Installation

In this guide, you will set up nevisAdmin 4 on an existing Kubernetes cluster.

If you don't have a cluster yet, or need to prepare an Oracle volume, see Preparation first. See Restrictions in Kubernetes Setups for limitations specific to Kubernetes.

For a quick, automated test setup instead, see Test Setups, covering Azure and OpenShift. These are not recommended beyond test setups, as they make several assumptions.

We tested the installation with Azure, but other providers may work as well. For details about supported providers and versions, see Kubernetes Support Policy for Nevis.

Pay attention to the following:

nevisAdmin 4 requires between 4 GB and 16 GB of RAM and between 2 and 6 CPU cores, depending on project size and how many deployments/edits happen concurrently.
For the database, we recommend using PostgreSQL server, especially since support for MariaDB got removed in Azure. Use a database service whenever possible, especially for end user facing components. See the Nevis Product Lifetime and Platform Support Matrix for supported database versions.
In some Kubernetes installations, special permission settings or entitlements are required, for example, for the ingress-nginx component.

Prerequisites

Have an existing Kubernetes cluster and enough permissions to create resource groups and resources, which includes RBAC permissions.
- The installation of the crds, ingress-nginx and the cert-manager component needs cluster-wide permissions, for the rest, namespace scoped permissions are enough.
If using MariaDB as a database, the following server configuration is needed:

autocommit=0
transaction-isolation = READ-COMMITTED
log_bin_trust_function_creators = 1
lower_case_table_names = 1
character-set-server = utf8mb4

A Linux environment with the following software pre-installed:
- kubectl: Kubernetes command line interface. The same minor version is recommended as the used Kubernetes version.
- docker: Docker client.
- helm: Helm CLI

This guide requires basic knowledge of Linux and Kubernetes. If you are new to these topics, we recommend that you see tutorials or courses available online. If you have limited time, focus on Kubernetes tutorials, for example, Viewing Pods and Nodes.

Prepare Git Deployment Repository

In this tutorial, we use GitHub as the Git system. However, it is possible to use Bitbucket, Gitea, GitLab and more instead. The same options should be available in every case.

To configure the Git connection for nevisOperator, perform the following steps:

Prepare GitHub.
- Create a GitHub account.
- Create an empty Git repository called deploy.
- Set the GitHub repository to private. See https://help.github.com/en/articles/setting-repository-visibility#making-a-repository-private for detailed instructions

Create the SSH key material through the following commands:

#generate key pair
ssh-keygen -t ecdsa -C "kubernetes" -m PEM -P "" -f key

# create know_hosts file, replace the github domain if other Git system is used
ssh-keyscan github.com > known_hosts

# make sure ssh keys were generated
cat key
cat key.pub

The created key is used by both nevisOperator and nevisAdmin 4 to connect to GitHub.

Add the key key.pub to your GitHub account, or to the repository itself as a deployment key.

See http://help.github.com/en/articles/adding-a-new-ssh-key-to-your-github-account.
See the Deploy keys section in http://developer.github.com/v3/guides/managing-deploy-keys

Set environment variables

The remaining steps use the following environment variables:

Variable	Default	Description
`NEVISADMIN_PASSWORD`	—	Initial password for the nevisAdmin 4 admin user.
`NEVIS_VERSION`	—	Release version to install, for example `9.2605.2`. Find the latest one on the Nevis Portal download page or in the nevisAdmin 4 release notes. Used both for the image sync below and for the `--version` flag on the chart installs further down, so images and chart stay in sync.
`CONTAINER_REGISTRY`	—	Container registry of your Kubernetes cluster. Azure registries use a flat URL, for example `nevis.azurecr.io`.
`RELEASE_NAMESPACE`	`nevisadmin4`	Kubernetes namespace the Helm chart is installed into. You usually do not need to change this.
`RELEASE_NAME`	`nevisadmin4`	Name of the Helm release. You usually do not need to change this.
`DATABASE_HOST`	—	Database host, for example `nevisakvtest.postgres.database.azure.com` for PostgreSQL.
`DB_ROOT_USER`	`dbroot`	Root/administrator user of the database. If you are using an Azure database, do not include the host in the username.
`DB_ROOT_PASSWORD`	—	Password for `DB_ROOT_USER`. If you used the nevis-kubernetes-support Terraform template to create the database, retrieve it with `terraform output db_password`. Otherwise, ask your database administrator or check your cloud provider's console.
`DB_NEVISADMIN_SCHEMA_USER_PASSWORD`	—	Password for the nevisAdmin 4 schema user, which is created during installation.
`DB_NEVISADMIN_APP_USER_PASSWORD`	—	Password for the nevisAdmin 4 application user, which is created during installation.
`GIT_REPOSITORY_URL`	—	URL of the Git deployment repository nevisAdmin 4 and nevisOperator will use.
`DOMAIN`	—	Domain where nevisAdmin 4 will be available, for example `test.westeurope.cloudapp.azure.com`. The chart requires this value at install or upgrade time. Pick your domain first, then wire up DNS after installing the gateway.
`CLOUDSMITH_PASSWORD`	—	Temporary Cloudsmith credential used to pull the Nevis Helm charts and Docker images. Obtain it by clicking the download button for one of the Docker images at the Nevis Portal.

Upload Nevis Docker Images

Download the docker images from the Nevis Portal registry and upload them to the container registry of the Kubernetes cluster.

export NEVIS_VERSION=<the version you picked, for example 9.2605.2>

The sync-images.sh script in the nevis-kubernetes-support repository automates the upload: it pulls each image from Cloudsmith (or GitHub Container Registry) and pushes it to your target registry.

./sync-images.sh --source cloudsmith --token $CLOUDSMITH_PASSWORD --target $CONTAINER_REGISTRY --version $NEVIS_VERSION

$CLOUDSMITH_PASSWORD obtained this way is a temporary token. If pulls or pushes suddenly start failing with unauthorized or 400 Bad Request partway through, the token has likely expired — get a fresh one from the portal and retry.
Not every component image is tagged with the same version string as the overall release — a component still on an older tag will fail with manifest unknown. If you do not need that component yet (it is not part of the base nevisAdmin4 install, and only gets pulled in later by nevisOperator once a project uses it), skip it:
```
./sync-images.sh --source cloudsmith --token $CLOUDSMITH_PASSWORD --target $CONTAINER_REGISTRY --version $NEVIS_VERSION \
  --skip-images nevislogrend nevisfido nevisfido-dbschema nevisidm nevisidm-dbschema nevismeta nevismeta-dbschema \
  nevisadapt nevisadapt-dbschema nevisdetect-admin nevisdetect-core nevisdetect-entrypoint nevisdetect-persistency \
  nevisdetect-persistency-dbschema nevisdp nevis-base-flyway
```
Otherwise, use --tags <image>:<tag> to pin the correct tag for that component. The script still processes every non-skipped image, so preserve the previous --skip-images list and remove the target component from it.
Individual Nevis components can ship patch releases independently of the overall release. The image tag that nevisOperator will actually request when deploying a component is determined by the patterns plugin, not by $NEVIS_VERSION. If a deploy fails because nevisOperator tries to pull an image that is not in your registry — for example nevisidm:9.2605.3 when you synced 9.2605.2 — rerun the sync with an override for that component. Preserve the previous --skip-images list and remove nevisidm from it:
```
./sync-images.sh --source cloudsmith --token $CLOUDSMITH_PASSWORD --target $CONTAINER_REGISTRY \
  --version $NEVIS_VERSION --tags nevisidm:9.2605.3 \
  --skip-images nevislogrend nevisfido nevisfido-dbschema nevisidm-dbschema nevismeta nevismeta-dbschema \
  nevisadapt nevisadapt-dbschema nevisdetect-admin nevisdetect-core nevisdetect-entrypoint nevisdetect-persistency \
  nevisdetect-persistency-dbschema nevisdp nevis-base-flyway
```
The exact version required can be seen in the deployment preview inside the NevisComponent resource associated with the service in nevisAdmin 4, or inferred from the image pull error in the deployment log.

Deploy Envoy Gateway

Envoy Gateway is the recommended external routing solution for new installations. ingress-nginx reached end-of-life in March 2026 and no longer receives feature or security updates — only use it if you have a specific reason to stay on it for now, see Deploy ingress-nginx below.

At least Envoy Gateway 1.6.0 is required. Use a current, supported, non-EOL release; 1.6.0 itself is EOL. Check the Envoy Gateway releases page for the latest supported version and use it in the install command:

helm install eg oci://docker.io/envoyproxy/gateway-helm \
  --version <envoy-gateway-version> \
  --namespace envoy-gateway-system \
  --create-namespace

After the installation, create a GatewayClass and an EnvoyProxy configuration resource. The EnvoyProxy is recommended to merge all gateways into a single proxy (avoiding multiple load balancers) and to enforce TLS 1.3 toward backend nevisProxy instances.

The Envoy Gateway namespace is configurable. The installation script uses envoy by default, while the commands and examples below use the namespace configured for your installation; adjust namespace-qualified commands and YAML resources if you choose a different namespace.

Please note that using Envoy Gateway requires TLS 1.3 toward the backend nevisProxy instance. This is enforced globally in the same EnvoyProxy resource:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: gateway-config
  namespace: envoy-gateway-system
spec:
  logging:
    level:
      default: warn
  mergeGateways: true
  backendTLS:
    maxVersion: "1.3"
    minVersion: "1.3"
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-gateway
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: gateway-config
    namespace: envoy-gateway-system

Apply it with kubectl apply -f <file>. For more EnvoyProxy configuration options, see Customize EnvoyProxy.

info

Gateway support was introduced in nevisAdmin4 chart versions 8.2511.3 and 7.2511.3. Versions below 9.2605.0 still use the ingress API with ingress-nginx by default, so the nevisadmin4 chart values have to be set explicitly to use Envoy Gateway instead — see the Install nevisAdmin 4 Chart section.

Deploy cert-manager

If the Kubernetes cluster does not have cert-manager already installed, then follow the official guide: https://cert-manager.io/docs/installation/helm/

Gateway API support is required when using Envoy Gateway. Without it, cert-manager cannot perform HTTP-01 challenges via a Gateway, and TLS certificates will not be issued automatically. Enable it during installation:

Replace <cert-manager-version> with a currently supported cert-manager version compatible with your Kubernetes version.

helm install cert-manager cert-manager \
  --repo https://charts.jetstack.io \
  --version <cert-manager-version> \
  --namespace cert-manager \
  --create-namespace \
  --set installCRDs=true \
  --set config.apiVersion="controller.config.cert-manager.io/v1alpha1" \
  --set config.enableGatewayAPI=true \
  --set config.kind=ControllerConfiguration

If cert-manager is already installed, upgrade it to add Gateway API support:

helm upgrade cert-manager cert-manager \
  --repo https://charts.jetstack.io \
  --version <cert-manager-version> \
  --namespace cert-manager \
  --reuse-values \
  --set config.apiVersion="controller.config.cert-manager.io/v1alpha1" \
  --set config.enableGatewayAPI=true \
  --set config.kind=ControllerConfiguration

Wait for the cert-manager pods to restart and become ready before proceeding.

note

--set config.enableGatewayAPI=true sets the enableGatewayAPI field in cert-manager's ControllerConfiguration, which is the same approach described in the migration from Ingress to Gateway API guide.

For details, see Configuring the HTTP-01 Gateway API solver in the cert-manager documentation.

Configure DNS after installation

This section covers the case where a LoadBalancer IP is provisioned automatically by the cluster. If you are using a pre-provisioned public IP, annotate the LoadBalancer service via the EnvoyProxy resource instead — see the Envoy Gateway documentation for details.

After the Envoy Gateway Helm chart is installed and a Gateway resource exists (deploying a nevisAdmin 4 project is one way to create it), retrieve the external IP assigned to the LoadBalancer service:

kubectl get svc -n envoy-gateway-system

Look for the EXTERNAL-IP of the Envoy Gateway LoadBalancer service. If you are using ingress-nginx instead, run kubectl get svc -n ingress-nginx. Then configure the DNS record for DOMAIN to point to that IP.

Azure: The standard way to assign a stable hostname is to add the service.beta.kubernetes.io/azure-dns-label-name annotation to the LoadBalancer service. This gives you an FQDN of the form <label>.<azure-region>.cloudapp.azure.com. Replace <azure-region> with the Azure region where the public IP is provisioned. The annotation can be set via the EnvoyProxy resource's spec.provider.kubernetes.envoyService.annotations field:

spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyService:
        annotations:
          service.beta.kubernetes.io/azure-dns-label-name: <label>

Set DOMAIN to the resulting FQDN before running the install, or update it afterwards with helm upgrade.

Other environments: Create a DNS A record pointing DOMAIN to the LoadBalancer IP in your DNS provider.

Deploy ingress-nginx (opt-out)

caution

As of March 2026, ingress-nginx is end-of-life (EOL) and no longer receives any feature or security updates. Only use it if you have a specific reason to stay on it — for example, an existing setup already on it, or a chart version below 8.2511.3/7.2511.3, which doesn't support Envoy Gateway. New installations should use Envoy Gateway instead.

Follow the official installation instructions: https://kubernetes.github.io/ingress-nginx/deploy/. This is also the default if you don't deploy Envoy Gateway and don't set nginx.enabled=false — see the Install nevisAdmin 4 Chart section for the required chart values either way.

If you already have an existing ingress-nginx installation instead of deploying a new one for this release, see Using existing ingress-nginx installation.

Install CRD Chart

Install the helm chart that contains the CustomResourceDefinitions used by nevisAdmin 4.

helm install nevisadmin4-crd nevisadmin4-crd --version $NEVIS_VERSION --repo https://dl.cloudsmith.io/$CLOUDSMITH_PASSWORD/nevissecurity/rolling/helm/charts/

caution

Uninstalling this chart deletes all the existing CustomResources, which results in the deletion of all the deployments made with nevisAdmin 4

Install nevisAdmin 4 Chart

Prepare secrets for installation

Prepare the required secrets to be used by the helm chart. This is done to avoid plain secret values in the values.yaml.

Create namespace

kubectl create namespace $RELEASE_NAMESPACE

Create credential secrets

These secrets are used to avoid having plain values in the values.yaml.

# nevisAdmin 4 admin user credential
kubectl create secret generic nevis-nevisadmin4-admin-credential \
--from-literal=password=$NEVISADMIN_PASSWORD \
-n $RELEASE_NAMESPACE

# git credential
kubectl create secret generic nevis-git-credential \
--from-file=key=key \
--from-file=key.pub=key.pub \
--from-file=known_hosts=known_hosts \
--from-literal=passphrase="" \
--from-literal=username="" \
--from-literal=password="" \
-n $RELEASE_NAMESPACE

# database credential
kubectl create secret generic nevis-database-credential \
--from-literal=username=$DB_ROOT_USER \
--from-literal=password=$DB_ROOT_PASSWORD \
-n $RELEASE_NAMESPACE

# nevisAdmin 4 database credential
kubectl create secret generic nevis-nevisadmin4-database-credential \
--from-literal=applicationUser=admin4appuser \
--from-literal=applicationUserPassword=$DB_NEVISADMIN_APP_USER_PASSWORD \
--from-literal=schemaUser=admin4schemauser \
--from-literal=schemaUserPassword=$DB_NEVISADMIN_SCHEMA_USER_PASSWORD \
-n $RELEASE_NAMESPACE

The nevis-database-credential secret can be used for the Root Credential and Root Credential Namespace fields in the database patterns inside nevisAdmin 4.

For more configuration options, see the section in the appendix.

Minimal permissions for database.root

The dbschema job uses database.root to create the application database, the citext extension it needs, and the schema/app users. If your Postgres role for database.root is locked down rather than a true admin/superuser, you can shrink what it needs to just CREATEROLE by pre-provisioning the rest yourself, connected as your actual database admin, before installing:

CREATE DATABASE nevisadmin4 OWNER <database.root user>;
\connect nevisadmin4;
CREATE EXTENSION IF NOT EXISTS citext;

When citext already exists, CREATE EXTENSION IF NOT EXISTS is a no-op — on any platform, not just Azure — so the dbschema job's own attempt to create it succeeds without needing extension-creation privileges, and it will not need CREATEDB or (on Azure) azure_pg_admin membership either.

Install

The commands below use Envoy Gateway, the recommended default. In versions below 9.2605.0, ingress-nginx is the default external routing solution if you don't set these values explicitly. To opt out and use ingress-nginx instead — see Deploy ingress-nginx first — replace the Envoy-specific settings with:

--set nginx.enabled=true \
--set nevisAdmin4.ingress.enabled=true \
--set nevisAdmin4.gateway.enabled=false \
--set nginx.nameOverride=$RELEASE_NAMESPACE-nginx

Kubernetes

helm install $RELEASE_NAME nevisadmin4 -n $RELEASE_NAMESPACE --version $NEVIS_VERSION \
    --repo https://dl.cloudsmith.io/$CLOUDSMITH_PASSWORD/nevissecurity/rolling/helm/charts/ \
    --set image.repository=$CONTAINER_REGISTRY \
    --set git.repositoryUrl=$GIT_REPOSITORY_URL \
    --set git.credentialSecret=nevis-git-credential \
    --set database.type=postgresql \
    --set database.port=5432 \
    --set database.host=$DATABASE_HOST \
    --set database.root.preparedCredentialSecret=nevis-database-credential \
    --set nevisAdmin4.domain=$DOMAIN \
    --set nevisAdmin4.credentialSecret=nevis-nevisadmin4-admin-credential \
    --set nevisAdmin4.database.credentialSecret=nevis-nevisadmin4-database-credential \
    --set nginx.enabled=false \
    --set nevisAdmin4.ingress.enabled=false \
    --set nevisAdmin4.gateway.enabled=true

caution

database.type defaults to mariadb and database.port independently defaults to 3306 — setting database.type=postgresql alone does not change the port. If you're using PostgreSQL (the recommended option, see Prerequisites) but omit database.port=5432, the dbschema job will silently try to connect on the wrong port and fail with a timeout, not a clear error. This is being fixed upstream so postgresql/5432 become the new defaults together — until that ships, set both explicitly.

Deploy components to a separate namespace

By default, nevisAdmin 4 can only deploy Nevis components (for example nevisIDM, nevisAuth, and nevisProxy) into its own release namespace. If you want to deploy components into a different namespace — for example, to separate the nevisAdmin 4 management plane from the runtime components — you must:

Create the target namespace:

kubectl create namespace <component-namespace>

Grant nevisAdmin 4 permission to deploy there by adding it to additionalComponentNamespaces:
```
helm upgrade $RELEASE_NAME nevisadmin4 -n $RELEASE_NAMESPACE \
  --repo https://dl.cloudsmith.io/$CLOUDSMITH_PASSWORD/nevissecurity/rolling/helm/charts/ \
  --version $NEVIS_VERSION \
  --reuse-values \
  --set "additionalComponentNamespaces={<component-namespace>}"
```
This can also be set during the initial install by adding --set "additionalComponentNamespaces={<component-namespace>}" to the helm install command above. The namespace must exist before nevisOperator attempts to deploy into it — nevisOperator does not create it automatically.
Select <component-namespace> as the component namespace in the nevisAdmin 4 inventory. Adding a namespace to additionalComponentNamespaces grants permission to deploy there but does not change the deployment target.

OpenShift

This variant currently documents ingress-nginx only — Envoy Gateway on OpenShift is not yet covered here.

As ingress-nginx must run with user 101 and needs capabilities such as NET_BIND_SERVICE, it's required that the used SecurityContext is changed on OpenShift. Additionally, it's not allowed to set the fsGroup of the nevisAdmin 4 deployment.

# Username for the registry
REGISTRY_USERNAME=
# Password for the registry
REGISTRY_PASSWORD=

# Prepare registry secret
oc create secret docker-registry registry-secret --docker-server="$CONTAINER_REGISTRY" --docker-username="$REGISTRY_USERNAME" --docker-password="$REGISTRY_PASSWORD" -n "$RELEASE_NAMESPACE"
# Prepare nginx service account
oc create serviceaccount nevisadmin4-nginx -n "$RELEASE_NAMESPACE"
oc adm policy add-scc-to-user privileged -z nevisadmin4-nginx -n "$RELEASE_NAMESPACE"

helm install $RELEASE_NAME nevisadmin4 -n $RELEASE_NAMESPACE --version $NEVIS_VERSION \
    --repo https://dl.cloudsmith.io/$CLOUDSMITH_PASSWORD/nevissecurity/rolling/helm/charts/ \
    --set image.repository=$CONTAINER_REGISTRY \
    --set image.imagePullSecretName=registry-secret \
    --set git.repositoryUrl=$GIT_REPOSITORY_URL \
    --set git.credentialSecret=nevis-git-credential \
    --set database.type=postgresql \
    --set database.port=5432 \
    --set database.host=$DATABASE_HOST \
    --set database.root.preparedCredentialSecret=nevis-database-credential \
    --set nevisAdmin4.domain=$DOMAIN \
    --set nevisAdmin4.podSecurityContext.fsGroup=null \
    --set nevisAdmin4.credentialSecret=nevis-nevisadmin4-admin-credential \
    --set nevisAdmin4.database.credentialSecret=nevis-nevisadmin4-database-credential \
    --set nginx.serviceAccount.create=false \
    --set nginx.serviceAccount.name=nevisadmin4-nginx \
    --set nginx.nameOverride=$RELEASE_NAMESPACE-$RELEASE_NAME

Upgrade

To upgrade the installation, copy over the new images from Upload Nevis Docker Images then run:

helm get values $RELEASE_NAME -n $RELEASE_NAMESPACE > values.yaml \
&& helm upgrade $RELEASE_NAME nevisadmin4 -n $RELEASE_NAMESPACE -f values.yaml \
--repo https://dl.cloudsmith.io/$CLOUDSMITH_PASSWORD/nevissecurity/rolling/helm/charts/ \
--set <your-new-values> \
--version <version-to-upgrade>

If the version is not provided, it upgrades to the latest one.

Using existing ingress-nginx installation

Set the nginx.enabled to false, and set the nginx.controller.ingressClassResource.name and nginx.controller.ingressClass values to the ingress class of the existing ingress-nginx controller.

Starting with nginx 1.12, snippet annotations have a Critical risk level, and Ingress resources containing them are ignored by the controller by default. As this is required for the side-by-side deployment to function, make sure that you have the following in the ConfigMap used by ingress-nginx:

allow-snippet-annotations: "true"
annotations-risk-level: Critical
annotation-value-word-blocklist: load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,',\

It's recommended to use a blocklist to prevent misuse.

Appendix: nevisAdmin 4 Chart Values

additionalComponentNamespaces

By default, the permissions and accessory resources are set up in a way that it's only possible to deploy from nevisAdmin4 to the same namespace where the chart is installed. Listing additional ones here, will make it so that nevisAdmin4 can deploy to these namespaces. The namespace itself has to exist already.

Type: list

Default:

[]

bootstrap

Supports importing initial projects and inventories into nevisAdmin 4 and creating a repository in gitea.

Type: object

Default:

annotations: {}
gitea:
    enabled: false
image:
    version: 1.3.0
labels: {}
nevisAdmin4:
    enabled: false
podAnnotations: {}
podLabels: {}

bootstrap.annotations

Annotations to put onto the Job.

Type: object

Default:

{}

bootstrap.labels

Labels to put onto the bootstrap job.

Type: object

Default:

{}

bootstrap.podAnnotations

Annotations to put onto the pods.

Type: object

Default:

{}

bootstrap.podLabels

Labels to put onto the bootstrap job pod.

Type: object

Default:

{}

certManager.createCAIssuer

Create a CA Issuer to the main release namespace, it also creates a self-signed issuer to prepare the root CA

Type: bool

Default: true

certManager.createLetsEncryptIssuer

Creates a Let's encrypt issuer to every component namespace

Type: bool

Default: true

certManager.httpSolverGateway

Specify the gateway to be used for the http01 challenge solver. Must have a HTTP listener that allows routes from nevisadmin4 and component namespaces. By default, the nevisadmin4 gateway is used.

Type: string

Default: not set

certManager.httpSolverGatewayNamespace

Namespace of the gateway to be used for the http01 challenge solver. By default, the release namespace is used.

Type: string

Default: not set

database.host

Database host, example: mariadb29a7439e.mariadb.database.azure.com

Type: string

Default: not set

database.port

Database port

Type: string

Default: "3306"

database.root.credentialSecret

DEPRECATED: Use preparedCredentialSecret instead. Secret containing the username and password for the root user. Must have the "username" and "password" key.

Type: string

Default: "helm-database-credential"

database.root.password

Root password in plain value. It's recommended to prepare a secret instead.

Type: string

Default: not set

database.root.preparedCredentialSecret

When using this value, root-creds secret will only be created in the namespace where nevisAdmin4 resides. Adjust the Root Credential Namespace in the Database patterns of nevisAdmin 4 before the migration to this value.

Type: string

Default: not set

database.root.username

Root username in plain value. It's recommended to prepare a secret instead.

Type: string

Default: not set

database.type

Type of the database, supported values: mariadb, postgresql

Type: string

Default: "mariadb"

git.caCert64

Base64 PEM CA certificate, used to trust a private/internal CA for HTTPS git connections. Not needed for public CAs. Alternatively, a "ca.crt" key can be added to credentialSecret. If both are set, this value takes precedence over credentialSecret's "ca.crt" key.

Type: string

Default: not set

git.credentialSecret

Secret containing the git credentials, to avoid having plain values in the values file. Must have "key", "key.pub", "known_hosts", "passphrase", "username", "password" secret keys. In case only http or ssh is used, the corresponding values can be empty, but the keys still have to exist in the secret. Optionally, a "ca.crt" key can be added to trust a private/internal CA for HTTPS connections.

Type: string

Default: not set

git.knownHosts64

Base64 known_hosts.

Type: string

Default: not set

git.passphrase

Private key passphrase

Type: string

Default: not set

git.password

Password used for http authentication. It's recommended to prepare a secret instead.

Type: string

Default: not set

git.privateKey64

Base64 git private key.

Type: string

Default: not set

git.publicKey64

Base64 git public key.

Type: string

Default: not set

git.repositoryUrl

Git repository, can be either ssh or http

Type: string

Default: not set

git.repositoryUrlMap

Makes it possible to use a different repository for each component namespace

Type: object

Default:

{}

git.username

Username used for http authentication. It's recommended to prepare a secret instead.

Type: string

Default: not set

gitea.enabled

Type: bool

Default: false

gitea.fullnameOverride

Name of the gitea deployment

Type: string

Default: "gitea"

gitea.gitea.admin.email

Type: string

Default: "[email protected]"

gitea.gitea.admin.password

Gitea admin password

Type: string

Default: not set

gitea.gitea.admin.username

Gitea admin username

Type: string

Default: not set

gitea.gitea.config.cache.ADAPTER

Type: string

Default: "memory"

gitea.gitea.config.cache.ENABLED

Type: bool

Default: true

gitea.gitea.config.cache.HOST

Type: string

Default: "127.0.0.1:9090"

gitea.gitea.config.cache.INTERVAL

Type: int

Default: 60

gitea.gitea.config.database.DB_TYPE

Type: string

Default: "mysql"

gitea.gitea.config.database.HOST

Type: string

Default: "mariadb:3306"

gitea.gitea.config.database.NAME

Type: string

Default: "gitea"

gitea.gitea.config.database.PASSWD

Database user password

Type: string

Default: not set

gitea.gitea.config.database.SCHEMA

Type: string

Default: "gitea"

gitea.gitea.config.database.USER

Database user for gitea

Type: string

Default: not set

gitea.gitea.config.server.ROOT_URL

Root url of gitea

Type: string

Default: not set

gitea.httproute.enabled

Create a HTTPRoute for gitea, using the nevisAdmin4 gateway. This is a workaround as the gitea chart does not yet support creating httproutes. If enabled, set gitea.gitea.config.server.ROOT_URL to {{ .Values.nevisAdmin4.domain }}/gitea

Type: bool

Default: true

gitea.image.rootless

Use rootless image

Type: bool

Default: true

gitea.ingress.annotations."cert-manager.io/cluster-issuer"

Type: string

Default: "letsencrypt-prod"

gitea.ingress.annotations."nginx.ingress.kubernetes.io/rewrite-target"

Type: string

Default: "/$2"

gitea.ingress.apiVersion

Type: string

Default: "networking.k8s.io/v1"

gitea.ingress.enabled

Type: bool

Default: false

gitea.ingress.hosts[0].host

Type: string

Default: not set

gitea.ingress.hosts[0].paths[0].path

Type: string

Default: "/gitea(/|$)(.*)"

gitea.ingress.hosts[0].paths[0].pathType

Type: string

Default: "ImplementationSpecific"

gitea.ingress.tls[0].hosts[0]

Type: string

Default: not set

gitea.ingress.tls[0].secretName

Type: string

Default: "gitea-tls"

gitea.job.annotations

Annotations to put onto the Job.

Type: object

Default:

{}

gitea.job.labels

Type: object

Default:

{}

gitea.job.podAnnotations

Annotations to put onto the pods.

Type: object

Default:

{}

gitea.job.podLabels

Labels to put onto the bootstrap job pod.

Type: object

Default:

{}

gitea.memcached.enabled

Type: bool

Default: false

gitea.mysql.enabled

Type: bool

Default: false

gitea.postgresql.enabled

Type: bool

Default: false

gitea.statefulset.env[0].name

Type: string

Default: "HOME"

gitea.statefulset.env[0].value

Type: string

Default: "/data/git"

image.imagePrefix

Image prefix, nevis images will be pulled from [repository]/[imagePrefix]

Type: string

Default: "nevis"

image.imagePullSecretName

Name of the secret containing the credentials, only necessary if a private repository is used.

Type: string

Default: not set

image.repository

Repository where the images will be pulled from

Type: string

Default: not set

nevisAdmin4.affinity

Type: object

Default:

{}

nevisAdmin4.annotations

Additional annotations to be put on the nevisAdmin4 StatefulSet.

Type: object

Default:

{}

nevisAdmin4.certManagerIssuer

Specify the cert-manager issuer for the nevisAdmin4 ingress/gateway

Type: string

Default: "letsencrypt-prod"

nevisAdmin4.config

low level configuration options

Type: object

Default:

env: ""
logback: ""
nevisadmin4: {}

nevisAdmin4.config.env

Content of env.conf configuration file as multiline string

Type: string

Default: not set

nevisAdmin4.config.logback

Content of logback.xml configuration file as multiline string

Type: string

Default: not set

nevisAdmin4.config.nevisadmin4

Content of nevisadmin4.yml configuration file

Type: object

Default:

{}

nevisAdmin4.configOverrideEnabled

The env.conf, nevisadmin4.yml and logback.xml can be overwritten by placing the file with the same name besides the values.yaml.

Type: bool

Default: false

nevisAdmin4.containerSecurityContext

Security context for the nevisAdmin4 pod containers.

Type: object

Default:

allowPrivilegeEscalation: false
capabilities:
    drop:
        - ALL

nevisAdmin4.cors

cors attributes

Type: object

Default:

{}

nevisAdmin4.credentialSecret

Secret containing the initial password of nevisAdmin4 to avoid plain values in the values file. Must have the "password" key. If credentialSecret and password is not given it will be autogenerated. Must be prepared id advance.

Type: string

Default: not set

nevisAdmin4.database.applicationUser

Database user by nevisAdmin4

Type: string

Default: "admin4appuser"

nevisAdmin4.database.applicationUserPassword

Database app user password.

Type: string

Default: not set

nevisAdmin4.database.credentialSecret

Secret containing schema and application user credentials to avoid plain values in the values file. Must have the "applicationUser", "applicationUserPassword", "schemaUser", "schemaUserPassword" key. Must be prepared is advance.

Type: string

Default: not set

nevisAdmin4.database.enableSSL

Disable ssl if it's not supported by the database

Type: bool

Default: true

nevisAdmin4.database.job

Values for the dbschema job

Type: object

Default:

annotations: {}
cleanupEnabled: true
labels: {}
podAnnotations: {}
podLabels: {}
ttlSecondsAfterFinished: 1200

nevisAdmin4.database.job.annotations

Annotations to put onto the migration job.

Type: object

Default:

{}

nevisAdmin4.database.job.cleanupEnabled

dbschema job will be deleted automatically

Type: bool

Default: true

nevisAdmin4.database.job.labels

Labels to put onto the migration job.

Type: object

Default:

{}

nevisAdmin4.database.job.podAnnotations

Annotations to put onto the migration job pod.

Type: object

Default:

{}

nevisAdmin4.database.job.podLabels

Labels to put onto the migration job pod.

Type: object

Default:

{}

nevisAdmin4.database.name

Name of the database

Type: string

Default: "nevisadmin4"

nevisAdmin4.database.schemaUser

Database user used for the migration of the database for nevisAdmin4.

Type: string

Default: "admin4schemauser"

nevisAdmin4.database.schemaUserPassword

Database schema user password.

Type: string

Default: not set

nevisAdmin4.deployment.credentialSecret

Secret containing the deployment SSH credentials, to avoid having plain values in the values.yaml file. The "key" secret key is required. The "passphrase" and "known_hosts" are optional.

Type: string

Default: not set

nevisAdmin4.deployment.sshKnownHostsEnabled

Set to true if the credentialSecret contains a "known_hosts" key for SSH host verification.

Type: bool

Default: false

nevisAdmin4.deployment.sshPassphraseEnabled

Set to true if the credentialSecret contains a "passphrase" key for the SSH private key.

Type: bool

Default: false

nevisAdmin4.domain

Domain where nevisAdmin4 will be reachable

Type: string

Default: not set

nevisAdmin4.enabled

Type: bool

Default: true

nevisAdmin4.extraEnvs

Additional environment variables that will be added to the nevisAdmin4 container

Type: list

Default:

[]

nevisAdmin4.gateway.allowRoutesFromComponentNamespaces

Allow routes from component namespaces to attach to the nevisadmin4 gateway. This is required when using the same hostname for nevisadmin4 and nevisProxy virtual hosts.

Type: bool

Default: true

nevisAdmin4.gateway.enabled

Type: bool

Default: true

nevisAdmin4.gateway.gatewayClassName

Gateway class to use for the nevisAdmin4 Gateway.

Type: string

Default: "envoy-gateway"

nevisAdmin4.gateway.generateGateway

Create the Gateway resource for nevisAdmin4.

Type: bool

Default: true

nevisAdmin4.gateway.name

Name of the nevisAdmin4 Gateway. The HTTPRoute will reference this gateway whether it's created by the chart or already existing.

Type: string

Default: "nevisadmin4-gateway"

nevisAdmin4.gateway.namespace

Namespace where the Gateway is deployed. When generateGateway is set to true, this value is ignored and the release namespace is used. Defaults to the release namespace if not set.

Type: string

Default: not set

nevisAdmin4.gateway.tls.enabled

Add HTTPS listener to the gateway. If set to false, only HTTP listener will be created.

Type: bool

Default: true

nevisAdmin4.gateway.tls.secretName

Secret name for the TLS certificate, if useExistingSecret is set to false, a new secret will be generated by cert-manager.

Type: string

Default: "nevisadmin4-frontend-tls"

nevisAdmin4.gateway.tls.useExistingSecret

Use existing secret for TLS certificate. If set to true, secretName will be used as TLS secret on the listener.

Type: bool

Default: false

nevisAdmin4.image.migrationTag

Overrides the dbschema image tag whose default is the chart appVersion.

Type: string

Default: not set

nevisAdmin4.image.tag

Overrides the image tag whose default is the chart appVersion.

Type: string

Default: not set

nevisAdmin4.imagePullPolicy

Image pull policy for the nevisadmin4 container and nevisadmin4-dbschema init containers.

Type: string

Default: "Always"

nevisAdmin4.ingress.annotations

Annotations to be put on the nevisAdmin4 Ingress.

Type: object

Default:

nginx.ingress.kubernetes.io/proxy-body-size: 100m

nevisAdmin4.ingress.enabled

Type: bool

Default: false

nevisAdmin4.ingress.ingressClass

Ingress class to use for the nevisAdmin4 Ingress.

Type: string

Default: "nginx"

nevisAdmin4.ingress.tls.enabled

Add TLS settings to the nevisAdmin4 Ingress. If set to false, the ingress controller's default TLS settings will be used.

Type: bool

Default: true

nevisAdmin4.ingress.tls.secretName

Secret name for the TLS certificate, if useExistingSecret is set to false, a new secret will be generated by cert-manager.

Type: string

Default: "nevisadmin4-frontend-tls"

nevisAdmin4.ingress.tls.useExistingSecret

Use existing secret for TLS certificate, if set to true, secretName will be used as TLS secret on the ingress.

Type: bool

Default: false

nevisAdmin4.ingressIssuerAnnotation

cert-manager annotation to put on the ingress/gateway

Type: string

Default: "cert-manager.io/issuer"

nevisAdmin4.jwt.hmacSignerSecret

Secret used for JWT token signing. If not set, a random secret is generated on nevisAdmin startup. Set to call the API using a prepared token.

Type: string

Default: not set

nevisAdmin4.labels

Additional labels to be put on the nevisAdmin4 StatefulSet.

Type: object

Default:

{}

nevisAdmin4.ldap

ldap attributes for the nevisadmin4.yml

Type: object

Default:

context: {}
enabled: false
search: {}
truststore64: ""
truststorePassphrase: ""
user: {}

nevisAdmin4.ldap.context

ldap context block

Type: object

Default:

{}

nevisAdmin4.ldap.enabled

Enable ldap

Type: bool

Default: false

nevisAdmin4.ldap.search

ldap search block

Type: object

Default:

{}

nevisAdmin4.ldap.truststore64

pkcs12 truststore in base64 format

Type: string

Default: not set

nevisAdmin4.ldap.truststorePassphrase

truststore passphrase

Type: string

Default: not set

nevisAdmin4.ldap.user

ldap user block

Type: object

Default:

{}

nevisAdmin4.livenessProbe

Specify a custom livenessProbe.

Type: object

Default:

{}

nevisAdmin4.managementPort

Management port, this is where the health checks will be available

Type: int

Default: 9889

nevisAdmin4.migrationResources.limits.cpu

Type: string

Default: "1000m"

nevisAdmin4.migrationResources.limits.memory

Type: string

Default: "1000Mi"

nevisAdmin4.migrationResources.requests.cpu

Type: string

Default: "20m"

nevisAdmin4.migrationResources.requests.memory

Type: string

Default: "200Mi"

nevisAdmin4.nodeSelector

Type: object

Default:

{}

nevisAdmin4.otel.enabled

Enable OpenTelemetry forwarding

Type: bool

Default: false

nevisAdmin4.otel.protocol

OpenTelemetry protocol

Type: string

Default: "http/protobuf"

nevisAdmin4.otel.url

OpenTelemetry url

Type: string

Default: not set

nevisAdmin4.password

Initial password of nevisAdmin4. If credentialSecret and password is not given it will be autogenerated.

Type: string

Default: not set

nevisAdmin4.passwordLoginEnabled

When SAML or LDAP is used you can disable the local password authentication.

Type: bool

Default: true

nevisAdmin4.passwordPolicy

Password policy for local authentication. Note: The admin user always requires a password >= 16 characters, independent of this policy setting. Defaults keep backward compatibility with previous versions (minimal restrictions).

Type: object

Default:

minLength: 6
minLower: 0
minNonAlnum: 0
minNumeric: 0
minUpper: 0
passwordExpiration: 0
weakPasswordFile: pwlist.txt
weakPasswordPvc: ""

nevisAdmin4.passwordPolicy.weakPasswordFile

Name of the file inside the PVC that contains the weak-password list.

Type: string

Default: "pwlist.txt"

nevisAdmin4.passwordPolicy.weakPasswordPvc

Name of an existing PVC containing the weak-password list. When set, the PVC is mounted and its content is used to reject weak passwords on password change. The file must contain one forbidden password per line.

Type: string

Default: not set

nevisAdmin4.podAnnotations

Additional annotations to be put on the nevisAdmin4 pods.

Type: object

Default:

{}

nevisAdmin4.podLabels

Additional labels to be put on the nevisAdmin4 pods.

Type: object

Default:

{}

nevisAdmin4.podSecurityContext

Security context for the nevisAdmin4 pods.

Type: object

Default:

fsGroup: 2000
runAsNonRoot: true

nevisAdmin4.port

Default port of nevisAdmin4

Type: int

Default: 9080

nevisAdmin4.priorityClassName

Priority class name for nevisAdmin4 pods

Type: string

Default: not set

nevisAdmin4.productAnalytics.enabled

Enable product analytics

Type: bool

Default: false

nevisAdmin4.productAnalytics.prometheus.credentialSecret

Credential secret for Prometheus in case basic authentication is enabled. Has to have "password" and "username" keys.

Type: string

Default: not set

nevisAdmin4.productAnalytics.prometheus.password

Password for Prometheus in case basic authentication is enabled

Type: string

Default: not set

nevisAdmin4.productAnalytics.prometheus.url

base url of the Prometheus instance

Type: string

Default: not set

nevisAdmin4.productAnalytics.prometheus.username

Username for Prometheus in case basic authentication is enabled

Type: string

Default: not set

nevisAdmin4.readinessProbe

Specify a custom readinessProbe.

Type: object

Default:

{}

nevisAdmin4.resources.limits.cpu

Type: string

Default: "4000m"

nevisAdmin4.resources.limits.memory

Type: string

Default: "4500Mi"

nevisAdmin4.resources.requests.cpu

Type: string

Default: "1000m"

nevisAdmin4.resources.requests.memory

Type: string

Default: "1500Mi"

nevisAdmin4.saml.attribute

Maps SAML assertion attributes to nevisAdmin 4 user properties. Defaults correspond to the SAML attribute names used by Microsoft Entra ID (formerly Azure AD). The group-keys names the single assertion attribute whose values are used directly as nevisAdmin 4 group names. This works when your IdP is configured to include exact nevisAdmin 4 group names (for example __admin) as role or group values in the assertion. If the assertion values do not match nevisAdmin 4 group names, add roles-key and role-mappings to define an explicit translation. For setup instructions and an example, see SAML Integration documentation.

Type: object

Default:

email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
first-name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
group-keys: http://schemas.microsoft.com/ws/2008/06/identity/claims/role
last-name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
user-key: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

nevisAdmin4.saml.certificate64

Base64 saml.crt.

Type: string

Default: not set

nevisAdmin4.saml.enabled

Enable SAML login

Type: bool

Default: false

nevisAdmin4.saml.idp.hostnameVerificationEnabled

Set to false to disable hostname verification for the IdP metadata TLS connection. Only disable this in non-production environments. Only takes effect when trustStoreSecret is also set.

Type: bool

Default: true

nevisAdmin4.saml.idp.metadataUri

Type: string

Default: nil

nevisAdmin4.saml.idp.trustStoreSecret

Name of an existing Kubernetes Secret containing the truststore for the IDP metadata endpoint. Required when the IDP metadata URL is served with a certificate from a private or internal CA. Also requires nevisAdmin4.saml.enabled: true to take effect. The secret must contain a truststore file under key 'truststore.p12' (when trustStoreType is PKCS12, the default) or 'truststore.jks' (when trustStoreType is JKS), plus a 'passphrase' key with the truststore password. The IdP metadata is refreshed in the background every hour by default. For setup instructions, see SAML Integration documentation.

Type: string

Default: not set

nevisAdmin4.saml.idp.trustStoreType

Truststore format. Supported values: PKCS12, JKS. Determines which key name is expected in trustStoreSecret (truststore.p12 or truststore.jks).

Type: string

Default: "PKCS12"

nevisAdmin4.saml.keySecret

Secret containing the sam key and certificate to avoid using local files. Must be prepared advance. Must have saml.key and saml.crt key.

Type: string

Default: not set

nevisAdmin4.saml.privateKey64

Base64 saml.key.

Type: string

Default: not set

nevisAdmin4.springProfiles

Commma seperated list of spring profiles to use, overrides all defaults

Type: string

Default: not set

nevisAdmin4.storageClass

Specify the storage class for the nevisAdmin4 persistent volume

Type: string

Default: not set

nevisAdmin4.tls.enabled

Enable https for nevisadmin4, it will only affect the traffic between nginc and nevisadmin4

Type: bool

Default: false

nevisAdmin4.tls.keyAlias

The key alias

Type: string

Default: "nevisadmin"

nevisAdmin4.tls.keystore

Keystore file to use, will be used instead of the prepared secret or base64 if the file is available in the chart folder. The keystore must contain the full certificate chain if Gateway API is used.

Type: string

Default: "keystore.p12"

nevisAdmin4.tls.keystore64

Base64 keystore file.

Type: string

Default: not set

nevisAdmin4.tls.keystoreSecret

Secret containing the tls keystore, to avoid plain values and using a local files. Must be prepared in advance. Must have the "passphrase" and the value for tls.keystore as a secret key.

Type: string

Default: not set

nevisAdmin4.tls.keystoreType

Keystore type

Type: string

Default: "pkcs12"

nevisAdmin4.tls.passphrase

Keystore passphrase

Type: string

Default: not set

nevisAdmin4.tls.port

Port to use if https is enabled.

Type: int

Default: 8443

nevisAdmin4.tolerations

Type: list

Default:

[]

nevisAdmin4.trustStore

Trust a private/internal CA for outbound Java HTTPS connections made by nevisAdmin4 itself (see -Djavax.net.ssl.trustStore, set via JAVA_OPTS in nevisAdmin4.config.env / env.conf), for example when fetching Git configuration over HTTPS from a server whose certificate is issued by a private/internal CA. Mirrors the same mounting pattern as the SAML IdP truststore (saml.idp.trustStoreSecret/trustStoreType), but with its own dedicated secretName/type keys under trustStore.

Type: object

Default:

secretName: ""
type: PKCS12

nevisAdmin4.trustStore.secretName

Name of an existing Kubernetes Secret containing the Java truststore. Mounted read-only at /var/opt/nevisadmin4/conf/custom-truststore. The secret must contain a truststore file under key 'truststore.p12' (when trustStore.type is PKCS12, the default) or 'truststore.jks' (when trustStore.type is JKS).

Type: string

Default: not set

nevisAdmin4.trustStore.type

Truststore type. Accepted values: PKCS12 (default), JKS. Case-insensitive.

Type: string

Default: "PKCS12"

nevisAdmin4.yaml.literalBlockStyle.enabled

YAML literal block style formatting, if not set the default settings is coming from nevisAdmin4 itself.

Type: bool

Default: nil

nevisOperator.affinity

Type: object

Default:

{}

nevisOperator.annotations

Annotations to put onto the Deployment.

Type: object

Default:

{}

nevisOperator.certRetrievalTimeout

Time the operator will wait for certificates to be issued on CertificateRequests before it will be considered failed. Accepts a duration string (e.g. 20s, 5m, 1h).

Type: string

Default: "20s"

nevisOperator.certificateDuration

Certificate duration of the internal certificates created with cert-manager

Type: string

Default: "8760h"

nevisOperator.containerSecurityContext

Security context for the nevisOperator pod containers.

Type: object

Default:

allowPrivilegeEscalation: false
capabilities:
    drop:
        - ALL

nevisOperator.csr

These values will be used for creating the internal certificates with cert-manager

Type: object

Default:

country: CH
email-address: [email protected]
locality: K8S
organization: K8S
organizational-unit: K8S
province: K8S

nevisOperator.defaultImagePullPolicy

Sets the default imagePullPolicy for the deployed components by nevisAdmin 4

Type: string

Default: not set

nevisOperator.enableLeaderElection

Enable leader election for nevisOperator, this make it possible to run with multiple replicas

Type: bool

Default: true

nevisOperator.enabled

Enable deployment of nevisOperator

Type: bool

Default: true

nevisOperator.gatewayClassName

Default gateway class the nevisOperator will create gateways with unless specified in the NevisGateway custom resource

Type: string

Default: "envoy-gateway"

nevisOperator.gatewayIssuer

Name of the issuer that will be used for the generated gateways

Type: string

Default: "letsencrypt-prod-gw"

nevisOperator.gatewayIssuerAnnotation

cert-manager annotation to put on the gateway (and ingress if enabled) resources. Takes precedence over ingressIssuerAnnotation when both are defined.

Type: string

Default: "cert-manager.io/issuer"

nevisOperator.image.tag

Overrides the image tag whose default is the chart appVersion.

Type: string

Default: not set

nevisOperator.imagePullPolicy

Image pull policy for the nevisOperator container.

Type: string

Default: "Always"

nevisOperator.ingressClass

Default ingress class the nevisOperator will create ingresses with unless specified in the NevisIngress custom resource

Type: string

Default: "nginx"

nevisOperator.ingressIssuer

Name of the issuer that will be used for the generated ingresses

Type: string

Default: "letsencrypt-prod"

nevisOperator.ingressIssuerAnnotation

cert-manager annotation to put on the ingress (and gateway if enabled) resources. Superseded by gatewayIssuerAnnotation when both are defined.

Type: string

Default: "cert-manager.io/issuer"

nevisOperator.internalIssuer

Name of the internal issuer used to create the certificate for internal communication between the components

Type: string

Default: "ca-issuer"

nevisOperator.internalIssuerCASecret

Name of the CA secret of the internal issuer

Type: string

Default: "ca-root-secret"

nevisOperator.internalIssuerCASecretNamespace

Namespace of the CA secret, defaults to the release namespace

Type: string

Default: not set

nevisOperator.internalIssuerNamespace

Namespace of the internal issuer used to create the certificate for internal communication between the components

Type: string

Default: not set

nevisOperator.labels

Labels to put onto the Deployment.

Type: object

Default:

{}

nevisOperator.nevisAdmin4ServiceAccountNamespace

Namespace where the service account defined in .Values.serviceAccount.name (default nevisadmin4) is deployed. This is used for setting up nevisAdmin4 access when nevisOperator is installed separately. If left empty, no role or rolebinding will be created.

Type: string

Default: not set

nevisOperator.nodeSelector

Type: object

Default:

{}

nevisOperator.podAnnotations

Annotations to put onto the pods.

Type: object

Default:

{}

nevisOperator.podLabels

Labels to put onto the pods.

Type: object

Default:

{}

nevisOperator.podSecurityContext

Security context for the nevisOperator pods.

Type: object

Default:

runAsNonRoot: true

nevisOperator.preStopSleepTime

Time in seconds the pod will sleep before sending SIGTERM to the container

Type: int

Default: 32

nevisOperator.priorityClassName

Priority class name for nevisOperator pods

Type: string

Default: not set

nevisOperator.replicas

Type: int

Default: 1

nevisOperator.resources.limits.cpu

Type: string

Default: "200m"

nevisOperator.resources.limits.memory

Type: string

Default: "256Mi"

nevisOperator.resources.requests.cpu

Type: string

Default: "100m"

nevisOperator.resources.requests.memory

Type: string

Default: "96Mi"

nevisOperator.restrictNamespaces.additionalNamespaces

Add additional namespaces the nevisOperator has access to, this is useful in case a secret or some other resource is referenced in the configuration. If the goal is to deploy to these namespace use the additionalComponentNamespaces value instead

Type: list

Default:

[]

nevisOperator.restrictNamespaces.enabled

By default, nevisOperator only has access to the namespace where it resides, and the namespaces from the additionalComponentNamespaces

Type: bool

Default: true

nevisOperator.shutdownTimer

Time in seconds deployed components will have to finish their shutdown sequence

Type: int

Default: 30

nevisOperator.tolerations

Type: list

Default:

[]

nginx.controller

Settings for the nginx ingress controller.

Type: object

Default:

admissionWebhooks:
    enabled: false
config:
    annotation-value-word-blocklist: load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount
    annotations-risk-level: Critical
ingressClassResource:
    enabled: true
    name: nginx
service:
    externalTrafficPolicy: Local

nginx.controller.config.annotations-risk-level

It is necessary to allow Critical rated annotations for canary deployments

Type: string

Default: "Critical"

nginx.enabled

Disable if nginx is already installed. See nginx.controller for configuration.

Type: bool

Default: false

podLabels

Labels that will put onto every pod created by the chart

Type: object

Default:

{}

serviceAccount.create

Enable service account creation, if disabled the default service account will be used

Type: bool

Default: true

serviceAccount.name

Override the name of the created service account for nevisadmin4

Type: string

Default: not set

serviceAccount.nevisOperatorName

Override the name of the created service account for nevisoperator

Type: string

Default: not set

Appendix: Scripted Installation

For full control, we recommend to go through all sections of this guide step by step. However, to speed up the installation, you may have a look at this installer script: kubernetes-installer.sh

warning

The script does not expose all settings, and it is possible that it does not work for you. We are working on improvements / replacements, but for now the script is provided as-is.

The script uses environment variables that you have already exported, but it also provides command line parameters for customization. See the following help for details:

$ ./kubernetes-installer.sh --help
### Usage: ./kubernetes-installer.sh
    --upgrade                                                  upgrade an existing installation
    --add-nginx-node-port                                      
    --add-nginx-load-balancer                                  
    --namespace <namespace>                                    required
    --domain <domain>                                          required
    --container-registry <container_registry>                  required
    --registry-image-prefix <registry-image-prefix>            optional (default: nevis)
    --registry-username <registry_username>                    required
    --registry-password <registry_password>                    required
    --cloudsmith-password <cloudsmith_password>                required if not using a separate helm repository
    --nevisadmin-password <nevisadmin_password>               
    --git-password <git_password>                             
    --database-password <database_password>                   
    --version <chart_version>                                 
    --helm-repository <helm_repository>                       
    --helm-repository-username <helm_repository_password>     
    --helm-repository-password <helm_repository_username>     
    --cluster-context                                          switch to the given context
    --skip-images                                              skip image pull from Cloudsmith
    --no-prompt                                                answer y to every question
    --helm-setting <setting>                                   add a custom helm value to the installation with --set
    --image-version <image_version>                           
    --help                                                     show this help

Prerequisites
Prepare Git Deployment Repository
Set environment variables
Upload Nevis Docker Images
Deploy Envoy Gateway
Deploy cert-manager
Configure DNS after installation
Deploy ingress-nginx (opt-out)
Install CRD Chart
Install nevisAdmin 4 Chart
Appendix: nevisAdmin 4 Chart Values
Appendix: Scripted Installation

Prerequisites​

Prepare Git Deployment Repository​

Set environment variables​

Upload Nevis Docker Images​

Deploy Envoy Gateway​

Deploy cert-manager​

Configure DNS after installation​

Deploy ingress-nginx (opt-out)​

Install CRD Chart​

Install nevisAdmin 4 Chart​

Prepare secrets for installation​

Create namespace​

Create credential secrets​

Install​

Kubernetes​

Deploy components to a separate namespace​

OpenShift​

Upgrade​

Using existing ingress-nginx installation​

Appendix: nevisAdmin 4 Chart Values​

additionalComponentNamespaces​

bootstrap​

bootstrap.annotations​

bootstrap.labels​

bootstrap.podAnnotations​

bootstrap.podLabels​

certManager.createCAIssuer​

certManager.createLetsEncryptIssuer​

certManager.httpSolverGateway​

certManager.httpSolverGatewayNamespace​

database.host​

database.port​

database.root.credentialSecret​

database.root.password​

database.root.preparedCredentialSecret​

database.root.username​

database.type​

git.caCert64​

git.credentialSecret​

git.knownHosts64​

git.passphrase​

git.password​

git.privateKey64​

git.publicKey64​

git.repositoryUrl​

git.repositoryUrlMap​

git.username​

gitea.enabled​

gitea.fullnameOverride​

gitea.gitea.admin.email​

gitea.gitea.admin.password​

gitea.gitea.admin.username​

gitea.gitea.config.cache.ADAPTER​

gitea.gitea.config.cache.ENABLED​

gitea.gitea.config.cache.HOST​

gitea.gitea.config.cache.INTERVAL​

gitea.gitea.config.database.DB_TYPE​

gitea.gitea.config.database.HOST​

gitea.gitea.config.database.NAME​

gitea.gitea.config.database.PASSWD​

gitea.gitea.config.database.SCHEMA​

gitea.gitea.config.database.USER​

gitea.gitea.config.server.ROOT_URL​

gitea.httproute.enabled​

gitea.image.rootless​

gitea.ingress.annotations."cert-manager.io/cluster-issuer"​

gitea.ingress.annotations."nginx.ingress.kubernetes.io/rewrite-target"​

gitea.ingress.apiVersion​

gitea.ingress.enabled​

gitea.ingress.hosts[0].host​

gitea.ingress.hosts[0].paths[0].path​

gitea.ingress.hosts[0].paths[0].pathType​

gitea.ingress.tls[0].hosts[0]​

gitea.ingress.tls[0].secretName​

gitea.job.annotations​

gitea.job.labels​

gitea.job.podAnnotations​

gitea.job.podLabels​

gitea.memcached.enabled​

gitea.mysql.enabled​

Prerequisites

Prepare Git Deployment Repository

Set environment variables

Upload Nevis Docker Images

Deploy Envoy Gateway

Deploy cert-manager

Configure DNS after installation

Deploy ingress-nginx (opt-out)

Install CRD Chart

Install nevisAdmin 4 Chart

Prepare secrets for installation

Create namespace

Create credential secrets

Install

Kubernetes

Deploy components to a separate namespace

OpenShift

Upgrade

Using existing ingress-nginx installation

Appendix: nevisAdmin 4 Chart Values

additionalComponentNamespaces

bootstrap

bootstrap.annotations

bootstrap.labels

bootstrap.podAnnotations

bootstrap.podLabels

certManager.createCAIssuer

certManager.createLetsEncryptIssuer

certManager.httpSolverGateway

certManager.httpSolverGatewayNamespace

database.host

database.port

database.root.credentialSecret

database.root.password

database.root.preparedCredentialSecret

database.root.username

database.type

git.caCert64

git.credentialSecret

git.knownHosts64

git.passphrase

git.password

git.privateKey64

git.publicKey64

git.repositoryUrl

git.repositoryUrlMap

git.username

gitea.enabled

gitea.fullnameOverride

gitea.gitea.admin.email

gitea.gitea.admin.password

gitea.gitea.admin.username

gitea.gitea.config.cache.ADAPTER

gitea.gitea.config.cache.ENABLED

gitea.gitea.config.cache.HOST

gitea.gitea.config.cache.INTERVAL

gitea.gitea.config.database.DB_TYPE

gitea.gitea.config.database.HOST

gitea.gitea.config.database.NAME

gitea.gitea.config.database.PASSWD

gitea.gitea.config.database.SCHEMA

gitea.gitea.config.database.USER

gitea.gitea.config.server.ROOT_URL

gitea.httproute.enabled

gitea.image.rootless

gitea.ingress.annotations."cert-manager.io/cluster-issuer"

gitea.ingress.annotations."nginx.ingress.kubernetes.io/rewrite-target"

gitea.ingress.apiVersion

gitea.ingress.enabled

gitea.ingress.hosts[0].host

gitea.ingress.hosts[0].paths[0].path

gitea.ingress.hosts[0].paths[0].pathType

gitea.ingress.tls[0].hosts[0]

gitea.ingress.tls[0].secretName

gitea.job.annotations

gitea.job.labels

gitea.job.podAnnotations

gitea.job.podLabels

gitea.memcached.enabled

gitea.mysql.enabled