NVIDIA
diff --git a/‎deployments/charts/service/templates/api-service.yaml‎
Lines changed: 28 additions & 1 deletion b/‎deployments/charts/service/templates/api-service.yaml‎
Lines changed: 28 additions & 1 deletion
diff --git a/‎deployments/charts/service/templates/configs.yaml‎
Lines changed: 70 additions & 0 deletions b/‎deployments/charts/service/templates/configs.yaml‎
Lines changed: 70 additions & 0 deletions
diff --git a/‎deployments/charts/service/templates/gateway.yaml‎
Lines changed: 14 additions & 2 deletions b/‎deployments/charts/service/templates/gateway.yaml‎
Lines changed: 14 additions & 2 deletions
diff --git a/‎deployments/charts/service/values.yaml‎
Lines changed: 186 additions & 0 deletions b/‎deployments/charts/service/values.yaml‎
Lines changed: 186 additions & 0 deletions
@@ -31,6 +31,9 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
       annotations:
+        {{- if .Values.services.configs.enabled }}
+        checksum/configs: {{ .Values.services.configs | toYaml | sha256sum }}
+        {{- end }}
         {{- include "osmo.extra-annotations" .Values.services.service | nindent 8 }}
     spec:
       {{- with .Values.services.service.hostAliases }}
@@ -145,6 +148,10 @@ spec:
         - --default_admin_username
         - {{ .Values.services.defaultAdmin.username | quote }}
         {{- end }}
+        {{- if .Values.services.configs.enabled }}
+        - --config_file
+        - /etc/osmo/configs/config.yaml
+        {{- end }}
         {{- range $arg := .Values.services.service.extraArgs }}
         - {{ $arg | quote }}
         {{- end }}
@@ -188,14 +195,24 @@ spec:
         ports:
         - name: metrics
           containerPort: 9464
-        {{- if or .Values.services.configFile.enabled .Values.global.logs.enabled .Values.services.service.extraVolumeMounts }}
+        {{- if or .Values.services.configFile.enabled .Values.global.logs.enabled .Values.services.configs.enabled .Values.services.service.extraVolumeMounts }}
         volumeMounts:
         {{- end }}
         {{- if .Values.services.configFile.enabled}}
         - mountPath: {{ .Values.services.configFile.path }}
           name: mek-volume
           subPath: mek.yaml
         {{- end }}
+        {{- if .Values.services.configs.enabled }}
+        - name: configs
+          mountPath: /etc/osmo/configs
+          readOnly: true
+        {{- range .Values.services.configs.secretRefs }}
+        - name: secret-{{ .secretName }}
+          mountPath: /etc/osmo/secrets/{{ .secretName }}
+          readOnly: true
+        {{- end }}
+        {{- end }}
         {{- if .Values.global.logs.enabled }}
         - name: logs
           mountPath: /logs
@@ -247,6 +264,16 @@ spec:
             name: mek-config
           name: mek-volume
         {{- end}}
+        {{- if .Values.services.configs.enabled }}
+        - name: configs
+          configMap:
+            name: {{ .Values.services.service.serviceName }}-configs
+        {{- range .Values.services.configs.secretRefs }}
+        - name: secret-{{ .secretName }}
+          secret:
+            secretName: {{ .secretName }}
+        {{- end }}
+        {{- end }}
 ---
 
 apiVersion: v1
 
@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+{{- if .Values.services.configs.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.services.service.serviceName }}-configs
+  labels:
+    app: {{ .Values.services.service.serviceName }}
+data:
+  config.yaml: |
+    {{- $cfg := .Values.services.configs }}
+    {{- if $cfg.service }}
+    service:
+      {{- $service := deepCopy $cfg.service }}
+      {{- if and (not (index $service "service_base_url")) .Values.services.service.hostname }}
+      {{- $_ := set $service "service_base_url" (printf "https://%s" .Values.services.service.hostname) }}
+      {{- end }}
+      {{- toYaml $service | nindent 6 }}
+    {{- end }}
+    {{- if $cfg.workflow }}
+    workflow:
+      {{- toYaml $cfg.workflow | nindent 6 }}
+    {{- end }}
+    {{- if $cfg.dataset }}
+    dataset:
+      {{- toYaml $cfg.dataset | nindent 6 }}
+    {{- end }}
+    {{- if $cfg.pools }}
+    pools:
+      {{- toYaml $cfg.pools | nindent 6 }}
+    {{- end }}
+    {{- if $cfg.podTemplates }}
+    pod_templates:
+      {{- toYaml $cfg.podTemplates | nindent 6 }}
+    {{- end }}
+    {{- if $cfg.resourceValidations }}
+    resource_validations:
+      {{- toYaml $cfg.resourceValidations | nindent 6 }}
+    {{- end }}
+    {{- if $cfg.backends }}
+    backends:
+      {{- toYaml $cfg.backends | nindent 6 }}
+    {{- end }}
+    {{- if $cfg.backendTests }}
+    backend_tests:
+      {{- toYaml $cfg.backendTests | nindent 6 }}
+    {{- end }}
+    {{- if $cfg.groupTemplates }}
+    group_templates:
+      {{- toYaml $cfg.groupTemplates | nindent 6 }}
+    {{- end }}
+    {{- if $cfg.roles }}
+    roles:
+      {{- toYaml $cfg.roles | nindent 6 }}
+    {{- end }}
+{{- end }}
@@ -453,6 +453,9 @@ spec:
         imagePullPolicy: {{ $gw.authz.imagePullPolicy }}
         args:
           - "--grpc-port={{ $gw.authz.grpcPort }}"
+          {{- if .Values.services.configs.enabled }}
+          - "--roles-file=/etc/osmo/configs/config.yaml"
+          {{- else }}
           - "--postgres-host={{ .Values.services.postgres.serviceName }}"
           - "--postgres-port={{ .Values.services.postgres.port }}"
           - "--postgres-database={{ .Values.services.postgres.db }}"
@@ -461,6 +464,7 @@ spec:
           - "--postgres-max-conns={{ $gw.authz.postgres.maxConns }}"
           - "--postgres-min-conns={{ $gw.authz.postgres.minConns }}"
           - "--postgres-max-conn-lifetime={{ $gw.authz.postgres.maxConnLifetimeMin }}"
+          {{- end }}
           - "--cache-ttl={{ $gw.authz.cache.ttl }}"
           - "--cache-max-size={{ $gw.authz.cache.maxSize }}"
           {{- if .Values.global.logs.enabled }}
@@ -483,16 +487,19 @@ spec:
                 name: db-secret
                 key: db-password
           {{- end }}
-        {{- if or .Values.global.logs.enabled $gw.authz.extraVolumeMounts }}
         volumeMounts:
           {{- if .Values.global.logs.enabled }}
           - name: logs
             mountPath: /logs
           {{- end }}
+          {{- if .Values.services.configs.enabled }}
+          - name: configs
+            mountPath: /etc/osmo/configs
+            readOnly: true
+          {{- end }}
           {{- with $gw.authz.extraVolumeMounts }}
             {{- toYaml . | nindent 10 }}
           {{- end }}
-        {{- end }}
         {{- with $gw.authz.livenessProbe }}
         livenessProbe:
           {{- toYaml . | nindent 10 }}
@@ -508,6 +515,11 @@ spec:
         - name: logs
           emptyDir: {}
         {{- end }}
+        {{- if .Values.services.configs.enabled }}
+        - name: configs
+          configMap:
+            name: {{ .Values.services.service.serviceName }}-configs
+        {{- end }}
         {{- with $gw.authz.extraVolumes }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
 
@@ -229,6 +229,192 @@ services:
     ##
     passwordSecretKey: password
 
+  ## Dynamic configuration loaded from ConfigMap.
+  ## When enabled, all configs are served from in-memory (parsed from the mounted
+  ## ConfigMap file). CLI/API writes return 409. The authz_sidecar reads roles
+  ## from the same file instead of PostgreSQL. Changes are detected via watchdog/inotify.
+  ##
+  configs:
+    ## Enable ConfigMap-based configuration.
+    ## When true: all configs served from in-memory (parsed from ConfigMap),
+    ## CLI/API writes return 409, authz_sidecar reads roles from file.
+    ## When false: configs in database, CLI/API works normally.
+    ##
+    enabled: false
+
+    ## Service config. service_base_url is auto-derived from
+    ## services.service.hostname if not set here.
+    ##
+    service: {}
+
+    ## Workflow config (limits, timeouts, image credentials).
+    ## Use secretName in config fields to reference K8s Secrets.
+    ## Each secretName must also be listed in secretRefs above.
+    ##
+    workflow:
+      max_num_tasks: 100
+      max_exec_timeout: "30d"
+      default_exec_timeout: "7d"
+
+    ## Dataset config (buckets, credentials).
+    ## Use credentialSecretName to reference K8s Secrets for bucket creds.
+    ##
+    dataset: {}
+
+    ## Pod templates applied to workflow containers.
+    ##
+    podTemplates:
+      default_ctrl:
+        spec:
+          containers:
+          - name: osmo-ctrl
+            resources:
+              requests:
+                cpu: "1"
+                memory: "1Gi"
+              limits:
+                memory: "1Gi"
+      default_user:
+        spec:
+          containers:
+          - name: "{{USER_CONTAINER_NAME}}"
+            resources:
+              requests:
+                cpu: "{{USER_CPU}}"
+                memory: "{{USER_MEMORY}}"
+                nvidia.com/gpu: "{{USER_GPU}}"
+                ephemeral-storage: "{{USER_STORAGE}}"
+              limits:
+                memory: "{{USER_MEMORY}}"
+                nvidia.com/gpu: "{{USER_GPU}}"
+                ephemeral-storage: "{{USER_STORAGE}}"
+
+    ## Resource validation rules.
+    ##
+    resourceValidations:
+      default_cpu:
+      - left_operand: cpu
+        operator: LE
+        right_operand: node_cpu
+        assert_message: "cpu must be <= node_cpu"
+      - left_operand: cpu
+        operator: GT
+        right_operand: "0"
+        assert_message: "cpu must be > 0"
+      default_memory:
+      - left_operand: memory
+        operator: LE
+        right_operand: node_memory
+        assert_message: "memory must be <= node_memory"
+      - left_operand: memory
+        operator: GT
+        right_operand: "0"
+        assert_message: "memory must be > 0"
+
+    ## RBAC role definitions. Policies are product defaults.
+    ## Override external_roles per deployment to map IDP groups.
+    ##
+    roles:
+      osmo-admin:
+        description: "Admin role — full access to all resources"
+        policies:
+        - effect: Allow
+          actions: ["*:*"]
+          resources: ["*"]
+        external_roles: [osmo-admin]
+      osmo-user:
+        description: "User role — standard workflow and data operations"
+        policies:
+        - effect: Allow
+          actions:
+          - "app:*"
+          - "auth:Token"
+          - "credentials:*"
+          - "dataset:*"
+          - "pool:List"
+          - "profile:Read"
+          - "profile:Update"
+          - "resources:Read"
+          - "user:List"
+          - "workflow:Cancel"
+          - "workflow:Create"
+          - "workflow:Delete"
+          - "workflow:Exec"
+          - "workflow:List"
+          - "workflow:PortForward"
+          - "workflow:Read"
+          - "workflow:Rsync"
+          - "workflow:Update"
+          resources: ["*"]
+        external_roles: [osmo-user]
+      osmo-default:
+        description: "Default role — login, profile, health check"
+        policies:
+        - effect: Allow
+          actions:
+          - "auth:Login"
+          - "auth:Refresh"
+          - "auth:Token"
+          - "profile:*"
+          - "system:Health"
+          resources: ["*"]
+        external_roles: []
+      osmo-ctrl:
+        description: "Controller role — internal container communication"
+        policies:
+        - effect: Allow
+          actions: ["internal:Logger", "internal:Router"]
+          resources: ["*"]
+        external_roles: [osmo-ctrl]
+      osmo-backend:
+        description: "Backend role — internal operator communication"
+        policies:
+        - effect: Allow
+          actions: ["internal:Operator", "config:Read", "pool:List"]
+          resources: ["*"]
+        external_roles: [osmo-backend]
+
+    ## Backend cluster definitions. The "default" backend is created by
+    ## configure_app() on first deploy — include it here so ConfigMap mode
+    ## serves it from memory.
+    ##
+    backends:
+      default:
+        description: "Default backend"
+        scheduler_settings:
+          scheduler_type: kai
+          scheduler_name: kai-scheduler
+          scheduler_timeout: 30
+
+    ## Pool definitions. The "default" pool references the "default" backend.
+    ##
+    pools:
+      default:
+        description: "Default pool"
+        backend: default
+        default_platform: default
+        platforms:
+          default: {}
+
+    ## Backend test definitions.
+    ##
+    backendTests: {}
+
+    ## Group templates.
+    ##
+    groupTemplates: {}
+
+    ## K8s Secrets to mount into the service pods.
+    ## Each entry generates a volume + volumeMount at /etc/osmo/secrets/<secretName>/.
+    ## The Python config loader resolves secretName references in configs at runtime.
+    ##
+    ## Example:
+    ##   secretRefs:
+    ##   - secretName: my-bucket-cred        # mounts all keys
+    ##   - secretName: imagepullsecret       # mounts all keys
+    ##
+    secretRefs: []
+
   ## Redis cache service configuration
   ## Set enabled to false if using an external Redis deployment
   ##