Helm chart
The Pro control plane installs on Kubernetes via the official Helm chart. The chart is chart-test gated, publishes multi-arch images per release, and signs them with cosign. It runs on any cluster with an external Postgres + Redis.
Install from the published OCI chart
Every release tag publishes the chart as a cosign-signed OCI artifact to
oci://ghcr.io/neochaotic/charts/leoflow (ADR 0028),
co-versioned with the release tag — so you can install a pinned version without
cloning the repo:
helm install leoflow oci://ghcr.io/neochaotic/charts/leoflow --version <x.y.z> \
-n leoflow --create-namespace \
-f values.yaml
Pass the release tag without the leading v (tag v0.4.0 → --version 0.4.0):
the chart version/appVersion move in lockstep with the tag, so this also pins
the control-plane image. Installing from a source checkout
(helm install ./helm/leoflow) is still supported for unreleased branches — see
the chart README
for both paths and the full values surface.
This operator-journey page is the entry point; the exhaustive values reference is
maintained alongside the chart source so it never drifts from values.yaml:
→ Helm chart README (including the datastore compatibility matrix).
A first-class values reference on this site is a TODO for a later migration phase.
What the chart gives you
- The
/api/v2/Airflow-compatible API + UI, and the scheduler — as one process (role=all) or split intorole=api+role=scheduler(ADR 0049). - Opt-in hardening templates: HPA, PodDisruptionBudget, NetworkPolicy, and a Prometheus ServiceMonitor.
- TLS termination via cert-manager — see Pro TLS.
Related
- Editions & operating modes — what Pro gives you and its validation status.
- Deploy your first Pro DAG — the promotion walkthrough.
- Upgrades — upgrading a chart release safely.
- Cross-listed from the Reference section for the values surface.