Helm configuration reference

This reference is for the platform values.yaml you apply with Helm: chart-level settings (global, tags, nginx, prometheus, and other subcharts) and the APC API application block astronomer.houston.config, including deployments.* defaults used with Config governance (platform defaults in this file, then optional cluster, workspace, and deployment overrides). Tabular sections use the same path prefix you use in your install values.

Values file structure

The APC Helm chart uses a hierarchical structure:

global:           # Platform-wide settings
  baseDomain: ""  # Required: your base domain
  plane:
    mode: ""      # unified, control, or data
  # ... more global settings

tags:             # Enable/disable component groups

  monitoring: true
  logging: true

astronomer:       # Platform component settings
  houston: {}
  commander: {}
  registry: {}
  astroUI: {}

nginx: {}         # Ingress configuration
prometheus: {}    # Metrics collection
elasticsearch: {} # Log storage
grafana: {}       # Dashboards
# ... more component sections

Required configuration

Configure the following required values:

global:
  baseDomain: "example.com"  # Your platform domain
  tlsSecret: "astronomer-tls"  # TLS certificate secret name

Helm chart parameter tables

Selected defaults from the APC umbrella chart (values.yaml). Parameter paths are relative to the root of your install values file.

Parameter	Type	Description	Default	Allowed values
`tags.platform`	boolean	Enable core platform chart groups (ingress, Astronomer stack).	`true`	`true`, `false`
`tags.monitoring`	boolean	Enable Prometheus, kube-state-metrics, Grafana stack.	`true`	`true`, `false`
`tags.logging`	boolean	Enable Elasticsearch and logging collectors.	`true`	`true`, `false`

Global settings

Parameter	Type	Description	Default	Allowed values
`global.baseDomain`	string	DNS zone for platform hosts (`app`, `houston`, ingress).	`~`	Domain name
`global.tlsSecret`	string	TLS Secret used by ingress.	`astronomer-tls`	Kubernetes Secret name
`global.privateCaCerts`	array	Extra CA Secrets for private PKI.	`[]`	Secret names
`global.plane.mode`	string	Control plane / data plane / unified topology.	`"unified"`	`unified`, `control`, `data`
`global.plane.domainPrefix`	string	Prefix for split-plane routing when used.	`""`	String
`global.networkPolicy.enabled`	boolean	Install NetworkPolicies for platform namespaces.	`true`	`true`, `false`
`global.defaultDenyNetworkPolicy`	boolean	Default-deny ingress NetworkPolicy baseline.	`true`	`true`, `false`
`global.networkNSLabels.enabled`	boolean	Enable namespace labels for network policies.	`false`	`true`, `false`
`global.rbac.enabled`	boolean	Manage Kubernetes RBAC objects for the platform.	`true`	`true`, `false`
`global.clusterRoles`	boolean	Use ClusterRole bindings where required.	`true`	`true`, `false`
`global.nats.enabled`	boolean	Deploy NATS for the APC API messaging.	`true`	`true`, `false`
`global.nats.replicas`	integer	NATS replicas.	`3`	Positive integer
`global.airflowOperator.enabled`	boolean	Enable Airflow Kubernetes operator integration path.	`false`	`true`, `false`
`global.keda.enabled`	boolean	Create the identity KEDA uses for worker autoscaling and report an installed KEDA to the control plane. Set on data planes. See Configure worker autoscaling.	`false`	`true`, `false`
`global.keda.namespace`	string	Namespace KEDA runs in. Required when `global.keda.enabled` is `true`.	`keda`	Namespace name
`global.keda.clusterObjectNamespace`	string	Namespace where KEDA resolves cluster-scoped objects, if it differs from `global.keda.namespace`.	`~` (uses `global.keda.namespace`)	Namespace name
`global.keda.operatorServiceAccountName`	string	Service account the KEDA operator runs as.	`keda-operator`	Service account name
`global.laminar.enabled`	boolean	Install Laminar on the data plane. Required for worker autoscaling and hibernation.	`false`	`true`, `false`
`global.dataPlaneFailover.enabled`	boolean	Master switch for data-plane failover features when components are installed.	`false`	`true`, `false`
`global.controlPlaneHA.enabled`	boolean	Turn on control plane reliability. Set to `true` on every control plane in the group, and on every data plane registered to them, so that data plane services reach the control plane through the global domain. Requires `globalBaseDomain`, a shared database, and a shared JWT keypair. Independent of `global.dataPlaneFailover.enabled`. See Control plane disaster recovery reference.	`false`	`true`, `false`
`global.controlPlaneHA.bootstrapJwks`	boolean	Generate the shared JWT signing key and certificate. Set to `true` on the first control plane only. Every other control plane uses the copied keypair.	`false`	`true`, `false`
`global.controlPlaneHA.globalBaseDomain`	string	The shared customer-facing domain that every control plane serves (`app.<globalBaseDomain>`, `houston.<globalBaseDomain>`). Required on control planes and data planes when `global.controlPlaneHA.enabled` is `true`, and `helm upgrade` fails without it. Each control plane’s TLS certificate must also cover these hosts.	`~`	Domain name
`global.controlPlaneHA.cpId`	string	This control plane’s stable identity (UUID), stored in the `cp-identity` secret. The chart generates one on every control plane and unified installation. Set it explicitly to keep it fixed when you render the chart without cluster access, for example with `helm template` in a GitOps workflow.	`~` (generated)	UUID
`global.controlPlaneHA.cookieDomain`	string	The `Domain` attribute of the session cookie. If unset, the APC API uses `.<globalBaseDomain>`. Set it to a common parent of the global and per-control-plane domains for single-cookie mode. See Widen the cookie scope.	`~`	Domain name
`global.controlPlaneHA.cookieName`	string	The session cookie name. If unset, the APC API derives it from `globalBaseDomain`, the same on every control plane. Set it to keep an existing cookie name while you move to control plane reliability, so that current sessions stay valid.	`~`	Cookie name
`global.ingress.enabled`	boolean	Render the platform’s Ingress and Istio `VirtualService` resources. Set to `false` only if you create the routes for platform components yourself.	`true`	`true`, `false`
`global.houston.database.schemaName`	string	The Postgres schema that holds the APC API’s tables. Change it only on a fresh install, for example to `public` when the database doesn’t allow creating schemas. On an existing install, changing it points the APC API at an empty schema.	`houston$default`	Schema name
`global.secretsFromFiles.enabled`	boolean	Deliver platform component secrets as mounted files instead of environment variables. A component’s own `secretsFromFiles.enabled` overrides it. See Load platform secrets from mounted files.	`false`	`true`, `false`
`global.secretsFromFiles.fsGroup`	integer	The `fsGroup` the chart sets on Pods that read secrets from files. Ignored on OpenShift.	`1000`	Group ID
`global.dbBootstrapper.secretsFromFiles.enabled`	boolean	Deliver the database bootstrapper’s connection as a mounted file. Doesn’t follow `global.secretsFromFiles.enabled`.	`false`	`true`, `false`

Astronomer platform images

Parameter	Type	Description	Default	Allowed values
`astronomer.images.commander.repository`	string	Deployment orchestrator image repository.	`quay.io/astronomer/ap-commander`	OCI repository
`astronomer.images.commander.tag`	string	Deployment orchestrator image tag.	Pinned by each chart release	Tag string
`astronomer.images.houston.repository`	string	APC API image repository.	`quay.io/astronomer/ap-houston-api`	OCI repository
`astronomer.images.houston.tag`	string	APC API image tag.	Pinned by each chart release	Tag string
`astronomer.images.astroUI.repository`	string	Astro UI image repository.	`quay.io/astronomer/ap-astro-ui`	OCI repository
`astronomer.images.astroUI.tag`	string	Astro UI tag.	Pinned by each chart release	Tag string
`astronomer.images.registry.repository`	string	Internal registry image repository.	`quay.io/astronomer/ap-registry`	OCI repository
`astronomer.images.registry.tag`	string	Internal registry tag.	Pinned by each chart release	Tag string
`astronomer.images.mcpServer.repository`	string	APC MCP server image repository. APC 2.2 and later.	`quay.io/astronomer/ap-apc-mcp-server`	OCI repository

For the image versions in each release, see Container image reference.

Astronomer workload defaults

Resource defaults for core platform Deployments often ship in the umbrella chart—override requests / limits per component:

Parameter	Type	Description	Default	Allowed values
`astronomer.astroUI.resources`	object	Astro UI CPU/memory requests and limits.	requests `100m`/`256Mi`, limits `500m`/`1024Mi`	Kubernetes resources
`astronomer.houston.resources`	object	APC API CPU/memory.	requests `500m`/`1024Mi`, limits `1000m`/`2048Mi`	Kubernetes resources
`astronomer.houston.strictSchemaCheck.enabled`	boolean	Chart-level toggle aligned with the APC API; keep consistent with `astronomer.houston.config.strictSchemaCheck.enabled` below.	`true`	`true`, `false`
`astronomer.commander.resources`	object	Deployment orchestrator CPU/memory.	requests `250m`/`1Gi`, limits `500m`/`2Gi`	Kubernetes resources
`astronomer.registry.persistence.enabled`	boolean	Persist registry storage.	`true`	`true`, `false`
`astronomer.registry.persistence.size`	string	Registry PVC size.	`"100Gi"`	Quantity string
`astronomer.install.resources`	object	Helm install job resources.	requests `100m`/`256Mi`, limits `500m`/`1024Mi`	Kubernetes resources

For nginx, Prometheus, Elasticsearch, Grafana, NATS workload tables, follow the same pattern in your values.yaml; defaults ship alongside those keys in the umbrella chart.

Astronomer platform settings

Parameter	Type	Description	Default	Allowed values
`astronomer.airflowChartVersion`	string	The Airflow Helm chart version that the data plane reports to the control plane. New Deployments use it, and platform upgrades move existing Deployments to it. Set on the data plane, or on a unified installation.	Pinned by each chart release	Chart version
`astronomer.houston.prismaConnectionLimit`	integer	The most database connections that each APC API Pod and each DP-Link Pod keeps open. Starting in APC 2.2, the default is `20` instead of `5`, and the chart applies it through `connection_limit` in the connection URI it generates. A connection URI that you supply, for example through `houston.backendSecretName`, isn’t changed. Size your Postgres `max_connections` for it. See Connection limit.	`20`	Positive integer
`astronomer.houston.dbName`	string	The name of the APC API’s database. If unset, the chart uses `<release-name>-houston`. Set it only on a fresh install.	`~`	Database name
`astronomer.houston.upgradeDeployments.enabled`	boolean	Run the `houston-upgrade-deployments` hook after every `helm upgrade` and `helm install`. The hook re-applies every non-cordoned Deployment, which can restart Airflow Pods across the fleet. Set to `false` to run `yarn upgrade-deployments` yourself in a maintenance window. Set it under `astronomer.houston`: a top-level `houston.upgradeDeployments.enabled` has no effect.	`true`	`true`, `false`
`astronomer.houston.syncDataplaneClusters.enabled`	boolean	Run the hourly CronJob that pulls every data plane cluster’s metadata. In APC 2.2 it’s the fallback for metadata that DP-Link sends. Keep it on. See Data plane metadata sync.	`true`	`true`, `false`
`astronomer.houston.syncDataplaneClusters.schedule`	string	Cron schedule for the metadata sync CronJob.	`"0 * * * *"`	Cron expression
`astronomer.commander.signingKey.regenerateKeyEachUpgrade`	boolean	Generate a new signing keypair for the deployment orchestrator on every upgrade. The deployment orchestrator signs the tokens it sends to data plane services, such as Laminar, with this key. Leave it `false` so the key stays stable across upgrades. APC 2.2 and later.	`false`	`true`, `false`

APC API configuration

Set these keys under astronomer.houston.config in your platform values.yaml. Published defaults mirror the APC API config/default.yaml. The subtree deployments.* participates in layered overrides (platform → cluster → workspace → deployment); see Config governance. Override APIs may use the string DELETE_KEY at mergeable leaves where the schema allows (see Config governance).

Outside the `deployments` subtree

These keys configure the APC API, workers, auth, UI metadata, and integrations. They are not subject to the four deployment override tiers unless documented elsewhere.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.strictSchemaCheck.enabled`	boolean	When `true`, unknown keys or invalid types under `deployments` overrides are rejected (runtime enforcement aligns with this setting).	`true`	`true`, `false`
`astronomer.houston.config.clusters.configDerive.mode`	string	APC 2.2 and later. Whether data plane clusters derive their `deployments` configuration from the current platform defaults instead of the snapshot stored at registration. `off` never derives, `optIn` derives only for clusters that opt in, and `on` derives unless a cluster opts out. See Derive cluster configuration from platform defaults.	`"off"`	`"off"`, `"optIn"`, `"on"`
`astronomer.houston.config.webserver.port`	integer	HTTP listen port for the APC API inside the pod.	`8871`	Positive integer
`astronomer.houston.config.webserver.endpoint`	string	REST API base path.	`"/v1"`	String
`astronomer.houston.config.webserver.graphqlPlayground.enabled`	boolean	Expose GraphQL playground endpoint.	`true`	`true`, `false`
`astronomer.houston.config.logging.level`	string	APC API log level.	`"info"`	Typical log levels (`error`, `warn`, `info`, `debug`, …)
`astronomer.houston.config.platformReleasesFile`	string	Platform releases manifest filename.	`'astronomer_platform_releases.json'`	Filename string
`astronomer.houston.config.publicSignups.enabled`	boolean	Allow public user registration.	`false`	`true`, `false`
`astronomer.houston.config.emailConfirmation.enabled`	boolean	Require email confirmation for new accounts.	`true`	`true`, `false`
`astronomer.houston.config.email.enabled`	boolean	Enable outbound email.	`false`	`true`, `false`
`astronomer.houston.config.email.reply`	string	Default From / reply address.	`"noreply@astronomer.io"`	Email string
`astronomer.houston.config.email.smtpUrl`	string	SMTP connection URL.	`~` (null)	SMTP URL or null
`astronomer.houston.config.prometheus.enabled`	boolean	Query Prometheus for metrics in the APC API features that support it.	`false`	`true`, `false`
`astronomer.houston.config.prometheus.host`	string	Prometheus hostname.	`localhost`	Hostname
`astronomer.houston.config.prometheus.port`	integer	Prometheus port.	`9090`	Port number
`astronomer.houston.config.plane.mode`	string	Logical plane mode for the APC API runtime behavior.	`unified`	`unified`, `control`, `data` (also set chart-wide using `global.plane.mode`)
`astronomer.houston.config.auth.openidConnect.flow`	string	OIDC OAuth flow.	`"implicit"`	`"code"`, `"implicit"`
`astronomer.houston.config.jwt.authDuration`	integer	Session length bound (ms), coordinated with IdP token lifetimes.	`86400000`	Positive integer
`astronomer.houston.config.airgapped.enabled`	boolean	Air-gapped installation behaviors.	`false`	`true`, `false`
`astronomer.houston.config.updateAirflowCheck.enabled`	boolean	Enable checks related to Airflow version updates.	`true`	`true`, `false`
`astronomer.houston.config.updateRuntimeCheck.enabled`	boolean	Enable Astro Runtime update checks.	`true`	`true`, `false`
`astronomer.houston.config.sslVerification.enabled`	boolean	Verify TLS for outbound connections (replaces legacy inverted `disableSSLVerify`).	`true`	`true`, `false`
`astronomer.houston.config.autoCompleteForSensitiveFields.enabled`	boolean	Allow autocomplete on sensitive fields in UI.	`true`	`true`, `false`
`astronomer.houston.config.logUsername.enabled`	boolean	Include usernames in logs when enabled.	`false`	`true`, `false`
`astronomer.houston.config.maxDockerJwtExtraDeployments`	integer	Upper bound for JWT-scoped docker operations across extra deployments.	`50`	Non-negative integer

For keys not listed here (full auth providers, workers.*, prisma, nats, Helm runtime templating helm.*), refer to config/default.yaml and Configuration Flag Migration (2.x) in the APC API repository.

Deployment defaults for the APC API

The following tables list defaults under astronomer.houston.config.deployments.*. Keys in this subtree participate in the platform → cluster → workspace → deployment override chain described in Config governance.

Operational and platform defaults

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.chart.version`	string	Default Airflow chart version for new deployments; also used for upgrade coordination. For a registered cluster, the data plane supplies this value from `astronomer.airflowChartVersion`, and no override tier can change it. See Values the data plane supplies.	`0.0.0`	Chart version string
`astronomer.houston.config.deployments.releaseVerification`	string	Which image classes may be deployed (`STABLE` only official runtime releases; `EDGE` adds edge images; `DEV` adds dev builds).	`STABLE`	`STABLE`, `EDGE`, `DEV`; override layers may use `DELETE_KEY` where schema allows
`astronomer.houston.config.deployments.subdomain`	string	Subdomain segment used for deployment hostnames.	`'deployments'`	DNS label–safe string
`astronomer.houston.config.deployments.performanceOptimization.enabled`	boolean	Feature gate for performance optimization mode.	`false`	`true`, `false`
`astronomer.houston.config.deployments.upsertDeployment.extraIniAllowed`	boolean	Allow `pgbouncer` extra INI fields via upsert API.	`true`	`true`, `false`
`astronomer.houston.config.deployments.upsertDeployment.allowFromUi.enabled`	boolean	Allow creating/updating deployments from the UI.	`true`	`true`, `false`
`astronomer.houston.config.deployments.logHelmValues.enabled`	boolean	Log generated Helm values (debug; noisy).	`false`	`true`, `false`
`astronomer.houston.config.deployments.tagPrefix`	string	Prefix for deployment tags on images.	`"deploy"`	String
`astronomer.houston.config.deployments.fluentdIndexPrefix`	string	Fluentd index prefix.	`"fluentd"`	String

Runtime management

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.runtimeManagement.airflowV3.enabled`	boolean	Enable Airflow 3–related runtime behaviors where supported.	`false`	`true`, `false`
`astronomer.houston.config.deployments.runtimeManagement.airflowV3.minimumAstroRuntimeVersion`	string	Minimum Astro Runtime version when Airflow 3 is in play.	`"3.1-2"`	Runtime version string
`astronomer.houston.config.deployments.runtimeManagement.customImageSha.enabled`	boolean	Allow deployment create/update using image SHA selection flows.	`false`	`true`, `false`
`astronomer.houston.config.deployments.runtimeManagement.listAllRuntimeVersions.enabled`	boolean	Expose full runtime version list where applicable.	`false`	`true`, `false`
`astronomer.houston.config.deployments.runtimeManagement.runtimeEnvOverrideSemverCheck`	string	SemVer constraint for runtime environment overrides.	See `default.yaml`	SemVer range string
`astronomer.houston.config.deployments.runtimeManagement.astroRuntimeReleasesFile`	string	Astro Runtime releases manifest file.	`'astro_runtime_releases.json'`	Filename
`astronomer.houston.config.deployments.runtimeManagement.airflowMinimumAstroRuntimeVersion`	string	Minimum Astro Runtime for Airflow 2 paths.	`2.2.5`	Version string

Logging

Vector sidecar and optional Elasticsearch client settings for deployment workloads.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.logging.loggingSidecar.enabled`	boolean	Enable Vector sidecar for deployment logs.	`false`	`true`, `false`
`astronomer.houston.config.deployments.logging.loggingSidecar.name`	string	Sidecar container name.	`sidecar-log-consumer`	String
`astronomer.houston.config.deployments.logging.loggingSidecar.image`	string	Vector image reference.	`quay.io/astronomer/ap-vector:0.47.0-5`	Image reference
`astronomer.houston.config.deployments.logging.loggingSidecar.customConfig`	boolean	Use custom Vector config.	`false`	`true`, `false`
`astronomer.houston.config.deployments.logging.elasticsearch.enabled`	boolean	Enable Elasticsearch logging integration for this domain.	`false`	`true`, `false`

Logging keys are blocklisted for Workspace and Deployment overrides. See Config governance.

Dag deploy

Defaults for Dag-only deployment when that mechanism is enabled under deployMechanisms.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.dagDeploy.enabled`	boolean	Master enable for Dag-deploy server/client paths in defaults.	`false`	`true`, `false`
`astronomer.houston.config.deployments.dagDeploy.images.dagServer.repository`	string	Dag server image repository.	`quay.io/astronomer/ap-dag-deploy`	Repository URL
`astronomer.houston.config.deployments.dagDeploy.images.dagServer.tag`	string	Dag server image tag.	`0.7.2`	Tag string
`astronomer.houston.config.deployments.dagDeploy.serviceAccount.create`	boolean	Create service account for Dag deploy components.	`true`	`true`, `false`

Deploy mechanisms

Feature gates for Dag deploy, NFS, git-sync, and git-sync relay defaults.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.deployMechanisms.configureDagDeployment.enabled`	boolean	Allow configuring Dag deployment mechanisms.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deployMechanisms.dagOnlyDeployment.enabled`	boolean	Dag-only deployment mechanism.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deployMechanisms.nfsMountDagDeployment.enabled`	boolean	NFS-mounted Dag bundles.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deployMechanisms.objectStorageMountDagDeployment.enabled`	boolean	Allow Dags mounted from cloud object storage (GCS, S3, Azure Blob). APC 2.2 and later. See Deploy Dags with an object storage mount.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deployMechanisms.gitSyncDagDeployment.enabled`	boolean	Git-sync–based Dag deployment.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deployMechanisms.gitSyncRelay.storageClassName`	string	Storage class for relay PVCs.	`~`	Storage class name or null
`astronomer.houston.config.deployments.deployMechanisms.gitSyncRelay.webhookSecretKey.showForMinutes`	integer	How long relay webhook secrets are shown in responses.	`1`	Non-negative integer

Airflow components

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.airflowComponents.triggerer.enabled`	boolean	Deploy Airflow triggerer.	`true`	`true`, `false`
`astronomer.houston.config.deployments.airflowComponents.dagProcessor.enabled`	boolean	Deploy Airflow Dag processor.	`true`	`true`, `false`

Auth sidecar

Auth sidecar for routing/auth integration (often cluster-scoped).

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.authSideCar.enabled`	boolean	Deploy auth sidecar template with deployments.	`false`	`true`, `false`
`astronomer.houston.config.deployments.authSideCar.repository`	string	Container image repository.	`quay.io/astronomer/ap-auth-sidecar`	Image repository
`astronomer.houston.config.deployments.authSideCar.tag`	string	Image tag.	`1.29.2`	Tag string
`astronomer.houston.config.deployments.authSideCar.port`	integer	Listen port.	`8084`	Port

Resource management

Cluster sizing, executor availability, Astro Units, and capacity ceilings.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.resourceManagement.resourceQuotas.enabled`	boolean	Manage Kubernetes ResourceQuota / LimitRange objects for namespaces.	`true`	`true`, `false`
`astronomer.houston.config.deployments.resourceManagement.components`	array	Component resource profiles.	Entries for the scheduler, webserver, API server, StatsD, PgBouncer, Flower, Redis, workers, triggerer, and Dag processor	Array of component specs; see `default.yaml`
`astronomer.houston.config.deployments.resourceManagement.executors`	array	Supported executors and required components per executor. Starting in APC 2.2, the built-in Local, Celery, and Kubernetes executors are defined in the APC API, so the default list is empty. A non-empty list replaces the built-in executors, so list every executor you want to offer, including the built-in ones.	`[]`	Array of executor specs
`astronomer.houston.config.deployments.resourceManagement.astroUnit.cpu`	integer	Millicores per Astro Unit.	`100`	Positive integer
`astronomer.houston.config.deployments.resourceManagement.astroUnit.memory`	integer	MiB per Astro Unit.	`384`	Positive integer
`astronomer.houston.config.deployments.resourceManagement.maxExtraCapacity.cpu`	integer	Max extra CPU (millicores) schedulable above base.	`40000`	Integer
`astronomer.houston.config.deployments.resourceManagement.maxExtraCapacity.memory`	integer	Max extra memory (MiB).	`153600`	Integer
`astronomer.houston.config.deployments.resourceManagement.maxPodCapacity.cpu`	integer	Max CPU per pod (millicores).	`3500`	Integer
`astronomer.houston.config.deployments.resourceManagement.maxPodCapacity.memory`	integer	Max memory per pod (MiB).	`13440`	Integer
`astronomer.houston.config.deployments.resourceManagement.overProvisioningFactorMem`	number	Memory over-provisioning factor.	`1`	Number ≥ 1
`astronomer.houston.config.deployments.resourceManagement.overProvisioningFactorCPU`	number	CPU over-provisioning factor.	`1`	Number ≥ 1

Worker queues and hibernation

APC 2.2 and later. These features apply to Deployments that run in Airflow Operator mode.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.workerQueues.enabled`	boolean	Make worker queues available to Deployments that use the Celery executor. See Configure worker queues.	`false`	`true`, `false`
`astronomer.houston.config.deployments.workerQueues.maxPerDeployment`	integer	The most worker queues a Deployment can have.	`10`	Positive integer
`astronomer.houston.config.deployments.workerQueues.autoscaling.enabled`	boolean	Make worker autoscaling with KEDA available. Requires KEDA and `global.laminar.enabled: true`. See Configure worker autoscaling.	`false`	`true`, `false`
`astronomer.houston.config.deployments.workerQueues.autoscaling.pollingIntervalSeconds`	integer	How often KEDA checks whether to scale a queue.	`30`	Positive integer
`astronomer.houston.config.deployments.hibernation.enabled`	boolean	Make Deployment hibernation available. Requires Laminar and KEDA on the data plane. See Hibernate Deployments.	`false`	`true`, `false`

Namespace management

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.namespaceManagement.manualReleaseNames.enabled`	boolean	Allow operators to set Helm release names manually.	`false`	`true`, `false`
`astronomer.houston.config.deployments.namespaceManagement.manualNamespaceNames.enabled`	boolean	Manual Kubernetes namespace names for deployments. Supplied by the data plane for a registered cluster (see the note after this table).	`false`	`true`, `false`
`astronomer.houston.config.deployments.namespaceManagement.namespaceFreeFormEntry.enabled`	boolean	Free-form namespace entry flows.	`false`	`true`, `false`
`astronomer.houston.config.deployments.namespaceManagement.namespaceFreeFormEntry.preDeploymentValidationHookAllowedHosts`	array	Hosts that a Workspace-level `preDeploymentValidationHook` URL may point to, as `host` or `host:port`, case-insensitive. When `namespaceFreeFormEntry.enabled` is `true`, a Workspace hook on any other host fails Deployment operations in that Workspace. Set it at the platform or cluster tier only. APC 2.2 and later.	`[]`	Host names, with an optional port
`astronomer.houston.config.deployments.namespaceManagement.namespaceLabels`	object	Labels applied to deployment namespaces.	`{}`	String map
`astronomer.houston.config.deployments.namespaceManagement.preCreatedNamespaces`	array	Pre-created namespace names for routing. Supplied by the data plane for a registered cluster (see the note after this table).	`[]`	Array of `{name}` objects

For a registered cluster, the data plane supplies manualNamespaceNames.enabled and preCreatedNamespaces from its namespace pool settings, global.namespaceManagement.namespacePools.enabled and global.namespaceManagement.namespacePools.namespaces.names. Set them there, not here. No override tier can change them. See Values the data plane supplies. namespaceManagement is blocklisted for Deployment overrides because namespace configuration can’t change after a Deployment is created. See Config governance.

Deployment lifecycle

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.deploymentLifecycle.deployRollback.enabled`	boolean	Allow rollback of code deploys / revisions.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deploymentLifecycle.deployRollback.deployRevisionReportNumberOfDays`	integer	Window for deploy revision reporting (days).	`90`	Positive integer
`astronomer.houston.config.deployments.deploymentLifecycle.deployRollback.dagTarballVersionValidation.enabled`	boolean	Validate Dag tarball versions on rollback paths.	`true`	`true`, `false`
`astronomer.houston.config.deployments.deploymentLifecycle.hardDeleteDeployment.enabled`	boolean	Deprecated. Starting in APC 2.0, hard delete is always on, and this flag doesn’t gate any behavior.	`true`	N/A
`astronomer.houston.config.deployments.deploymentLifecycle.cleanupAirflowDb.enabled`	boolean	Enable cleanup jobs for Airflow metadata DB.	`false`	`true`, `false`

Database management

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.databaseManagement.database.enabled`	boolean	Provision per-deployment Airflow databases when enabled.	`true`	`true`, `false`
`astronomer.houston.config.deployments.databaseManagement.database.retainOnDelete`	boolean	Keep DB objects after deployment deletion.	`false`	`true`, `false`
`astronomer.houston.config.deployments.databaseManagement.database.allowRootAccess`	boolean	Allow root-level DB access patterns documented in the APC API.	`false`	`true`, `false`
`astronomer.houston.config.deployments.databaseManagement.manualConnectionStrings.enabled`	boolean	Allow manual connection string configuration.	`false`	`true`, `false`
`astronomer.houston.config.deployments.databaseManagement.pgBouncerResourceCalculationStrategy`	string	Strategy key for PgBouncer sizing (`null` uses built-in algorithm).	`~`	Strategy name or null

Image registry

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.deploymentImagesRegistry.exposeDockerWebhookEndpoint.enabled`	boolean	Expose webhook endpoint for image push flows.	`true`	`true`, `false`
`astronomer.houston.config.deployments.deploymentImagesRegistry.updateDeploymentImageEndpoint.enabled`	boolean	Allow API to update deployment images directly.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deploymentImagesRegistry.updateDeploymentImageEndpointDockerValidation.enabled`	boolean	Validate docker payloads on image update endpoint.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deploymentImagesRegistry.serviceAccountAnnotationKey`	string	Cloud IAM annotation key on workload identity (`eks.amazonaws.com/role-arn`, `iam.gke.io/gcp-service-account`, …).	`~`	Annotation key or null

Metrics reporting

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.metricsReporting.grafana.enabled`	boolean	Surface Grafana links / metrics UI integration points.	`true`	`true`, `false`
`astronomer.houston.config.deployments.metricsReporting.taskUsageMetrics.enabled`	boolean	Enable task usage metrics reporting features.	`false`	`true`, `false`
`astronomer.houston.config.deployments.metricsReporting.taskUsageMetrics.reportNumberOfDays`	integer	Reporting horizon for task usage (days).	`90`	Positive integer

Pagination maxTake limits under metricsReporting.pagination.* follow defaults in config/default.yaml (typically 101 per collection).

Orchestration mode

Deployment orchestration mode (Helm vs operator).

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.mode.helm.enabled`	boolean	Use Helm-based deployment reconciler.	`true`	`true`, `false`
`astronomer.houston.config.deployments.mode.operator.enabled`	boolean	Use Kubernetes operator–based deployment path when supported.	`false`	`true`, `false`

Operator probes and detailed probe specs are defined under deployments.mode.operator in default.yaml.

Deployments Helm defaults

The deployments.helm subtree supplies defaults merged into Airflow Helm chart values for each deployment (scheduler resources, PgBouncer sidecars, ingress, runtime images, Elasticsearch hooks, etc.). It is large and nested; defaults are authoritative in config/default.yaml under deployments.helm. For merge and validation rules at override layers, rely on deployments-config-override.schema.json and Config governance.

Mock webhook (test only)

Test-only mock webhook settings for development scenarios.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.mockWebhook.enabled`	boolean	Enable mock webhook server wiring.	`false`	`true`, `false`
`astronomer.houston.config.deployments.mockWebhook.krb.enabled`	boolean	Kerberos realm defaults for mock.	`true`	`true`, `false`
`astronomer.houston.config.deployments.mockWebhook.shouldCreateDb`	boolean	Auto-create backing DB objects in mock mode.	`true`	`true`, `false`

Global configuration

Base domain and TLS

global:
  # Required: Base domain for all platform endpoints
  # Results in: app.example.com, houston.example.com, etc.
  baseDomain: "example.com"

  # Name of Kubernetes secret containing TLS certificate
  tlsSecret: "astronomer-tls"

  # List of secrets containing private CA certificates
  privateCaCerts: []

Plane mode (control, data, unified)

Astro Private Cloud 2.0 supports split control plane and data plane deployments:

global:
  plane:
    # Options: unified (default), control, data
    mode: "unified"

    # Domain prefix for this plane (used in split deployments)
    domainPrefix: ""

Mode	Description
`unified`	Control and data plane in same cluster (default, like 0.x)
`control`	Control plane only - manages Deployments
`data`	Data plane only - runs Airflow workloads

Network policies

global:
  # Enable platform-level network policies
  networkPolicy:
    enabled: true

  # Apply default deny ingress policy
  defaultDenyNetworkPolicy: true

  # Enable namespace labels for network policies
  networkNSLabels:
    enabled: false

RBAC and cluster roles

global:
  # Enable Kubernetes RBAC
  rbac:
    enabled: true

  # Use cluster-wide roles (required for some features)
  clusterRoles: true

  # Management of cluster-scoped resources (RBAC objects, etc.)
  manageClusterScopedResources:
    enabled: true

Node selection

Separate platform Pods from Airflow Pods:

global:
  platformNodePool:
    nodeSelector:
      node-role: platform
    affinity: {}
    tolerations:
      - key: "platform"
        operator: "Equal"
        value: "true"
        effect: "NoSchedule"

Private registry

Use a private container registry:

global:
  privateRegistry:
    enabled: true
    repository: "registry.example.com/astronomer"
    secretName: "registry-credentials"

Namespace pools

Pre-provision namespaces for Airflow Deployments:

global:
  namespaceManagement:
    namespacePools:
      enabled: true
      createRbac: true
      namespaces:
        create: false  # Set true to auto-create
        names:
          - airflow-prod
          - airflow-staging
          - airflow-dev

Storage class

Specify a storage class for all persistent volumes:

global:
  storageClass: "gp3"

OpenShift support

global:
  openshift:
    enabled: true
  scc:
    enabled: true  # Security context constraints

Astronomer platform components

APC API

The APC API is the core internal API that powers the platform:

astronomer:
  houston:
    replicas: 2

    resources:
      requests:
        cpu: "500m"
        memory: "1024Mi"
      limits:
        cpu: "1000m"
        memory: "2048Mi"

    # Database connection
    backendSecretName: "houston-backend-secret"
    # Or specify directly:
    backendConnection:
      user: houston
      pass: "<YOUR_DATABASE_PASSWORD>"
      host: postgres.example.com
      port: 5432
      db: houston

    # Airflow database connection template
    airflowBackendSecretName: "airflow-backend-secret"

    # APC API configuration (see the following APC API configuration section)
    config: {}

    # Environment variables common to all houston containers
    env:
      - name: LOG_LEVEL
        value: "info"

    # Worker pods for async processing
    worker:
      enabled: true
      replicas: 2

    # Upgrade all airflow helm deployments when upgrading APC helm deployment
    upgradeDeployments:
      enabled: true

    # Cleanup soft-deleted deployments
    cleanupDeployments:
      enabled: true
      schedule: "0 0 * * *"
      olderThan: 14

    # Airflow db cleanup: enables the cleanupAirflowDb API feature flag.
    # No longer a built-in CronJob as of 2.2.0 -- call the API directly on
    # your own schedule. See "Configure cleanup jobs" for details.
    cleanupAirflowDb:
      enabled: false

APC API configuration examples (`houston.config`)

The APC API accepts extensive configuration via houston.config:

Authentication

astronomer:
  houston:
    config:
      auth:
        # Local username/password auth
        local:
          enabled: true

        # OpenID Connect
        openidConnect:
          # Auth flow: "code" (recommended) or "implicit"
          flow: "code"

          # Microsoft/Azure AD
          microsoft:
            enabled: true
            clientId: "<YOUR_CLIENT_ID>"
            clientSecret: "<YOUR_CLIENT_SECRET>"
            discoveryUrl: "https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration"

          # Google OAuth
          google:
            enabled: false
            clientId: ""
            clientSecret: ""

          # Okta
          okta:
            enabled: false
            clientId: ""
            clientSecret: ""
            discoveryUrl: ""

          # Import groups from IDP (nested `.enabled` in APC 2.0)
          idpGroupsImport:
            enabled: true
          idpGroupsRefresh:
            enabled: false

        # GitHub via Auth0
        github:
          enabled: false

Deployment defaults (`deployments`)

APC 2.0 groups deployment-related settings under domains (for example deployMechanisms, deploymentLifecycle, runtimeManagement) using nested objects and feature.enabled toggles—not flat keys such as dagOnlyDeployment or hardDeleteDeployment. For tables of defaults, allowed values, and override semantics, see APC API configuration earlier on this page. For how cluster, workspace, and deployment layers merge, see Config governance. Example shape (abbreviated):

astronomer:
  houston:
    config:
      deployments:
        deployMechanisms:
          dagOnlyDeployment:
            enabled: true
          gitSyncDagDeployment:
            enabled: true
        deploymentLifecycle:
          hardDeleteDeployment:
            enabled: false
          deployRollback:
            enabled: true
        resourceManagement:
          components: []

Airflow Helm value defaults merged per deployment live under deployments.helm in the APC API’s config/default.yaml; see Deployments Helm defaults earlier on this page.

Email configuration

astronomer:
  houston:
    config:
      email:
        enabled: true
        smtpUrl: "smtp://smtp.example.com:587"
        reply: "noreply@example.com"

      # Root-level toggles (APC 2.0 nested `.enabled` pattern)
      emailConfirmation:
        enabled: true

      publicSignups:
        enabled: false

Prometheus integration

astronomer:
  houston:
    config:
      prometheus:
        enabled: true
        host: "http://astronomer-prometheus:9090"

Deployment orchestrator

The deployment orchestrator manages Kubernetes resources for Deployments:

astronomer:
  commander:
    replicas: 2

    resources:
      requests:
        cpu: "250m"
        memory: "1Gi"
      limits:
        cpu: "500m"
        memory: "2Gi"

    # Air-gapped mode (no external registry access)
    airGapped:
      enabled: false

    # Helm upgrade timeout (seconds)
    upgradeTimeout: 600

    # Environment variables
    env: []

DP-Link

DP-Link runs on the control plane and holds a gRPC stream to each registered data plane cluster. It receives each cluster’s metadata and tracks its link health, and data plane failover depends on it. It runs by default on every control plane, and starting in APC 2.2, on unified installations. See Data plane metadata sync.

Parameter	Type	Description	Default	Allowed values
`astronomer.dpLink.enabled`	boolean	Run DP-Link on a control plane or unified installation. DP-Link also runs when data plane failover or Laminar is enabled, whatever this value is.	`true`	`true`, `false`
`astronomer.dpLink.replicas`	integer	DP-Link Pods. One Pod owns each cluster’s stream at a time.	`2`	Positive integer
`astronomer.dpLink.resources`	object	DP-Link CPU and memory. Size it for the number of registered clusters.	requests `250m`/`512Mi`, limits `500m`/`1024Mi`	Kubernetes resources
`astronomer.dpLink.degradedThresholdSeconds`	integer	Seconds without a heartbeat before a cluster’s link is `DEGRADED`.	`30`	Positive integer
`astronomer.dpLink.unreachableThresholdSeconds`	integer	Seconds without a heartbeat before a cluster’s link is `UNREACHABLE`.	`90`	Positive integer
`astronomer.dpLink.claimIntervalSeconds`	integer	How often each DP-Link Pod looks for clusters to claim.	`30`	Positive integer
`astronomer.dpLink.leaseDurationSeconds`	integer	How long a Pod’s claim on a cluster lasts without renewal. Another Pod can claim the cluster after it expires.	`60`	Positive integer
`astronomer.dpLink.leaseRenewalIntervalSeconds`	integer	How often a Pod renews its claims. Keep it well below `leaseDurationSeconds`.	`15`	Positive integer
`astronomer.dpLink.initialReconnectDelaySeconds`	integer	First delay before reconnecting a stream that ended.	`1`	Positive integer
`astronomer.dpLink.maxReconnectDelaySeconds`	integer	Longest delay between reconnection attempts.	`30`	Positive integer
`astronomer.dpLink.reconnectDelayMultiplier`	number	Factor that each reconnection delay grows by.	`2`	Positive number
`astronomer.dpLink.jitterFraction`	number	Random variation applied to each reconnection delay.	`0.2`	`0` to `1`
`astronomer.dpLink.reconnectMaxAttempts`	integer	Failed reconnection attempts before the Pod releases the cluster so that it can be claimed again.	`10`	Positive integer
`astronomer.dpLink.fallbackPull.enabled`	boolean	Pull an `UNREACHABLE` cluster’s metadata on an interval. APC 2.2 and later.	`false`	`true`, `false`
`astronomer.dpLink.fallbackPull.intervalSeconds`	integer	Seconds between pulls for an `UNREACHABLE` cluster.	`300`	Positive integer

Don’t set DP-Link environment variables under astronomer.dpLink.env. The chart renders every entry twice, which can make helm upgrade fail. Use the values in this table instead. See Data plane metadata sync.

Registry

Container registry for deployment images:

astronomer:
  registry:
    replicas: 1

    resources:
      requests:
        cpu: "250m"
        memory: "512Mi"
      limits:
        cpu: "500m"
        memory: "1024Mi"

    # Persistent storage
    persistence:
      enabled: true
      size: "100Gi"
      storageClassName: ~

    # Use external storage backends
    # AWS S3
    s3:
      enabled: false
      accesskey: ""
      secretkey: ""
      region: "us-east-1"
      bucket: "astronomer-registry"

    # Google Cloud Storage
    gcs:
      enabled: false
      bucket: ""
      useKeyfile: true
      keyfile: /var/gcs-keyfile/astronomer-gcs-keyfile

    # Azure Blob Storage
    azure:
      enabled: false
      accountname: ""
      accountkey: ""
      container: ""

Astro UI

astronomer:
  astroUI:
    replicas: 2

    resources:
      requests:
        cpu: "100m"
        memory: "256Mi"
      limits:
        cpu: "500m"
        memory: "1024Mi"

    env: []

APC MCP server

APC 2.2 and later. The APC MCP server runs on the control plane and lets MCP clients and AI agents manage APC. It’s off by default. See APC MCP server.

Parameter	Type	Description	Default	Allowed values
`astronomer.mcpServer.enabled`	boolean	Install the APC MCP server. Not supported with `global.authSidecar.enabled: true`, and the chart fails to render if you set both.	`false`	`true`, `false`
`astronomer.mcpServer.enabledGroups`	array	Tool groups that the server offers. Replaces the default list, so include `platform_read` and `platform_write` if you set it. Groups that contain destructive tools are off by default.	`["platform_read", "platform_write"]`	Tool group names
`astronomer.mcpServer.disabledTools`	array	Individual tools to block.	`[]`	Tool names
`astronomer.mcpServer.skills.enabled`	boolean	Add the bundled Airflow skills.	`false`	`true`, `false`
`astronomer.mcpServer.replicas`	integer	MCP server Pods.	`2`	Positive integer
`astronomer.mcpServer.resources`	object	MCP server CPU and memory.	requests `100m`/`128Mi`, limits `500m`/`512Mi`	Kubernetes resources

NGINX ingress

nginx:
  replicas: 2

  resources:
    requests:
      cpu: "500m"
      memory: "1024Mi"
    limits:
      cpu: "1"
      memory: "2048Mi"

  # Service type: LoadBalancer, ClusterIP, or NodePort
  serviceType: "LoadBalancer"

  # Specific load balancer IP (optional)
  loadBalancerIP: ~

  # Restrict source IPs
  loadBalancerSourceRanges:
    - "10.0.0.0/8"

  # Private/internal load balancer
  privateLoadBalancer: false

  # NodePort configuration (when serviceType: NodePort)
  httpNodePort: ~
  httpsNodePort: ~

  # Ingress annotations
  ingressAnnotations:
    # AWS
    service.beta.kubernetes.io/aws-load-balancer-internal: "true"
    # GCP
    cloud.google.com/load-balancer-type: "Internal"
    # Azure
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"

  # Proxy settings
  proxyConnectTimeout: 15
  proxyReadTimeout: 600
  proxySendTimeout: 600
  proxyBodySize: "1024m"

  # Default backend
  defaultBackend:
    enabled: true
    resources:
      requests:
        cpu: "100m"
        memory: "50Mi"

To pass extra flags to the NGINX ingress controller, set nginx.extraArgs. The chart renders each key as --<key>=<value>, or as --<key> when the value is empty:

nginx:
  extraArgs:
    enable-ssl-passthrough: ""

Prometheus (monitoring)

prometheus:
  # Data retention period
  retention: 15d

  # Persistent storage
  persistence:
    enabled: true
    size: "150Gi"

  resources:
    requests:
      cpu: "1000m"
      memory: "4Gi"
    limits:
      cpu: "2000m"
      memory: "8Gi"

Default alerts for Laminar and the Airflow operator

APC 2.2 and later. Prometheus alerts when a Laminar or Airflow operator container isn’t ready, or when their Deployments have no available replicas.

Parameter	Type	Description	Default	Allowed values
`prometheus.defaultAlerts.laminar.enabled`	boolean	Install the default Laminar alerts.	`true`	`true`, `false`
`prometheus.defaultAlerts.airflowOperator.enabled`	boolean	Install the default Airflow operator alerts.	`true`	`true`, `false`
`prometheus.additionalAlerts.laminar`	string	Your own rules, appended to the Laminar alert group, as a YAML list in a block string.	`~`	YAML block string
`prometheus.additionalAlerts.airflowOperator`	string	Your own rules, appended to the Airflow operator alert group, as a YAML list in a block string.	`~`	YAML block string

Node exporter tolerations

Astro Private Cloud 2.1This feature was introduced in Astro Private Cloud 2.1. To access this feature, upgrade your Astro Private Cloud installation to 2.1 or later.

prometheus-node-exporter runs as a DaemonSet. APC applies the following default toleration so node exporter schedules onto every node, including tainted control-plane nodes, which it needs in order to collect complete host metrics:

prometheus-node-exporter:
  tolerations:
    - effect: NoSchedule
      operator: Exists

If your cluster policy disallows a broad toleration like this, override prometheus-node-exporter.tolerations with a narrower list, or set it to an empty list to remove the toleration entirely:

prometheus-node-exporter:
  tolerations: []

prometheus-node-exporter.tolerations is different from global.platformNodePool.tolerations under Node selection. The platformNodePool value adds a toleration so platform Pods can schedule onto nodes you’ve tainted for dedicated platform use. prometheus-node-exporter.tolerations is the node exporter DaemonSet’s own toleration list, which controls whether node exporter itself can schedule onto tainted nodes.

Grafana

grafana:
  resources:
    requests:
      cpu: "250m"
      memory: "512Mi"
    limits:
      cpu: "500m"
      memory: "1024Mi"

  # Custom dashboards
  dashboards:
    default:
      custom-dashboard:
        file: dashboards/custom.json

  # Extra environment variables (for example, SMTP for alerts)
  extraEnvVars:
    - name: GF_SMTP_ENABLED
      value: "true"
    - name: GF_SMTP_HOST
      value: "smtp.example.com:587"

Elasticsearch (logging)

elasticsearch:
  # Enable persistence
  common:
    persistence:
      enabled: true

  # Client nodes
  client:
    replicas: 2
    heapMemory: "2g"
    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "4Gi"

  # Data nodes
  data:
    replicas: 3
    heapMemory: "2g"
    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "4Gi"
    persistence:
      size: "100Gi"

  # Master nodes
  master:
    replicas: 3
    heapMemory: "2g"
    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "4Gi"
    persistence:
      size: "20Gi"

Vector (log collection)

vector:
  vector:
    resources:
      requests:
        cpu: "250m"
        memory: "512Mi"
      limits:
        cpu: "1000m"
        memory: "1024Mi"

External logging

Forward logs to external Elasticsearch:

global:
  customLogging:
    enabled: true
    scheme: https
    host: "elasticsearch.example.com"
    port: "9200"
    secret: "es-credentials"

NATS (messaging)

global:
  nats:
    enabled: true
    replicas: 3
    jetStream:
      enabled: true
      tls: false

nats:
  nats:
    resources:
      requests:
        cpu: "75m"
        memory: "30Mi"
      limits:
        cpu: "250m"
        memory: "100Mi"

Database configuration

External PostgreSQL (recommended)

global:
  # Disable in-cluster PostgreSQL
  postgresql:
    enabled: false

astronomer:
  houston:
    backendSecretName: "houston-db-secret"
    # Secret should contain: connection=postgres://user:pass@host:5432/houston
    airflowBackendSecretName: "airflow-db-secret"

Database SSL

global:
  ssl:
    enabled: true
    mode: "require"  # disable, allow, prefer, require, verify-ca, verify-full
    grafana:
      sslmode: "require"

PgBouncer (connection pooling)

global:
  pgbouncer:
    enabled: true
    gssSupport: true
    secretName: "astronomer-pgbouncer-config"
    servicePort: "6543"

Auth sidecar (OpenShift)

global.authSidecar configures the chart-level platform auth proxy used for OpenShift and similar environments. This is separate from astronomer.houston.config.deployments.authSideCar, which controls the per-Deployment auth sidecar injected by the APC API (default tag 1.29.2).

The APC MCP server isn’t supported with the auth sidecar in this release. On a control plane or unified plane, rendering fails if astronomer.mcpServer.enabled and global.authSidecar.enabled are both true.

global:
  authSidecar:
    enabled: true
    repository: quay.io/astronomer/ap-auth-sidecar
    tag: 1.29.8
    port: 8084
    resources:
      requests:
        cpu: "500m"
        memory: "512Mi"
      limits:
        cpu: "1000m"
        memory: "1024Mi"

Istio Gateway

global.istio.gateway routes platform traffic through an existing Istio Gateway instead of the NGINX ingress controller. It requires global.authSidecar.enabled: true. See Route Astro Private Cloud traffic through an Istio Gateway.

global:
  istio:
    gateway:
      enabled: true
      name: "<namespace>/<gateway-name>"

Logging sidecar

Add Vector sidecar to Airflow Pods:

global:
  logging:
    loggingSidecar:
      enabled: true
      name: sidecar-log-consumer
      repository: quay.io/astronomer/ap-vector
      tag: 0.54.0
      resources:
        requests:
          cpu: "100m"
          memory: "386Mi"

Dag-only deployments

global:
  deployMechanisms:
    dagOnlyDeployment:
      enabled: true
      repository: quay.io/astronomer/ap-dag-deploy
      tag: 0.9.4
      resources: {}
      persistence: {}

Airflow operator

Enable Kubernetes operator-based deployments:

global:
  airflowOperator:
    enabled: false

To pass extra flags to the Airflow operator’s manager, set airflow-operator.extraArgs. As with nginx.extraArgs, each key renders as --<key>=<value>, or as --<key> when the value is empty.

Laminar

APC 2.2 and later. Laminar is a data plane component that provides worker autoscaling, hibernation, and Deployment status for operator-based Deployments. Set global.laminar.enabled to true to install it.

Parameter	Type	Description	Default	Allowed values
`laminar.imagePullSecrets`	array	Pull secrets for the Laminar image, as a list of `{name: <secret-name>}` entries. Set the token that Astronomer provides if you pull from an Astronomer-managed registry. Ignored when `global.privateRegistry.enabled` is `true` and `global.privateRegistry.secretName` is set, because Laminar then uses that secret.	`[]`	List of `{name}` objects
`laminar.databaseBootstrapper.backendSecretName`	string	An existing secret with the Laminar database connection under a `connection` key. If unset, APC creates the database and the secret in your Postgres instance.	`~`	Secret name
`laminar.databaseBootstrapper.dbName`	string	The Laminar database name. If unset, the chart uses `<release-name>-laminar`.	`~`	Database name

Extra objects

Add custom Kubernetes resources:

astronomer:
  extraObjects:
    # Custom LimitRange
    - apiVersion: v1
      kind: LimitRange
      metadata:
        name: default-limits
        namespace: astronomer
      spec:
        limits:
          - default:
              cpu: "1"
              memory: "1Gi"
            defaultRequest:
              cpu: "100m"
              memory: "128Mi"
            type: Container

    # Custom NetworkPolicy
    - apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: custom-policy
      spec:
        podSelector: {}
        policyTypes:
          - Ingress

Complete example

Here’s an example configuration. The astronomer.houston.config.deployments.* values shown below only seed the platform default the first time a cluster is registered — to change these settings for a cluster that’s already running, use the Configuration Override section of the Astro UI or the updateCluster API instead (see Override data plane cluster configurations).

global:
  baseDomain: "airflow.example.com"
  tlsSecret: "astronomer-tls"

  plane:
    mode: "unified"

  rbac:
    enabled: true
  clusterRoles: true

  networkPolicy:
    enabled: true

  postgresql:
    enabled: false

  privateRegistry:
    enabled: true
    repository: "registry.example.com/astronomer"
    secretName: "registry-creds"

  platformNodePool:
    nodeSelector:
      node-type: platform
    tolerations:
      - key: "dedicated"
        value: "platform"
        effect: "NoSchedule"

  ssl:
    enabled: true
    mode: "require"

tags:
  platform: true
  monitoring: true
  logging: true

astronomer:
  houston:
    replicas: 2
    resources:
      requests:
        cpu: "500m"
        memory: "1Gi"
      limits:
        cpu: "1000m"
        memory: "2Gi"
    backendSecretName: "houston-db-secret"
    config:
      auth:
        local:
          enabled: false
        openidConnect:
          microsoft:
            enabled: true
            clientId: "<YOUR_CLIENT_ID>"
            clientSecret: "<YOUR_CLIENT_SECRET>"
            discoveryUrl: "https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration"
      email:
        enabled: true
        smtpUrl: "smtp://smtp.example.com:587"
      publicSignups:
        enabled: false
      deployments:
        namespaceManagement:
          manualReleaseNames:
            enabled: true

  commander:
    replicas: 2
    resources:
      requests:
        cpu: "250m"
        memory: "1Gi"
      limits:
        cpu: "500m"
        memory: "2Gi"

  registry:
    persistence:
      enabled: true
      size: "200Gi"

nginx:
  replicas: 2
  serviceType: LoadBalancer
  privateLoadBalancer: true
  resources:
    requests:
      cpu: "500m"
      memory: "1Gi"

prometheus:
  retention: 30d
  persistence:
    enabled: true
    size: "200Gi"
  resources:
    requests:
      cpu: "1"
      memory: "4Gi"

elasticsearch:
  data:
    replicas: 3
    persistence:
      size: "200Gi"
    resources:
      requests:
        cpu: "1"
        memory: "4Gi"

Validate configuration

After creating your values file, validate it:

# Dry-run to check for errors
helm template astronomer astronomer/astronomer \
  -f values.yaml \
  --namespace astronomer \
  --debug

# Check rendered templates
helm template astronomer astronomer/astronomer \
  -f values.yaml \
  --namespace astronomer > rendered.yaml

Upgrade configuration

(Optional) When updating your values file, you can use the helm diff plugin, and then run the following command to see a diff of your changes:

# Compare changes
helm diff upgrade astronomer astronomer/astronomer \
  -f values.yaml \
  --namespace astronomer

# Apply changes
helm upgrade astronomer astronomer/astronomer \
  -f values.yaml \
  --namespace astronomer

⌘I

Values file structure

Required configuration

Helm chart parameter tables

Tags

Global settings

Astronomer platform images

Astronomer workload defaults

Astronomer platform settings

APC API configuration

Outside the deployments subtree

Deployment defaults for the APC API

Operational and platform defaults

Runtime management

Logging

Dag deploy

Deploy mechanisms

Airflow components

Auth sidecar

Resource management

Worker queues and hibernation

Namespace management

Deployment lifecycle

Database management

Image registry

Metrics reporting

Orchestration mode

Deployments Helm defaults

Mock webhook (test only)

Global configuration

Base domain and TLS

Plane mode (control, data, unified)

Network policies

RBAC and cluster roles

Node selection

Private registry

Namespace pools

Storage class

OpenShift support

Astronomer platform components

APC API

APC API configuration examples (houston.config)

Authentication

Deployment defaults (deployments)

Email configuration

Prometheus integration

Deployment orchestrator

DP-Link

Registry

Astro UI

APC MCP server

NGINX ingress

Prometheus (monitoring)

Default alerts for Laminar and the Airflow operator

Node exporter tolerations

Grafana

Elasticsearch (logging)

Vector (log collection)

External logging

NATS (messaging)

Database configuration

External PostgreSQL (recommended)

Database SSL

PgBouncer (connection pooling)

Auth sidecar (OpenShift)

Istio Gateway

Logging sidecar

Dag-only deployments

Airflow operator

Laminar

Extra objects

Complete example

Validate configuration

Upgrade configuration

Related documentation

Outside the `deployments` subtree

APC API configuration examples (`houston.config`)

Deployment defaults (`deployments`)