Helm Configuration Reference

Plethos is configured through the Helm chart’s values.yaml file. It controls values for the portal, controller and expiration CRON job. This reference will explain all of its configuration values.

Here is the full default contents of the values.yaml file:

Click to see the default values.yaml

values.yaml

# Default values for the plethos chart.
# Install into its own namespace, e.g.:
#   helm install plethos ./charts/plethos -n plethos-system --create-namespace -f my-values.yaml


# Versions of vCluster the controller can provision. Must be a comma-separated list.
# The portal always provisions new vCluster with the latest version in that list.
# Shared between portal and controller.
supportedVclusterVersions: "0.35.0"

# Domain each vCluster's control plane (Kubernetes API) is exposed under, as
# <claim-name>.<vClusterApiBaseDomain>, e.g. vcluster.plethos.example.com. Requires an ingress
# controller with SSL passthrough. Required.
vClusterApiBaseDomain: ""

# Domain owner-deployed apps are exposed under, as <claim-name>.<exposedAppsBaseDomain>, e.g.
# apps.plethos.example.com. Independent of vClusterApiBaseDomain. The portal uses it only to display a cluster's app host and the controller to provision the Ingress for it. Leaving it blank turns app exposure off.
# Shared between portal and controller.
exposedAppsBaseDomain: ""

portal:
  image:
    repository: codeberg.org/hmcloudlabs/plethos-portal
    tag: "" # defaults to the chart's appVersion
    pullPolicy: IfNotPresent

  replicas: 1

  # Name of an existing Secret (in the release namespace) with keys:
  # PORTAL_SESSION_SECRET, CSRF_TOKEN_SECRET, OIDC_CLIENT_SECRET and optionally SMTP_USERNAME,
  # SMTP_PASSWORD (leave out if your SMTP server doesn't require authentication).
  # This chart never creates it - see NOTES.txt after install for the kubectl
  # command to create it. Leave blank to use the default "<release>-portal-secrets".
  secretName: ""

  ingress:
    enabled: true
    className: ""
    host: plethos.example.com

  # Public URL the portal is reachable at (used to build links in emails and must be a real,
  # reachable URL in production, not the default localhost one, or those links will be broken.
  baseUrl: "http://localhost:8000"

  # Portal admin settings ConfigMap. These are initial defaults only: they are applied on the first
  # install, afterwards the live values (editable in the portal's admin UI) are kept on upgrades.
  settings:
    adminEmails: "admin@example.com"
    maxVclustersPerUser: 5
    maxTeamSize: 5

  # OIDC configuration, override with yours
  oidc:
    issuer: ""
    clientId: plethos-portal

  supportEmail: "support@example.com"

  # SMTP configuration, override with yours
  smtp:
    host: ""
    port: 1025
    fromAddress: "plethos@example.com"

controller:
  image:
    repository: codeberg.org/hmcloudlabs/plethos-controller
    tag: "" # defaults to the chart's appVersion
    pullPolicy: IfNotPresent

  replicas: 1

  # Namespace the ingress controller runs in, each vCluster's NetworkPolicy lets it through.
  ingressNamespace: ingress-nginx

  # Only needed if the ingress controller runs with `hostNetwork: true`: its traffic then comes from
  # node IPs, which the namespace above can't match. List the IP ranges (CIDR notation) covering
  # every node it may run on, e.g. ["192.168.10.0/24"]
  ingressControllerIpRanges: []

  # Seconds between drift-correcting reconciliations of every VClusterClaim. This is the
  # fallback, not the path a user waits on.
  reconciliationInterval: 10800 # 3hrs
  # Seconds between reconciliations of VClusterClaims in Provisioning, Pending or Waking. Only those
  # VClusterClaim are polled, so this sets how fast the portal shows a cluster becoming Running.
  transitionalReconciliationInterval: 10

notifier:
  # Daily inactivity check that flags/expires unused vClusters.
  schedule: "0 3 * * *"

# Override the release-name-derived resource prefix (see templates/_helpers.tpl).
nameOverride: ""
fullnameOverride: ""

Minimum configuration

Everything else has working defaults, but these values are placeholders or empty and must be set for your environment:

• vClusterApiBaseDomain
• portal.ingress.host
• portal.baseUrl
• portal.oidc.issuer
• portal.smtp.host and portal.smtp.port
• portal.smtp.fromAddress
• portal.settings.adminEmails
• portal.supportEmail

Value reference

Shared values

These top-level values are used by both the portal and the controller.

Value	Default	Description
supportedVclusterVersions	"0.35.0"	Comma-separated list of vCluster versions the controller can provision, e.g. "0.34.0,0.35.0". The portal always provisions new vClusters with the latest version in the list. The latest officially supported vCluster version by Plethos is 0.35.0. Only add versions to this list if your Plethos version officially supports it.
vClusterApiBaseDomain	""	Required. Each vCluster’s Kubernetes API is exposed at <claim-name>.<vClusterApiBaseDomain>. Needs an ingress controller with SSL passthrough.
exposedAppsBaseDomain	""	Apps deployed by cluster owners are exposed at <claim-name>.<exposedAppsBaseDomain>. The portal uses it to show the app URL to the user, the controller to create the Ingress. Optional, leave empty to turn app exposure off.

Portal

The portal is the web UI where users sign in and manage their vClusters.

Image and scaling

Value	Default	Description
portal.image.repository	codeberg.org/hmcloudlabs/ plethos-portal	Container image. Only change if you use a different, unofficial distribution of Plethos.
portal.image.tag	""	Defaults to the chart’s appVersion. There is rarely a reason to change this.
portal.image.pullPolicy	IfNotPresent	Standard Kubernetes pull policy.
portal.replicas	1	Number of portal pods.

Ingress and URL

Value	Default	Description
portal.ingress.enabled	true	Create an Ingress for the portal.
portal.ingress.className	""	Ingress class to use. Leave blank for the cluster default.
portal.ingress.host	plethos.example.com	Hostname the portal is served on.
portal.baseUrl	http://localhost:8000	Public URL of the portal, used to build links in emails. Must be a real, reachable URL, normally https:// plus your ingress host.

Secret

The portal reads credentials from a Kubernetes Secret.

Value	Default	Description
portal.secretName	""	Name of an existing Secret in the release namespace. Blank uses <release>-portal-secrets, so in most cases you can leave it.

Admin settings

These settings are applied on the first install only. After that, the live values are kept on upgrades and are edited in the portal’s admin UI. Changing them in values.yaml later has no effect. The max* values can be overwritten specifically per user using the admin UI.

Value	Default	Description
portal.settings.adminEmails	"admin@example.com"	Email address(es) of portal admins.
portal.settings. maxVclustersPerUser	5	Maximum vClusters a single user can have.
portal.settings.maxTeamSize	5	Maximum size of a team (i.e how many users can be invited to a cluster).

Authentication and email

Value	Default	Description
portal.oidc.issuer	""	Required. Issuer URL of your OIDC provider.
portal.oidc.clientId	plethos-portal	Client ID registered at your OIDC provider. The client secret goes in the Secret, not here.
portal.supportEmail	support@example.com	Support address shown to users.
portal.smtp.host	""	SMTP server hostname.
portal.smtp.port	1025	SMTP server port. The default suits a local test mail server, so change it for a real one.
portal.smtp.fromAddress	plethos@example.com	Sender address of automated emails.

Controller

The controller watches VClusterClaim resources and creates, reconciles and cleans up the actual vClusters.

Value	Default	Description
controller.image.repository	codeberg.org/hmcloudlabs/ plethos-controller	Container image. Only change if you use a different, unofficial distribution of Plethos.
controller.image.tag	""	Defaults to the chart’s appVersion. There is rarely a reason to change this.
controller.image.pullPolicy	IfNotPresent	Standard Kubernetes pull policy.
controller.replicas	1	Number of controller pods.
controller.ingressNamespace	ingress-nginx	Namespace your ingress controller runs in. Each vCluster’s NetworkPolicy allows traffic from it.
controller.ingress ControllerIpRanges	[]	Only needed if the ingress controller uses hostNetwork: true. See below.
controller.reconciliation Interval	10800	Seconds between drift-correcting reconciliations of every VClusterClaim (3 hours). This is a fallback, not what users wait on.
controller.transitional ReconciliationInterval	10	Seconds between reconciliations of claims in Provisioning, Pending or Waking. Controls how quickly the portal shows a cluster as Running.

Using hostNetwork on your ingress controller?

If your ingress controller runs with hostNetwork: true, ingress traffic comes from node IPs, which a namespace rule can’t match. List the CIDR ranges covering every node the ingress controller may run on, for example:

controller:
  ingressControllerIpRanges: ["192.168.10.0/24"]

Without this, the vClusters’ NetworkPolicies block the ingress controller from reaching exposed apps.

Expiration Notifier

Value	Default	Description
notifier.schedule	"0 3 * * *"	Cron schedule of the daily expiration check that flags and expires unused vClusters. The default runs every day at 03:00 am.

Naming

These are standard Helm options for customizing generated resource names. Most installs don’t need them.

Value	Default	Description
nameOverride	""	Replaces the chart name in generated resource names.
fullnameOverride	""	Replaces the whole generated resource name prefix, which is otherwise derived from the release name.

Example values

A realistic setup with app exposure enabled. Adjust the domains, issuer and SMTP details to your environment.

values.yaml

# Newest version in the list is used for new vClusters
supportedVclusterVersions: "0.34.0,0.35.0"

vClusterApiBaseDomain: vcluster.plethos.example.com
exposedAppsBaseDomain: apps.plethos.example.com

portal:
  baseUrl: https://plethos.example.com
  ingress:
    className: nginx
    host: plethos.example.com

  # Initial defaults, editable later in the portal's admin UI
  settings:
    adminEmails: "admin@example.com"
    maxVclustersPerUser: 3
    maxTeamSize: 10

  oidc:
    issuer: https://auth.example.com/realms/main
    clientId: plethos-portal

  supportEmail: "support@example.com"

  smtp:
    host: smtp.example.com
    port: 587
    fromAddress: "plethos@example.com"

controller:
  ingressNamespace: ingress-nginx
  # Only if the ingress controller runs with hostNetwork: true
  # ingressControllerIpRanges: ["192.168.10.0/24"]