Deploy with Helm

Deploy the Layer7 Operator with Helm

The Layer7 Operator can be installed with Helm. This is the recommended option if you already manage your cluster workloads with Helm. The chart source lives in the Operator repository and is published to https://caapim.github.io/layer7-operator/.

Index

• Requirements
• Install cert-manager
• Install the Layer7 Operator
• Watch specific namespaces
• Configuration
  • Common values
  • Using an existing webhook certificate
  • Private registries
  • Operator OpenTelemetry metrics
  • Behind a proxy
• Upgrade
• Uninstall

Requirements

• A Kubernetes cluster and cluster privileges to install (the chart creates cluster-scoped RBAC and webhook configurations).
• Helm >= 3.7
• cert-manager — required for the Operator's Validating and Mutating Webhooks (unless you supply your own TLS secret, see Using an existing webhook certificate).

Install cert-manager

If you don't already have cert-manager in the cluster, install it. There are additional options here.

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.20.0/cert-manager.yaml

Note: Wait until all cert-manager resources are ready before continuing.

kubectl get all -n cert-manager

Install the Layer7 Operator

Add the Layer7 Operator Helm repository:

helm repo add layer7-operator https://caapim.github.io/layer7-operator/

Update your repositories:

helm repo update

Install the Operator:

helm upgrade -i layer7-operator layer7-operator/layer7-operator -n layer7-operator-system --create-namespace

Watch for the Layer7 Operator pod to be ready:

kubectl get all -n layer7-operator-system

By default the Operator watches all namespaces for Layer7 custom resources (gateway, repository, l7statestore, etc.).

Watch specific namespaces

To restrict the Operator to specific namespaces, set managedNamespaces:

helm upgrade -i layer7-operator layer7-operator/layer7-operator \
  -n layer7-operator-system --create-namespace \
  --set 'managedNamespaces={ns1,ns2,ns3}'

Or with a values file:

managedNamespaces:
- ns1
- ns2
- ns3

helm upgrade -i layer7-operator layer7-operator/layer7-operator \
  -n layer7-operator-system --create-namespace -f values.yaml

Configuration

Values can be supplied with --set or a values file (-f values.yaml). The full list of parameters is documented in the chart README. The most commonly used values are below.

Common values

Value	Description	Default
managedNamespaces	Namespaces the Operator manages. Empty = all namespaces.	[""]
replicas	Number of Operator replicas (leader election).	1
image.registry	Operator image registry.	docker.io
image.repository	Operator image repository.	caapim/layer7-operator
image.tag	Operator image tag.	v1.3.0
image.pullPolicy	Image pull policy.	IfNotPresent
image.pullSecrets	Image pull secrets for private registries.	[]
webhook.enabled	Create Validating and Mutating webhook configurations.	true
webhook.tls.certmanager.enabled	Use cert-manager to issue the webhook certificate.	true
webhook.tls.existingTlsSecret	Use an existing kubernetes.io/tls secret instead of cert-manager.	webhook-cert-secret
resources	Operator container resource requests/limits.	100m/64Mi … 500m/512Mi
args	Operator container arguments (--zap-log-level=10 increases verbosity).	see chart
otel.enabled	Enable OpenTelemetry metrics for the Operator.	false
proxy.httpProxy / httpsProxy / noProxy	Proxy configuration.	nil

Using an existing webhook certificate

If you don't use cert-manager, disable it and provide your own kubernetes.io/tls secret for the webhooks:

webhook:
  enabled: true
  tls:
    certmanager:
      enabled: false
    existingTlsSecret: my-webhook-tls-secret

Private registries

To pull the Operator image from a private registry, create an image pull secret in the Operator namespace and reference it:

image:
  registry: my-registry.example.com
  repository: caapim/layer7-operator
  tag: v1.3.0
  pullSecrets:
    - my-registry-credentials

Operator OpenTelemetry metrics

The Operator can emit its own metrics to an OpenTelemetry collector:

otel:
  enabled: true
  otlpEndpoint: otel-collector.observability:4317
  metricPrefix: layer7_

Behind a proxy

proxy:
  httpProxy: http://proxy.example.com:3128
  httpsProxy: http://proxy.example.com:3128
  noProxy: .svc,.cluster.local,10.0.0.0/8
  caBundle:
    enabled: true
    create: true
    pem: |+
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----

Upgrade

helm repo update
helm upgrade -i layer7-operator layer7-operator/layer7-operator -n layer7-operator-system

Uninstall

helm uninstall layer7-operator -n layer7-operator-system

If you installed cert-manager for the Operator and no longer need it:

kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.20.0/cert-manager.yaml

Back to Home