Helm Chart¶

The OpenDepot Helm chart is published to a GitHub Pages Helm repository:

helm repo add opendepot https://opendepot.defdev.io
helm repo update

The chart source is also available at chart/opendepot/ in the repository.

See Installation for prerequisites and deployment instructions.

Global¶

Server Configuration¶

General¶

OIDC Authentication¶

The server.oidc section enables OIDC JWT validation for production-ready single sign-on. See Authentication for detailed setup and examples.

Example (recommended — Dex proxied through the server):

server:
  oidc:
    enabled: true
    issuerUrl: https://opendepot.example.com/dex
    clientId: opendepot
    clientSecret: $(openssl rand -base64 32)
    clientSecretName: ""  # Use the above value; or set to "my-secret" to use external secret
    dexProxy:
      enabled: true

Dex Configuration¶

The dex section deploys Dex as an OIDC identity provider. Dex federates upstream IdPs (GitHub, Entra ID, Okta, LDAP, etc.) and issues JWTs that the server validates locally.

Basic Example (GitHub):

dex:
  enabled: true
  config:
    issuer: https://opendepot.example.com/dex
    connectors:
      - type: github
        id: github
        name: GitHub
        config:
          clientID: <github-oauth-app-client-id>
          clientSecret: <github-oauth-app-secret>
          redirectURI: https://opendepot.example.com/dex/callback
          org: my-org  # (optional) restrict to an org

Entra ID (Azure AD) Example:

dex:
  enabled: true
  config:
    issuer: https://opendepot.example.com/dex
    connectors:
      - type: microsoft
        id: microsoft
        name: "Azure AD"
        config:
          clientID: <azure-app-id>
          clientSecret: <azure-app-secret>
          redirectURI: https://opendepot.example.com/dex/callback
          tenant: <azure-tenant-id>

For connector configuration details, refer to the Dex Connector Documentation.

Controllers¶

These values apply to version, module, depot, and provider independently — substitute <service> with the controller name:

The Version controller's init containers use fixed bounded resources (10m CPU and 16Mi memory requests; 100m CPU and 32Mi memory limits). The controller also runs a token-refresh-helper sidecar that refreshes the projected ServiceAccount token used by the controller. The main controller does not use a directly mounted Kubernetes ServiceAccount token.

Assembly Line¶

Assembly Line derives module contracts and provider configuration schemas and enables validated root-module ZIP export. It is disabled by default (assembly.enabled: false) and is OpenTofu-only — see Assembly Line for provider eligibility. Default images do not include OpenTofu, so enabling Assembly Line requires server.image.tag and version.image.tag set to a -assembly tag. ui.baseUrl must be a valid external HTTP(S) URL when Assembly Line is enabled; its host, including a non-default port, is used for generated module source addresses and the generated OpenTofu Provider Network Mirror URL. Generated provider source addresses use the provider's canonical short identity (e.g. hashicorp/aws) instead.

The server root filesystem remains read-only. The chart mounts only assembly.workDir as a writable, size-limited emptyDir. Consider adding ephemeral-storage requests and limits under server.resources and version.resources for production workloads.

See Assembly Line for provider bindings, generated files, authentication, and validation behavior.

GPG Signing (Providers)¶

The server signs SHA256SUMS files for provider packages using a GPG key you supply. OpenTofu and Terraform verify this signature as part of the Provider Registry Protocol. See GPG Signing for Providers for full setup instructions.

Service Account & RBAC¶

Storage¶

See Storage Backends for S3, Azure, and GCS configuration, which are set via environment variables rather than Helm values.

UI Configuration¶

The ui section deploys the OpenDepot Workshop frontend. See OpenDepot Workshop for setup, OIDC login, and public visibility configuration.

Prometheus Monitoring¶

The chart can optionally install a minimal kube-prometheus-stack. Grafana, Alertmanager, and node exporters are disabled by default. The OpenDepot server Service exposes /metrics on the named metrics port (9090). The chart's ServiceMonitor selects that Service by the app: server label in global.namespace.

The ServiceMonitor is enabled by default and scrapes every 15 seconds with a 10-second timeout. It requires a Prometheus Operator. If an existing operator selects ServiceMonitors by label, set server.metrics.serviceMonitor.additionalLabels to the labels it expects. Set server.metrics.serviceMonitor.enabled: false when the external monitoring system discovers the endpoint by another method.

The Stats page queries Prometheus through its HTTP API. For an existing Prometheus deployment, set server.stats.prometheusURL to its absolute HTTP API base URL:

server:
  stats:
    prometheusURL: https://prometheus.example.com

This value takes precedence over the chart's in-cluster fallback. When it is empty and monitoring.enabled: true, the server falls back to http://<release>-monitoring-prometheus.<release-namespace>.svc.cluster.local:9090, which requires monitoring.bundled.enabled: true. The bundled stack is disabled by default because the Prometheus Operator requires cluster-wide RBAC.

The bundled Prometheus stack requires cluster-wide Prometheus Operator RBAC and is disabled by default. Enable it only when that cluster-wide access is acceptable:

monitoring:
  bundled:
    enabled: true

The Stats page uses the configured lookback window, not an all-time total. For time series longer than local retention, configure remoteWrite to Mimir or another Prometheus-compatible backend and use Grafana to query the retained history.

Source-built controller dependencies¶

The -assembly server and Version controller images build the pinned OpenTofu source commit used for initialization and schema extraction. The default images do not include OpenTofu. The version-controller image built with INCLUDE_TRIVY=true also builds Trivy from a pinned source commit, and the -assembly version-controller image includes both Trivy and OpenTofu. The chart release metadata is the source of the default image tag; release 0.11.0 uses chart and application version 0.11.0.

See Download Tracking for details on how stats are recorded and surfaced in OpenDepot Workshop.

Scanning Values¶

The scanning section controls Trivy-based vulnerability scanning for modules and providers. See Vulnerability Scanning for full details.

The optional policy-management API is intentionally separate from controller enforcement. Enabling server.policyManagement.enabled adds write verbs to the server ServiceAccount and exposes the UI CRUD surface; it does not grant users access. Configure Kubernetes Role/RoleBinding permissions for kubeconfig or bearer-token callers, or create a least-privilege SecurityGroupBinding for OIDC callers. Keep the value false when policies are applied only through GitOps.

Tilt and monitoring scope¶

The repository's Tilt profile is development-only: it enables global.developmentMode, local TLS/Dex, Trivy scanning, the UI, and the bundled Prometheus stack for an end-to-end environment. It does not enable server.policyManagement.enabled; turn that on only in a disposable cluster when testing the write surface. Do not copy the Tilt values file into production: it uses local filesystem storage, test OIDC settings, and Dex password authentication.

The bundled monitoring configuration is intentionally narrow. It scrapes OpenDepot application metrics with a single Prometheus and 90-day retention; Grafana, Alertmanager, node exporters, Kubernetes component monitors, and the Prometheus Operator ServiceMonitor are disabled by default in the chart values. Policy audit evidence comes from server/Kubernetes logs, not from Prometheus. Configure monitoring.prometheus.prometheusSpec.remoteWrite and a durable audit-log sink separately when longer retention or production alerting is required.