Helm configuration reference

1
global:           # Platform-wide settings
2
  baseDomain: ""  # Required: your base domain
3
  plane:
4
    mode: ""      # unified, control, or data
5
  # ... more global settings
6
7
tags:             # Enable/disable component groups
8
9
  monitoring: true
10
  logging: true
11
12
astronomer:       # Platform component settings
13
  houston: {}
14
  commander: {}
15
  registry: {}
16
  astroUI: {}
17
18
nginx: {}         # Ingress configuration
19
prometheus: {}    # Metrics collection
20
elasticsearch: {} # Log storage
21
grafana: {}       # Dashboards
22
# ... more component sections

1
global:
2
  baseDomain: "example.com"  # Your platform domain
3
  tlsSecret: "astronomer-tls"  # TLS certificate secret name

1
global:
2
  # Required: Base domain for all platform endpoints
3
  # Results in: app.example.com, houston.example.com, etc.
4
  baseDomain: "example.com"
5
6
  # Name of Kubernetes secret containing TLS certificate
7
  tlsSecret: "astronomer-tls"
8
9
  # List of secrets containing private CA certificates
10
  privateCaCerts: []

1
global:
2
  plane:
3
    # Options: unified (default), control, data
4
    mode: "unified"
5
6
    # Domain prefix for this plane (used in split deployments)
7
    domainPrefix: ""

1
global:
2
  # Enable platform-level network policies
3
  networkPolicy:
4
    enabled: true
5
6
  # Apply default deny ingress policy
7
  defaultDenyNetworkPolicy: true
8
9
  # Enable namespace labels for network policies
10
  networkNSLabels:
11
    enabled: false

1
global:
2
  # Enable Kubernetes RBAC
3
  rbac:
4
    enabled: true
5
6
  # Use cluster-wide roles (required for some features)
7
  clusterRoles: true
8
9
  # Management of cluster-scoped resources (RBAC objects, etc.)
10
  manageClusterScopedResources:
11
    enabled: true

1
global:
2
  platformNodePool:
3
    nodeSelector:
4
      node-role: platform
5
    affinity: {}
6
    tolerations:
7
      - key: "platform"
8
        operator: "Equal"
9
        value: "true"
10
        effect: "NoSchedule"

1
global:
2
  privateRegistry:
3
    enabled: true
4
    repository: "registry.example.com/astronomer"
5
    secretName: "registry-credentials"

1
global:
2
  features:
3
    namespacePools:
4
      enabled: true
5
      createRbac: true
6
      namespaces:
7
        create: false  # Set true to auto-create
8
        names:
9
          - airflow-prod
10
          - airflow-staging
11
          - airflow-dev

1
global:
2
  storageClass: "gp3"

1
global:
2
  openshiftEnabled: true
3
  sccEnabled: true  # Security context constraints

1
astronomer:
2
  houston:
3
    replicas: 2
4
5
    resources:
6
      requests:
7
        cpu: "500m"
8
        memory: "1024Mi"
9
      limits:
10
        cpu: "1000m"
11
        memory: "2048Mi"
12
13
    # Database connection
14
    backendSecretName: "houston-backend-secret"
15
    # Or specify directly:
16
    backendConnection:
17
      user: houston
18
      pass: "password"
19
      host: postgres.example.com
20
      port: 5432
21
      db: houston
22
23
    # Airflow database connection template
24
    airflowBackendSecretName: "airflow-backend-secret"
25
26
    # Houston configuration (see houston.config section below)
27
    config: {}
28
29
    # Environment variables common to all houston containers
30
    env:
31
      - name: LOG_LEVEL
32
        value: "info"
33
34
    # Worker pods for async processing
35
    worker:
36
      enabled: true
37
      replicas: 2
38
39
    # Upgrade all airflow helm deployments when upgrading APC helm deployment
40
    upgradeDeployments:
41
      enabled: true
42
43
    # Cleanup soft-deleted deployments
44
    cleanupDeployments:
45
      enabled: true
46
      schedule: "0 0 * * *"
47
      olderThan: 14
48
49
    # Cleanup Airflow database metadata
50
    cleanupAirflowDb:
51
      enabled: false
52
      schedule: "23 5 * * *"
53
      olderThan: 365

1
astronomer:
2
  houston:
3
    config:
4
      auth:
5
        # Local username/password auth
6
        local:
7
          enabled: true
8
9
        # OpenID Connect
10
        openidConnect:
11
          # Auth flow: "code" (recommended) or "implicit"
12
          flow: "code"
13
14
          # Microsoft/Azure AD
15
          microsoft:
16
            enabled: true
17
            clientId: "<YOUR_CLIENT_ID>"
18
            clientSecret: "<YOUR_CLIENT_SECRET>"
19
            discoveryUrl: "https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration"
20
21
          # Google OAuth
22
          google:
23
            enabled: false
24
            clientId: ""
25
            clientSecret: ""
26
27
          # Okta
28
          okta:
29
            enabled: false
30
            clientId: ""
31
            clientSecret: ""
32
            discoveryUrl: ""
33
34
          # Import groups from IDP (nested `.enabled` in APC 2.0)
35
          idpGroupsImport:
36
            enabled: true
37
          idpGroupsRefresh:
38
            enabled: false
39
40
        # GitHub via Auth0
41
        github:
42
          enabled: false

1
astronomer:
2
  houston:
3
    config:
4
      deployments:
5
        deployMechanisms:
6
          dagOnlyDeployment:
7
            enabled: true
8
          gitSyncDagDeployment:
9
            enabled: true
10
        deploymentLifecycle:
11
          hardDeleteDeployment:
12
            enabled: false
13
          deployRollback:
14
            enabled: true
15
        resourceManagement:
16
          components: []

1
astronomer:
2
  houston:
3
    config:
4
      email:
5
        enabled: true
6
        smtpUrl: "smtp://smtp.example.com:587"
7
        reply: "noreply@example.com"
8
9
      # Root-level toggles (APC 2.0 nested `.enabled` pattern)
10
      emailConfirmation:
11
        enabled: true
12
13
      publicSignups:
14
        enabled: false

1
astronomer:
2
  houston:
3
    config:
4
      prometheus:
5
        enabled: true
6
        host: "http://astronomer-prometheus:9090"

1
astronomer:
2
  commander:
3
    replicas: 2
4
5
    resources:
6
      requests:
7
        cpu: "250m"
8
        memory: "1Gi"
9
      limits:
10
        cpu: "500m"
11
        memory: "2Gi"
12
13
    # Air-gapped mode (no external registry access)
14
    airGapped:
15
      enabled: false
16
17
    # Helm upgrade timeout (seconds)
18
    upgradeTimeout: 600
19
20
    # Environment variables
21
    env: []

1
astronomer:
2
  registry:
3
    replicas: 1
4
5
    resources:
6
      requests:
7
        cpu: "250m"
8
        memory: "512Mi"
9
      limits:
10
        cpu: "500m"
11
        memory: "1024Mi"
12
13
    # Persistent storage
14
    persistence:
15
      enabled: true
16
      size: "100Gi"
17
      storageClassName: ~
18
19
    # Use external storage backends
20
    # AWS S3
21
    s3:
22
      enabled: false
23
      accesskey: ""
24
      secretkey: ""
25
      region: "us-east-1"
26
      bucket: "astronomer-registry"
27
28
    # Google Cloud Storage
29
    gcs:
30
      enabled: false
31
      bucket: ""
32
      useKeyfile: true
33
      keyfile: /var/gcs-keyfile/astronomer-gcs-keyfile
34
35
    # Azure Blob Storage
36
    azure:
37
      enabled: false
38
      accountname: ""
39
      accountkey: ""
40
      container: ""

1
astronomer:
2
  astroUI:
3
    replicas: 2
4
5
    resources:
6
      requests:
7
        cpu: "100m"
8
        memory: "256Mi"
9
      limits:
10
        cpu: "500m"
11
        memory: "1024Mi"
12
13
    env: []

1
nginx:
2
  replicas: 2
3
4
  resources:
5
    requests:
6
      cpu: "500m"
7
      memory: "1024Mi"
8
    limits:
9
      cpu: "1"
10
      memory: "2048Mi"
11
12
  # Service type: LoadBalancer, ClusterIP, or NodePort
13
  serviceType: "LoadBalancer"
14
15
  # Specific load balancer IP (optional)
16
  loadBalancerIP: ~
17
18
  # Restrict source IPs
19
  loadBalancerSourceRanges:
20
    - "10.0.0.0/8"
21
22
  # Private/internal load balancer
23
  privateLoadBalancer: false
24
25
  # NodePort configuration (when serviceType: NodePort)
26
  httpNodePort: ~
27
  httpsNodePort: ~
28
29
  # Ingress annotations
30
  ingressAnnotations:
31
    # AWS
32
    service.beta.kubernetes.io/aws-load-balancer-internal: "true"
33
    # GCP
34
    cloud.google.com/load-balancer-type: "Internal"
35
    # Azure
36
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"
37
38
  # Proxy settings
39
  proxyConnectTimeout: 15
40
  proxyReadTimeout: 600
41
  proxySendTimeout: 600
42
  proxyBodySize: "1024m"
43
44
  # Default backend
45
  defaultBackend:
46
    enabled: true
47
    resources:
48
      requests:
49
        cpu: "100m"
50
        memory: "50Mi"

1
prometheus:
2
  # Data retention period
3
  retention: 15d
4
5
  # Persistent storage
6
  persistence:
7
    enabled: true
8
    size: "150Gi"
9
10
  resources:
11
    requests:
12
      cpu: "1000m"
13
      memory: "4Gi"
14
    limits:
15
      cpu: "2000m"
16
      memory: "8Gi"

1
grafana:
2
  resources:
3
    requests:
4
      cpu: "250m"
5
      memory: "512Mi"
6
    limits:
7
      cpu: "500m"
8
      memory: "1024Mi"
9
10
  # Custom dashboards
11
  dashboards:
12
    default:
13
      custom-dashboard:
14
        file: dashboards/custom.json
15
16
  # Extra environment variables (for example, SMTP for alerts)
17
  extraEnvVars:
18
    - name: GF_SMTP_ENABLED
19
      value: "true"
20
    - name: GF_SMTP_HOST
21
      value: "smtp.example.com:587"

1
elasticsearch:
2
  # Enable persistence
3
  common:
4
    persistence:
5
      enabled: true
6
7
  # Client nodes
8
  client:
9
    replicas: 2
10
    heapMemory: "2g"
11
    resources:
12
      requests:
13
        cpu: "1"
14
        memory: "2Gi"
15
      limits:
16
        cpu: "2"
17
        memory: "4Gi"
18
19
  # Data nodes
20
  data:
21
    replicas: 3
22
    heapMemory: "2g"
23
    resources:
24
      requests:
25
        cpu: "1"
26
        memory: "2Gi"
27
      limits:
28
        cpu: "2"
29
        memory: "4Gi"
30
    persistence:
31
      size: "100Gi"
32
33
  # Master nodes
34
  master:
35
    replicas: 3
36
    heapMemory: "2g"
37
    resources:
38
      requests:
39
        cpu: "1"
40
        memory: "2Gi"
41
      limits:
42
        cpu: "2"
43
        memory: "4Gi"
44
    persistence:
45
      size: "20Gi"

1
vector:
2
  vector:
3
    resources:
4
      requests:
5
        cpu: "250m"
6
        memory: "512Mi"
7
      limits:
8
        cpu: "1000m"
9
        memory: "1024Mi"

1
global:
2
  customLogging:
3
    enabled: true
4
    scheme: https
5
    host: "elasticsearch.example.com"
6
    port: "9200"
7
    secret: "es-credentials"

1
global:
2
  nats:
3
    enabled: true
4
    replicas: 3
5
    jetStream:
6
      enabled: true
7
      tls: false
8
9
nats:
10
  nats:
11
    resources:
12
      requests:
13
        cpu: "75m"
14
        memory: "30Mi"
15
      limits:
16
        cpu: "250m"
17
        memory: "100Mi"

1
global:
2
  # Disable in-cluster PostgreSQL
3
  postgresql:
4
    enabled: false
5
6
astronomer:
7
  houston:
8
    backendSecretName: "houston-db-secret"
9
    # Secret should contain: connection=postgres://user:pass@host:5432/houston
10
    airflowBackendSecretName: "airflow-db-secret"

1
global:
2
  ssl:
3
    enabled: true
4
    mode: "require"  # disable, allow, prefer, require, verify-ca, verify-full
5
    grafana:
6
      sslmode: "require"

1
global:
2
  pgbouncer:
3
    enabled: true
4
    gssSupport: true
5
    secretName: "astronomer-pgbouncer-config"
6
    servicePort: "6543"

1
global:
2
  authSidecar:
3
    enabled: true
4
    repository: quay.io/astronomer/ap-auth-sidecar
5
    tag: 1.29.8
6
    port: 8084
7
    resources:
8
      requests:
9
        cpu: "500m"
10
        memory: "512Mi"
11
      limits:
12
        cpu: "1000m"
13
        memory: "1024Mi"

1
global:
2
  logging:
3
    loggingSidecar:
4
      enabled: true
5
      name: sidecar-log-consumer
6
      repository: quay.io/astronomer/ap-vector
7
      tag: 0.54.0
8
      resources:
9
        requests:
10
          cpu: "100m"
11
          memory: "386Mi"

1
global:
2
  dagOnlyDeployment:
3
    enabled: true
4
    repository: quay.io/astronomer/ap-dag-deploy
5
    tag: 0.9.4
6
    resources: {}
7
    persistence: {}

1
global:
2
  airflowOperator:
3
    enabled: false

1
astronomer:
2
  extraObjects:
3
    # Custom LimitRange
4
    - apiVersion: v1
5
      kind: LimitRange
6
      metadata:
7
        name: default-limits
8
        namespace: astronomer
9
      spec:
10
        limits:
11
          - default:
12
              cpu: "1"
13
              memory: "1Gi"
14
            defaultRequest:
15
              cpu: "100m"
16
              memory: "128Mi"
17
            type: Container
18
19
    # Custom NetworkPolicy
20
    - apiVersion: networking.k8s.io/v1
21
      kind: NetworkPolicy
22
      metadata:
23
        name: custom-policy
24
      spec:
25
        podSelector: {}
26
        policyTypes:
27
          - Ingress

1
global:
2
  baseDomain: "airflow.example.com"
3
  tlsSecret: "astronomer-tls"
4
5
  plane:
6
    mode: "unified"
7
8
  rbac:
9
    enabled: true
10
  clusterRoles: true
11
12
  networkPolicy:
13
    enabled: true
14
15
  postgresql:
16
    enabled: false
17
18
  privateRegistry:
19
    enabled: true
20
    repository: "registry.example.com/astronomer"
21
    secretName: "registry-creds"
22
23
  platformNodePool:
24
    nodeSelector:
25
      node-type: platform
26
    tolerations:
27
      - key: "dedicated"
28
        value: "platform"
29
        effect: "NoSchedule"
30
31
  ssl:
32
    enabled: true
33
    mode: "require"
34
35
tags:
36
  platform: true
37
  monitoring: true
38
  logging: true
39
40
astronomer:
41
  houston:
42
    replicas: 2
43
    resources:
44
      requests:
45
        cpu: "500m"
46
        memory: "1Gi"
47
      limits:
48
        cpu: "1000m"
49
        memory: "2Gi"
50
    backendSecretName: "houston-db-secret"
51
    config:
52
      auth:
53
        local:
54
          enabled: false
55
        openidConnect:
56
          microsoft:
57
            enabled: true
58
            clientId: "<YOUR_CLIENT_ID>"
59
            clientSecret: "<YOUR_CLIENT_SECRET>"
60
            discoveryUrl: "https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration"
61
      email:
62
        enabled: true
63
        smtpUrl: "smtp://smtp.example.com:587"
64
      publicSignups:
65
        enabled: false
66
      deployments:
67
        deploymentLifecycle:
68
          hardDeleteDeployment:
69
            enabled: true
70
        namespaceManagement:
71
          manualReleaseNames:
72
            enabled: true
73
74
  commander:
75
    replicas: 2
76
    resources:
77
      requests:
78
        cpu: "250m"
79
        memory: "1Gi"
80
      limits:
81
        cpu: "500m"
82
        memory: "2Gi"
83
84
  registry:
85
    persistence:
86
      enabled: true
87
      size: "200Gi"
88
89
nginx:
90
  replicas: 2
91
  serviceType: LoadBalancer
92
  privateLoadBalancer: true
93
  resources:
94
    requests:
95
      cpu: "500m"
96
      memory: "1Gi"
97
98
prometheus:
99
  retention: 30d
100
  persistence:
101
    enabled: true
102
    size: "200Gi"
103
  resources:
104
    requests:
105
      cpu: "1"
106
      memory: "4Gi"
107
108
elasticsearch:
109
  data:
110
    replicas: 3
111
    persistence:
112
      size: "200Gi"
113
    resources:
114
      requests:
115
        cpu: "1"
116
        memory: "4Gi"