{"id":46249942,"url":"https://github.com/itential/iag5-helm","last_synced_at":"2026-03-03T22:01:39.510Z","repository":{"id":305751193,"uuid":"991994902","full_name":"itential/iag5-helm","owner":"itential","description":"A Helm chart for running Itential Automation Gateway 5 in Kubernetes","archived":false,"fork":false,"pushed_at":"2026-01-14T20:29:25.000Z","size":155,"stargazers_count":0,"open_issues_count":0,"forks_count":3,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-15T00:46:19.995Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Smarty","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/itential.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-05-28T13:08:27.000Z","updated_at":"2026-01-07T22:01:18.000Z","dependencies_parsed_at":"2025-08-13T16:07:20.364Z","dependency_job_id":"77f157c9-e80a-4ecf-84f8-246bd1f0fdc1","html_url":"https://github.com/itential/iag5-helm","commit_stats":null,"previous_names":["itential/iag5-helm"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/itential/iag5-helm","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itential%2Fiag5-helm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itential%2Fiag5-helm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itential%2Fiag5-helm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itential%2Fiag5-helm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/itential","download_url":"https://codeload.github.com/itential/iag5-helm/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itential%2Fiag5-helm/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30063357,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-03T18:21:05.932Z","status":"ssl_error","status_checked_at":"2026-03-03T18:20:59.341Z","response_time":61,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-03-03T22:01:38.915Z","updated_at":"2026-03-03T22:01:39.501Z","avatar_url":"https://github.com/itential.png","language":"Smarty","funding_links":[],"categories":[],"sub_categories":[],"readme":"# IAG5 Helm Chart\n\nThis chart is designed to enable the easy and rapid deployment of IAG5 environments and\narchitectures. Requires Kubernetes version `1.31` or greater and Helm version `v3.15.0`.\n\n## IAG5 Architectures\n\nThere are a few different architectures that are available when running IAG5. This chart is capable\nof building two of them:\n\n- A simple server architecture that is invoked from a client. The client is not a part of the chart.\n- A distributed architecture that includes a server and runners that is invoked from a client. The\nclient is not a part of the chart.\n\nFor information about installing a client please visit the IAG5 repo.\n\n### Requirements \u0026 Dependencies\n\n| Repository | Name | Version |\n|:-----------|:-----|:--------|\n| \u003chttps://charts.bitnami.com/bitnami\u003e | etcd | 11.3.0 |\n| \u003chttps://charts.jetstack.io\u003e | cert-manager | 1.12.3 |\n| \u003chttps://kubernetes-sigs.github.io/external-dns/\u003e | external-dns | 1.17.0 |\n\n#### Secrets\n\nThe chart assumes the following secrets, they are not included in the Chart.\n\n##### imagePullSecrets\n\nThis is the secret that will pull the image from the Itential ECR. Name to be determined by the user\n of the chart and that name must be provided in the values file (`imagePullSecrets[0].name`).\n\n##### itential-ca\n\nThis secret represents the CA used by cert-manager to derive all the TLS certificates. Name to be\nprovided by the user of the chart in the values file (`issuer.caSecretName`) if using cert-manager.\n\n##### itential-gateway-secrets\n\nThis secret contains several sensitive values that the application may use. They are loaded into the\npod as environment variables. Some are optional and depend on your implementation. The creation of\nthis secret is left out of the chart to allow for flexibility with its creation.\n\n| Secret Key | Description | Required? |\n|:-----------|:------------|:----------|\n| encryptionKey | A private key used to encrypt and decrypt secrets within IAG5, a base 64 256 character string is recommended. | true |\n\n##### dynamodb-aws-secrets\n\nWhen using DynamoDB as the backend store, a Secret named \"dynamodb-aws-secrets\" is required. This\nSecret will contain the necessary AWS environment variables that are used when establishing\nconnections to DynamoDB. The keys in this secret are used as environment variables and are probably\nthese:\n\n- AWS_ACCESS_KEY_ID\n- AWS_SECRET_ACCESS_KEY\n- AWS_SESSION_TOKEN\n- AWS_REGION\n\n#### Certificates\n\nThe chart will require a Certificate Authority to be added to the Kubernetes environment. This is\nused by the chart when running with TLS flags enabled. The chart will use this CA to generate the\nnecessary certificates using a Kubernetes `Issuer` which is included. The Issuer will issue the\ncertificates using the CA. The certificates are then included using a Kubernetes `Secret` which is\nmounted by the pods. Creating and adding this CA is outside of the scope of this chart.\n\nBoth the `Issuer` and the `Certificate` objects are realized by using the widely used Kubernetes\nadd-on called `cert-manager`. Cert-manager is responsible for making the TLS certificates required\nby using the CA that was installed separately. The installation of cert-manager is outside the scope\nof this chart. To check if this is already installed run this command:\n\n```bash\nkubectl get crds | grep cert-manager\n```\n\n#### Etcd\n\nEtcd is a strongly consistent, distributed key-value store that provides a reliable way to store\ndata that needs to be accessed by a distributed system or cluster of machines. It gracefully handles\nleader elections during network partitions and can tolerate machine failure, even in the leader\nnode. This is a required component when running the application in \"distributed\" mode.\n\nThis chart was developed with the Bitnami Etcd chart. For more information see the [Bitnami Chart](https://artifacthub.io/packages/helm/bitnami/etcd).\n\n#### DNS\n\nThis is an optional requirement.\n\nItential used the ExternalDNS project to facilitate the creation of DNS entries. ExternalDNS\nsynchronizes exposed Kubernetes Services and Ingresses with DNS providers. This is not a\nrequirement for running the chart. The chart and the application can run without this if needed. We\nchose to use this to provide us with external addresses.\n\nFor more information see the [ExternalDNS project](https://github.com/kubernetes-sigs/external-dns).\n\n### Simple Server\n\nAn IAG5 simple server is a simple All-in-one architecture that can run automations that are invoked\nfrom a client. That client could be a local installation of IAG5, or an Itential Platform server. It\nruns all automations in isolated execution environments and runs on a single pod runs all\nautomations in memory and runs on a single pod. It can support TLS connections.\n\nTo create this environment the values file must provide the appropriate values for `serverSettings`\nand `runnerSettings`. When the replicaCount is greater than zero in the `serverSettings` config\nobject the chart will create a pod as a server. When the number of runners is greater than zero the\nchart will create pods as runners. The values in `applicationSettings` effect all pods. These\nconfiguration sections in values.yaml file can also contain all of the environment variables for a\npod. For example, this will create a simple server:\n\n```yaml\nhostname: iag5.example.com\nport: 50051\nuseTLS: true\n\n# Set the number of runner replicas to zero\nrunnerSettings:\n  replicaCount: 0\n  env: {}\n    ...\n\n# Set the number of server replicas to one\nserverSettings:\n  replicaCount: 1\n  connectEnabled: true\n  connectHosts: \"itential.example.com\" # The hostname of the Itential server\n  connectInsecureEnabled: true\n  env: {}\n    ...\n\n# Configure all pods with these values\napplicationSettings:\n  clusterId: cluster_1\n  storeBackend: memory\n  env: {}\n```\n\n### Distributed Server\n\nAn IAG5 distributed server is a server with a configurable number of runners. The server instructs\nthe runners to run IAG5 services, the runners obey. The server responds to a client, like the simple\nserver architecture. That client could be a local installation of IAG5 or an Itential Platform\nserver. It requires an Etcd cluster that it uses for communication. It consists of many pods. It\ncan support TLS connections.\n\nThe chart will create the Etcd cluster when the `etcd.enabled` value is set to true. Itential\nroutinely uses the helm chart provided by [Bitnami](https://artifacthub.io/packages/helm/bitnami/etcd).\nThis chart is listed as a dependency.\n\nTo create this environment the values file must provide the appropriate values for `serverSettings` and\n`runnerSettings`. When the replicaCount is greater than zero in the `serverSettings` config\nobject the chart will create a pod as a server. When the replicaCount is greater than zero in the\n`runnerSettings` config object the chart will create that many runners. The values in\n`applicationSettings` effect all pods. These configuration sections in values.yaml file can also\ncontain all of the environment variables for a pod. For example, this will create a distributed\nserver:\n\n```yaml\nhostname: iag5.example.com\nport: 50051\nuseTLS: true\n\n# Set the number of runner replicas to the desired number of runners\nrunnerSettings:\n  replicaCount: 3\n  env: {}\n    ...\n\n# Set the number of server replicas to one\nserverSettings:\n  replicaCount: 1\n  connectEnabled: true\n  connectHosts: \"itential.example.com\" # The hostname of the Itential server\n  connectInsecureEnabled: true\n  env: {}\n    ...\n\n# Configure all pods with these values\napplicationSettings:\n  etcdTlsSecretName: etcd-tls-secret\n  clusterId: cluster_1\n  storeBackend: etcd # \"etcd\", \"memory\", \"dynamodb\"\n\n  # Etcd settings\n  etcdHosts: \"etcd.default.svc.cluster.local:2379\"\n  env: {}\n```\n\n### Using DynamoDB instead of Etcd\n\nJust change the `storeBackend` and add the DynamoDB table name.\n\n```yaml\n# Configure all pods with these values\napplicationSettings:\n  clusterId: cluster_1\n  storeBackend: dynamodb\n\n  # DynamoDB settings\n  dynamodbTableName: \"itential-dynamodb-test\"\n  env: {}\n  ```\n\n### Using TLS connections\n\nTo enable TLS connections between IAG5 and Etcd you can use a configuration like this:\n\n```yaml\nhostname: iag5.example.com\nport: 50051\nuseTLS: true\n\n# Set the number of runner replicas to the desired number of runners\nrunnerSettings:\n  replicaCount: 3\n  env: {}\n    ...\n\n# Set the number of server replicas to one\nserverSettings:\n  replicaCount: 1\n  connectEnabled: true\n  connectHosts: \"itential.example.com\" # The hostname of the Itential server\n  connectInsecureEnabled: true\n  env: {}\n    ...\n\n# Configure all pods with these values\napplicationSettings:\n  etcdTlsSecretName: etcd-tls-secret\n  clusterId: cluster_1\n  logLevel: DEBUG\n  storeBackend: etcd\n\n  # Etcd settings\n  etcdUseTLS: true\n  etcdUseClientCertAuth: true\n  etcdHosts: \"etcd.default.svc.cluster.local:2379\"\n  env: {}\n```\n\nThis requires an additional Secret to be installed in the Kubernetes environment. That Secret's\nname must be provided to the pods as the value of `applicationSettings.etcdTlsSecretName`. The\nDeployments will mount this secret as files whose paths are described by\n`GATEWAY_STORE_ETCD_CA_CERTIFICATE_FILE`, `GATEWAY_STORE_ETCD_CERTIFICATE_FILE`, and\n`GATEWAY_STORE_ETCD_PRIVATE_KEY_FILE`.\n\n### Run the Chart\n\nClone this repo, adhere to the requirements, modify values.yaml appropriately, and install into your\nKubernetes environment by doing the following:\n\n```bash\nhelm install iag5 . -f values.yaml\n```\n\n### Run the unit tests\n\nThis project uses the helm unittest plugin.\n\n```bash\nhelm unittest .\n```\n### Run helm tests\n\nThis project uses helm tests that should be run after deployment. These are integration tests that run actual pods in your cluster after deployment to verify the application is working correctly.\n\nHelm tests are present in `iag5-helm/charts/iag5/templates/tests/`\n\nHelm looks through ALL rendered Kubernetes manifests in chart for resources that have this specific annotation:\n\n```bash\nannotations:\n  \"helm.sh/hook\": test\n```\nRun all test using below command\n\n```bash\nhelm test iag5 -n \u003cNAMESPACE\u003e --logs\n```\nRun individual test using below command\n\n```bash\nhelm test iag5 -n \u003cNAMESPACE\u003e --filter name=iag5-test-connection --logs\n```\nRun multiple tests using below command\n\n```bash\nhelm test iag5 -n \u003cNAMESPACE\u003e --filter 'name=iag5-test-version,name=iag5-test-processes' --logs\n```\n\n#### Values\n\nThese values are intended to be refined when this chart is implemented. Many of these values are\nsimply values that were used during development and testing.\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| affinity | object | `{}` | Additional affinities |\n| applicationSettings.clusterId | string | `\"cluster_1\"` | The ID that uniquely identifies your gateway instance or a cluster of related gateway instances. This is also used to link a gateway controller node to Gateway Manager so that automations can be sent to a particular cluster. |\n| applicationSettings.dynamodbTableName | string | `\"\"` | The DynamoDB table name when storeBackend is set to \"dynamodb\" |\n| applicationSettings.etcdHosts | string | `\"etcd.default.svc.cluster.local:2379\"` | Sets the etcd hosts that the gateway connects to for backend storage. A host entry consists of an address and port: hostname:port. If there are multiple etcd hosts, enter them as a space separated list: hostname1:port hostname2:port. |\n| applicationSettings.etcdTlsSecretName | string | `\"etcd-tls-secret\"` | The name of the etcd TLS secret. This is mounted as a volume by the deployment and contains the Etcd TLS certs and keys. |\n| applicationSettings.etcdUseClientCertAuth | bool | `true` | Enable certificate validation when connecting to Etcd. |\n| applicationSettings.etcdUseTLS | bool | `true` | Enable TLS when connecting the Etcd. |\n| applicationSettings.logLevel | string | `\"DEBUG\"` | Sets the verbosity of the logs that the gateway displays to the console and file logs. Possible values are: \"TRACE\", \"DEBUG\", \"INFO\", \"WARN\", \"ERROR\", \"FATAL\", \"DISABLED\". |\n| applicationSettings.storeBackend | string | `\"memory\"` | Sets the backend type for persistent data storage. Itential Automation Gateway (IAG) uses stores as key-value databases to persistently save objects. IAG supports three types of store backends: \"local\", \"memory\", \"etcd\", \"dynamodb\" |\n| certManager.enabled | bool | `true` | Toggles the use of cert-manager for managing the TLS certificates. Setting this to false means that creation of the TLS certificates will be manual and outside of the chart. |\n| certificate.dnsNames | list | `[\"iag5.example.com\"]` | The list of static DNS names to include in the certificate. |\n| certificate.duration | string | `\"2160h\"` | Specifies how long the certificate should be valid for (its lifetime). |\n| certificate.enabled | bool | `true` | Toggle to use the certificate object or not |\n| certificate.includeServiceIPs | bool | `true` | Include the list of service IP addresses. |\n| certificate.ipAddress | list | `[]` | The list of static IPs to include in the certificate, if any. |\n| certificate.issuerRef.kind | string | `\"Issuer\"` | The issuer type |\n| certificate.issuerRef.name | string | `\"iag5-ca-issuer\"` | The name of the issuer with the CA reference. |\n| certificate.keyStores | object | `{}` | Specifies any key store properties |\n| certificate.privateKey | object | `{}` | Specifies any private key properties |\n| certificate.renewBefore | string | `\"48h\"` | Specifies how long before the certificate expires that cert-manager should try to renew. |\n| certificate.subject | object | `{\"countries\":[\"US\"],\"localities\":[\"Atlanta\"],\"organizations\":[\"Itential\"],\"postalCodes\":[\"30309\"],\"provinces\":[\"Georgia\"],\"streetAddresses\":[\"1350 Spring St NW\"]}` | Specifies any subject fields required |\n| external-dns.enabled | bool | `false` | Optional dependency to generate a static external DNS name |\n| hostname | string | `\"iag5.example.com\"` | The intended hostname to use |\n| image.pullPolicy | string | `\"IfNotPresent\"` | The image pull policy |\n| image.repository | string | `\"497639811223.dkr.ecr.us-east-2.amazonaws.com/automation-gateway5\"` | The image repository |\n| image.tag | string | `\"5.1.1-amd64\"` | The image tag |\n| imagePullSecrets | list | `[{\"name\":\"\"}]` | The secrets object used to pull the image from the repo |\n| issuer.caSecretName | string | `\"itential-ca\"` | The CA secret to be used by this issuer when creating TLS certificates. |\n| issuer.enabled | bool | `true` | Toggle to use the issuer object or not |\n| issuer.kind | string | `\"Issuer\"` | The issuer type. Template defaults to Issuer. |\n| issuer.name | string | `\"iag5-ca-issuer\"` | The name of this issuer. |\n| nodeSelector | object | `{}` | Additional nodeSelectors |\n| podAnnotations | object | `{}` | Additional pod annotations |\n| podLabels | object | `{}` | Additional pod labels |\n| podSecurityContext | object | `{}` | Additional pod security context |\n| port | int | `50051` | The intended port to use |\n| runnerSettings.replicaCount | int | `0` | The number of runners to use. Set to zero to disable distributed runners. |\n| securityContext | object | `{}` | Additional security context |\n| serverSettings.connectEnabled | bool | `true` | Enables or disables the connection to Gateway Manager. |\n| serverSettings.connectHosts | string | `\"itential.example.com:8080\"` | Configures the hostname and port used to connect to Gateway Manager. |\n| serverSettings.connectInsecureEnabled | bool | `false` | Determines whether the gateway verifies TLS certificates when it connects to Itential Platform. When set to true, the gateway skips TLS certificate verification. We strongly recommend enabling TLS certificate verification in production environments. |\n| serverSettings.replicaCount | int | `1` | The number of servers to use. At least one server must be defined. |\n| service.annotations | object | `{\"external-dns.alpha.kubernetes.io/hostname\":\"iag5.example.com\",\"external-dns.alpha.kubernetes.io/ttl\":\"60\",\"service.beta.kubernetes.io/aws-load-balancer-backend-protocol\":\"TCP\",\"service.beta.kubernetes.io/aws-load-balancer-internal\":\"false\",\"service.beta.kubernetes.io/aws-load-balancer-type\":\"nlb\"}` | Annotations on the service object, passed through as is |\n| service.name | string | `\"iag5-service\"` | The name of this Kubernetes service object |\n| service.type | string | `\"LoadBalancer\"` | The service type |\n| tolerations | list | `[]` | Additonal tolerations |\n| useTLS | bool | `true` | Turn on TLS connectivity between all the members. All on or all off. |\n| volumeMounts | list | `[]` | Additional volumeMounts on the output Deployment definition. |\n| volumes | list | `[]` | Additional volumes on the output Deployment definition. |","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fitential%2Fiag5-helm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fitential%2Fiag5-helm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fitential%2Fiag5-helm/lists"}