Installation

In this guide, you will set up nevisAdmin 4 on an existing Kubernetes cluster.

If you don't have a cluster yet, or need to prepare an Oracle volume, see Preparation first. See Restrictions in Kubernetes Setups for limitations specific to Kubernetes.

For a quick, automated test setup instead, see Test Setups, covering Azure and OpenShift. These are not recommended beyond test setups, as they make several assumptions.

We tested the installation with Azure, but other providers may work as well. For details about supported providers and versions, see Kubernetes Support Policy for Nevis.

Pay attention to the following:

nevisAdmin 4 requires between 4 GB and 16 GB of RAM and between 2 and 6 CPU cores, depending on project size and how many deployments/edits happen concurrently.
For the database, we recommend using PostgreSQL server, especially since support for MariaDB got removed in Azure. Use a database service whenever possible, especially for end user facing components. See the Nevis Product Lifetime and Platform Support Matrix for supported database versions.
In some Kubernetes installations, special permission settings or entitlements are required, for example, for the ingress-nginx component.

Prerequisites

Have an existing Kubernetes cluster and enough permissions to create resource groups and resources, which includes RBAC permissions.
- The installation of the crds, ingress-nginx and the cert-manager component needs cluster-wide permissions, for the rest, namespace scoped permissions are enough.
If using MariaDB as a database, the following server configuration is needed:

autocommit=0
transaction-isolation = READ-COMMITTED
log_bin_trust_function_creators = 1
lower_case_table_names = 1
character-set-server = utf8mb4

A Linux environment with the following software pre-installed:
- kubectl: Kubernetes command line interface. The same minor version is recommended as the used Kubernetes version.
- docker: Docker client.
- helm: Helm CLI

This guide requires basic knowledge of Linux and Kubernetes. If you are new to these topics, we recommend that you see tutorials or courses available online. If you have limited time, focus on Kubernetes tutorials, for example, Viewing Pods and Nodes.

Prepare Git Deployment Repository

In this tutorial, we use GitHub as the Git system. However, it is possible to use Bitbucket, Gitea, GitLab and more instead. The same options should be available in every case.

To configure the Git connection for nevisOperator, perform the following steps:

Prepare GitHub.
- Create a GitHub account.
- Create an empty Git repository called deploy.
- Set the GitHub repository to private. See https://help.github.com/en/articles/setting-repository-visibility#making-a-repository-private for detailed instructions

Create the SSH key material through the following commands:

#generate key pair
ssh-keygen -t ecdsa -C "kubernetes" -m PEM -P "" -f key

# create know_hosts file, replace the github domain if other Git system is used
ssh-keyscan github.com > known_hosts

# make sure ssh keys were generated
cat key
cat key.pub

The created key is used by both nevisOperator and nevisAdmin 4 to connect to GitHub.

Add the key key.pub to your GitHub account, or to the repository itself as a deployment key.

See http://help.github.com/en/articles/adding-a-new-ssh-key-to-your-github-account.
See the Deploy keys section in http://developer.github.com/v3/guides/managing-deploy-keys

Set environment variables

The remaining steps use the following environment variables:

Variable	Default	Description
`NEVISADMIN_PASSWORD`	—	Initial password for the nevisAdmin 4 admin user.
`NEVIS_VERSION`	—	Release version to install, for example `9.2605.2`. Find the latest one on the Nevis Portal download page or in the nevisAdmin 4 release notes. Used both for the image sync below and for the `--version` flag on the chart installs further down, so images and chart stay in sync.
`CONTAINER_REGISTRY`	—	Container registry of your Kubernetes cluster. Azure registries use a flat URL, for example `nevis.azurecr.io`.
`RELEASE_NAMESPACE`	`nevisadmin4`	Kubernetes namespace the Helm chart is installed into. You usually do not need to change this.
`RELEASE_NAME`	`nevisadmin4`	Name of the Helm release. You usually do not need to change this.
`DATABASE_HOST`	—	Database host, for example `nevisakvtest.postgres.database.azure.com` for PostgreSQL.
`DB_ROOT_USER`	`dbroot`	Root/administrator user of the database. If you are using an Azure database, do not include the host in the username.
`DB_ROOT_PASSWORD`	—	Password for `DB_ROOT_USER`. If you used the nevis-kubernetes-support Terraform template to create the database, retrieve it with `terraform output db_password`. Otherwise, ask your database administrator or check your cloud provider's console.
`DB_NEVISADMIN_SCHEMA_USER_PASSWORD`	—	Password for the nevisAdmin 4 schema user, which is created during installation.
`DB_NEVISADMIN_APP_USER_PASSWORD`	—	Password for the nevisAdmin 4 application user, which is created during installation.
`GIT_REPOSITORY_URL`	—	URL of the Git deployment repository nevisAdmin 4 and nevisOperator will use.
`DOMAIN`	—	Domain where nevisAdmin4 will be available, for example `test.westeurope.cloudapp.azure.com`. Point this at the IP of the nginx LoadBalancer once the installation is done.
`CLOUDSMITH_PASSWORD`	—	Temporary Cloudsmith credential used to pull the Nevis Helm charts and Docker images. Obtain it by clicking the download button for one of the Docker images at the Nevis Portal.

Upload Nevis Docker Images

Download the docker images from the Nevis Portal registry and upload them to the container registry of the Kubernetes cluster.

export NEVIS_VERSION=<the version you picked, for example 9.2605.2>

The sync-images.sh script in the nevis-kubernetes-support repository automates the upload: it pulls each image from Cloudsmith (or GitHub Container Registry) and pushes it to your target registry.

./sync-images.sh --source cloudsmith --token $CLOUDSMITH_PASSWORD --target $CONTAINER_REGISTRY --version $NEVIS_VERSION

$CLOUDSMITH_PASSWORD obtained this way is a temporary token. If pulls or pushes suddenly start failing with unauthorized or 400 Bad Request partway through, the token has likely expired — get a fresh one from the portal and retry.

Not every component image is tagged with the same version string as the overall release — a component still on an older tag will fail with manifest unknown. If you do not need that component yet (it is not part of the base nevisAdmin4 install, and only gets pulled in later by nevisOperator once a project uses it), skip it:

./sync-images.sh --source cloudsmith --token $CLOUDSMITH_PASSWORD --target $CONTAINER_REGISTRY --version $NEVIS_VERSION \
  --skip-images nevislogrend nevisfido nevisfido-dbschema nevisidm nevisidm-dbschema nevismeta nevismeta-dbschema \
  nevisadapt nevisadapt-dbschema nevisdetect-admin nevisdetect-core nevisdetect-entrypoint nevisdetect-persistency \
  nevisdetect-persistency-dbschema nevisdp nevis-base-flyway

Otherwise, use --tags <image>:<tag> to pin the correct tag for that specific component instead.

Deploy Envoy Gateway

Envoy Gateway is the recommended external routing solution for new installations. ingress-nginx reached end-of-life in March 2026 and no longer receives feature or security updates — only use it if you have a specific reason to stay on it for now, see Deploy ingress-nginx below.

Follow the official installation instructions: https://gateway.envoyproxy.io/docs/install/. At least gateway-helm-1.6.0 is required. This will install the gateway controller and the CRDs for both the Gateway API and its Envoy-specific extensions.

Create a GatewayClass with a name and controllerName that match the values set in the nevisAdmin4 and Envoy Gateway charts (by default envoy-gateway and gateway.envoyproxy.io/gatewayclass-controller, respectively). It is also recommended to merge gateways of the same class into a single envoy proxy deployment via an EnvoyProxy resource to avoid needing multiple load balancers.

Please note that using Envoy Gateway requires TLS 1.3 toward the backend nevisProxy instance. This is enforced globally in the same EnvoyProxy resource:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: <envoy-config-name>
  namespace: <envoy-config-namespace>
spec:
  backendTLS:
    maxVersion: "1.3"
    minVersion: "1.3"

For EnvoyProxy configuration examples, see Customize EnvoyProxy.

info

Gateway support was introduced in nevisAdmin4 chart versions 8.2511.3 and 7.2511.3. Versions below 9.2605.0 still use the ingress API with ingress-nginx by default, so the nevisadmin4 chart values have to be set explicitly to use Envoy Gateway instead — see the Install nevisAdmin 4 Chart section.

Deploy cert-manager

If the Kubernetes cluster does not have cert-manager already installed, then follow the official guide: https://cert-manager.io/docs/installation/helm/

If using Envoy Gateway, Gateway API support needs to be enabled in cert-manager configuration, see https://cert-manager.io/docs/configuration/acme/http01/#configuring-the-http-01-gateway-api-solver

Deploy ingress-nginx (opt-out)

caution

As of March 2026, ingress-nginx is end-of-life (EOL) and no longer receives any feature or security updates. Only use it if you have a specific reason to stay on it — for example, an existing setup already on it, or a chart version below 8.2511.3/7.2511.3, which doesn't support Envoy Gateway. New installations should use Envoy Gateway instead.

Follow the official installation instructions: https://kubernetes.github.io/ingress-nginx/deploy/. This is also the default if you don't deploy Envoy Gateway and don't set nginx.enabled=false — see the Install nevisAdmin 4 Chart section for the required chart values either way.

If you already have an existing ingress-nginx installation instead of deploying a new one for this release, see Using existing ingress-nginx installation.

Install CRD Chart

Install the helm chart that contains the CustomResourceDefinitions used by nevisAdmin 4.

helm install nevisadmin4-crd nevisadmin4-crd --version $NEVIS_VERSION --repo https://dl.cloudsmith.io/$CLOUDSMITH_PASSWORD/nevissecurity/rolling/helm/charts/

caution

Uninstalling this chart deletes all the existing CustomResources, which results in the deletion of all the deployments made with nevisAdmin 4

Install nevisAdmin 4 Chart

Prepare secrets for installation

Prepare the required secrets to be used by the helm chart. This is done to avoid plain secret values in the values.yaml.

Create namespace

kubectl create namespace $RELEASE_NAMESPACE

Create credential secrets

These secrets are used to avoid having plain values in the values.yaml.

# nevisAdmin 4 admin user credential
kubectl create secret generic nevis-nevisadmin4-admin-credential \
--from-literal=password=$NEVISADMIN_PASSWORD \
-n $RELEASE_NAMESPACE

# git credential
kubectl create secret generic nevis-git-credential \
--from-file=key=key \
--from-file=key.pub=key.pub \
--from-file=known_hosts=known_hosts \
--from-literal=passphrase="" \
--from-literal=username="" \
--from-literal=password="" \
-n $RELEASE_NAMESPACE

# database credential
kubectl create secret generic nevis-database-credential \
--from-literal=username=$DB_ROOT_USER \
--from-literal=password=$DB_ROOT_PASSWORD \
-n $RELEASE_NAMESPACE

# nevisAdmin 4 database credential
kubectl create secret generic nevis-nevisadmin4-database-credential \
--from-literal=applicationUser=admin4appuser \
--from-literal=applicationUserPassword=$DB_NEVISADMIN_APP_USER_PASSWORD \
--from-literal=schemaUser=admin4schemauser \
--from-literal=schemaUserPassword=$DB_NEVISADMIN_SCHEMA_USER_PASSWORD \
-n $RELEASE_NAMESPACE

The nevis-database-credential secret can be used for the Root Credential and Root Credential Namespace fields in the database patterns inside nevisAdmin 4.

For more configuration options, see the section in the appendix.

Minimal permissions for database.root

The dbschema job uses database.root to create the application database, the citext extension it needs, and the schema/app users. If your Postgres role for database.root is locked down rather than a true admin/superuser, you can shrink what it needs to just CREATEROLE by pre-provisioning the rest yourself, connected as your actual database admin, before installing:

CREATE DATABASE nevisadmin4 OWNER <database.root user>;
\connect nevisadmin4;
CREATE EXTENSION IF NOT EXISTS citext;

When citext already exists, CREATE EXTENSION IF NOT EXISTS is a no-op — on any platform, not just Azure — so the dbschema job's own attempt to create it succeeds without needing extension-creation privileges, and it will not need CREATEDB or (on Azure) azure_pg_admin membership either.

Install

The commands below use Envoy Gateway, the recommended default. In versions below 9.2605.0, ingress-nginx is the default external routing solution if you don't set these values explicitly. To opt out and use ingress-nginx instead — see Deploy ingress-nginx first — replace the Envoy-specific settings with:

--set nginx.enabled=true \
--set nevisAdmin4.ingress.enabled=true \
--set nevisAdmin4.gateway.enabled=false \
--set nginx.nameOverride=$RELEASE_NAMESPACE-nginx

Kubernetes

helm install $RELEASE_NAME nevisadmin4 -n $RELEASE_NAMESPACE --version $NEVIS_VERSION \
    --repo https://dl.cloudsmith.io/$CLOUDSMITH_PASSWORD/nevissecurity/rolling/helm/charts/ \
    --set image.repository=$CONTAINER_REGISTRY \
    --set git.repositoryUrl=$GIT_REPOSITORY_URL \
    --set git.credentialSecret=nevis-git-credential \
    --set database.type=postgresql \
    --set database.port=5432 \
    --set database.host=$DATABASE_HOST \
    --set database.root.preparedCredentialSecret=nevis-database-credential \
    --set nevisAdmin4.domain=$DOMAIN \
    --set nevisAdmin4.credentialSecret=nevis-nevisadmin4-admin-credential \
    --set nevisAdmin4.database.credentialSecret=nevis-nevisadmin4-database-credential \
    --set nginx.enabled=false \
    --set nevisAdmin4.ingress.enabled=false \
    --set nevisAdmin4.gateway.enabled=true

caution

database.type defaults to mariadb and database.port independently defaults to 3306 — setting database.type=postgresql alone does not change the port. If you're using PostgreSQL (the recommended option, see Prerequisites) but omit database.port=5432, the dbschema job will silently try to connect on the wrong port and fail with a timeout, not a clear error. This is being fixed upstream so postgresql/5432 become the new defaults together — until that ships, set both explicitly.

OpenShift

This variant currently documents ingress-nginx only — Envoy Gateway on OpenShift is not yet covered here.

As ingress-nginx must run with user 101 and needs capabilities such as NET_BIND_SERVICE, it's required that the used SecurityContext is changed on OpenShift. Additionally, it's not allowed to set the fsGroup of the nevisAdmin 4 deployment.

# Username for the registry
REGISTRY_USERNAME=
# Password for the registry
REGISTRY_PASSWORD=

# Prepare registry secret
oc create secret docker-registry registry-secret --docker-server="$CONTAINER_REGISTRY" --docker-username="$REGISTRY_USERNAME" --docker-password="$REGISTRY_PASSWORD" -n "$RELEASE_NAMESPACE"
# Prepare nginx service account
oc create serviceaccount nevisadmin4-nginx -n "$RELEASE_NAMESPACE"
oc adm policy add-scc-to-user privileged -z nevisadmin4-nginx -n "$RELEASE_NAMESPACE"

helm install $RELEASE_NAME nevisadmin4 -n $RELEASE_NAMESPACE --version $NEVIS_VERSION \
    --repo https://dl.cloudsmith.io/$CLOUDSMITH_PASSWORD/nevissecurity/rolling/helm/charts/ \
    --set image.repository=$CONTAINER_REGISTRY \
    --set image.imagePullSecretName=registry-secret \
    --set git.repositoryUrl=$GIT_REPOSITORY_URL \
    --set git.credentialSecret=nevis-git-credential \
    --set database.type=postgresql \
    --set database.port=5432 \
    --set database.host=$DATABASE_HOST \
    --set database.root.preparedCredentialSecret=nevis-database-credential \
    --set nevisAdmin4.domain=$DOMAIN \
    --set nevisAdmin4.podSecurityContext.fsGroup=null \
    --set nevisAdmin4.credentialSecret=nevis-nevisadmin4-admin-credential \
    --set nevisAdmin4.database.credentialSecret=nevis-nevisadmin4-database-credential \
    --set nginx.serviceAccount.create=false \
    --set nginx.serviceAccount.name=nevisadmin4-nginx \
    --set nginx.nameOverride=$RELEASE_NAMESPACE-$RELEASE_NAME

Upgrade

To upgrade the installation, copy over the new images from Upload Nevis Docker Images then run:

helm get values $RELEASE_NAME -n $RELEASE_NAMESPACE > values.yaml \
&& helm upgrade $RELEASE_NAME nevisadmin4 -n $RELEASE_NAMESPACE -f values.yaml \
--repo https://dl.cloudsmith.io/$CLOUDSMITH_PASSWORD/nevissecurity/rolling/helm/charts/ \
--set <your-new-values> \
--version <version-to-upgrade>

If the version is not provided, it upgrades to the latest one.

Using existing ingress-nginx installation

Set the nginx.enabled to false, and set the nginx.controller.ingressClassResource.name and nginx.controller.ingressClass values to the ingress class of the existing ingress-nginx controller.

Starting with nginx 1.12, snippet annotations have a Critical risk level, and Ingress resources containing them are ignored by the controller by default. As this is required for the side-by-side deployment to function, make sure that you have the following in the ConfigMap used by ingress-nginx:

allow-snippet-annotations: "true"
annotations-risk-level: Critical
annotation-value-word-blocklist: load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,',\

It's recommended to use a blocklist to prevent misuse.

Appendix: nevisAdmin 4 Chart Values

additionalComponentNamespaces

By default, the permissions and accessory resources are set up in a way that it's only possible to deploy from nevisAdmin4 to the same namespace where the chart is installed. Listing additional ones here, will make it so that nevisAdmin4 can deploy to these namespaces. The namespace itself has to exist already.

Type: list

Default:

[]

bootstrap

Supports importing initial projects and inventories into nevisAdmin 4 and creating a repository in gitea.

Type: object

Default:

annotations: {}
gitea:
    enabled: false
image:
    version: 1.3.0
labels: {}
nevisAdmin4:
    enabled: false
podAnnotations: {}
podLabels: {}

bootstrap.annotations

Annotations to put onto the Job.

Type: object

Default:

{}

bootstrap.labels

Labels to put onto the bootstrap job.

Type: object

Default:

{}

bootstrap.podAnnotations

Annotations to put onto the pods.

Type: object

Default:

{}

bootstrap.podLabels

Labels to put onto the bootstrap job pod.

Type: object

Default:

{}

certManager.createCAIssuer

Create a CA Issuer to the main release namespace, it also creates a self-signed issuer to prepare the root CA

Type: bool

Default: true

certManager.createLetsEncryptIssuer

Creates a Let's encrypt issuer to every component namespace

Type: bool

Default: true

certManager.httpSolverGateway

Specify the gateway to be used for the http01 challenge solver. Must have a HTTP listener that allows routes from nevisadmin4 and component namespaces. By default, the nevisadmin4 gateway is used.

Type: string

Default: not set

certManager.httpSolverGatewayNamespace

Namespace of the gateway to be used for the http01 challenge solver. By default, the release namespace is used.

Type: string

Default: not set

database.host

Database host, example: mariadb29a7439e.mariadb.database.azure.com

Type: string

Default: not set

database.port

Database port

Type: string

Default: "3306"

database.root.credentialSecret

DEPRECATED: Use preparedCredentialSecret instead. Secret containing the username and password for the root user. Must have the "username" and "password" key.

Type: string

Default: "helm-database-credential"

database.root.password

Root password in plain value. It's recommended to prepare a secret instead.

Type: string

Default: not set

database.root.preparedCredentialSecret

When using this value, root-creds secret will only be created in the namespace where nevisAdmin4 resides. Adjust the Root Credential Namespace in the Database patterns of nevisAdmin 4 before the migration to this value.

Type: string

Default: not set

database.root.username

Root username in plain value. It's recommended to prepare a secret instead.

Type: string

Default: not set

database.type

Type of the database, supported values: mariadb, postgresql

Type: string

Default: "mariadb"

git.credentialSecret

Secret containing the git credentials, to avoid having plain values in the values file. Must have "key", "key.pub", "known_hosts", "passphrase", "username", "password" secret keys. In case only http or ssh is used, the corresponding values can be empty, but the keys still have to exist in the secret.

Type: string

Default: not set

git.knownHosts64

Base64 known_hosts.

Type: string

Default: not set

git.passphrase

Private key passphrase

Type: string

Default: not set

git.password

Password used for http authentication. It's recommended to prepare a secret instead.

Type: string

Default: not set

git.privateKey64

Base64 git private key.

Type: string

Default: not set

git.publicKey64

Base64 git public key.

Type: string

Default: not set

git.repositoryUrl

Git repository, can be either ssh or http

Type: string

Default: not set

git.repositoryUrlMap

Makes it possible to use a different repository for each component namespace

Type: object

Default:

{}

git.username

Username used for http authentication. It's recommended to prepare a secret instead.

Type: string

Default: not set

gitea.enabled

Type: bool

Default: false

gitea.fullnameOverride

Name of the gitea deployment

Type: string

Default: "gitea"

gitea.gitea.admin.email

Type: string

Default: "[email protected]"

gitea.gitea.admin.password

Gitea admin password

Type: string

Default: not set

gitea.gitea.admin.username

Gitea admin username

Type: string

Default: not set

gitea.gitea.config.cache.ADAPTER

Type: string

Default: "memory"

gitea.gitea.config.cache.ENABLED

Type: bool

Default: true

gitea.gitea.config.cache.HOST

Type: string

Default: "127.0.0.1:9090"

gitea.gitea.config.cache.INTERVAL

Type: int

Default: 60

gitea.gitea.config.database.DB_TYPE

Type: string

Default: "mysql"

gitea.gitea.config.database.HOST

Type: string

Default: "mariadb:3306"

gitea.gitea.config.database.NAME

Type: string

Default: "gitea"

gitea.gitea.config.database.PASSWD

Database user password

Type: string

Default: not set

gitea.gitea.config.database.SCHEMA

Type: string

Default: "gitea"

gitea.gitea.config.database.USER

Database user for gitea

Type: string

Default: not set

gitea.gitea.config.server.ROOT_URL

Root url of gitea

Type: string

Default: not set

gitea.httproute.enabled

Create a HTTPRoute for gitea, using the nevisAdmin4 gateway. This is a workaround as the gitea chart does not yet support creating httproutes. If enabled, set gitea.gitea.config.server.ROOT_URL to {{ .Values.nevisAdmin4.domain }}/gitea

Type: bool

Default: true

gitea.image.rootless

Use rootless image

Type: bool

Default: true

gitea.ingress.annotations."cert-manager.io/cluster-issuer"

Type: string

Default: "letsencrypt-prod"

gitea.ingress.annotations."nginx.ingress.kubernetes.io/rewrite-target"

Type: string

Default: "/$2"

gitea.ingress.apiVersion

Type: string

Default: "networking.k8s.io/v1"

gitea.ingress.enabled

Type: bool

Default: false

gitea.ingress.hosts[0].host

Type: string

Default: not set

gitea.ingress.hosts[0].paths[0].path

Type: string

Default: "/gitea(/|$)(.*)"

gitea.ingress.hosts[0].paths[0].pathType

Type: string

Default: "ImplementationSpecific"

gitea.ingress.tls[0].hosts[0]

Type: string

Default: not set

gitea.ingress.tls[0].secretName

Type: string

Default: "gitea-tls"

gitea.job.annotations

Annotations to put onto the Job.

Type: object

Default:

{}

gitea.job.labels

Type: object

Default:

{}

gitea.job.podAnnotations

Annotations to put onto the pods.

Type: object

Default:

{}

gitea.job.podLabels

Labels to put onto the bootstrap job pod.

Type: object

Default:

{}

gitea.memcached.enabled

Type: bool

Default: false

gitea.mysql.enabled

Type: bool

Default: false

gitea.postgresql.enabled

Type: bool

Default: false

gitea.statefulset.env[0].name

Type: string

Default: "HOME"

gitea.statefulset.env[0].value

Type: string

Default: "/data/git"

image.imagePrefix

Image prefix, nevis images will be pulled from [repository]/[imagePrefix]

Type: string

Default: "nevis"

image.imagePullSecretName

Name of the secret containing the credentials, only necessary if a private repository is used.

Type: string

Default: not set

image.repository

Repository where the images will be pulled from

Type: string

Default: not set

nevisAdmin4.affinity

Type: object

Default:

{}

nevisAdmin4.annotations

Additional annotations to be put on the nevisAdmin4 StatefulSet.

Type: object

Default:

{}

nevisAdmin4.certManagerIssuer

Specify the cert-manager issuer for the nevisAdmin4 ingress/gateway

Type: string

Default: "letsencrypt-prod"

nevisAdmin4.config

low level configuration options

Type: object

Default:

env: ""
logback: ""
nevisadmin4: {}

nevisAdmin4.config.env

Content of env.conf configuration file as multiline string

Type: string

Default: not set

nevisAdmin4.config.logback

Content of logback.xml configuration file as multiline string

Type: string

Default: not set

nevisAdmin4.config.nevisadmin4

Content of nevisadmin4.yml configuration file

Type: object

Default:

{}

nevisAdmin4.configOverrideEnabled

The env.conf, nevisadmin4.yml and logback.xml can be overwritten by placing the file with the same name besides the values.yaml.

Type: bool

Default: false

nevisAdmin4.containerSecurityContext

Security context for the nevisAdmin4 pod containers.

Type: object

Default:

allowPrivilegeEscalation: false
capabilities:
    drop:
        - ALL

nevisAdmin4.cors

cors attributes

Type: object

Default:

{}

nevisAdmin4.credentialSecret

Secret containing the initial password of nevisAdmin4 to avoid plain values in the values file. Must have the "password" key. If credentialSecret and password is not given it will be autogenerated. Must be prepared id advance.

Type: string

Default: not set

nevisAdmin4.database.applicationUser

Database user by nevisAdmin4

Type: string

Default: "admin4appuser"

nevisAdmin4.database.applicationUserPassword

Database app user password.

Type: string

Default: not set

nevisAdmin4.database.credentialSecret

Secret containing schema and application user credentials to avoid plain values in the values file. Must have the "applicationUser", "applicationUserPassword", "schemaUser", "schemaUserPassword" key. Must be prepared is advance.

Type: string

Default: not set

nevisAdmin4.database.enableSSL

Disable ssl if it's not supported by the database

Type: bool

Default: true

nevisAdmin4.database.job

Values for the dbschema job

Type: object

Default:

annotations: {}
cleanupEnabled: true
labels: {}
podAnnotations: {}
podLabels: {}
ttlSecondsAfterFinished: 1200

nevisAdmin4.database.job.annotations

Annotations to put onto the migration job.

Type: object

Default:

{}

nevisAdmin4.database.job.cleanupEnabled

dbschema job will be deleted automatically

Type: bool

Default: true

nevisAdmin4.database.job.labels

Labels to put onto the migration job.

Type: object

Default:

{}

nevisAdmin4.database.job.podAnnotations

Annotations to put onto the migration job pod.

Type: object

Default:

{}

nevisAdmin4.database.job.podLabels

Labels to put onto the migration job pod.

Type: object

Default:

{}

nevisAdmin4.database.name

Name of the database

Type: string

Default: "nevisadmin4"

nevisAdmin4.database.schemaUser

Database user used for the migration of the database for nevisAdmin4.

Type: string

Default: "admin4schemauser"

nevisAdmin4.database.schemaUserPassword

Database schema user password.

Type: string

Default: not set

nevisAdmin4.deployment.credentialSecret

Secret containing the deployment SSH credentials, to avoid having plain values in the values.yaml file. The "key" secret key is required. The "passphrase" and "known_hosts" are optional.

Type: string

Default: not set

nevisAdmin4.deployment.sshKnownHostsEnabled

Set to true if the credentialSecret contains a "known_hosts" key for SSH host verification.

Type: bool

Default: false

nevisAdmin4.deployment.sshPassphraseEnabled

Set to true if the credentialSecret contains a "passphrase" key for the SSH private key.

Type: bool

Default: false

nevisAdmin4.domain

Domain where nevisAdmin4 will be reachable

Type: string

Default: not set

nevisAdmin4.enabled

Type: bool

Default: true

nevisAdmin4.extraEnvs

Additional environment variables that will be added to the nevisAdmin4 container

Type: list

Default:

[]

nevisAdmin4.gateway.allowRoutesFromComponentNamespaces

Allow routes from component namespaces to attach to the nevisadmin4 gateway. This is required when using the same hostname for nevisadmin4 and nevisProxy virtual hosts.

Type: bool

Default: true

nevisAdmin4.gateway.enabled

Type: bool

Default: true

nevisAdmin4.gateway.gatewayClassName

Gateway class to use for the nevisAdmin4 Gateway.

Type: string

Default: "envoy-gateway"

nevisAdmin4.gateway.generateGateway

Create the Gateway resource for nevisAdmin4.

Type: bool

Default: true

nevisAdmin4.gateway.name

Name of the nevisAdmin4 Gateway. The HTTPRoute will reference this gateway whether it's created by the chart or already existing.

Type: string

Default: "nevisadmin4-gateway"

nevisAdmin4.gateway.namespace

Namespace where the Gateway is deployed. When generateGateway is set to true, this value is ignored and the release namespace is used. Defaults to the release namespace if not set.

Type: string

Default: not set

nevisAdmin4.gateway.tls.enabled

Add HTTPS listener to the gateway. If set to false, only HTTP listener will be created.

Type: bool

Default: true

nevisAdmin4.gateway.tls.secretName

Secret name for the TLS certificate, if useExistingSecret is set to false, a new secret will be generated by cert-manager.

Type: string

Default: "nevisadmin4-frontend-tls"

nevisAdmin4.gateway.tls.useExistingSecret

Use existing secret for TLS certificate. If set to true, secretName will be used as TLS secret on the listener.

Type: bool

Default: false

nevisAdmin4.image.migrationTag

Overrides the dbschema image tag whose default is the chart appVersion.

Type: string

Default: not set

nevisAdmin4.image.tag

Overrides the image tag whose default is the chart appVersion.

Type: string

Default: not set

nevisAdmin4.imagePullPolicy

Image pull policy for the nevisadmin4 container and nevisadmin4-dbschema init containers.

Type: string

Default: "Always"

nevisAdmin4.ingress.annotations

Annotations to be put on the nevisAdmin4 Ingress.

Type: object

Default:

nginx.ingress.kubernetes.io/proxy-body-size: 100m

nevisAdmin4.ingress.enabled

Type: bool

Default: false

nevisAdmin4.ingress.ingressClass

Ingress class to use for the nevisAdmin4 Ingress.

Type: string

Default: "nginx"

nevisAdmin4.ingress.tls.enabled

Add TLS settings to the nevisAdmin4 Ingress. If set to false, the ingress controller's default TLS settings will be used.

Type: bool

Default: true

nevisAdmin4.ingress.tls.secretName

Secret name for the TLS certificate, if useExistingSecret is set to false, a new secret will be generated by cert-manager.

Type: string

Default: "nevisadmin4-frontend-tls"

nevisAdmin4.ingress.tls.useExistingSecret

Use existing secret for TLS certificate, if set to true, secretName will be used as TLS secret on the ingress.

Type: bool

Default: false

nevisAdmin4.ingressIssuerAnnotation

cert-manager annotation to put on the ingress/gateway

Type: string

Default: "cert-manager.io/issuer"

nevisAdmin4.jwt.hmacSignerSecret

Secret used for JWT token signing. If not set, a random secret is generated on nevisAdmin startup. Set to call the API using a prepared token.

Type: string

Default: not set

nevisAdmin4.labels

Additional labels to be put on the nevisAdmin4 StatefulSet.

Type: object

Default:

{}

nevisAdmin4.ldap

ldap attributes for the nevisadmin4.yml

Type: object

Default:

context: {}
enabled: false
search: {}
truststore64: ""
truststorePassphrase: ""
user: {}

nevisAdmin4.ldap.context

ldap context block

Type: object

Default:

{}

nevisAdmin4.ldap.enabled

Enable ldap

Type: bool

Default: false

nevisAdmin4.ldap.search

ldap search block

Type: object

Default:

{}

nevisAdmin4.ldap.truststore64

pkcs12 truststore in base64 format

Type: string

Default: not set

nevisAdmin4.ldap.truststorePassphrase

truststore passphrase

Type: string

Default: not set

nevisAdmin4.ldap.user

ldap user block

Type: object

Default:

{}

nevisAdmin4.livenessProbe

Specify a custom livenessProbe.

Type: object

Default:

{}

nevisAdmin4.managementPort

Management port, this is where the health checks will be available

Type: int

Default: 9889

nevisAdmin4.migrationResources.limits.cpu

Type: string

Default: "1000m"

nevisAdmin4.migrationResources.limits.memory

Type: string

Default: "1000Mi"

nevisAdmin4.migrationResources.requests.cpu

Type: string

Default: "20m"

nevisAdmin4.migrationResources.requests.memory

Type: string

Default: "200Mi"

nevisAdmin4.nodeSelector

Type: object

Default:

{}

nevisAdmin4.otel.enabled

Enable OpenTelemetry forwarding

Type: bool

Default: false

nevisAdmin4.otel.protocol

OpenTelemetry protocol

Type: string

Default: "http/protobuf"

nevisAdmin4.otel.url

OpenTelemetry url

Type: string

Default: not set

nevisAdmin4.password

Initial password of nevisAdmin4. If credentialSecret and password is not given it will be autogenerated.

Type: string

Default: not set

nevisAdmin4.passwordLoginEnabled

When SAML or LDAP is used you can disable the local password authentication.

Type: bool

Default: true

nevisAdmin4.passwordPolicy

Password policy for local authentication. Note: The admin user always requires a password >= 16 characters, independent of this policy setting. Defaults keep backward compatibility with previous versions (minimal restrictions).

Type: object

Default:

minLength: 6
minLower: 0
minNonAlnum: 0
minNumeric: 0
minUpper: 0
passwordExpiration: 0
weakPasswordFile: pwlist.txt
weakPasswordPvc: ""

nevisAdmin4.passwordPolicy.weakPasswordFile

Name of the file inside the PVC that contains the weak-password list.

Type: string

Default: "pwlist.txt"

nevisAdmin4.passwordPolicy.weakPasswordPvc

Name of an existing PVC containing the weak-password list. When set, the PVC is mounted and its content is used to reject weak passwords on password change. The file must contain one forbidden password per line.

Type: string

Default: not set

nevisAdmin4.podAnnotations

Additional annotations to be put on the nevisAdmin4 pods.

Type: object

Default:

{}

nevisAdmin4.podLabels

Additional labels to be put on the nevisAdmin4 pods.

Type: object

Default:

{}

nevisAdmin4.podSecurityContext

Security context for the nevisAdmin4 pods.

Type: object

Default:

fsGroup: 2000
runAsNonRoot: true

nevisAdmin4.port

Default port of nevisAdmin4

Type: int

Default: 9080

nevisAdmin4.priorityClassName

Priority class name for nevisAdmin4 pods

Type: string

Default: not set

nevisAdmin4.productAnalytics.enabled

Enable product analytics

Type: bool

Default: false

nevisAdmin4.productAnalytics.prometheus.credentialSecret

Credential secret for Prometheus in case basic authentication is enabled. Has to have "password" and "username" keys.

Type: string

Default: not set

nevisAdmin4.productAnalytics.prometheus.password

Password for Prometheus in case basic authentication is enabled

Type: string

Default: not set

nevisAdmin4.productAnalytics.prometheus.url

base url of the Prometheus instance

Type: string

Default: not set

nevisAdmin4.productAnalytics.prometheus.username

Username for Prometheus in case basic authentication is enabled

Type: string

Default: not set

nevisAdmin4.readinessProbe

Specify a custom readinessProbe.

Type: object

Default:

{}

nevisAdmin4.resources.limits.cpu

Type: string

Default: "4000m"

nevisAdmin4.resources.limits.memory

Type: string

Default: "4500Mi"

nevisAdmin4.resources.requests.cpu

Type: string

Default: "1000m"

nevisAdmin4.resources.requests.memory

Type: string

Default: "1500Mi"

nevisAdmin4.saml.attribute

Maps SAML assertion attributes to nevisAdmin 4 user properties. Defaults correspond to the SAML attribute names used by Microsoft Entra ID (formerly Azure AD).

Type: object

Default:

email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
first-name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
group-keys: http://schemas.microsoft.com/ws/2008/06/identity/claims/role
last-name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
user-key: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

group-keys names the single assertion attribute whose values are used directly as nevisAdmin 4 group names. This works when your IdP is configured to include exact nevisAdmin 4 group names (for example __admin) as role or group values in the assertion.

If the assertion values do not match nevisAdmin 4 group names, add roles-key and role-mappings to define an explicit translation. For setup instructions and an example, see SAML Integration.

nevisAdmin4.saml.certificate64

Base64 saml.crt.

Type: string

Default: not set

nevisAdmin4.saml.enabled

Enable SAML login

Type: bool

Default: false

nevisAdmin4.saml.idp.metadataUri

Type: string

Default: nil

nevisAdmin4.saml.idp.trustStoreSecret

info

Available in rolling release 9.2605.2 and later, and in LTS26.

Name of an existing Kubernetes secret containing the truststore for verifying the IdP metadata endpoint TLS certificate. Required when the IdP uses a certificate issued by an internal or private CA. Also requires nevisAdmin4.saml.enabled: true.

The secret must contain:

a truststore file under key truststore.p12 (when nevisAdmin4.saml.idp.trustStoreType: PKCS12, the default) or truststore.jks (when nevisAdmin4.saml.idp.trustStoreType: JKS)
a passphrase key with the truststore password

The IdP metadata is refreshed in the background every hour by default. For setup instructions, see SAML Integration.

Type: string

Default: not set

nevisAdmin4.saml.idp.trustStoreType

info

Available in rolling release 9.2605.2 and later, and in LTS26.

Truststore format. Supported values: PKCS12, JKS. Determines which key name is expected in trustStoreSecret (truststore.p12 or truststore.jks).

Type: string

Default: PKCS12

nevisAdmin4.saml.idp.hostnameVerificationEnabled

info

Available in rolling release 9.2605.2 and later, and in LTS26.

Set to false to disable hostname verification for the IdP metadata TLS connection. Only disable this in non-production environments. Only takes effect when trustStoreSecret is also set.

Type: bool

Default: true

nevisAdmin4.saml.keySecret

Secret containing the sam key and certificate to avoid using local files. Must be prepared advance. Must have saml.key and saml.crt key.

Type: string

Default: not set

nevisAdmin4.saml.privateKey64

Base64 saml.key.

Type: string

Default: not set

nevisAdmin4.springProfiles

Commma seperated list of spring profiles to use, overrides all defaults

Type: string

Default: not set

nevisAdmin4.storageClass

Specify the storage class for the nevisAdmin4 persistent volume

Type: string

Default: not set

nevisAdmin4.tls.enabled

Enable https for nevisadmin4, it will only affect the traffic between nginc and nevisadmin4

Type: bool

Default: false

nevisAdmin4.tls.keyAlias

The key alias

Type: string

Default: "nevisadmin"

nevisAdmin4.tls.keystore

Keystore file to use, will be used instead of the prepared secret or base64 if the file is available in the chart folder. The keystore must contain the full certificate chain if Gateway API is used.

Type: string

Default: "keystore.p12"

nevisAdmin4.tls.keystore64

Base64 keystore file.

Type: string

Default: not set

nevisAdmin4.tls.keystoreSecret

Secret containing the tls keystore, to avoid plain values and using a local files. Must be prepared in advance. Must have the "passphrase" and the value for tls.keystore as a secret key.

Type: string

Default: not set

nevisAdmin4.tls.keystoreType

Keystore type

Type: string

Default: "pkcs12"

nevisAdmin4.tls.passphrase

Keystore passphrase

Type: string

Default: not set

nevisAdmin4.tls.port

Port to use if https is enabled.

Type: int

Default: 8443

nevisAdmin4.tolerations

Type: list

Default:

[]

nevisAdmin4.yaml.literalBlockStyle.enabled

YAML literal block style formatting, if not set the default settings is coming from nevisAdmin4 itself.

Type: bool

Default: nil

nevisOperator.affinity

Type: object

Default:

{}

nevisOperator.annotations

Annotations to put onto the Deployment.

Type: object

Default:

{}

nevisOperator.certificateDuration

Certificate duration of the internal certificates created with cert-manager

Type: string

Default: "8760h"

nevisOperator.containerSecurityContext

Security context for the nevisOperator pod containers.

Type: object

Default:

allowPrivilegeEscalation: false
capabilities:
    drop:
        - ALL

nevisOperator.csr

These values will be used for creating the internal certificates with cert-manager

Type: object

Default:

country: CH
email-address: [email protected]
locality: K8S
organization: K8S
organizational-unit: K8S
province: K8S

nevisOperator.defaultImagePullPolicy

Sets the default imagePullPolicy for the deployed components by nevisAdmin 4

Type: string

Default: not set

nevisOperator.enableLeaderElection

Enable leader election for nevisOperator, this make it possible to run with multiple replicas

Type: bool

Default: true

nevisOperator.enabled

Enable deployment of nevisOperator

Type: bool

Default: true

nevisOperator.gatewayClassName

Default gateway class the nevisOperator will create gateways with unless specified in the NevisGateway custom resource

Type: string

Default: "envoy-gateway"

nevisOperator.gatewayIssuer

Name of the issuer that will be used for the generated gateways

Type: string

Default: "letsencrypt-prod-gw"

nevisOperator.gatewayIssuerAnnotation

cert-manager annotation to put on the gateway (and ingress if enabled) resources. Takes precedence over ingressIssuerAnnotation when both are defined.

Type: string

Default: "cert-manager.io/issuer"

nevisOperator.image.tag

Overrides the image tag whose default is the chart appVersion.

Type: string

Default: not set

nevisOperator.imagePullPolicy

Image pull policy for the nevisOperator container.

Type: string

Default: "Always"

nevisOperator.ingressClass

Default ingress class the nevisOperator will create ingresses with unless specified in the NevisIngress custom resource

Type: string

Default: "nginx"

nevisOperator.ingressIssuer

Name of the issuer that will be used for the generated ingresses

Type: string

Default: "letsencrypt-prod"

nevisOperator.ingressIssuerAnnotation

cert-manager annotation to put on the ingress (and gateway if enabled) resources. Superseded by gatewayIssuerAnnotation when both are defined.

Type: string

Default: "cert-manager.io/issuer"

nevisOperator.internalIssuer

Name of the internal issuer used to create the certificate for internal communication between the components

Type: string

Default: "ca-issuer"

nevisOperator.internalIssuerCASecret

Name of the CA secret of the internal issuer

Type: string

Default: "ca-root-secret"

nevisOperator.internalIssuerCASecretNamespace

Namespace of the CA secret, defaults to the release namespace

Type: string

Default: not set

nevisOperator.internalIssuerNamespace

Namespace of the internal issuer used to create the certificate for internal communication between the components

Type: string

Default: not set

nevisOperator.labels

Labels to put onto the Deployment.

Type: object

Default:

{}

nevisOperator.nevisAdmin4ServiceAccountNamespace

Namespace where the service account defined in .Values.serviceAccount.name (default nevisadmin4) is deployed. This is used for setting up nevisAdmin4 access when nevisOperator is installed separately. If left empty, no role or rolebinding will be created.

Type: string

Default: not set

nevisOperator.nodeSelector

Type: object

Default:

{}

nevisOperator.podAnnotations

Annotations to put onto the pods.

Type: object

Default:

{}

nevisOperator.podLabels

Labels to put onto the pods.

Type: object

Default:

{}

nevisOperator.podSecurityContext

Security context for the nevisOperator pods.

Type: object

Default:

runAsNonRoot: true

nevisOperator.priorityClassName

Priority class name for nevisOperator pods

Type: string

Default: not set

nevisOperator.replicas

Type: int

Default: 1

nevisOperator.resources.limits.cpu

Type: string

Default: "200m"

nevisOperator.resources.limits.memory

Type: string

Default: "256Mi"

nevisOperator.resources.requests.cpu

Type: string

Default: "100m"

nevisOperator.resources.requests.memory

Type: string

Default: "96Mi"

nevisOperator.restrictNamespaces.additionalNamespaces

Add additional namespaces the nevisOperator has access to, this is useful in case a secret or some other resource is referenced in the configuration. If the goal is to deploy to these namespace use the additionalComponentNamespaces value instead

Type: list

Default:

[]

nevisOperator.restrictNamespaces.enabled

By default, nevisOperator only has access to the namespace where it resides, and the namespaces from the additionalComponentNamespaces

Type: bool

Default: true

nevisOperator.tolerations

Type: list

Default:

[]

nginx.controller

Settings for the nginx ingress controller.

Type: object

Default:

admissionWebhooks:
    enabled: false
config:
    annotation-value-word-blocklist: load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount
    annotations-risk-level: Critical
ingressClassResource:
    enabled: true
    name: nginx
service:
    externalTrafficPolicy: Local

nginx.controller.config.annotations-risk-level

It is necessary to allow Critical rated annotations for canary deployments

Type: string

Default: "Critical"

nginx.enabled

Disable if nginx is already installed. See nginx.controller for configuration.

Type: bool

Default: false

podLabels

Labels that will put onto every pod created by the chart

Type: object

Default:

{}

serviceAccount.create

Enable service account creation, if disabled the default service account will be used

Type: bool

Default: true

serviceAccount.name

Override the name of the created service account for nevisadmin4

Type: string

Default: not set

serviceAccount.nevisOperatorName

Override the name of the created service account for nevisoperator

Type: string

Default: not set

Appendix: Scripted Installation

For full control, we recommend to go through all sections of this guide step by step. However, to speed up the installation, you may have a look at this installer script: kubernetes-installer.sh

warning

The script does not expose all settings, and it is possible that it does not work for you. We are working on improvements / replacements, but for now the script is provided as-is.

The script uses environment variables that you have already exported, but it also provides command line parameters for customization. See the following help for details:

$ ./kubernetes-installer.sh --help
### Usage: ./kubernetes-installer.sh
    --upgrade                                                  upgrade an existing installation
    --add-nginx-node-port                                      
    --add-nginx-load-balancer                                  
    --namespace <namespace>                                    required
    --domain <domain>                                          required
    --container-registry <container_registry>                  required
    --registry-image-prefix <registry-image-prefix>            optional (default: nevis)
    --registry-username <registry_username>                    required
    --registry-password <registry_password>                    required
    --cloudsmith-password <cloudsmith_password>                required if not using a separate helm repository
    --nevisadmin-password <nevisadmin_password>               
    --git-password <git_password>                             
    --database-password <database_password>                   
    --version <chart_version>                                 
    --helm-repository <helm_repository>                       
    --helm-repository-username <helm_repository_password>     
    --helm-repository-password <helm_repository_username>     
    --cluster-context                                          switch to the given context
    --skip-images                                              skip image pull from Cloudsmith
    --no-prompt                                                answer y to every question
    --helm-setting <setting>                                   add a custom helm value to the installation with --set
    --image-version <image_version>                           
    --help                                                     show this help

Prerequisites
Prepare Git Deployment Repository
Set environment variables
Upload Nevis Docker Images
Deploy Envoy Gateway
Deploy cert-manager
Deploy ingress-nginx (opt-out)
Install CRD Chart
Install nevisAdmin 4 Chart
Appendix: nevisAdmin 4 Chart Values
Appendix: Scripted Installation

Prerequisites​

Prepare Git Deployment Repository​

Set environment variables​

Upload Nevis Docker Images​

Deploy Envoy Gateway​

Deploy cert-manager​

Deploy ingress-nginx (opt-out)​

Install CRD Chart​

Install nevisAdmin 4 Chart​

Prepare secrets for installation​

Create namespace​

Create credential secrets​

Install​

Kubernetes​

OpenShift​

Upgrade​

Using existing ingress-nginx installation​

Appendix: nevisAdmin 4 Chart Values​

additionalComponentNamespaces​

bootstrap​

bootstrap.annotations​

bootstrap.labels​

bootstrap.podAnnotations​

bootstrap.podLabels​

certManager.createCAIssuer​

certManager.createLetsEncryptIssuer​

certManager.httpSolverGateway​

certManager.httpSolverGatewayNamespace​

database.host​

database.port​

database.root.credentialSecret​

database.root.password​

database.root.preparedCredentialSecret​

database.root.username​

database.type​

git.credentialSecret​

git.knownHosts64​

git.passphrase​

git.password​

git.privateKey64​

git.publicKey64​

git.repositoryUrl​

git.repositoryUrlMap​

git.username​

gitea.enabled​

gitea.fullnameOverride​

gitea.gitea.admin.email​

gitea.gitea.admin.password​

gitea.gitea.admin.username​

gitea.gitea.config.cache.ADAPTER​

gitea.gitea.config.cache.ENABLED​

gitea.gitea.config.cache.HOST​

gitea.gitea.config.cache.INTERVAL​

gitea.gitea.config.database.DB_TYPE​

gitea.gitea.config.database.HOST​

gitea.gitea.config.database.NAME​

gitea.gitea.config.database.PASSWD​

gitea.gitea.config.database.SCHEMA​

gitea.gitea.config.database.USER​

gitea.gitea.config.server.ROOT_URL​

gitea.httproute.enabled​

gitea.image.rootless​

gitea.ingress.annotations."cert-manager.io/cluster-issuer"​

gitea.ingress.annotations."nginx.ingress.kubernetes.io/rewrite-target"​

gitea.ingress.apiVersion​

gitea.ingress.enabled​

gitea.ingress.hosts[0].host​

gitea.ingress.hosts[0].paths[0].path​

gitea.ingress.hosts[0].paths[0].pathType​

gitea.ingress.tls[0].hosts[0]​

gitea.ingress.tls[0].secretName​

gitea.job.annotations​

gitea.job.labels​

gitea.job.podAnnotations​

gitea.job.podLabels​

gitea.memcached.enabled​

gitea.mysql.enabled​

gitea.postgresql.enabled​

gitea.statefulset.env[0].name​

gitea.statefulset.env[0].value​

Prerequisites

Prepare Git Deployment Repository

Set environment variables

Upload Nevis Docker Images

Deploy Envoy Gateway

Deploy cert-manager

Deploy ingress-nginx (opt-out)

Install CRD Chart

Install nevisAdmin 4 Chart

Prepare secrets for installation

Create namespace

Create credential secrets

Install

Kubernetes

OpenShift

Upgrade

Using existing ingress-nginx installation

Appendix: nevisAdmin 4 Chart Values

additionalComponentNamespaces

bootstrap

bootstrap.annotations

bootstrap.labels

bootstrap.podAnnotations

bootstrap.podLabels

certManager.createCAIssuer

certManager.createLetsEncryptIssuer

certManager.httpSolverGateway

certManager.httpSolverGatewayNamespace

database.host

database.port

database.root.credentialSecret

database.root.password

database.root.preparedCredentialSecret

database.root.username

database.type

git.credentialSecret

git.knownHosts64

git.passphrase

git.password

git.privateKey64

git.publicKey64

git.repositoryUrl

git.repositoryUrlMap

git.username

gitea.enabled

gitea.fullnameOverride

gitea.gitea.admin.email

gitea.gitea.admin.password

gitea.gitea.admin.username

gitea.gitea.config.cache.ADAPTER

gitea.gitea.config.cache.ENABLED

gitea.gitea.config.cache.HOST

gitea.gitea.config.cache.INTERVAL

gitea.gitea.config.database.DB_TYPE

gitea.gitea.config.database.HOST

gitea.gitea.config.database.NAME

gitea.gitea.config.database.PASSWD

gitea.gitea.config.database.SCHEMA

gitea.gitea.config.database.USER

gitea.gitea.config.server.ROOT_URL

gitea.httproute.enabled

gitea.image.rootless

gitea.ingress.annotations."cert-manager.io/cluster-issuer"

gitea.ingress.annotations."nginx.ingress.kubernetes.io/rewrite-target"

gitea.ingress.apiVersion

gitea.ingress.enabled

gitea.ingress.hosts[0].host

gitea.ingress.hosts[0].paths[0].path

gitea.ingress.hosts[0].paths[0].pathType

gitea.ingress.tls[0].hosts[0]

gitea.ingress.tls[0].secretName

gitea.job.annotations

gitea.job.labels

gitea.job.podAnnotations

gitea.job.podLabels

gitea.memcached.enabled

gitea.mysql.enabled

gitea.postgresql.enabled

gitea.statefulset.env[0].name

gitea.statefulset.env[0].value