Helm Charts Overview
flex.plane is deployed to a Kubernetes management cluster using Helm charts. Each chart handles a distinct piece of the platform. The Proxmox compute nodes themselves do not run Kubernetes. They only need the flex.plane agent installed.
Understand the chart architecture
A complete deployment consists of these charts:
| Chart | Purpose | Dependencies |
|---|---|---|
| identity | Zitadel OIDC provider + PostgreSQL for authentication and user management | PostgreSQL (bundled or external) |
| flextenant | The orchestrator (GraphQL API) and portal (web UI) | identity, Headscale |
| flexkube | Managed Kubernetes control planes (etcd, API server, controller manager, scheduler) | flextenant |
| flexgateway | Edge gateway services, load balancer proxies, and service exposure to the Tailscale mesh | flextenant |
| konnectivity-agent | Network proxy agent for managed Kubernetes clusters | flexkube |
The typical installation order:
- identity: set up authentication first. Everything else depends on OIDC tokens.
- flextenant: deploy the orchestrator and portal. This is the core of the platform.
- flexkube: deploy per managed Kubernetes cluster. One release per cluster.
- flexgateway: deploy per zone or per set of load balancers. One release per deployment target.
- konnectivity-agent: deploy on managed clusters for control plane connectivity.
Choose your registry
All flex.plane container images are hosted at:
ghcr.io/zeitlos/flex.plane
Individual images follow the pattern:
ghcr.io/zeitlos/flex.plane/<service>:<tag>
For example:
ghcr.io/zeitlos/flex.plane/orchestrator:abc1234ghcr.io/zeitlos/flex.plane/portal:abc1234ghcr.io/zeitlos/flex.plane/cloud-controller-manager:abc1234
If your cluster cannot reach ghcr.io directly, mirror the images to your internal registry and set the image.repository values in each chart accordingly.
Manage versions
Container images are tagged with the git commit hash from which they were built. There are no latest tags. Every deployment is pinned to a specific version.
Set the image tag in your Helm values:
# charts/flextenant/values.yaml
orchestrator:
image:
tag: "a1b2c3d"
portal:
image:
tag: "a1b2c3d"
To check which version you are running, query the API:
{ tenant { version } }
This returns the git commit hash of the running orchestrator.