIN, LANGFLOW_SUPERUSER, LANGFLOW_SUPERUSER_PASSWORD, ...) instead - OAuth2 Proxy: not part of the upstream chart. Section removed; SSO now documented as "deploy an external OAuth2 Proxy in front of the Langflow Service" — same pattern as other chart-wrap components - External access: Gateway API (Envoy Gateway + HTTPRoute) is the recommended path; upstream chart Ingress is documented as fallback Prerequisites section added: cluster must have a default StorageClass (the chart's `sqlite.volume.existingStorageClassName: "default"` magic string relies on it). Every parameter in this rewrite was validated end-to-end on ACP 4.3 (business-1) against a real langflow-operator.v1.10.1-rc.8 install: - SQLite storage on default SC (sc-topolvm): rc.8 e2e smoke - Gateway API external access: rc.8 e2e smoke E probe (Envoy Gateway, NodePort 32423, hits /health_check successfully) - Runtime mode (backendOnly + frontend.enabled=false): dedicated probe I — frontend Deployment count 0, backend still serves - Flow CRUD (POST/GET/DELETE): smoke F probe on rc.8 - API key gate (create + valid=200 + wrong=403): smoke H probe on rc.8 - External PostgreSQL: fresh langflow-pg ns install; verified LANGFLOW_DATABASE_URL rewritten via chart shim, `/data/langflow.db` absent, 33 flows written into PostgreSQL, full Langflow schema created via Alembic - Auth env vars (AUTO_LOGIN=false + SUPERUSER creds): 403/200/401/ 200/403 probe on fresh langflow-auth ns - Global variables (LANGFLOW_VARIABLES_TO_GET_FROM_ENVIRONMENT + plain env + secretKeyRef): GET /api/v1/variables/ returns both entries as type: Credential Both zh and en versions updated in parallel.
…Ingress
Reviewer asked for every parameter to be verified against a live install
before it lands in the doc. Ran a fresh langflow-batch install on
business-1 (ACP 4.3) exercising the full Production Recommendations
surface at once:
- §5.3 numWorkers=2 → LANGFLOW_NUM_WORKERS=2 env set correctly
- §5.4 resources → pod containers[0].resources matches CR (requests
cpu:500m/mem:1Gi, limits cpu:2/mem:4Gi)
- §5.1 DO_NOT_TRACK=true → env visible in container
- §5.2 LANGFLOW_TRANSACTIONS_STORAGE_ENABLED=false → /monitor/transactions
returns {"items":[],"total":0}
- ConfigMap flow auto-import via LANGFLOW_LOAD_FLOWS_PATH → after backend
restart, GET /api/v1/flows returns 34 (33 starter + 1 imported
hello-world)
- Python deps via PVC + PYTHONPATH → env set, /opt/python-packages
mounted writable
Also caught a real trap during validation and made it a top-level warning
in Configuration section: `spec.langflow.backend.volumes` (and
volumeMounts) REPLACE the chart-default emptyDirs (tmp/data/db/flows)
instead of appending. Adding a custom volume without re-declaring the
defaults crashes the backend at startup:
FileNotFoundError: [Errno 2] No usable temporary directory found in
['/tmp', '/var/tmp', '/usr/tmp', '/app']
(Langflow's entrypoint imports dill, which calls tempfile.gettempdir();
readOnlyRootFilesystem: true means /tmp must be a writable volume.)
Every sample YAML that customizes volumes/volumeMounts (ConfigMap flow
import, local models, Python deps, runtime mode) now includes the four
required chart-default entries as boilerplate. This trap was caught live
on ACP 4.3.
Per reviewer feedback:
- Delete Chinese doc (auto-translated, we only maintain English).
- Delete Ingress content (platform standardises on Gateway API for chart-
wrap components; Ingress is not the supported external-access path).
- Delete SSO section entirely (upstream chart has no OAuth2 Proxy; users
needing SSO should deploy their own gateway outside the wrap).
Filename verified against real GA artifacts:
langflow-operator.alpha.ALL.v1.10.1.tgz
matches minio://packages/langflow-operator/v1.10/ path.
Reviewer feedback: 1. Prerequisites section removed. The default-StorageClass requirement is already documented under §1.1 Configure SQLite Storage (via the `existingStorageClassName: "default"` magic string). No need to warn about it twice. 2. External access section (§3) now inlines the complete EnvoyProxy + Gateway YAML alongside the HTTPRoute. Previously it referenced an example file in an internal repo — end-user docs shouldn't leak platform-internal paths. The 3-object bundle is now self-contained and copy-pasteable. 3. Terminology scrub. Removed all occurrences of "chart-wrap", "wrap CR", "upstream chart", "community chart", and the repo path `components/langflow/examples/...`. The doc talks about the `Langflow` custom resource without exposing how the package is assembled.
The previous verification step listed HTTP status codes (403/200/401 on /auto_login, /login, /all) which is what an operator would probe with curl during development. End users following the doc reported that after setting the auth env vars, "the page still went straight into the IDE" — because their browser had cookies from a previous auto-login session, and Langflow's JWTs stay valid until expiration regardless of the current LANGFLOW_AUTO_LOGIN setting. Replace the status-code checklist with browser steps: 1. Open in Incognito (or clear the 3 lf cookies). 2. Expect to see a login form, not the IDE. 3. Log in with the superuser credentials. Also fix the token-expiration defaults note (upstream is 30d/60d, not "conservative") and give a concrete production-recommended pair with LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS=3600 + LANGFLOW_REFRESH_TOKEN_ EXPIRE_SECONDS=604800.
Langflow 1.10.2 GA. Upstream upgrade is transparent to users: default install path unchanged (chart-wrap keeps AUTO_LOGIN=true by default), and the auth section (LANGFLOW_AUTO_LOGIN=false + SUPERUSER + SUPERUSER_PASSWORD) was already accurate for 1.10.2's stricter default (upstream v1.10.2 removed the hardcoded fallback superuser password — these three env vars are now the only supported way to enable auth). Re-verified all doc parameters live on 4.3-x86 against a 1.10.2 install: default install ready, /auto_login=403 with AUTO_LOGIN=false, /login=200 with matching creds + 401 on wrong creds. The "Starting with v1.10.1" reference is kept — that's the version where the OperatorHub install path was introduced, historical fact. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
luohua13
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Langflow v1.10.1 ships as an OLM
OperatorBundle(chart-wrap of the upstreamlangflow-ai/langflow-helm-charts/langflow-idechart 0.1.2) instead of the previous Alauda fork chart (aml/langflowv1.6.4). The doc had documented the fork's config surface (langflow.auth.enabled,oauth2_proxy.*, top-levelexternalDatabase, etc.) — none of which are present in the community chart. This PR rewrites the doc against the new surface.Key changes
Langflowcustom resource, not Applications / Catalog form.langflow.foo→spec.langflow.backend.foothroughout.sqlite.volume.storageClassName→sqlite.volume.existingStorageClassName; magic string"default"means "use cluster-default SC"..backend.externalDatabase; documented the chart's startup shim that composesLANGFLOW_DATABASE_URLfromLF_CHART_EXTERNALDB_*env vars.auth.enabledin the community chart. Documented viaLANGFLOW_AUTO_LOGIN+LANGFLOW_SUPERUSER*env vars.HTTPRoutetolangflow-service:8080) is the recommended path; upstream chart Ingress documented as fallback.existingStorageClassName: "default"magic string relies on it).backend.backendOnly=trueANDfrontend.enabled=false(both are required to actually skip the frontend Deployment).Validation
Every parameter in this rewrite was validated on ACP 4.3 (business-1) against a live
langflow-operator.v1.10.1-rc.8install:/health_checkreturns 200)backendOnly+frontend.enabled=false)langflow-pgns;LANGFLOW_DATABASE_URLrewritten by chart shim,/data/langflow.dbabsent, 33 flows written into PostgreSQL, full schema built via AlembicAUTO_LOGIN=false+ superuser)langflow-authnsLANGFLOW_VARIABLES_TO_GET_FROM_ENVIRONMENT)GET /api/v1/variables/returns bothMY_PLAIN_VARandMY_SECRET_KEYastype: CredentialTest plan
zh/anden/are in sync.