chore: allow disabling of agent products automatically (#565)

* chore: allow disabling of agent products automatically

* enable agent bootstrap by default

* new images

* update operator

* addressed romains comment

Author: joaquin-borggio-lc

charts/langsmith/Chart.yaml

@@ -5,5 +5,5 @@ maintainers:
     email: ankush@langchain.dev
 description: Helm chart to deploy the langsmith application and all services it depends on.
 type: application
-version: 0.13.3
-appVersion: "0.13.4"
+version: 0.13.4
+appVersion: "0.13.5"

charts/langsmith/README.md

@@ -1,6 +1,6 @@
 # langsmith
 
-![Version: 0.13.3](https://img.shields.io/badge/Version-0.13.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.13.4](https://img.shields.io/badge/AppVersion-0.13.4-informational?style=flat-square)
+![Version: 0.13.4](https://img.shields.io/badge/Version-0.13.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.13.5](https://img.shields.io/badge/AppVersion-0.13.5-informational?style=flat-square)
 
 Helm chart to deploy the langsmith application and all services it depends on.
 
@@ -137,41 +137,41 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | gateway.sectionName | string | `""` |  |
 | images.aceBackendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.aceBackendImage.repository | string | `"docker.io/langchain/langsmith-ace-backend"` |  |
-| images.aceBackendImage.tag | string | `"0.13.4"` |  |
+| images.aceBackendImage.tag | string | `"0.13.5"` |  |
 | images.agentBuilderImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.agentBuilderImage.repository | string | `"docker.io/langchain/agent-builder-deep-agent"` |  |
-| images.agentBuilderImage.tag | string | `"0.13.4"` |  |
+| images.agentBuilderImage.tag | string | `"0.13.5"` |  |
 | images.agentBuilderToolServerImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.agentBuilderToolServerImage.repository | string | `"docker.io/langchain/agent-builder-tool-server"` |  |
-| images.agentBuilderToolServerImage.tag | string | `"0.13.4"` |  |
+| images.agentBuilderToolServerImage.tag | string | `"0.13.5"` |  |
 | images.agentBuilderTriggerServerImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.agentBuilderTriggerServerImage.repository | string | `"docker.io/langchain/agent-builder-trigger-server"` |  |
-| images.agentBuilderTriggerServerImage.tag | string | `"0.13.4"` |  |
+| images.agentBuilderTriggerServerImage.tag | string | `"0.13.5"` |  |
 | images.backendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.backendImage.repository | string | `"docker.io/langchain/langsmith-backend"` |  |
-| images.backendImage.tag | string | `"0.13.4"` |  |
+| images.backendImage.tag | string | `"0.13.5"` |  |
 | images.clickhouseImage.pullPolicy | string | `"Always"` |  |
 | images.clickhouseImage.repository | string | `"docker.io/clickhouse/clickhouse-server"` |  |
 | images.clickhouseImage.tag | string | `"25.4"` |  |
 | images.frontendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.frontendImage.repository | string | `"docker.io/langchain/langsmith-frontend"` |  |
-| images.frontendImage.tag | string | `"0.13.4"` |  |
+| images.frontendImage.tag | string | `"0.13.5"` |  |
 | images.hostBackendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.hostBackendImage.repository | string | `"docker.io/langchain/hosted-langserve-backend"` |  |
-| images.hostBackendImage.tag | string | `"0.13.4"` |  |
+| images.hostBackendImage.tag | string | `"0.13.5"` |  |
 | images.imagePullSecrets | list | `[]` | Secrets with credentials to pull images from a private registry. Specified as name: value. |
 | images.insightsAgentImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.insightsAgentImage.repository | string | `"docker.io/langchain/langsmith-clio"` |  |
-| images.insightsAgentImage.tag | string | `"0.13.4"` |  |
+| images.insightsAgentImage.tag | string | `"0.13.5"` |  |
 | images.operatorImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.operatorImage.repository | string | `"docker.io/langchain/langgraph-operator"` |  |
-| images.operatorImage.tag | string | `"0.1.23"` |  |
+| images.operatorImage.tag | string | `"0.1.34"` |  |
 | images.platformBackendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.platformBackendImage.repository | string | `"docker.io/langchain/langsmith-go-backend"` |  |
-| images.platformBackendImage.tag | string | `"0.13.4"` |  |
+| images.platformBackendImage.tag | string | `"0.13.5"` |  |
 | images.playgroundImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.playgroundImage.repository | string | `"docker.io/langchain/langsmith-playground"` |  |
-| images.playgroundImage.tag | string | `"0.13.4"` |  |
+| images.playgroundImage.tag | string | `"0.13.5"` |  |
 | images.postgresImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.postgresImage.repository | string | `"docker.io/postgres"` |  |
 | images.postgresImage.tag | string | `"14.7"` |  |
@@ -340,6 +340,11 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | config.observability.tracing.exporter | string | `"http"` |  |
 | config.observability.tracing.useTls | bool | `true` |  |
 | config.personalOrgsDisabled | bool | `true` | Disable personal orgs. |
+| config.security | object | `{"cors":{"allowedOrigins":"*","allowedOriginsRegex":"","alwaysAllowPathsRegex":""}}` | Security configuration for CORS, headers, and other security-related settings. These settings control cross-origin access and help protect against common web vulnerabilities. |
+| config.security.cors | object | `{"allowedOrigins":"*","allowedOriginsRegex":"","alwaysAllowPathsRegex":""}` | CORS (Cross-Origin Resource Sharing) configuration. Controls which origins can make requests to the LangSmith API. By default, CORS is permissive. For production deployments, you should restrict this. |
+| config.security.cors.allowedOrigins | string | `"*"` | Comma-separated list of allowed origins. Use "*" to allow all origins (not recommended for production). Example: "https://app.example.com,https://admin.example.com" If allowedOriginsRegex is set, this value is ignored. |
+| config.security.cors.allowedOriginsRegex | string | `""` | Regular expression pattern for allowed origins. Takes precedence over allowedOrigins if set. Example: "https://.*\\.example\\.com" to allow all subdomains of example.com. Leave empty to use allowedOrigins instead. |
+| config.security.cors.alwaysAllowPathsRegex | string | `""` | Regular expression pattern for paths that should always allow CORS from any origin. Useful for public endpoints like webhooks or public API endpoints. Example: ".*(/feedback/tokens/|/public/).*" |
 | config.settings | object | `{"redisRunsExpirySeconds":"21600"}` | Application Settings. These are used to tune the application |
 | config.settings.redisRunsExpirySeconds | string | `"21600"` | Optional. Be very careful when lowering this value as it can result in runs being lost if your queue is down/not processing items fast enough. |
 | config.telemetry.logs | bool | `true` | Optional. These values are used to send telemetry to the LangChain team to assist with troubleshooting. |

charts/langsmith/templates/_helpers.tpl

@@ -589,6 +589,28 @@ Template containing common environment variables that are used by several servic
 {{ printf "%s-%s" (include "langsmith.fullname" .) "agent-bootstrap" | trunc 63 | trimSuffix "-" }}
 {{- end -}}
 
+{{- define "agentBootstrap.createAgentProducts" -}}
+{{- $createProducts := list }}
+{{- if .Values.config.agentBuilder.enabled }}
+{{- $createProducts = append $createProducts "agent_builder" }}
+{{- end }}
+{{- if .Values.config.insights.enabled }}
+{{- $createProducts = append $createProducts "insights" }}
+{{- end }}
+{{ toYaml $createProducts }}
+{{- end -}}
+
+{{- define "agentBootstrap.destroyAgentProducts" -}}
+{{- $destroyProducts := list }}
+{{- if not .Values.config.agentBuilder.enabled }}
+{{- $destroyProducts = append $destroyProducts "agent_builder" }}
+{{- end }}
+{{- if not .Values.config.insights.enabled }}
+{{- $destroyProducts = append $destroyProducts "insights" }}
+{{- end }}
+{{ toYaml $destroyProducts }}
+{{- end -}}
+
 {{/* Fail on duplicate keys in the inputted list of environment variables */}}
 {{- define "langsmith.detectDuplicates" -}}
 {{- $inputList := . -}}

charts/langsmith/templates/agent-bootstrap/bootstrap-job.yaml

@@ -1,9 +1,12 @@
-{{- if and .Values.backend.agentBootstrap.enabled (or .Values.config.agentBuilder.enabled .Values.config.insights.enabled) }}
+{{- if and .Values.backend.agentBootstrap.enabled .Values.config.deployment.enabled }}
 {{- $envVars := concat .Values.commonEnv (include "langsmith.commonEnv" . | fromYamlArray) .Values.backend.agentBootstrap.extraEnv -}}
 {{- $volumes := concat .Values.commonVolumes (include "langsmith.tlsVolumes" . | fromYamlArray) -}}
 {{- $volumeMounts := concat .Values.commonVolumeMounts (include "langsmith.tlsVolumeMounts" . | fromYamlArray) }}
-# This job deploys bundled agents (Agent Builder, Insights) via the LangSmith Deployments API
-# It runs as a post-install/post-upgrade hook to ensure the agents are deployed after the rest of LangSmith is ready
+{{- $createProducts := include "agentBootstrap.createAgentProducts" . | fromYamlArray }}
+{{- $destroyProducts := include "agentBootstrap.destroyAgentProducts" . | fromYamlArray }}
+# This job creates/destroys bundled agents per product (Agent Builder, Insights) via the LangSmith Deployments API.
+# Each product is either create (enabled) or destroy (disabled) in a single run (e.g. turn off Agent Builder, turn on Insights).
+# It runs as a post-install/post-upgrade hook.
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -79,15 +82,11 @@ spec:
             - "python"
             - "scripts/deploy_bundled_agents.pyc"
           args:
-            - "--products"
-            {{- $products := list }}
-            {{- if .Values.config.agentBuilder.enabled }}
-            {{- $products = append $products "agent_builder" }}
-            {{- end }}
-            {{- if .Values.config.insights.enabled }}
-            {{- $products = append $products "insights" }}
-            {{- end }}
-            - "{{ join "," $products }}"
+            - "--destroy-products"
+            - "{{ join "," $destroyProducts }}"
+            - "--create-products"
+            - "{{ join "," $createProducts }}"
+            {{- if $createProducts }}
             - "--config"
             - |
               {
@@ -120,6 +119,7 @@ spec:
                 }
               {{- end }}
               }
+            {{- end }}
           env:
             {{- with $envVars }}
               {{- toYaml . | nindent 12 }}

charts/langsmith/templates/agent-bootstrap/rbac.yaml

@@ -1,5 +1,5 @@
-# RBAC for the agent bootstrap job to create/patch ConfigMaps and restart deployments
-{{- if and .Values.backend.agentBootstrap.enabled (or .Values.config.agentBuilder.enabled .Values.config.insights.enabled) }}
+# ServiceAccount for the agent bootstrap job (needed whenever the job runs)
+{{- if and .Values.backend.agentBootstrap.enabled .Values.config.deployment.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -10,7 +10,10 @@ metadata:
     app.kubernetes.io/component: agent-bootstrap
   annotations:
     {{- include "langsmith.annotations" . | nindent 4 }}
+{{- end }}
 ---
+# Role + RoleBinding: only when at least one product is enabled (create path patches ConfigMaps and restarts deployments)
+{{- if and .Values.backend.agentBootstrap.enabled .Values.config.deployment.enabled (or .Values.config.agentBuilder.enabled .Values.config.insights.enabled) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:

charts/langsmith/values.yaml

@@ -33,35 +33,35 @@ images:
   aceBackendImage:
     repository: "docker.io/langchain/langsmith-ace-backend"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
   backendImage:
     repository: "docker.io/langchain/langsmith-backend"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
   insightsAgentImage:
     repository: "docker.io/langchain/langsmith-clio"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
   frontendImage:
     repository: "docker.io/langchain/langsmith-frontend"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
   hostBackendImage:
     repository: "docker.io/langchain/hosted-langserve-backend"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
   operatorImage:
     repository: "docker.io/langchain/langgraph-operator"
     pullPolicy: IfNotPresent
-    tag: "0.1.23"
+    tag: "0.1.34"
   platformBackendImage:
     repository: "docker.io/langchain/langsmith-go-backend"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
   playgroundImage:
     repository: "docker.io/langchain/langsmith-playground"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
   postgresImage:
     repository: "docker.io/postgres"
     pullPolicy: IfNotPresent
@@ -77,15 +77,15 @@ images:
   agentBuilderToolServerImage:
     repository: "docker.io/langchain/agent-builder-tool-server"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
   agentBuilderTriggerServerImage:
     repository: "docker.io/langchain/agent-builder-trigger-server"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
   agentBuilderImage:
     repository: "docker.io/langchain/agent-builder-deep-agent"
     pullPolicy: IfNotPresent
-    tag: "0.13.4"
+    tag: "0.13.5"
 
 ingress:
   enabled: false