helm: improvements (#10976)

- fix(ingress): use root context ($) for fullname inside range - fix(statefulset): use updateStrategy instead of strategy for mysql/infinity/elasticsearch/opensearch - feat(mysql): add external mode via mysql.enabled=false with env MYSQL_HOST/PORT and MYSQL_USER (default root) - feat(minio/redis): add external mode via *.enabled=false with env *_HOST/PORT - feat(global): add global.repo for image registry prefix and global.imagePullSecrets for all pods - feat: helper template ragflow.imageRepo to render image with global repo - chore(env): allow optional MINIO_HOST, MINIO_PASSWORD, REDIS_PASSWORD (remove required); keep MYSQL_PASSWORD required - docs(helm): add helm/README.md and update usage - refactor(images): apply global repo to all components and init containers - test: align test busybox image with global repo helper ### What problem does this PR solve? _Briefly describe what this PR aims to solve. Include background context that will help reviewers understand the purpose of the PR._ ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue) - [x] New Feature (non-breaking change which adds functionality) - [x] Documentation Update - [ ] Refactoring - [ ] Performance Improvement - [ ] Other (please describe):
2025-12-30 00:32:30 +08:00 · 2025-12-29 13:29:47 +08:00
parent a764f0a5b2
commit 082c2ed11c
14 changed files with 246 additions and 38 deletions
--- a/helm/README.md
+++ b/helm/README.md
@ -0,0 +1,133 @@
+# RAGFlow Helm Chart
+
+A Helm chart to deploy RAGFlow and its dependencies on Kubernetes.
+
+- Components: RAGFlow (web/api) and optional dependencies (Infinity/Elasticsearch/OpenSearch, MySQL, MinIO, Redis)
+- Requirements: Kubernetes >= 1.24, Helm >= 3.10
+
+## Install
+
+```bash
+helm upgrade --install ragflow ./ \
+  --namespace ragflow --create-namespace
+```
+
+Uninstall:
+```bash
+helm uninstall ragflow -n ragflow
+```
+
+## Global Settings
+
+- `global.repo`: Prepend a global image registry prefix for all images.
+  - Behavior: Replaces the registry part and keeps the image path (e.g., `quay.io/minio/minio` -> `registry.example.com/myproj/minio/minio`).
+  - Example: `global.repo: "registry.example.com/myproj"`
+- `global.imagePullSecrets`: List of image pull secrets applied to all Pods.
+  - Example:
+    ```yaml
+    global:
+      imagePullSecrets:
+        - name: regcred
+    ```
+
+## External Services (MySQL / MinIO / Redis)
+
+The chart can deploy in-cluster services or connect to external ones. Toggle with `*.enabled`. When disabled, provide host/port via `env.*`.
+
+- MySQL
+  - `mysql.enabled`: default `true`
+  - If `false`, set:
+    - `env.MYSQL_HOST` (required), `env.MYSQL_PORT` (default `3306`)
+    - `env.MYSQL_DBNAME` (default `rag_flow`), `env.MYSQL_PASSWORD` (required)
+    - `env.MYSQL_USER` (default `root` if omitted)
+- MinIO
+  - `minio.enabled`: default `true`
+  - Configure:
+    - `env.MINIO_HOST` (optional external host), `env.MINIO_PORT` (default `9000`)
+    - `env.MINIO_ROOT_USER` (default `rag_flow`), `env.MINIO_PASSWORD` (optional)
+- Redis (Valkey)
+  - `redis.enabled`: default `true`
+  - If `false`, set:
+    - `env.REDIS_HOST` (required), `env.REDIS_PORT` (default `6379`)
+    - `env.REDIS_PASSWORD` (optional; empty disables auth if server allows)
+
+Notes:
+- When `*.enabled=true`, the chart renders in-cluster resources and injects corresponding `*_HOST`/`*_PORT` automatically.
+- Sensitive variables like `MYSQL_PASSWORD` are required; `MINIO_PASSWORD` and `REDIS_PASSWORD` are optional. All secrets are stored in a Secret.
+
+### Example: use external MySQL, MinIO, and Redis
+
+```yaml
+# values.override.yaml
+mysql:
+  enabled: false  # use external MySQL
+minio:
+  enabled: false  # use external MinIO (S3 compatible)
+redis:
+  enabled: false  # use external Redis/Valkey
+
+env:
+  # MySQL
+  MYSQL_HOST: mydb.example.com
+  MYSQL_PORT: "3306"
+  MYSQL_USER: root
+  MYSQL_DBNAME: rag_flow
+  MYSQL_PASSWORD: "<your-mysql-password>"
+
+  # MinIO
+  MINIO_HOST: s3.example.com
+  MINIO_PORT: "9000"
+  MINIO_ROOT_USER: rag_flow
+  MINIO_PASSWORD: "<your-minio-secret>"
+
+  # Redis
+  REDIS_HOST: redis.example.com
+  REDIS_PORT: "6379"
+  REDIS_PASSWORD: "<your-redis-pass>"
+```
+
+Apply:
+```bash
+helm upgrade --install ragflow ./helm -n ragflow -f values.override.yaml
+```
+
+## Document Engine Selection
+
+Choose one of `infinity` (default), `elasticsearch`, or `opensearch` via `env.DOC_ENGINE`. The chart renders only the selected engine and sets the appropriate host variables.
+
+```yaml
+env:
+  DOC_ENGINE: infinity   # or: elasticsearch | opensearch
+  # For elasticsearch
+  ELASTIC_PASSWORD: "<es-pass>"
+  # For opensearch
+  OPENSEARCH_PASSWORD: "<os-pass>"
+```
+
+## Ingress
+
+Expose the web UI via Ingress:
+
+```yaml
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: ragflow.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+```
+
+## Validate the Chart
+
+```bash
+helm lint ./helm
+helm template ragflow ./helm > rendered.yaml
+```
+
+## Notes
+
+- By default, the chart uses `DOC_ENGINE: infinity` and deploys in-cluster MySQL, MinIO, and Redis.
+- The chart injects derived `*_HOST`/`*_PORT` and required secrets into a single Secret (`<release>-ragflow-env-config`).
+- `global.repo` and `global.imagePullSecrets` apply to all Pods; per-component `*.image.pullSecrets` still work and are merged with global settings.
--- a/helm/templates/_helpers.tpl
+++ b/helm/templates/_helpers.tpl
@ -42,6 +42,31 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}

+{{/*
+Resolve image repository with optional global repo prefix.
+If .Values.global.repo is set, replace registry part and keep image path.
+Detect existing registry by first segment containing '.' or ':' or being 'localhost'.
+Usage: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.foo.image.repository) }}
+*/}}
+{{- define "ragflow.imageRepo" -}}
+{{- $root := .root -}}
+{{- $repo := .repo -}}
+{{- $global := $root.Values.global -}}
+{{- if and $global $global.repo }}
+  {{- $parts := splitList "/" $repo -}}
+  {{- $first := index $parts 0 -}}
+  {{- $hasRegistry := or (regexMatch "\\." $first) (regexMatch ":" $first) (eq $first "localhost") -}}
+  {{- if $hasRegistry -}}
+    {{- $path := join "/" (rest $parts) -}}
+    {{- printf "%s/%s" $global.repo $path -}}
+  {{- else -}}
+    {{- printf "%s/%s" $global.repo $repo -}}
+  {{- end -}}
+{{- else -}}
+  {{- $repo -}}
+{{- end -}}
+{{- end }}
+
 {{/*
 Selector labels
 */}}
--- a/helm/templates/elasticsearch.yaml
+++ b/helm/templates/elasticsearch.yaml
@ -32,7 +32,7 @@ spec:
      {{- include "ragflow.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: elasticsearch
  {{- with .Values.elasticsearch.deployment.strategy }}
-  strategy:
+  updateStrategy:
    {{- . | toYaml | nindent 4 }}
  {{- end }}
  template:
@ -44,9 +44,9 @@ spec:
        checksum/config-es: {{ include (print $.Template.BasePath "/elasticsearch-config.yaml") . | sha256sum }}
        checksum/config-env: {{ include (print $.Template.BasePath "/env.yaml") . | sha256sum }}
    spec:
-      {{- if or .Values.imagePullSecrets .Values.elasticsearch.image.pullSecrets }}
+      {{- if or .Values.global.imagePullSecrets .Values.elasticsearch.image.pullSecrets }}
      imagePullSecrets:
-        {{- with .Values.imagePullSecrets }}
+        {{- with .Values.global.imagePullSecrets }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.elasticsearch.image.pullSecrets }}
@ -55,7 +55,7 @@ spec:
      {{- end }}
      initContainers:
      - name: fix-data-volume-permissions
-        image: {{ .Values.elasticsearch.initContainers.alpine.repository }}:{{ .Values.elasticsearch.initContainers.alpine.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.elasticsearch.initContainers.alpine.repository) }}:{{ .Values.elasticsearch.initContainers.alpine.tag }}
        {{- with .Values.elasticsearch.initContainers.alpine.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
@ -67,7 +67,7 @@ spec:
          - mountPath: /usr/share/elasticsearch/data
            name: es-data
      - name: sysctl
-        image: {{ .Values.elasticsearch.initContainers.busybox.repository }}:{{ .Values.elasticsearch.initContainers.busybox.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.elasticsearch.initContainers.busybox.repository) }}:{{ .Values.elasticsearch.initContainers.busybox.tag }}
        {{- with .Values.elasticsearch.initContainers.busybox.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
@ -77,7 +77,7 @@ spec:
        command: ["sysctl", "-w", "vm.max_map_count=262144"]
      containers:
      - name: elasticsearch
-        image: {{ .Values.elasticsearch.image.repository }}:{{ .Values.elasticsearch.image.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.elasticsearch.image.repository) }}:{{ .Values.elasticsearch.image.tag }}
        {{- with .Values.elasticsearch.image.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
--- a/helm/templates/env.yaml
+++ b/helm/templates/env.yaml
@ -9,20 +9,39 @@ metadata:
 type: Opaque
 stringData:
  {{- range $key, $val := .Values.env }}
-  {{- if $val }}
+  {{- if and $val (ne $key "MYSQL_HOST") (ne $key "MYSQL_PORT") (ne $key "MYSQL_USER") (ne $key "MINIO_HOST") (ne $key "MINIO_PORT") (ne $key "REDIS_HOST") (ne $key "REDIS_PORT") }}
  {{ $key }}: {{ quote $val }}
  {{- end }}
  {{- end }}
  {{- /*
  Use host names derived from internal cluster DNS
  */}}
+  {{- if .Values.redis.enabled }}
  REDIS_HOST: {{ printf "%s-redis.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
+  REDIS_PORT: "6379"
+  {{- else }}
+  REDIS_HOST: {{ required "env.REDIS_HOST is required when redis.enabled=false" .Values.env.REDIS_HOST | quote }}
+  REDIS_PORT: {{ default "6379" .Values.env.REDIS_PORT | quote }}
+  {{- end }}
+  {{- if .Values.mysql.enabled }}
  MYSQL_HOST: {{ printf "%s-mysql.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
+  MYSQL_PORT: "3306"
+  {{- else }}
+  MYSQL_HOST: {{ required "env.MYSQL_HOST is required when mysql.enabled=false" .Values.env.MYSQL_HOST | quote }}
+  MYSQL_PORT: {{ default "3306" .Values.env.MYSQL_PORT | quote }}
+  MYSQL_USER: {{ default "root" .Values.env.MYSQL_USER | quote }}
+  {{- end }}
+  {{- if .Values.minio.enabled }}
  MINIO_HOST: {{ printf "%s-minio.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
+  MINIO_PORT: "9000"
+  {{- else }}
+  MINIO_HOST: {{ default "" .Values.env.MINIO_HOST | quote }}
+  MINIO_PORT: {{ default "9000" .Values.env.MINIO_PORT | quote }}
+  {{- end }}
  {{- /*
  Fail if passwords are not provided in release values
  */}}
-  REDIS_PASSWORD: {{ .Values.env.REDIS_PASSWORD | required "REDIS_PASSWORD is required" }}
+  REDIS_PASSWORD: {{ default "" .Values.env.REDIS_PASSWORD }}
  {{- /*
  NOTE: MySQL uses MYSQL_ROOT_PASSWORD env var but Ragflow container expects
  MYSQL_PASSWORD so we need to define both as the same value here.
@ -31,10 +50,9 @@ stringData:
  MYSQL_PASSWORD: {{ . }}
  MYSQL_ROOT_PASSWORD: {{ . }}
  {{- end }}
-  {{- with .Values.env.MINIO_PASSWORD | required "MINIO_PASSWORD is required" }}
-  MINIO_PASSWORD: {{ . }}
-  MINIO_ROOT_PASSWORD: {{ . }}
-  {{- end }}
+  {{- $minioPass := default "" .Values.env.MINIO_PASSWORD }}
+  MINIO_PASSWORD: {{ $minioPass }}
+  MINIO_ROOT_PASSWORD: {{ $minioPass }}
  {{- /*
  Only provide env vars for enabled doc engine
  */}}
--- a/helm/templates/infinity.yaml
+++ b/helm/templates/infinity.yaml
@ -32,7 +32,7 @@ spec:
      {{- include "ragflow.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: infinity
  {{- with .Values.infinity.deployment.strategy }}
-  strategy:
+  updateStrategy:
    {{- . | toYaml | nindent 4 }}
  {{- end }}
  template:
@ -43,9 +43,9 @@ spec:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/env.yaml") . | sha256sum }}
    spec:
-      {{- if or .Values.imagePullSecrets .Values.infinity.image.pullSecrets }}
+      {{- if or .Values.global.imagePullSecrets .Values.infinity.image.pullSecrets }}
      imagePullSecrets:
-        {{- with .Values.imagePullSecrets }}
+        {{- with .Values.global.imagePullSecrets }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.infinity.image.pullSecrets }}
@ -54,7 +54,7 @@ spec:
      {{- end }}
      containers:
      - name: infinity
-        image: {{ .Values.infinity.image.repository }}:{{ .Values.infinity.image.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.infinity.image.repository) }}:{{ .Values.infinity.image.tag }}
        {{- with .Values.infinity.image.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
--- a/helm/templates/ingress.yaml
+++ b/helm/templates/ingress.yaml
@ -35,7 +35,7 @@ spec:
            {{- end }}
            backend:
              service:
-                name: {{ $.Release.Name }}
+                name: {{ include "ragflow.fullname" $ }}
                port:
                  name: http
          {{- end }}
--- a/helm/templates/minio.yaml
+++ b/helm/templates/minio.yaml
@ -1,3 +1,4 @@
+{{- if .Values.minio.enabled }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@ -43,9 +44,9 @@ spec:
        {{- include "ragflow.labels" . | nindent 8 }}
        app.kubernetes.io/component: minio
    spec:
-      {{- if or .Values.imagePullSecrets .Values.minio.image.pullSecrets }}
+      {{- if or .Values.global.imagePullSecrets .Values.minio.image.pullSecrets }}
      imagePullSecrets:
-        {{- with .Values.imagePullSecrets }}
+        {{- with .Values.global.imagePullSecrets }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.minio.image.pullSecrets }}
@ -54,7 +55,7 @@ spec:
      {{- end }}
      containers:
      - name: minio
-        image: {{ .Values.minio.image.repository }}:{{ .Values.minio.image.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.minio.image.repository) }}:{{ .Values.minio.image.tag }}
        {{- with .Values.minio.image.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
@ -103,3 +104,4 @@ spec:
      port: 9001
      targetPort: console
  type: {{ .Values.minio.service.type }}
+{{- end }}
--- a/helm/templates/mysql-config.yaml
+++ b/helm/templates/mysql-config.yaml
@ -1,3 +1,4 @@
+{{- if .Values.mysql.enabled }}
 ---
 apiVersion: v1
 kind: ConfigMap
@ -7,3 +8,4 @@ data:
  init.sql: |-
    CREATE DATABASE IF NOT EXISTS rag_flow;
    USE rag_flow;
+{{- end }}
--- a/helm/templates/mysql.yaml
+++ b/helm/templates/mysql.yaml
@ -1,3 +1,4 @@
+{{- if .Values.mysql.enabled }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@ -32,7 +33,7 @@ spec:
      {{- include "ragflow.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: mysql
  {{- with .Values.mysql.deployment.strategy }}
-  strategy:
+  updateStrategy:
    {{- . | toYaml | nindent 4 }}
  {{- end }}
  template:
@ -44,9 +45,9 @@ spec:
        checksum/config-mysql: {{ include (print $.Template.BasePath "/mysql-config.yaml") . | sha256sum }}
        checksum/config-env: {{ include (print $.Template.BasePath "/env.yaml") . | sha256sum }}
    spec:
-      {{- if or .Values.imagePullSecrets .Values.mysql.image.pullSecrets }}
+      {{- if or .Values.global.imagePullSecrets .Values.mysql.image.pullSecrets }}
      imagePullSecrets:
-        {{- with .Values.imagePullSecrets }}
+        {{- with .Values.global.imagePullSecrets }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.mysql.image.pullSecrets }}
@ -55,7 +56,7 @@ spec:
      {{- end }}
      containers:
      - name: mysql
-        image: {{ .Values.mysql.image.repository }}:{{ .Values.mysql.image.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.mysql.image.repository) }}:{{ .Values.mysql.image.tag }}
        {{- with .Values.mysql.image.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
@ -108,3 +109,4 @@ spec:
      port: 3306
      targetPort: mysql
  type: {{ .Values.mysql.service.type }}
+{{- end }}
--- a/helm/templates/opensearch.yaml
+++ b/helm/templates/opensearch.yaml
@ -32,7 +32,7 @@ spec:
      {{- include "ragflow.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: opensearch
  {{- with .Values.opensearch.deployment.strategy }}
-  strategy:
+  updateStrategy:
    {{- . | toYaml | nindent 4 }}
  {{- end }}
  template:
@ -44,9 +44,9 @@ spec:
        checksum/config-opensearch: {{ include (print $.Template.BasePath "/opensearch-config.yaml") . | sha256sum }}
        checksum/config-env: {{ include (print $.Template.BasePath "/env.yaml") . | sha256sum }}
    spec:
-      {{- if or .Values.imagePullSecrets .Values.opensearch.image.pullSecrets }}
+      {{- if or .Values.global.imagePullSecrets .Values.opensearch.image.pullSecrets }}
      imagePullSecrets:
-        {{- with .Values.imagePullSecrets }}
+        {{- with .Values.global.imagePullSecrets }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.opensearch.image.pullSecrets }}
@ -55,7 +55,7 @@ spec:
      {{- end }}
      initContainers:
      - name: fix-data-volume-permissions
-        image: {{ .Values.opensearch.initContainers.alpine.repository }}:{{ .Values.opensearch.initContainers.alpine.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.opensearch.initContainers.alpine.repository) }}:{{ .Values.opensearch.initContainers.alpine.tag }}
        {{- with .Values.opensearch.initContainers.alpine.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
@ -67,7 +67,7 @@ spec:
          - mountPath: /usr/share/opensearch/data
            name: opensearch-data
      - name: sysctl
-        image: {{ .Values.opensearch.initContainers.busybox.repository }}:{{ .Values.opensearch.initContainers.busybox.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.opensearch.initContainers.busybox.repository) }}:{{ .Values.opensearch.initContainers.busybox.tag }}
        {{- with .Values.opensearch.initContainers.busybox.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
@ -77,7 +77,7 @@ spec:
        command: ["sysctl", "-w", "vm.max_map_count=262144"]
      containers:
      - name: opensearch
-        image: {{ .Values.opensearch.image.repository }}:{{ .Values.opensearch.image.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.opensearch.image.repository) }}:{{ .Values.opensearch.image.tag }}
        {{- with .Values.opensearch.image.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
--- a/helm/templates/ragflow.yaml
+++ b/helm/templates/ragflow.yaml
@ -25,9 +25,9 @@ spec:
        checksum/config-env: {{ include (print $.Template.BasePath "/env.yaml") . | sha256sum }}
        checksum/config-ragflow: {{ include (print $.Template.BasePath "/ragflow_config.yaml") . | sha256sum }}
    spec:
-      {{- if or .Values.imagePullSecrets .Values.ragflow.image.pullSecrets }}
+      {{- if or .Values.global.imagePullSecrets .Values.ragflow.image.pullSecrets }}
      imagePullSecrets:
-        {{- with .Values.imagePullSecrets }}
+        {{- with .Values.global.imagePullSecrets }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.ragflow.image.pullSecrets }}
@ -36,7 +36,7 @@ spec:
      {{- end }}
      containers:
      - name: ragflow
-        image: {{ .Values.ragflow.image.repository }}:{{ .Values.ragflow.image.tag }}
+        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.ragflow.image.repository) }}:{{ .Values.ragflow.image.tag }}
        {{- with .Values.ragflow.image.pullPolicy }}
        imagePullPolicy: {{ . }}
        {{- end }}
--- a/helm/templates/redis.yaml
+++ b/helm/templates/redis.yaml
@ -1,3 +1,4 @@
+{{- if .Values.redis.enabled }}
 ---
 apiVersion: v1
 kind: Service
@ -40,9 +41,9 @@ spec:
      annotations:
        checksum/config-env: {{ include (print $.Template.BasePath "/env.yaml") . | sha256sum }}
    spec:
-      {{- if or .Values.imagePullSecrets .Values.redis.image.pullSecrets }}
+      {{- if or .Values.global.imagePullSecrets .Values.redis.image.pullSecrets }}
      imagePullSecrets:
-        {{- with .Values.imagePullSecrets }}
+        {{- with .Values.global.imagePullSecrets }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- with .Values.redis.image.pullSecrets }}
@ -52,7 +53,7 @@ spec:
      terminationGracePeriodSeconds: 60
      containers:
        - name: redis
-          image: {{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}
+          image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.redis.image.repository) }}:{{ .Values.redis.image.tag }}
          {{- with .Values.redis.image.pullPolicy }}
          imagePullPolicy: {{ . }}
          {{- end }}
@ -131,3 +132,4 @@ spec:
    matchLabels:
      {{- include "ragflow.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: redis
+{{- end }}
--- a/helm/templates/tests/test-connection.yaml
+++ b/helm/templates/tests/test-connection.yaml
@ -9,7 +9,7 @@ metadata:
 spec:
  containers:
    - name: wget
-      image: busybox
+      image: {{ include "ragflow.imageRepo" (dict "root" . "repo" "busybox") }}
      command:
      - 'wget'
      args:
--- a/helm/values.yaml
+++ b/helm/values.yaml
@ -1,7 +1,14 @@
 # Based on docker compose .env file

 # Global image pull secrets configuration
-imagePullSecrets: []
+global:
+  # Global image repo prefix to render all images from a mirror/registry.
+  # Example: "registry.example.com/myproj"
+  # When set, template will replace the registry part of each image and keep the path.
+  # Leave empty to use per-image repositories as-is.
+  repo: ""
+  # Global image pull secrets for all pods
+  imagePullSecrets: []

 env:
  # The type of doc engine to use.
@ -27,14 +34,28 @@ env:
  MYSQL_PASSWORD: infini_rag_flow_helm
  # The database of the MySQL service to use
  MYSQL_DBNAME: rag_flow
+  # External MySQL host (only required when mysql.enabled=false)
+  # MYSQL_HOST: ""
+  # External MySQL port (defaults to 3306 if not set)
+  # MYSQL_PORT: "3306"
+  # External MySQL user (only when mysql.enabled=false), default is root if omitted
+  # MYSQL_USER: "root"

  # The username for MinIO.
  MINIO_ROOT_USER: rag_flow
  # The password for MinIO
  MINIO_PASSWORD: infini_rag_flow_helm
+  # External MinIO host
+  # MINIO_HOST: ""
+  # External MinIO port (defaults to 9000 if not set)
+  # MINIO_PORT: "9000"

  # The password for Redis
  REDIS_PASSWORD: infini_rag_flow_helm
+  # External Redis host (only required when redis.enabled=false)
+  # REDIS_HOST: ""
+  # External Redis port (defaults to 6379 if not set)
+  # REDIS_PORT: "6379"

  # The local time zone.
  TZ: "Asia/Shanghai"
@ -163,6 +184,7 @@ opensearch:
    type: ClusterIP

 minio:
+  enabled: true
  image:
    repository: quay.io/minio/minio
    tag: RELEASE.2023-12-20T01-00-02Z
@ -178,6 +200,7 @@ minio:
    type: ClusterIP

 mysql:
+  enabled: true
  image:
    repository: mysql
    tag: 8.0.39
@ -193,6 +216,7 @@ mysql:
    type: ClusterIP

 redis:
+  enabled: true
  image:
    repository: valkey/valkey
    tag: 8