Self-Hosting
Helm Values Reference
Key Helm chart values for all flex.plane charts.
This page documents the most important Helm values for each flex.plane chart. For the complete set of values, refer to the values.yaml file in each chart directory.
flextenant
The core chart deploying the orchestrator and portal.
Global values
oidc:
clientId: "" # OIDC client ID for the portal
issuer: "" # OIDC issuer URL
zitadel:
orgId: "" # Zitadel organization ID
projectId: "" # Zitadel project ID
privateKeySecret: "" # Name of K8s secret with Zitadel JWT key
headscale:
domain: flexplane.local # Domain for the Headscale control server
tenant:
name: "" # Tenant display name
domain: "" # Tenant domain
containerRegistry:
host: "" # Container registry host
imagePullSecret: "" # Image pull secret name
Orchestrator values
orchestrator:
replicaCount: 1
image:
repository: ghcr.io/zeitlos/flex.plane/orchestrator
pullPolicy: IfNotPresent
tag: ""
controlUrl: "http://localhost:9090"
extraEnv: [] # Additional environment variables
service:
type: ClusterIP
ports:
graphql: 8080
headscale: 9090
headscale-grpc: 50443
terminal: 7777
ingress:
enabled: false
tlsEnabled: false
className: ""
annotations: {}
persistence:
enabled: true
storageClass: ""
size: 10Gi
accessMode: ReadWriteOnce
resources:
requests:
cpu: 10m
memory: 192Mi
limits:
memory: 1Gi
hostAliases: [] # Additional /etc/hosts entries
Portal values
portal:
replicaCount: 1
image:
repository: ghcr.io/zeitlos/flex.plane/portal
pullPolicy: IfNotPresent
tag: ""
extraEnv: []
service:
type: ClusterIP
port: 3000
ingress:
enabled: false
tlsEnabled: false
className: ""
path: "/portal"
annotations: {}
resources:
requests:
cpu: 10m
memory: 128Mi
limits:
memory: 1Gi
Extra manifests
Deploy additional Kubernetes resources alongside the chart:
extraDeploy:
- apiVersion: v1
kind: ConfigMap
metadata:
name: custom-config
data:
key: value
identity
Wraps the upstream Zitadel Helm chart with a bundled PostgreSQL option.
zitadel:
enabled: true
fullnameOverride: zitadel
replicaCount: 1
envVarsSecret: postgresql # Secret containing DB passwords
zitadel:
masterkeySecretName: zitadel # Secret with the master encryption key
configmapConfig:
TLS:
Enabled: false
Database:
Postgres:
Host: postgresql
Port: 5432
Database: zitadel
ingress: {}
postgresql:
enabled: false # Set true for bundled PostgreSQL
fullnameOverride: "postgresql"
auth:
database: "zitadel"
username: "zitadel"
existingSecret: "postgresql"
For production, set
postgresql.enabled: false and point Database.Postgres.Host to your managed PostgreSQL instance.flexkube
Deploys managed Kubernetes control planes. One release per cluster.
global:
storageClass: ""
timezone: "Europe/Zurich"
imagePullSecrets: []
kubernetes:
clusterName: ""
version: "v1.34.1"
networking:
ipv4:
serviceSubnet: "10.96.0.0/16"
podSubnet: "10.244.0.0/16"
ipv6:
enabled: true
serviceSubnet: "fd12:3456:789a:1::/108"
podSubnet: "fd12:3456:789a::/64"
dnsDomain: "cluster.local"
etcd:
replicas: 3
persistence:
size: "1Gi"
backup:
enabled: true
schedule: "0 */12 * * *"
retentionDays: 7
apiServer:
replicas: 2
service:
type: LoadBalancer
loadBalancerIP: ""
ingress:
enabled: true
host: ""
controllerManager:
replicas: 2
scheduler:
replicas: 2
konnectivity:
replicas: 2
port: 8131
The flexkube chart deploys full Kubernetes control plane components (etcd, API server, controller manager, scheduler, konnectivity) as pods in your management cluster. Worker nodes run as VMs on Proxmox, managed by Cluster API.
flexgateway
Deploys edge gateway services and load balancer proxies.
controlUrl: "http://localhost:9090"
gatewayEgress:
image:
repository: ghcr.io/zeitlos/flex.plane/gateway-egress
tag: ""
loadBalancers:
- name: "example"
authKey: ""
targets:
- host: "node01.flexnet.local"
id: ""
ports:
- targetPort: 80
nodePort: 80123
ingress:
enabled: false
className: "nginx-external"
tls:
enabled: true
passthrough: false
host: ""
paths:
- prefix: /
targetPort: 8080
service:
type: ClusterIP
ports:
- port: 80
targetPort: 8080
protocol: TCP
expose:
kubernetes:
targets:
- hostname: "example"
targetURL: "my-service.namespace.svc.cluster.local"
auth:
value: ""