> ## Documentation Index
> Fetch the complete documentation index at: https://ayakaleaf-pro.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes

> Configure a Kubernetes deployment - where settings, secrets and files go, and one page per feature.

A Kubernetes deployment reads the same environment variables as the Toolkit. Where a Toolkit page says "add this to `config/variables.env`", put the value into the ConfigMap `overleaf-env`, or into the Secret `overleaf-secrets` when it is a password, key or token. Then restart:

```bash theme={null}
kubectl -n overleaf apply -f 30-config.yaml        # after editing the ConfigMap
kubectl -n overleaf patch secret overleaf-secrets --type merge \
  -p '{"stringData":{"GITHUB_TOKEN_CIPHER_PASSWORD":"'"$(openssl rand -hex 32)"'"}}'
kubectl -n overleaf rollout restart deployment/overleaf
```

Values in `config/overleaf.rc` are Toolkit settings, not environment variables; the Q\&A at the end of this page says what replaces them.

### Features

Each feature of the Toolkit configuration has a page here with its services, settings, network paths, background jobs, what changes with several replicas, and how it was tested:

| Feature | Services in the pod | Beyond the ConfigMap and Secret |
| - | - | - |
| [Authentication](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication): [OIDC](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/oidc-authentication.md), [SAML](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/saml-authentication.md), [LDAP](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/ldap-authentication.md), [Public Access](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/public-access.md), [reCAPTCHA](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/recaptcha.md), [Password restrictions](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/authentication/password-restrictions.md) | web | client secrets, the IdP certificate, the LDAP CA |
| [Sandboxed Compiles](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/sandboxed-compiles.md) | clsi | Docker Engine and the TeX Live images on every node |
| [Pandoc Import and Export](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/pandoc-import-and-export.md) | clsi, web | the Pandoc image in Docker on every node |
| [Git integration](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/git-integration.md) | git-bridge (own pod), web, history-v1 | the git-bridge StatefulSet and two Services |
| [GitHub](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/github-synchronisation.md), [GitLab](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/gitlab-synchronisation.md), [Gitea](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/gitea-synchronisation.md) Synchronisation | web | Git integration |
| [Dropbox Synchronisation](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/dropbox-synchronisation.md) | web, third-party-datastore, document-updater | Git integration, the webhook reachable from the internet, database indexes |
| [Zotero](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/zotero-integration.md), [Mendeley](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/mendeley-integration.md) Integration | web | the cipher password in the Secret |
| [MCP Server](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/mcp-server.md) | web | Git integration |
| [AI Integration](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/ai-integration.md) | web, linked-url-proxy | – |
| [Overleaf Import API](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/overleaf-import-api.md) | web, linked-url-proxy | – |
| [Templates](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/templates.md) | web, filestore | S3 for several replicas |
| [External URL](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/external-url.md) | linked-url-proxy | public node addresses in `OVERLEAF_LINKED_URL_BLOCKED_NETWORKS` |
| [Logging](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/logging.md) | every service | a volume at `/var/log/overleaf` to keep logs |
| [TLS proxy](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/tls-proxy.md) | your ingress or load balancer | TLS ends in front of the pods |
| [Branding](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/branding.md) | web | – |
| [Localization](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/localization.md) | web | one host name per language |
| [Email delivery](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/email-delivery.md) | web | – |
| [Redis](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/redis.md) | every service with live state | – |
| [S3](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/s3.md) | history-v1, filestore | an S3 service, required for several replicas |
| [Adding LaTeX user help](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/adding-latex-user-help.md) | web | the pods must reach the wiki |
| [Horizontal scaling](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/horizontal-scaling.md) | all | S3, a load balancer with sticky sessions |

### Certificates and other files

Some features take a file path instead of a value: the SAML certificates (`OVERLEAF_SAML_IDP_CERT`, ...), the LDAP CA (`OVERLEAF_LDAP_TLS_OPTS_CA_PATH`), or a private CA for a self-hosted GitHub Enterprise, GitLab or Gitea (`NODE_EXTRA_CA_CERTS`). Put the files into a Secret and mount it where the Toolkit pages expect them, `/var/lib/overleaf/certs`:

```bash theme={null}
kubectl -n overleaf create secret generic overleaf-certs --from-file=idp_cert.pem --from-file=ca.pem
```

```yaml title="40-overleaf.yaml (additions)" theme={null}
          volumeMounts:
            # ...
            - name: certs
              mountPath: /var/lib/overleaf/certs
              readOnly: true
      volumes:
        # ...
        - name: certs
          secret:
            secretName: overleaf-certs
```

Then refer to them by path in the ConfigMap, for example `NODE_EXTRA_CA_CERTS: /var/lib/overleaf/certs/ca.pem`, and restart.

> [!WARNING]
>
> **Cipher passwords.** Set every `*_CIPHER_PASSWORD` of the features you use in the Secret. Some features otherwise generate a key file in the data volume on first use: with one replica that works until the volume is lost, with several replicas each replica would encrypt with a different key.

### Q\&A

> [accordion] Which Toolkit settings from `config/overleaf.rc` do I need?
>
> **Answer:** None of them are read by Ayakaleaf Pro. Their Kubernetes counterparts:
>
> | `config/overleaf.rc` | Kubernetes |
> | - | - |
> | `OVERLEAF_LISTEN_IP`, `OVERLEAF_PORT` | the Service (NodePort) or your ingress |
> | `SIBLING_CONTAINERS_ENABLED` | `SANDBOXED_COMPILES*` in the ConfigMap, Docker socket in the pod |
> | `GIT_BRIDGE_ENABLED` | [Git integration](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/integrations/git-integration.md) |
> | `MONGO_ENABLED`, `REDIS_ENABLED`, `MONGO_URL`, `REDIS_HOST` | the StatefulSets or your managed services, `OVERLEAF_MONGO_URL` and `OVERLEAF_REDIS_HOST` |
> | `REDIS_AOF_PERSISTENCE` | `--appendonly yes` in `20-redis.yaml` |
> | `NGINX_ENABLED`, `TLS_*` | your ingress or load balancer |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.