Chart values¶
The umbrella chart (charts/kubespaces) installs the whole control plane.
This page covers the values that change behavior;
values.yaml
is the exhaustive, commented source of truth, and examples/ holds complete
profiles (kind demo, GKE test, production).
Components¶
api:
image: {repository: ghcr.io/kubespaces-io/api, tag: "", pullPolicy: IfNotPresent}
frontend:
image: {repository: ghcr.io/kubespaces-io/frontend, tag: ""}
operator:
enabled: false # flip on — it is the product
installCRDs: true
image: {repository: ghcr.io/kubespaces-io/operator, tag: ""}
Empty tags follow the chart's appVersion. For dev clusters use
pullPolicy: Always or pin digests — mutable tags and node caches disagree.
Data & identity¶
postgresql:
enabled: true # built-in StatefulSet, official postgres image
persistence: {enabled: true, size: 8Gi, storageClass: ""}
# production: enabled: false + externalDatabase host/port/user/passwordSecret
keycloak:
enabled: true # built-in, DEV MODE, realm auto-imported
# production: enabled: false + oidc issuer/clientID of your IdP
The bundled Keycloak runs start-dev and exists for evaluation — bringing
your own OIDC issuer is a values change, not a migration: the API and
portal speak generic OIDC.
Exposure of the control plane itself¶
ingress:
enabled: false # classic Ingress for portal + API
gatewayApi: # or: ride an existing Gateway as an HTTPRoute
enabled: false
host: kubespaces.example.com
gateway: {name: kubespaces-apps, namespace: kubespaces-system, sectionName: ""}
Tenant exposure (networking)¶
The top-level networking.* block is the recommended, DRY home for the shared
domain and the two production Gateways — set the domain once and both the API
and apps paths are wired up (Production gateway stack):
networking:
domain: "" # <tenant>.api.<domain> and <app>.<tenant>.apps.<domain>
apiGateway: # TLS passthrough
name: "" # e.g. kubespaces-api
namespace: "" # e.g. kubespaces-system
sectionName: "" # e.g. apipassthrough
appsGateway: # TLS terminate
name: "" # e.g. kubespaces-apps
namespace: ""
clusterIssuer: "" # cert-manager ClusterIssuer for per-tenant wildcards
externalDnsTarget: "" # optional external-dns override (on-prem IP)
The older per-path operator.tenantApi.* / operator.tenantApps.* keys are
still supported and take precedence over networking.* when set — the two
spellings are interchangeable and backward compatible. Use the granular keys to
override a single field (e.g. a different domain for apps than for the API):
operator:
# vCluster chart source — defaults to the pinned KubeSpaces OCI mirror
vclusterChartRef: "" # e.g. oci://ghcr.io/kubespaces-io/charts/vcluster
vclusterChartVersion: "" # e.g. 0.35.2
tenantApi: # <tenant>.api.<domain> — TLS passthrough
domain: "" # default: networking.domain
gateway:
name: "" # default: networking.apiGateway.name
namespace: "" # default: networking.apiGateway.namespace
sectionName: "" # default: networking.apiGateway.sectionName
externalDnsTarget: "" # default: networking.externalDnsTarget
tenantApps: # <app>.<tenant>.apps.<domain> — TLS terminate
domain: "" # default: networking.domain
gateway:
name: "" # default: networking.appsGateway.name
namespace: "" # default: networking.appsGateway.namespace
clusterIssuer: "" # default: networking.clusterIssuer
Semantics:
- Empty = off. With no
networking/tenantApi/tenantAppsconfig the operator provisions tenants without any public endpoints (the evaluation tier) — identical behavior to pre-exposure releases. - The API path requires domain + API gateway name + namespace; the apps path additionally requires the ClusterIssuer.
- These values become
KUBESPACES_*environment variables on the operator Deployment — useful to know when debugging (kubectl describe deploy). - The Gateways themselves are not chart-managed — they are host infrastructure, one per cluster: Host cluster preparation.