Skip to content

Langflow

Deploy Langflow on Kubernetes for visual AI workflows, agents, RAG applications, and provider integrations.

Overview

The HelmForge Langflow chart uses the official docker.io/langflowai/langflow:1.12.0 image and exposes the web/API server on port 7860. The default deployment persists /app/langflow because flows, local SQLite state, provider settings, and local configuration are not stateless.

Langflow 1.12 adds authorization changes, database migrations and curated component bundles. Review the upgrade guidance below before reusing existing data.

When no existing or inline authentication credentials are provided, the chart generates a strong secret key and initial superuser password on the first install and preserves them across upgrades. The startup, liveness, and readiness probes use Langflow’s reliable /health_check endpoint, which verifies application services and the database instead of only checking whether the port is open.

The chart generates the core Langflow runtime environment:

  • LANGFLOW_HOST=0.0.0.0
  • LANGFLOW_PORT
  • LANGFLOW_CONFIG_DIR
  • LANGFLOW_SAVE_DB_IN_CONFIG_DIR
  • LANGFLOW_OPEN_BROWSER
  • LANGFLOW_AUTO_LOGIN=false

Upgrade to 1.12

Before upgrading, stop writers, back up the database and encryption Secret, and export important flows. Start one replica for Alembic migrations; confirm health and flow execution before restoring the desired replica count. Recreate causes an upgrade maintenance window. Changing the database URL does not copy SQLite data to PostgreSQL. Do not run destructive migration repair against the only copy.

Existing generated keys are preserved. Older chart releases generated 64-character alphanumeric keys, which are not valid Fernet keys. Audit the existing key before upgrading or enabling production preflight. Restore the original valid key when encrypted data depends on it; do not silently replace a key or discard credentials. If the old key is unusable, plan recovery of provider credentials and session invalidation before explicitly supplying a new key. New valid keys can be created with python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())' in an environment with cryptography installed. Store the result in a Secret.

The chart explicitly retains the official image’s authenticated default. Only isolated development deployments should opt in with auth.autoLogin=true.

The default image includes curated components and no longer installs PyTorch or every historical integration. Inventory flows that use removed bundles before upgrading; upstream offers langflowai/langflow-all for the extended profile. Pin and validate an appropriate supported image profile for those integrations. RBAC/provider policy and MCP authentication changes also require integration tests.

External OpenTelemetry dashboards must account for the new HTTP semantic conventions: duration changes from milliseconds to seconds under http.server.request.duration, with renamed method/status/path attributes. The upstream OTEL_SEMCONV_STABILITY_OPT_IN=http/dup setting provides migration compatibility when needed. This chart does not provision an OpenTelemetry collector.

Sources: 1.12 release, database migration guide.

Configuration Reference

Core runtime:

  • image.repository, image.tag, image.pullPolicy: official pinned Langflow image and pull behavior.
  • imagePullSecrets: optional registry pull secrets.
  • replicaCount: web/API replica count. Values greater than 1 require a shared external database.
  • app.port: Langflow HTTP port.
  • app.command, app.args: optional container command and argument overrides.
  • app.env, app.envFrom, app.extraEnv: provider credentials, integration settings, and advanced runtime environment.
  • commonLabels, nameOverride, fullnameOverride: naming and common metadata controls.

Secrets and database:

  • auth.autoLogin: defaults to false; requires login. Enable only for isolated development.
  • auth.secretKey, auth.superuser, auth.superuserPassword: optional inline credentials. Empty values are generated and preserved.
  • auth.existingSecret, auth.secretKeyKey, auth.superuserKey, auth.superuserPasswordKey: production Secret wiring.
  • database.mode: sqlite or external.
  • database.url: inline SQLAlchemy database URL for labs.
  • database.existingSecret, database.urlKey: production external database URL Secret.

Storage and scaling:

  • persistence.enabled, persistence.size, persistence.storageClass: local config and SQLite storage.
  • persistence.accessModes: generated PVC access modes. Multi-replica persistent deployments require ReadWriteMany.
  • persistence.existingClaim: mount an existing claim instead of creating one. With replicaCount > 1, the external claim controls access modes.
  • persistence.mountPath: Langflow config directory, default /app/langflow.
  • pdb.enabled, pdb.minAvailable: disruption budget for scaled deployments.

Exposure and operations:

  • serviceAccount.create, serviceAccount.name, serviceAccount.annotations, serviceAccount.automountServiceAccountToken.
  • service.type, service.port, service.annotations, service.ipFamilyPolicy, service.ipFamilies.
  • ingress.enabled, ingress.ingressClassName, ingress.annotations, ingress.hosts, ingress.tls. Set ingress.ingressClassName: "" to omit spec.ingressClassName.
  • gateway.enabled, gateway.parentRefs, gateway.hostnames, gateway.path, gateway.pathType.
  • networkPolicy.enabled, networkPolicy.ingressFrom, networkPolicy.dnsEgressPeers, networkPolicy.extraEgress. Enabling networkPolicy.enabled creates ingress restrictions plus egress isolation with built-in DNS and HTTPS allowances. networkPolicy.dnsEgressPeers defaults to kube-system/kube-dns and can be changed for clusters with different DNS labels. networkPolicy.extraEgress appends database, provider, or proxy rules after the built-in allowances.
  • probes.startup, probes.liveness, probes.readiness: enable flags, HTTP health-check paths, and timing values.
  • resources, podSecurityContext, securityContext, nodeSelector, tolerations, affinity.
  • topologySpreadConstraints, priorityClassName, terminationGracePeriodSeconds.
  • podLabels, podAnnotations, extraVolumes, extraVolumeMounts, extraManifests.

Installation

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install langflow helmforge/langflow

OCI install:

helm install langflow oci://ghcr.io/helmforgedev/helm/langflow

Production Example

auth:
  existingSecret: langflow-secrets
  secretKeyKey: secret-key
  superuserKey: superuser
  superuserPasswordKey: superuser-password

database:
  existingSecret: langflow-database
  urlKey: database-url

persistence:
  enabled: true
  size: 20Gi

networkPolicy:
  enabled: true
  dnsEgressPeers:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns

Secrets

Use auth.existingSecret for production so credentials remain under your secret-management lifecycle. It must hold:

  • secret-key
  • superuser
  • superuser-password

These key names can be changed with auth.secretKeyKey, auth.superuserKey, and auth.superuserPasswordKey. Keep the secret key value stable across upgrades. Rotating it can make encrypted provider credentials unusable. For a default installation, retrieve the generated username and password from the chart-managed Secret:

kubectl get secret RELEASE-langflow -o jsonpath='{.data.superuser}' | base64 --decode
kubectl get secret RELEASE-langflow -o jsonpath='{.data.superuser-password}' | base64 --decode

Replace RELEASE with the Helm release name and add -n NAMESPACE when installed outside the current namespace.

Database And Scaling

The default single-replica mode can use local SQLite under /app/langflow. For multiple replicas, configure a shared database:

replicaCount: 3
database:
  existingSecret: langflow-database
  urlKey: database-url
persistence:
  accessModes:
    - ReadWriteMany
pdb:
  enabled: true

The chart blocks replicaCount > 1 unless database.url or database.existingSecret is configured. When chart-created persistence stays enabled for multiple replicas, the shared config directory must use ReadWriteMany; the default generated ReadWriteOnce PVC is rejected to avoid multi-attach failures on multi-node clusters.

Backup

Back up the PVC and any external database. The PVC contains local configuration and may contain SQLite state, generated files, or custom components depending on how Langflow is used.

Additional Resources

Edit this page on GitHub