Deploy your first Pro DAG
Take a DAG from Lite to a Kubernetes control plane — your first Pro deployment.
Deploy & operate
Take Leoflow to production — deploy from CI, run the Helm chart, upgrade, back up, and keep the scheduler resilient.
Running Leoflow in production: promotion from Lite to Pro, the deploy pipeline, and the day-2 operations that keep a control plane healthy.
Start here
Deploy your first Pro DAG
Take a DAG from Lite to a Kubernetes control plane, end to end.
Go to production →
Deploy prerequisites & why shortcuts fail
Every gate a Pro deploy enforces, its exact error, and the fix.
Check the gates →
CI/CD & deploy
Build, push, and register DAGs from CI — GitHub Actions, GitLab, Cloud Build.
Wire up CI/CD →
Helm chart
Install and configure the Pro control plane on Kubernetes.
Install with Helm →
Troubleshooting & observability
Diagnose DAG, scheduler, and executor problems — and find where the logs live.
Diagnose issues →
Security & data-path internals
Agent credential transport, Pro TLS, the staging volume, and external secrets.
Deploy prerequisites & why shortcuts fail
Every gate leoflow deploy/push enforces — the exact error, why it exists, and the fix.
CI/CD & deploy examples
Build, push and register DAGs from CI — GitHub Actions, GitLab CI, Cloud Build.
Helm chart
Install and configure the Leoflow Pro control plane on Kubernetes with the official Helm chart.
Upgrades
Upgrade a Leoflow control plane safely, edition by edition.
Backup & restore
Back up and restore Leoflow state — metadata, secrets, and logs.
Trigger a run from an external system
Obtain a token, trigger a DAG run with conf over the REST API, and poll it — the raw-HTTP path for an external integrator.
External secrets (keyless, ESO, and mounted secrets)
Reach credentials that live in your cloud secret store or Vault from task pods — keyless first, then External Secrets Operator or a mounted Kubernetes Secret — without duplicating them in Leoflow.
Troubleshooting & observability
Diagnose DAG, scheduler and executor problems; where the logs and signals live.
Scheduler resilience
How the scheduler survives restarts, leader loss and partial failure.
Warm worker pools
Cut task start latency with pre-warmed worker pods.
Agent credential transport
How declared secrets reach the in-container agent, and the trust boundary.
Pro TLS (cert-manager)
Terminate TLS on the Pro control plane with cert-manager.
Staging volume
The ephemeral per-run volume that shares large data between tasks.