{"id":37229303,"url":"https://github.com/openrundev/openrun-helm-charts","last_synced_at":"2026-06-13T01:02:31.519Z","repository":{"id":331990403,"uuid":"1131299753","full_name":"openrundev/openrun-helm-charts","owner":"openrundev","description":"Helm chart for OpenRun","archived":false,"fork":false,"pushed_at":"2026-05-28T19:05:53.000Z","size":133,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-05-28T21:08:10.164Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go Template","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/openrundev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-01-09T19:27:54.000Z","updated_at":"2026-05-28T19:05:40.000Z","dependencies_parsed_at":"2026-01-31T04:01:15.646Z","dependency_job_id":null,"html_url":"https://github.com/openrundev/openrun-helm-charts","commit_stats":null,"previous_names":["openrundev/openrun-helm-charts"],"tags_count":43,"template":false,"template_full_name":null,"purl":"pkg:github/openrundev/openrun-helm-charts","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openrundev%2Fopenrun-helm-charts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openrundev%2Fopenrun-helm-charts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openrundev%2Fopenrun-helm-charts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openrundev%2Fopenrun-helm-charts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/openrundev","download_url":"https://codeload.github.com/openrundev/openrun-helm-charts/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openrundev%2Fopenrun-helm-charts/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34268189,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-12T02:00:06.859Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-15T03:32:06.102Z","updated_at":"2026-06-13T01:02:31.499Z","avatar_url":"https://github.com/openrundev.png","language":"Go Template","funding_links":[],"categories":[],"sub_categories":[],"readme":"# OpenRun Helm Chart\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://openrun.dev/openrun.png\" alt=\"OpenRun-logo\" width=\"300\" height=\"250\"/\u003e\n\n  \u003cp align=\"center\"\u003eApp deployment simplified. Open source alternative to Google Cloud Run and AWS App Runner. Easily deploy internal tools, on a single node with Docker/Podman or onto a Kubernetes cluster.\u003c/p\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"https://github.com/openrundev/openrun-helm-charts/actions/workflows/helm_test.yml/badge.svg\" alt=\"drawing\"/\u003e\n\u003cimg src=\"https://github.com/openrundev/openrun-helm-charts/actions/workflows/release.yml/badge.svg\" alt=\"drawing\"/\u003e\n\u003cimg src=\"https://img.shields.io/github/v/release/openrundev/openrun-helm-charts\" alt=\"drawing\"/\u003e\n\u003cimg src=\"https://img.shields.io/github/downloads/openrundev/openrun-helm-charts/total.svg\" alt=\"drawing\"/\u003e\n\u003c/p\u003e\nThis Helm chart installs [OpenRun](https://openrun.dev) together with the dependencies that are required for a Kubernetes deployment:\n\n- **Postgres** metadata database. A single-instance StatefulSet is deployed for testing when `postgres.enabled=true` (default). It is recommended to use an external Postgres instance instead.\n- **Container registry**. A single `registry:2` instance is deployed when `registry.enabled=true`. Set `registry.enabled=false` and provide your own registry configuration via `config.registry.*` if you already run a registry. An external registry is recommended.\n- A `LoadBalancer` service that exposes the OpenRun HTTP API.\n- RBAC that allows OpenRun to create Deployments and Services for the applications it manages.\n\nThe chart renders an `openrun.toml` using the template stored in `files/openrun.toml.tmpl`. Values referenced inside the template can be overridden without editing the chart.\n\n## Quick start\n\n```bash\nhelm repo add openrun https://openrundev.github.io/openrun-helm-charts/\n\n# Install a registry for use with OpenRun (for testing)\nhelm install openrun1 openrun/openrun \\\n  --namespace openrun --create-namespace --set registry.enabled=true\n\n# Install with a external registry (recommended)\nhelm install openrun1 openrun/openrun \\\n  --namespace openrun --create-namespace --set config.registry.url=\u003cregistry_url\u003e\n```\n\nBy default a bundled Postgres StatefulSet is used. It is recommended to use an exteranl managed Postgres. Once all pods become ready you can retrieve the external address of the OpenRun API with:\n\n```bash\nkubectl get svc openrun -n openrun\n```\n\n## Admin credentials\n\nBy default the chart generates a random admin password on install and prints it once in the Helm notes. To provide your own password, set `config.security.adminPassword`. To use a pre-generated bcrypt hash instead, set `config.security.adminPasswordBcrypt` (it takes precedence over `adminPassword`).\n\n```yaml\nconfig:\n  security:\n    adminPassword: \"change-me\"\n    # adminPasswordBcrypt: \"$2y$05$example...\"\n```\n\n## Configuring the registry\n\nOpenRun builds images with Kaniko and pushes them to the registry that is configured inside `openrun.toml`. The bundled registry Deployment is meant for local demos or proof-of-concept installs; for production environments use an external registry service (ECR, GCR, ACR, etc.) or use an existing Harbor deployment.\n\n- To use the bundled registry set `registry.enabled=true`. The service is reachable at `\u003crelease\u003e-registry.\u003cnamespace\u003e.svc.cluster.local:5000`. HTTP authentication is disabled by default, but you can feed a pre-generated htpasswd entry to require credentials:\n\n  ```yaml\n  registry:\n    enabled: true\n    auth:\n      enabled: true\n      username: \"openrun\"\n      password: \"openrun\"\n      # Generate the bcrypt hash with: htpasswd -nB openrun\n      htpasswd: \"openrun:$2y$05$example...\"\n  ```\n\n  When `registry.auth.enabled=true` the same `username` / `password` defaults are mirrored into `config.registry.*`.\n\n- To use an external registry, disable the in-cluster registry and set the desired registry parameters:\n\n  ```yaml\n  registry:\n    enabled: false\n\n  config:\n    registry:\n      url: \"registry.example.com:5000\"\n      project: \"openrun\"\n      username: \"ci-bot\"\n      password: \"\u003ctoken\u003e\"\n      insecure: false\n  ```\n\nThe rendered `openrun.toml` is stored in a secret named `{{ include \"openrun.configSecretName\" . }}` and mounted at `/var/lib/openrun/openrun.toml`.\n\n## Configuring Postgres\n\nThe embedded StatefulSet runs a single Postgres instance with persistent storage. It is intended for basic setups and testing—production clusters should either connect to a managed Postgres service or run a fully fledged operator such as CloudNativePG. Customize the in-cluster instance via the `postgres.*` values (storage size, credentials, probes, resources, etc). The OpenRun deployment uses the app user secret to build the Postgres connection string.\n\nTo reuse an external Postgres instance disable the embedded cluster and set the connection details:\n\n```yaml\npostgres:\n  enabled: false\n\nexternalDatabase:\n  enabled: true\n  host: postgres.mycompany.net\n  port: 5432\n  username: openrun\n  password: \"\u003cdb-password\u003e\"\n  # alternatively reference a secret created beforehand\n  # existingSecretName: openrun-db-creds\n```\n\nThe chart fails to render if neither `postgres.enabled` nor `externalDatabase.enabled` are set to `true`.\n\n### Database Names\n\nOpenRun uses four databases, with names derived from the deployment namespace:\n\n| Database | Default Name | Purpose |\n| -------- | ------------ | ------- |\n| Main | `\u003cnamespace\u003e_main` | Core metadata |\n| Audit | `\u003cnamespace\u003e_audit` | Audit logs |\n| App Store | `\u003cnamespace\u003e_app_store` | Store plugin |\n| Filesystem | `\u003cnamespace\u003e_fs` | FS plugin |\n\nFor example, deploying to namespace `prod` creates: `prod_main`, `prod_audit`, `prod_app_store`, `prod_fs`.\n\nThe db-init job automatically creates these databases. Ensure the database user has `CREATE DATABASE` privileges, or pre-create them via Terraform.\n\nTo override the default names:\n\n```yaml\nconfig:\n  metadata:\n    database: \"custom_main\"\n    auditDatabase: \"custom_audit\"\n    appStoreDatabase: \"custom_store\"\n    fsDatabase: \"custom_fs\"\n```\n\n### Terraform-Managed Infrastructure\n\nFor production deployments with Terraform-managed infrastructure (RDS, Cloud SQL, ECR, GCR, etc.), secrets must be copied to the OpenRun namespace before deployment.\n\n**Important:** Kubernetes Secrets are namespace-scoped. All secrets must exist in the same namespace where OpenRun is deployed.\n\n```bash\n# Set variables\nTERRAFORM_NS=\u003cterraform-namespace\u003e\nOPENRUN_NS=\u003copenrun-namespace\u003e\n\n# Create the namespace if it doesn't exist\nkubectl create namespace $OPENRUN_NS --dry-run=client -o yaml | kubectl apply -f -\n\n# Copy database credentials secret\nkubectl get secret openrun-db-credentials -n $TERRAFORM_NS -o yaml | \\\n  sed \"s/namespace: .*/namespace: $OPENRUN_NS/\" | \\\n  kubectl apply -f -\n\n# Copy registry credentials secret (if using private registry)\nkubectl get secret openrun-registry-credentials -n $TERRAFORM_NS -o yaml | \\\n  sed \"s/namespace: .*/namespace: $OPENRUN_NS/\" | \\\n  kubectl apply -f -\n\n# Deploy OpenRun\nhelm install openrun ./charts/openrun \\\n  --namespace $OPENRUN_NS \\\n  -f examples/values-terraform-external-db.yaml\n```\n\nExample values configuration:\n\n```yaml\npostgres:\n  enabled: false\n\nexternalDatabase:\n  enabled: true\n  host: \"mydb.abc123.us-east-1.rds.amazonaws.com\"\n  port: 5432\n  existingSecretName: \"openrun-db-credentials\"\n  usernameKey: \"username\"\n  passwordKey: \"password\"\n  sslMode: \"require\"\n\nregistry:\n  enabled: false\n\nconfig:\n  registry:\n    # Reference secret containing registry config as JSON\n    existingSecretName: \"openrun-registry-credentials\"\n```\n\nThe registry secret should contain JSON with the registry configuration. The JSON is read at deploy time and embedded directly in the config:\n\n```bash\nkubectl create secret generic openrun-registry-credentials \\\n  --namespace $OPENRUN_NS \\\n  --from-literal=config='{\"url\":\"registry.example.com\",\"project\":\"openrun\",\"username\":\"user\",\"password\":\"pass\",\"insecure\":false,\"type\":\"harbor\"}'\n```\n\n**Note:** The secret must exist before running `helm install`.\n\nSee [`examples/values-terraform-external-db.yaml`](examples/values-terraform-external-db.yaml) for a complete example.\n\n## RBAC\n\nA dedicated service account is created by default. The chart installs either a `ClusterRole` or namespace-scoped `Role` (switch via `rbac.clusterWide`). The role grants the verbs required for OpenRun to lazily create Deployments, Services, ConfigMaps, Secrets, Jobs, PVCs and related resources on behalf of applications.\n\n## Git Authentication\n\nOpenRun can authenticate to private Git repositories using SSH keys or personal access tokens. Multiple authentication accounts can be configured via the `gitAuth` values:\n\n```yaml\ngitAuth:\n  # GitLab using personal access token\n  gitlab_pat:\n    userId: \"myuser\"\n    password: \"glpat-xxxxxxxxxxxx\"\n\n  # GitHub using SSH key\n  github_ssh:\n    userId: \"git\"\n    keyFilePath: \"/path/to/ssh/private_key\"\n```\n\nEach entry generates a `[git_auth.\u003cname\u003e]` section in `openrun.toml`. Provide either `keyFilePath` (for SSH key authentication) or `password` (for HTTPS/token authentication), but not both.\n\n## App Authentication (OAuth/OIDC)\n\nOpenRun supports OAuth and OIDC authentication providers for applications. Multiple providers can be configured via the `auth` values:\n\n```yaml\nauth:\n  # Google OAuth with hosted domain restriction\n  google_openrun:\n    key: \"xxxxx.apps.googleusercontent.com\"\n    secret: \"GOCSPX-xxxxx\"\n    hostedDomain: \"openrun.dev\"\n\n  # GitHub OAuth\n  github_local:\n    key: \"Ov23xxxxx\"\n    secret: \"5dc28xxxxx\"\n\n  # Generic OIDC (e.g., Okta)\n  oidc_okta:\n    key: \"0oavknst5tchw8unl697\"\n    secret: \"nBTsFRY9BUZ5aAQsbmHt\"\n    discoveryUrl: \"https://example.okta.com/.well-known/openid-configuration\"\n    scopes: [\"openid\", \"profile\", \"email\", \"groups\"]\n\n  # Auth0\n  auth0_prod:\n    key: \"client-id\"\n    secret: \"client-secret\"\n    domain: \"myapp.auth0.com\"\n```\n\nEach entry generates an `[auth.\u003cname\u003e]` section in `openrun.toml`. All keys are optional:\n\n| Key            | Description                     | Used by       |\n| -------------- | ------------------------------- | ------------- |\n| `key`          | OAuth client ID                 | All providers |\n| `secret`       | OAuth client secret             | All providers |\n| `hostedDomain` | Restrict to hosted domain       | Google        |\n| `domain`       | Auth0 domain                    | Auth0         |\n| `orgUrl`       | Organization URL                | Okta          |\n| `discoveryUrl` | OIDC discovery endpoint         | Generic OIDC  |\n| `scopes`       | List of OAuth scopes to request | All providers |\n\n## SAML Authentication\n\nOpenRun supports SAML authentication providers. Multiple providers can be configured via the `saml` values:\n\n```yaml\nsaml:\n  # Okta SAML\n  okta_test:\n    metadataUrl: \"https://example.okta.com/app/xxxxx/sso/saml/metadata\"\n    forceAuthn: false\n\n  # Azure AD SAML\n  azure_ad:\n    metadataUrl: \"https://login.microsoftonline.com/xxxxx/federationmetadata/2007-06/federationmetadata.xml\"\n    groupsAttr: \"groups\"\n    usePost: true\n```\n\nEach entry generates a `[saml.\u003cname\u003e]` section in `openrun.toml`. All keys are optional:\n\n| Key           | Description                              |\n| ------------- | ---------------------------------------- |\n| `metadataUrl` | SAML metadata URL                        |\n| `groupsAttr`  | Attribute name for group membership      |\n| `usePost`     | Use POST binding (default: false)        |\n| `forceAuthn`  | Force re-authentication (default: false) |\n\n## Useful values\n\n| Key                  | Description                                         | Default           |\n| -------------------- | --------------------------------------------------- | ----------------- |\n| `config.registry.*`  | Registry configuration mirrored into `openrun.toml` | see `values.yaml` |\n| `postgres.enabled`   | Deploy the bundled Postgres StatefulSet             | `true`            |\n| `externalDatabase.*` | Connection info for an existing Postgres instance   | disabled          |\n| `registry.enabled`   | Deploy the in-cluster `registry:2` instance         | `false`           |\n| `gitAuth`            | Git authentication accounts for private repos       | `{}`              |\n| `auth`               | OAuth/OIDC providers for app authentication         | `{}`              |\n| `saml`               | SAML providers for app authentication               | `{}`              |\n\nRefer to `values.yaml` for the full list of tunables.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenrundev%2Fopenrun-helm-charts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenrundev%2Fopenrun-helm-charts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenrundev%2Fopenrun-helm-charts/lists"}