Helm chart for deploying the XBoard panel (web + horizon + ws-server) on Kubernetes.

Chart: 0.2.0 · App: latest · Kubernetes: ≥ 1.29 · Helm: ≥ 3.14

This chart deploys three components of XBoard:

Out of scope (manage separately): PostgreSQL database (CNPG), Redis (Bitnami chart), TLS certificate (cert-manager), and ArgoCD Application resources.

• Kubernetes >= 1.29
• Helm >= 3.14
• Gateway API v1 CRDs installed in cluster
• CNPG Cluster xboard-app-db deployed and ready (provides xboard-app-db-rw service)
• Bitnami Redis release redis deployed (provides redis-master service)
• Stakater Reloader operator (optional, required when reloader.enabled=true)

helm repo add xboard https://ah-dark.github.io/xboard-helm-chart
helm repo update
helm install xboard xboard/xboard \
  --namespace xboard \
  --create-namespace

git clone https://github.com/AH-dark/xboard-helm-chart.git
helm install xboard ./xboard-helm-chart/charts/xboard \
  --namespace xboard \
  --create-namespace

The chart auto-generates APP_KEY when it is left empty and no config.existingSecret is set. On helm upgrade the existing in-cluster value is reused via helm lookup, so pods are not invalidated.

For reproducible output (e.g. GitOps with helm template, dry-runs, or fully deterministic installs), set the key explicitly:

helm install xboard xboard/xboard \
  --namespace xboard \
  --create-namespace \
  --set config.values.APP_KEY="base64:$(openssl rand -base64 32)"

This chart only renders HTTPRoutes; the referenced Gateway must be provisioned out of band (for example via xboard/cert/gateway.yaml or a shared cluster-level gateway).

Set ingress.hostnames to expose the panel under multiple FQDNs (e.g. a primary domain and a vanity alias). Every HTTPRoute (web, redirect, ws) is rendered with the full list:

# values-override.yaml
ingress:
  hostnames:
    - panel.example.com
    - panel.alt.example.com

When hostnames is empty (the default), the chart falls back to the legacy single hostname field, preserving the behaviour of chart 0.1.x.

The chart renders a Secret from config.values. APP_KEY is auto-generated when empty; pass it explicitly only when you need a stable, externally-known value:

helm install xboard xboard/xboard \
  --namespace xboard \
  --set config.values.APP_KEY="base64:$(openssl rand -base64 32)" \
  --set config.values.DB_PASSWORD="my-db-password" \
  --set config.values.REDIS_PASSWORD="my-redis-password"

Pre-create the Secret externally, then reference it:

# Create secret beforehand (e.g. via Sealed Secrets, External Secrets, etc.)
kubectl create secret generic my-xboard-config \
  --namespace xboard \
  --from-env-file=config.env

# Install chart pointing to existing secret
helm install xboard xboard/xboard \
  --namespace xboard \
  --set config.existingSecret=my-xboard-config

When config.existingSecret is set, config.values is completely ignored and no Secret is rendered by this chart.

This chart does not render a Gateway resource. It assumes an external Gateway named xboard-gateway already exists in the namespace (e.g. deployed from xboard/cert/gateway.yaml).

To point HTTPRoutes at a different Gateway (e.g. shared cluster-level gateway):

# values-override.yaml
ingress:
  parentRefs:
    https:
      - name: shared-gateway
        namespace: gateway-system
        sectionName: https
    http:
      - name: shared-gateway
        namespace: gateway-system
        sectionName: http

helm upgrade xboard xboard/xboard \
  --namespace xboard

The auto-generated APP_KEY is preserved across upgrades via helm lookup. To rotate it, pass --set config.values.APP_KEY="base64:$(openssl rand -base64 32)" (note: pods using the previous key will need to re-encrypt any APP_KEY-encrypted data).

Important: Selector labels are immutable. If you need to change selector labels, you must uninstall and reinstall (with downtime).

helm uninstall xboard --namespace xboard

Note: PVCs (if any) and Secrets created outside this chart are NOT deleted by helm uninstall.

This chart is distributed under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later).