Document Engine 1.17.0

[zrzka]

Expose the new Document Engine 1.17.0 runtime knobs in the
document-engine Helm chart.

Async jobs and async /api/build

Added Helm values for the async jobs configuration introduced by
Document Engine:

• config.asyncAdmissionQueues
  -> ASYNC_ADMISSION_QUEUES
• config.asyncAdmissionQueueLimits
  -> ASYNC_ADMISSION_QUEUE_LIMITS
• config.asyncWorkerQueues
  -> ASYNC_WORKER_QUEUES
• config.asyncJobTimeoutSeconds
  -> ASYNC_JOB_TIMEOUT
• config.asyncJobMaxRetries
  -> ASYNC_JOB_MAX_RETRIES
• config.asyncJobRetryBackoffSeconds
  -> ASYNC_JOB_RETRY_BACKOFF_SECONDS
• config.asyncJobsMetadataTtlSeconds
  -> ASYNC_JOBS_METADATA_TTL

The existing config.asyncJobsTtlSeconds value continues to render
ASYNC_JOBS_TTL.

Async job encryption

Added config.asyncJobEncryption for ASYNC_JOB_ENCRYPTION_KEYS,
which Document Engine requires only when async Build API requests
contain sensitive persisted metadata such as remote URLs or PDF
passwords.

The chart supports both inline and external Secret configuration:

config:
  asyncJobEncryption:
    keys: ""
    externalSecret:
      name: ""
      key: ASYNC_JOB_ENCRYPTION_KEYS

When externalSecret.name is empty, keys is rendered into the
chart-owned Secret. When externalSecret.name is set, the pod receives
ASYNC_JOB_ENCRYPTION_KEYS through an explicit secretKeyRef, matching
existing chart patterns for keyed external Secrets.

Batch render

Added config.batchRender values:

• config.batchRender.maxConcurrency
  -> BATCH_RENDER_MAX_CONCURRENCY
• config.batchRender.maxPages
  -> BATCH_RENDER_MAX_PAGES
• config.batchRender.pageTimeoutSeconds
  -> BATCH_RENDER_PAGE_TIMEOUT_MS

The timeout value is configured in seconds in Helm values and rendered
in milliseconds for Document Engine.

Remote URL fetch policy

Added config.remoteUrlFetch values:

• config.remoteUrlFetch.policy
  -> REMOTE_URL_FETCH_POLICY
• config.remoteUrlFetch.allowedHosts
  -> REMOTE_URL_FETCH_ALLOWED_HOSTS
• config.remoteUrlFetch.allowedCidrs
  -> REMOTE_URL_FETCH_ALLOWED_CIDRS
• config.remoteUrlFetch.allowEmbeddedCredentials
  -> REMOTE_URL_FETCH_ALLOW_EMBEDDED_CREDENTIALS

Full-Text search

Added config.search values:

• config.search.ftsEnabled
  -> SEARCH_FTS_ENABLED
• config.search.ftsEnrichment
  -> SEARCH_FTS_ENRICHMENT
• config.search.maxGlyphSidecarPageBytes
  -> SEARCH_MAX_GLYPH_SIDECAR_PAGE_BYTES
• config.search.ftsBuildOnWrite
  -> SEARCH_FTS_BUILD_ON_WRITE

SEARCH_MAX_GLYPH_SIDECAR_PAGE_BYTES is rendered as an integer string
to avoid scientific notation in Helm output.

[zrzka]

Post merge ACK