Configuration and secrets

The chart does not create any Secret. Every workload it renders reads its configuration from one you create yourself:

envFrom:
  - secretRef:
      name: mixpeek-engine-secrets

Create that Secret in the same namespace before you install. If it is missing the pods will not start, which is the safe failure: you get a clear event and nothing runs against the wrong configuration.

The values only you can supply

These five name infrastructure. Each one has a built-in default that points at Mixpeek’s own buckets and projects, so leaving one out does not fail loudly. The pods start and that component talks to a resource you do not own.

Key	What it is	If you omit it
`AWS_BUCKET`	Bucket holding your source objects and extraction artifacts	Requests use a Mixpeek bucket name against your endpoint, so they fail with a `NoSuchBucket` naming a bucket you have never created
`AWS_PUBLIC_BUCKET`	Bucket for publicly addressable assets	Same shape as above
`MONGODB_API_DB`	Database name inside your MongoDB	Your data is written to a database named for Mixpeek’s dev environment
`GOOGLE_BUCKET_NAME`	GCS bucket, only if you enable Google-backed extractors	Uploads target a Mixpeek bucket name
`GEMINI_PROJECT_ID`	GCP project for Gemini inference, only if you enable it	Inference is billed against a Mixpeek project id, which your credentials cannot open
`GCS_STORAGE_BUCKET`	GCS bucket for processed artifacts, only with Google-backed storage	Writes target a Mixpeek bucket name
`S3_VECTORS_BUCKET_NAME`	Bucket backing the S3 vector store, if you use that backend	Vector writes target a Mixpeek bucket name
`S3_VECTORS_LOCAL_BUCKET`	Local-mode counterpart of the above	Same
`LANGSMITH_PROJECT`	LangSmith tracing project, only if you enable tracing	Traces are attributed to a Mixpeek project
`ENGINE_HEAD_SVC`	In-cluster address of the Ray head’s Serve service	Defaults to a hostname in Mixpeek’s namespace, which does not resolve in yours. The chart derives this for you when it installs the engine, so set it only if you run the engine separately.

Your credentials will not open a Mixpeek-owned resource, so the practical outcome is a permission or not-found error rather than data crossing between tenants. The problem is that the error names our resource and gives you nothing to act on.

Connecting to your own object store

Key	Notes
`AWS_ENDPOINT_URL`	Set this to your own S3-compatible endpoint. Leave it unset only if you are using AWS S3 itself.
`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`	Credentials for that endpoint
`AWS_REGION`	Region string your store expects

Everything else

The Secret Mixpeek runs internally carries around 120 keys. Most are integrations the runtime does not need in your environment: payments, support desks, analytics, social connectors and error reporting. Set only what you use. Most keys you leave out stay unset, and the feature that reads them stays off. SENTRY_DSN is the exception, and it is the one to read the next section for.

What leaves your environment

Short answer: error reports, unless you turn them off. Nothing else. SENTRY_DSN has a non-empty default that points at Mixpeek’s Sentry project. It is not part of the chart, so it appears in no manifest you can inspect, and leaving it unset does not disable it. The runtime only skips error reporting when the DSN is empty or ENV is local, and a deployed install is neither. Exceptions raised in your environment, with their stack traces and the context Sentry attaches, are sent to us. To stop that, set it explicitly to an empty value:

SENTRY_DSN: ""

Point it at your own Sentry project instead if you want the reports and want them to stay yours.

This default is being reconsidered so that error reporting is off unless you opt in. Until that ships, setting SENTRY_DSN: "" is what turns it off, and this page will say so plainly for as long as it is true.

A fuller version of this, with per-model sizes and the source line for each claim, is in the Customer-Hosted control-plane boundary write-up your account team can share.

What does not leave

Checked the same way, so this list means something:

Channel	Behaviour with the shipped configuration
Product analytics (PostHog)	Off. The client is a no-op without an API key, and the key has no default.
Mixpeek control plane	Off. Every `CONTROL_PLANE_*` setting defaults to unset, and the request-forwarding prefix does nothing without a control-plane URL.
Your objects and documents	Never leave. They are read from and written to the endpoints you configure above.
Model weights	Two model sets are baked into the engine image. Four more are downloaded from `huggingface.co` the first time a replica loads them, so this path is outbound but carries nothing of yours. An environment with no route to `huggingface.co` starts Ray healthy and then leaves those applications unable to load.

MIXPEEK_PRIVATE_TOKEN is worth calling out: the API and the engine authenticate to each other with it, so set it to a value you generate, and use the same value for both.

Get started

Connect your data

Extract features

Build retrievers

Enrich & organize

Integrate & operate

Resources

Configuration and secrets

The values only you can supply

Connecting to your own object store

Everything else

What leaves your environment

What does not leave

​The values only you can supply

​Connecting to your own object store

​Everything else

​What leaves your environment

​What does not leave

The values only you can supply

Connecting to your own object store

Everything else

What leaves your environment

What does not leave