By default, the App Platform installs a lightweight Git server to use for the values repository, a built-in Git repository to store platform configuration. While this works well when evaluating the platform or when testing, it is not intended for production use. For production use, we recommend storing the values repository outside the Kubernetes cluster such as in GitHub or GitLab.

Prerequisites

  • An empty Git repository accessible from the Kubernetes cluster via the HTTPS protocol.
  • The repository should be private (recommended)
  • A personal access token with read/write access to the repository.

Advantages of BYO Git

  • Benefit from the existing access Git repository controls
  • Persistence of your configuration even if the Kubernetes cluster is wiped out
  • Disaster recovery support

Switching to BYO Git on an existing App Platform deployment

In the platform view click Settings then click Git. The wizard will guide you.

During the GitOps repository switch, the existing values repository history is pushed to the new target repository and underlying platform components are reconfigured to watch the new target.

Installing App Platform via Helm chart

To install with BYO Git, provide the following configuration values.yaml:

apps:
cluster:
  domainSuffix: example.com
  name: my-cluster
  provider: linode
otomi:
  git:
    repoUrl: https://github.com/<owner>/<repo>
    username: <git-username>
    password: <personal-access-token>
    email: <git-email>
    branch: main

Git configuration options

The following otomi.git.* values are used during installation to configure Git access.

ParameterDescriptionRuntime Storage
otomi.git.repoUrlThe HTTPS URL of the external Git repository✓ Yes
otomi.git.usernameThe Git username for authentication (bootstrap only)✗ No¹
otomi.git.passwordA personal access token with read/write access (bootstrap only)✗ No¹
otomi.git.emailThe email address used for Git commits✓ Yes
otomi.git.branchThe branch to use (e.g. main)✓ Yes

¹ Stored in apl-secrets/apl-git-config Secret for direct access by platform components (apl-operator and otomi-api). Components reload credentials at runtime without requiring pod restarts.


Did this page help you?