Open WebUI

Deploy Open WebUI on Kubernetes with Ollama or OpenAI-compatible model providers, persistent RAG data, optional PostgreSQL and Redis, and scheduled PostgreSQL backups.

Key Features

• SQLite or PostgreSQL — a zero-configuration evaluation path and a production database path
• Bundled or external services — HelmForge PostgreSQL and Redis dependencies or operator-managed endpoints
• Secret-backed connections — application, provider, database, Redis, and S3 credentials
• Database-aware readiness — /health/db removes a pod from endpoints when its database is unavailable
• Safe upgrades — Recreate prevents concurrent migrations and SQLite writers
• Network isolation — tokenless ServiceAccount, seccomp, dropped capabilities, and inbound NetworkPolicy
• PostgreSQL backup — scheduled pg_dump archives to S3-compatible storage

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install open-webui helmforge/open-webui \
  --namespace open-webui \
  --create-namespace

OCI registry:

helm install open-webui oci://ghcr.io/helmforgedev/helm/open-webui \
  --namespace open-webui \
  --create-namespace

The first start can take several minutes while Open WebUI downloads its RAG embedding model. The startup probe intentionally allows approximately ten minutes.

Deployment Examples

openWebui:
  ollamaBaseUrl: http://ollama.ollama.svc.cluster.local:11434
  existingSecret: open-webui-session
  existingSecretKey: secret-key

persistence:
  enabled: true
  size: 20Gi

ingress:
  enabled: true
  ingressClassName: nginx
  hosts:
    - host: chat.example.com
      paths:
        - path: /
          pathType: Prefix

openWebui:
  openaiBaseUrl: https://api.openai.com/v1
  openaiExistingSecret: openai-credentials
  openaiExistingSecretKey: openai-api-key
  existingSecret: open-webui-session
  existingSecretKey: secret-key

postgresql:
  enabled: true
  auth:
    database: openwebui
    username: openwebui
    existingSecret: open-webui-postgresql

redis:
  enabled: true
  auth:
    enabled: true
    existingSecret: open-webui-redis
  master:
    persistence:
      enabled: false

persistence:
  enabled: true
  size: 20Gi

database:
  mode: external
  existingSecret: open-webui-database-url
  existingSecretKey: database-url

redisConfig:
  mode: external
  existingSecret: open-webui-redis-url
  existingSecretKey: redis-url

postgresql:
  enabled: false

redis:
  enabled: false

postgresql:
  enabled: true

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.example.com
    bucket: open-webui-backups
    prefix: production
    existingSecret: open-webui-s3
    existingSecretAccessKeyKey: access-key
    existingSecretSecretKeyKey: secret-key

Database Selection

Conflicting modes fail during Helm rendering. External mode requires either database.url or database.existingSecret.

Redis and WebSockets

Redis is optional in the supported single-replica architecture. When enabled, the chart sets REDIS_URL, WEBSOCKET_REDIS_URL, WEBSOCKET_MANAGER=redis, and ENABLE_WEBSOCKET_SUPPORT=true.

redisConfig.mode=external requires either redisConfig.url or an existing Secret. It cannot be combined with the bundled Redis dependency.

Security

The default manifests:

• create a dedicated ServiceAccount without a mounted Kubernetes API token;
• enable RuntimeDefault seccomp;
• disable privilege escalation and drop all Linux capabilities;
• allow inbound traffic only to the named HTTP port;
• keep integration egress open for operator-selected model and identity endpoints;
• retain the generated session Secret across upgrades.

For production, use existing Secrets, TLS ingress, a private initial administrator enrollment path, scoped egress rules, and storage encryption.

Backup with External PostgreSQL

The application Secret contains a complete database URL, while pg_dump needs individual connection fields. Configure the external backup contract separately:

backup:
  enabled: true
  database:
    host: postgres.example.com
    port: 5432
    name: openwebui
    username: openwebui
    existingSecret: open-webui-database-password
    existingSecretKey: database-password
  s3:
    endpoint: https://s3.example.com
    bucket: open-webui-backups
    existingSecret: open-webui-s3

Configuration Reference

Application

Datastores

Exposure and persistence

Health and backup

Operations

Verify Service endpoints, application health, and the database-aware readiness route after installation:

kubectl get pods,service,pvc --namespace open-webui
kubectl get endpointslice --namespace open-webui
kubectl logs --namespace open-webui deployment/open-webui-open-webui --tail=100

Before upgrades, back up the database and data PVC. Expect brief downtime from the Recreate strategy. Do not run mixed Open WebUI versions against one database.

More Information

• Open WebUI documentation
• Open WebUI source
• HelmForge chart source