Helm configuration reference

This reference is for the platform values.yaml you apply with Helm: chart-level settings (global, tags, nginx, prometheus, and other subcharts) and the APC API application block astronomer.houston.config, including deployments.* defaults used with Config governance (platform defaults in this file, then optional cluster, workspace, and deployment overrides). Tabular sections use the same path prefix you use in your install values.

Values file structure

The APC Helm chart uses a hierarchical structure:

global:           # Platform-wide settings
  baseDomain: ""  # Required: your base domain
  plane:
    mode: ""      # unified, control, or data
  # ... more global settings

tags:             # Enable/disable component groups

  monitoring: true
  logging: true

astronomer:       # Platform component settings
  houston: {}
  commander: {}
  registry: {}
  astroUI: {}

nginx: {}         # Ingress configuration
prometheus: {}    # Metrics collection
elasticsearch: {} # Log storage
grafana: {}       # Dashboards
# ... more component sections

Required configuration

Configure the following required values:

global:
  baseDomain: "example.com"  # Your platform domain
  tlsSecret: "astronomer-tls"  # TLS certificate secret name

Helm chart parameter tables

Selected defaults from the APC umbrella chart (values.yaml). Parameter paths are relative to the root of your install values file.

Parameter	Type	Description	Default	Allowed values
`tags.platform`	boolean	Enable core platform chart groups (ingress, Astronomer stack).	`true`	`true`, `false`
`tags.monitoring`	boolean	Enable Prometheus, kube-state-metrics, Grafana stack.	`true`	`true`, `false`
`tags.logging`	boolean	Enable Elasticsearch and logging collectors.	`true`	`true`, `false`

Global settings

Parameter	Type	Description	Default	Allowed values
`global.baseDomain`	string	DNS zone for platform hosts (`app`, `houston`, ingress).	`~`	Domain name
`global.tlsSecret`	string	TLS Secret used by ingress.	`astronomer-tls`	Kubernetes Secret name
`global.privateCaCerts`	array	Extra CA Secrets for private PKI.	`[]`	Secret names
`global.plane.mode`	string	Control plane / data plane / unified topology.	`"unified"`	`unified`, `control`, `data`
`global.plane.domainPrefix`	string	Prefix for split-plane routing when used.	`""`	String
`global.networkPolicy.enabled`	boolean	Install NetworkPolicies for platform namespaces.	`true`	`true`, `false`
`global.defaultDenyNetworkPolicy`	boolean	Default-deny ingress NetworkPolicy baseline.	`true`	`true`, `false`
`global.networkNSLabels.enabled`	boolean	Enable namespace labels for network policies.	`false`	`true`, `false`
`global.rbac.enabled`	boolean	Manage Kubernetes RBAC objects for the platform.	`true`	`true`, `false`
`global.clusterRoles`	boolean	Use ClusterRole bindings where required.	`true`	`true`, `false`
`global.nats.enabled`	boolean	Deploy NATS for the APC API messaging.	`true`	`true`, `false`
`global.nats.replicas`	integer	NATS replicas.	`3`	Positive integer
`global.airflowOperator.enabled`	boolean	Enable Airflow Kubernetes operator integration path.	`false`	`true`, `false`
`global.dataPlaneFailover.enabled`	boolean	Master switch for data-plane failover features when components are installed.	`false`	`true`, `false`

Astronomer platform images

Parameter	Type	Description	Default	Allowed values
`astronomer.images.commander.repository`	string	Deployment orchestrator image repository.	`quay.io/astronomer/ap-commander`	OCI repository
`astronomer.images.commander.tag`	string	Deployment orchestrator image tag.	`2.0.14`	Tag string
`astronomer.images.houston.repository`	string	APC API image repository.	`quay.io/astronomer/ap-houston-api`	OCI repository
`astronomer.images.houston.tag`	string	APC API image tag.	`2.0.18`	Tag string
`astronomer.images.astroUI.repository`	string	Astro UI image repository.	`quay.io/astronomer/ap-astro-ui`	OCI repository
`astronomer.images.astroUI.tag`	string	Astro UI tag.	`2.0.7`	Tag string
`astronomer.images.registry.repository`	string	Internal registry image repository.	`quay.io/astronomer/ap-registry`	OCI repository
`astronomer.images.registry.tag`	string	Internal registry tag.	`3.0.0-9`	Tag string

Astronomer workload defaults

Resource defaults for core platform Deployments often ship in the umbrella chart—override requests / limits per component:

Parameter	Type	Description	Default	Allowed values
`astronomer.astroUI.resources`	object	Astro UI CPU/memory requests and limits.	requests `100m`/`256Mi`, limits `500m`/`1024Mi`	Kubernetes resources
`astronomer.houston.resources`	object	APC API CPU/memory.	requests `500m`/`1024Mi`, limits `1000m`/`2048Mi`	Kubernetes resources
`astronomer.houston.strictSchemaCheck.enabled`	boolean	Chart-level toggle aligned with the APC API; keep consistent with `astronomer.houston.config.strictSchemaCheck.enabled` below.	`true`	`true`, `false`
`astronomer.commander.resources`	object	Deployment orchestrator CPU/memory.	requests `250m`/`1Gi`, limits `500m`/`2Gi`	Kubernetes resources
`astronomer.registry.persistence.enabled`	boolean	Persist registry storage.	`true`	`true`, `false`
`astronomer.registry.persistence.size`	string	Registry PVC size.	`"100Gi"`	Quantity string
`astronomer.install.resources`	object	Helm install job resources.	requests `100m`/`256Mi`, limits `500m`/`1024Mi`	Kubernetes resources

For nginx, Prometheus, Elasticsearch, Grafana, NATS workload tables, follow the same pattern in your values.yaml; defaults ship alongside those keys in the umbrella chart.

APC API configuration

Set these keys under astronomer.houston.config in your platform values.yaml. Published defaults mirror the APC API config/default.yaml. The subtree deployments.* participates in layered overrides (platform → cluster → workspace → deployment); see Config governance. Override APIs may use the string DELETE_KEY at mergeable leaves where the schema allows (see Config governance).

Outside the `deployments` subtree

These keys configure the APC API, workers, auth, UI metadata, and integrations. They are not subject to the four deployment override tiers unless documented elsewhere.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.strictSchemaCheck.enabled`	boolean	When `true`, unknown keys or invalid types under `deployments` overrides are rejected (runtime enforcement aligns with this setting).	`true`	`true`, `false`
`astronomer.houston.config.webserver.port`	integer	HTTP listen port for the APC API inside the pod.	`8871`	Positive integer
`astronomer.houston.config.webserver.endpoint`	string	REST API base path.	`"/v1"`	String
`astronomer.houston.config.webserver.graphqlPlayground.enabled`	boolean	Expose GraphQL playground endpoint.	`true`	`true`, `false`
`astronomer.houston.config.logging.level`	string	APC API log level.	`"info"`	Typical log levels (`error`, `warn`, `info`, `debug`, …)
`astronomer.houston.config.platformReleasesFile`	string	Platform releases manifest filename.	`'astronomer_platform_releases.json'`	Filename string
`astronomer.houston.config.publicSignups.enabled`	boolean	Allow public user registration.	`false`	`true`, `false`
`astronomer.houston.config.emailConfirmation.enabled`	boolean	Require email confirmation for new accounts.	`true`	`true`, `false`
`astronomer.houston.config.email.enabled`	boolean	Enable outbound email.	`false`	`true`, `false`
`astronomer.houston.config.email.reply`	string	Default From / reply address.	`"noreply@astronomer.io"`	Email string
`astronomer.houston.config.email.smtpUrl`	string	SMTP connection URL.	`~` (null)	SMTP URL or null
`astronomer.houston.config.prometheus.enabled`	boolean	Query Prometheus for metrics in the APC API features that support it.	`false`	`true`, `false`
`astronomer.houston.config.prometheus.host`	string	Prometheus hostname.	`localhost`	Hostname
`astronomer.houston.config.prometheus.port`	integer	Prometheus port.	`9090`	Port number
`astronomer.houston.config.plane.mode`	string	Logical plane mode for the APC API runtime behavior.	`unified`	`unified`, `control`, `data` (also set chart-wide using `global.plane.mode`)
`astronomer.houston.config.auth.openidConnect.flow`	string	OIDC OAuth flow.	`"implicit"`	`"code"`, `"implicit"`
`astronomer.houston.config.jwt.authDuration`	integer	Session length bound (ms), coordinated with IdP token lifetimes.	`86400000`	Positive integer
`astronomer.houston.config.airgapped.enabled`	boolean	Air-gapped installation behaviors.	`false`	`true`, `false`
`astronomer.houston.config.updateAirflowCheck.enabled`	boolean	Enable checks related to Airflow version updates.	`true`	`true`, `false`
`astronomer.houston.config.updateRuntimeCheck.enabled`	boolean	Enable Astro Runtime update checks.	`true`	`true`, `false`
`astronomer.houston.config.sslVerification.enabled`	boolean	Verify TLS for outbound connections (replaces legacy inverted `disableSSLVerify`).	`true`	`true`, `false`
`astronomer.houston.config.autoCompleteForSensitiveFields.enabled`	boolean	Allow autocomplete on sensitive fields in UI.	`true`	`true`, `false`
`astronomer.houston.config.logUsername.enabled`	boolean	Include usernames in logs when enabled.	`false`	`true`, `false`
`astronomer.houston.config.maxDockerJwtExtraDeployments`	integer	Upper bound for JWT-scoped docker operations across extra deployments.	`50`	Non-negative integer

For keys not listed here (full auth providers, workers.*, prisma, nats, Helm runtime templating helm.*), refer to config/default.yaml and Configuration Flag Migration (2.x) in the APC API repository.

The APC API deployment defaults

The following tables list defaults under astronomer.houston.config.deployments.*. Keys in this subtree participate in the platform → cluster → workspace → deployment override chain described in Config governance.

Operational and platform defaults

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.chart.version`	string	Default Airflow chart version for new deployments; also used for upgrade coordination.	`0.0.0`	Chart version string
`astronomer.houston.config.deployments.releaseVerification`	string	Which image classes may be deployed (`STABLE` only official runtime releases; `EDGE` adds edge images; `DEV` adds dev builds).	`STABLE`	`STABLE`, `EDGE`, `DEV`; override layers may use `DELETE_KEY` where schema allows
`astronomer.houston.config.deployments.subdomain`	string	Subdomain segment used for deployment hostnames.	`'deployments'`	DNS label–safe string
`astronomer.houston.config.deployments.performanceOptimization.enabled`	boolean	Feature gate for performance optimization mode.	`false`	`true`, `false`
`astronomer.houston.config.deployments.upsertDeployment.extraIniAllowed`	boolean	Allow `pgbouncer` extra INI fields via upsert API.	`true`	`true`, `false`
`astronomer.houston.config.deployments.upsertDeployment.allowFromUi.enabled`	boolean	Allow creating/updating deployments from the UI.	`true`	`true`, `false`
`astronomer.houston.config.deployments.logHelmValues.enabled`	boolean	Log generated Helm values (debug; noisy).	`false`	`true`, `false`
`astronomer.houston.config.deployments.tagPrefix`	string	Prefix for deployment tags on images.	`"deploy"`	String
`astronomer.houston.config.deployments.fluentdIndexPrefix`	string	Fluentd index prefix.	`"fluentd"`	String

Runtime management

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.runtimeManagement.airflowV3.enabled`	boolean	Enable Airflow 3–related runtime behaviors where supported.	`false`	`true`, `false`
`astronomer.houston.config.deployments.runtimeManagement.airflowV3.minimumAstroRuntimeVersion`	string	Minimum Astro Runtime version when Airflow 3 is in play.	`"3.1-2"`	Runtime version string
`astronomer.houston.config.deployments.runtimeManagement.customImageSha.enabled`	boolean	Allow deployment create/update using image SHA selection flows.	`false`	`true`, `false`
`astronomer.houston.config.deployments.runtimeManagement.listAllRuntimeVersions.enabled`	boolean	Expose full runtime version list where applicable.	`false`	`true`, `false`
`astronomer.houston.config.deployments.runtimeManagement.runtimeEnvOverrideSemverCheck`	string	SemVer constraint for runtime environment overrides.	See `default.yaml`	SemVer range string
`astronomer.houston.config.deployments.runtimeManagement.astroRuntimeReleasesFile`	string	Astro Runtime releases manifest file.	`'astro_runtime_releases.json'`	Filename
`astronomer.houston.config.deployments.runtimeManagement.airflowMinimumAstroRuntimeVersion`	string	Minimum Astro Runtime for Airflow 2 paths.	`2.2.5`	Version string

Logging

Vector sidecar and optional Elasticsearch client settings for deployment workloads.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.logging.loggingSidecar.enabled`	boolean	Enable Vector sidecar for deployment logs.	`false`	`true`, `false`
`astronomer.houston.config.deployments.logging.loggingSidecar.name`	string	Sidecar container name.	`sidecar-log-consumer`	String
`astronomer.houston.config.deployments.logging.loggingSidecar.image`	string	Vector image reference.	`quay.io/astronomer/ap-vector:0.47.0-5`	Image reference
`astronomer.houston.config.deployments.logging.loggingSidecar.customConfig`	boolean	Use custom Vector config.	`false`	`true`, `false`
`astronomer.houston.config.deployments.logging.elasticsearch.enabled`	boolean	Enable Elasticsearch logging integration for this domain.	`false`	`true`, `false`

Logging blocklists for workspace/deployment overrides are described in Config governance.

Dag deploy

Defaults for Dag-only deployment when that mechanism is enabled under deployMechanisms.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.dagDeploy.enabled`	boolean	Master enable for Dag-deploy server/client paths in defaults.	`false`	`true`, `false`
`astronomer.houston.config.deployments.dagDeploy.images.dagServer.repository`	string	Dag server image repository.	`quay.io/astronomer/ap-dag-deploy`	Repository URL
`astronomer.houston.config.deployments.dagDeploy.images.dagServer.tag`	string	Dag server image tag.	`0.7.2`	Tag string
`astronomer.houston.config.deployments.dagDeploy.serviceAccount.create`	boolean	Create service account for Dag deploy components.	`true`	`true`, `false`

Deploy mechanisms

Feature gates for Dag deploy, NFS, git-sync, and git-sync relay defaults.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.deployMechanisms.configureDagDeployment.enabled`	boolean	Allow configuring Dag deployment mechanisms.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deployMechanisms.dagOnlyDeployment.enabled`	boolean	Dag-only deployment mechanism.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deployMechanisms.nfsMountDagDeployment.enabled`	boolean	NFS-mounted Dag bundles.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deployMechanisms.gitSyncDagDeployment.enabled`	boolean	Git-sync–based Dag deployment.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deployMechanisms.gitSyncRelay.storageClassName`	string	Storage class for relay PVCs.	`~`	Storage class name or null
`astronomer.houston.config.deployments.deployMechanisms.gitSyncRelay.webhookSecretKey.showForMinutes`	integer	How long relay webhook secrets are shown in responses.	`1`	Non-negative integer

Airflow components

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.airflowComponents.triggerer.enabled`	boolean	Deploy Airflow triggerer.	`true`	`true`, `false`
`astronomer.houston.config.deployments.airflowComponents.dagProcessor.enabled`	boolean	Deploy Airflow Dag processor.	`true`	`true`, `false`

Auth sidecar

Auth sidecar for routing/auth integration (often cluster-scoped).

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.authSideCar.enabled`	boolean	Deploy auth sidecar template with deployments.	`false`	`true`, `false`
`astronomer.houston.config.deployments.authSideCar.repository`	string	Container image repository.	`quay.io/astronomer/ap-auth-sidecar`	Image repository
`astronomer.houston.config.deployments.authSideCar.tag`	string	Image tag.	`1.29.2`	Tag string
`astronomer.houston.config.deployments.authSideCar.port`	integer	Listen port.	`8084`	Port

Resource management

Cluster sizing, executor availability, Astro Units, and capacity ceilings.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.resourceManagement.resourceQuotas.enabled`	boolean	Manage Kubernetes ResourceQuota / LimitRange objects for namespaces.	`true`	`true`, `false`
`astronomer.houston.config.deployments.resourceManagement.components`	array	Component resource profiles (scheduler, workers, …).	`[]`	Array of component specs; see `default.yaml`
`astronomer.houston.config.deployments.resourceManagement.executors`	array	Supported executors and required components per executor.	Local, Celery, K8s entries	Fixed structure in `default.yaml`
`astronomer.houston.config.deployments.resourceManagement.astroUnit.cpu`	integer	Millicores per Astro Unit.	`100`	Positive integer
`astronomer.houston.config.deployments.resourceManagement.astroUnit.memory`	integer	MiB per Astro Unit.	`384`	Positive integer
`astronomer.houston.config.deployments.resourceManagement.maxExtraCapacity.cpu`	integer	Max extra CPU (millicores) schedulable above base.	`40000`	Integer
`astronomer.houston.config.deployments.resourceManagement.maxExtraCapacity.memory`	integer	Max extra memory (MiB).	`153600`	Integer
`astronomer.houston.config.deployments.resourceManagement.maxPodCapacity.cpu`	integer	Max CPU per pod (millicores).	`3500`	Integer
`astronomer.houston.config.deployments.resourceManagement.maxPodCapacity.memory`	integer	Max memory per pod (MiB).	`13440`	Integer
`astronomer.houston.config.deployments.resourceManagement.overProvisioningFactorMem`	number	Memory over-provisioning factor.	`1`	Number ≥ 1
`astronomer.houston.config.deployments.resourceManagement.overProvisioningFactorCPU`	number	CPU over-provisioning factor.	`1`	Number ≥ 1

Namespace management

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.namespaceManagement.manualReleaseNames.enabled`	boolean	Allow operators to set Helm release names manually.	`false`	`true`, `false`
`astronomer.houston.config.deployments.namespaceManagement.manualNamespaceNames.enabled`	boolean	Manual Kubernetes namespace names for deployments.	`false`	`true`, `false`
`astronomer.houston.config.deployments.namespaceManagement.namespaceFreeFormEntry.enabled`	boolean	Free-form namespace entry flows.	`false`	`true`, `false`
`astronomer.houston.config.deployments.namespaceManagement.namespaceLabels`	object	Labels applied to deployment namespaces.	`{}`	String map
`astronomer.houston.config.deployments.namespaceManagement.preCreatedNamespaces`	array	Pre-created namespace names for routing.	`[]`	Array of `{name}` objects

namespaceManagement is blocklisted for deployment-level overrides (immutable after create); see Config governance.

Deployment lifecycle

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.deploymentLifecycle.deployRollback.enabled`	boolean	Allow rollback of code deploys / revisions.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deploymentLifecycle.deployRollback.deployRevisionReportNumberOfDays`	integer	Window for deploy revision reporting (days).	`90`	Positive integer
`astronomer.houston.config.deployments.deploymentLifecycle.deployRollback.dagTarballVersionValidation.enabled`	boolean	Validate Dag tarball versions on rollback paths.	`true`	`true`, `false`
`astronomer.houston.config.deployments.deploymentLifecycle.hardDeleteDeployment.enabled`	boolean	Allow hard delete of deployments (destructive).	`false`	`true`, `false`
`astronomer.houston.config.deployments.deploymentLifecycle.cleanupAirflowDb.enabled`	boolean	Enable cleanup jobs for Airflow metadata DB.	`false`	`true`, `false`

Database management

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.databaseManagement.database.enabled`	boolean	Provision per-deployment Airflow databases when enabled.	`true`	`true`, `false`
`astronomer.houston.config.deployments.databaseManagement.database.retainOnDelete`	boolean	Keep DB objects after deployment deletion.	`false`	`true`, `false`
`astronomer.houston.config.deployments.databaseManagement.database.allowRootAccess`	boolean	Allow root-level DB access patterns documented in the APC API.	`false`	`true`, `false`
`astronomer.houston.config.deployments.databaseManagement.manualConnectionStrings.enabled`	boolean	Allow manual connection string configuration.	`false`	`true`, `false`
`astronomer.houston.config.deployments.databaseManagement.pgBouncerResourceCalculationStrategy`	string	Strategy key for PgBouncer sizing (`null` uses built-in algorithm).	`~`	Strategy name or null

Image registry

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.deploymentImagesRegistry.exposeDockerWebhookEndpoint.enabled`	boolean	Expose webhook endpoint for image push flows.	`true`	`true`, `false`
`astronomer.houston.config.deployments.deploymentImagesRegistry.updateDeploymentImageEndpoint.enabled`	boolean	Allow API to update deployment images directly.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deploymentImagesRegistry.updateDeploymentImageEndpointDockerValidation.enabled`	boolean	Validate docker payloads on image update endpoint.	`false`	`true`, `false`
`astronomer.houston.config.deployments.deploymentImagesRegistry.serviceAccountAnnotationKey`	string	Cloud IAM annotation key on workload identity (`eks.amazonaws.com/role-arn`, `iam.gke.io/gcp-service-account`, …).	`~`	Annotation key or null

Metrics reporting

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.metricsReporting.grafana.enabled`	boolean	Surface Grafana links / metrics UI integration points.	`true`	`true`, `false`
`astronomer.houston.config.deployments.metricsReporting.taskUsageMetrics.enabled`	boolean	Enable task usage metrics reporting features.	`false`	`true`, `false`
`astronomer.houston.config.deployments.metricsReporting.taskUsageMetrics.reportNumberOfDays`	integer	Reporting horizon for task usage (days).	`90`	Positive integer

Pagination maxTake limits under metricsReporting.pagination.* follow defaults in config/default.yaml (typically 101 per collection).

Orchestration mode

Deployment orchestration mode (Helm vs operator).

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.mode.helm.enabled`	boolean	Use Helm-based deployment reconciler.	`true`	`true`, `false`
`astronomer.houston.config.deployments.mode.operator.enabled`	boolean	Use Kubernetes operator–based deployment path when supported.	`false`	`true`, `false`

Operator probes and detailed probe specs are defined under deployments.mode.operator in default.yaml.

Deployments Helm defaults

The deployments.helm subtree supplies defaults merged into Airflow Helm chart values for each deployment (scheduler resources, PgBouncer sidecars, ingress, runtime images, Elasticsearch hooks, etc.). It is large and nested; defaults are authoritative in config/default.yaml under deployments.helm. For merge and validation rules at override layers, rely on deployments-config-override.schema.json and Config governance.

Mock webhook (test only)

Test-only mock webhook settings for development scenarios.

Parameter	Type	Description	Default	Allowed values
`astronomer.houston.config.deployments.mockWebhook.enabled`	boolean	Enable mock webhook server wiring.	`false`	`true`, `false`
`astronomer.houston.config.deployments.mockWebhook.krb.enabled`	boolean	Kerberos realm defaults for mock.	`true`	`true`, `false`
`astronomer.houston.config.deployments.mockWebhook.shouldCreateDb`	boolean	Auto-create backing DB objects in mock mode.	`true`	`true`, `false`

Global configuration

Base domain and TLS

global:
  # Required: Base domain for all platform endpoints
  # Results in: app.example.com, houston.example.com, etc.
  baseDomain: "example.com"

  # Name of Kubernetes secret containing TLS certificate
  tlsSecret: "astronomer-tls"

  # List of secrets containing private CA certificates
  privateCaCerts: []

Plane mode (control, data, unified)

Astro Private Cloud 2.0 supports split control plane and data plane deployments:

global:
  plane:
    # Options: unified (default), control, data
    mode: "unified"

    # Domain prefix for this plane (used in split deployments)
    domainPrefix: ""

Mode	Description
`unified`	Control and data plane in same cluster (default, like 0.x)
`control`	Control plane only - manages Deployments
`data`	Data plane only - runs Airflow workloads

Network policies

global:
  # Enable platform-level network policies
  networkPolicy:
    enabled: true

  # Apply default deny ingress policy
  defaultDenyNetworkPolicy: true

  # Enable namespace labels for network policies
  networkNSLabels:
    enabled: false

RBAC and cluster roles

global:
  # Enable Kubernetes RBAC
  rbac:
    enabled: true

  # Use cluster-wide roles (required for some features)
  clusterRoles: true

  # Management of cluster-scoped resources (RBAC objects, etc.)
  manageClusterScopedResources:
    enabled: true

Node selection

Separate platform Pods from Airflow Pods:

global:
  platformNodePool:
    nodeSelector:
      node-role: platform
    affinity: {}
    tolerations:
      - key: "platform"
        operator: "Equal"
        value: "true"
        effect: "NoSchedule"

Private registry

Use a private container registry:

global:
  privateRegistry:
    enabled: true
    repository: "registry.example.com/astronomer"
    secretName: "registry-credentials"

Namespace pools

Pre-provision namespaces for Airflow Deployments:

global:
  features:
    namespacePools:
      enabled: true
      createRbac: true
      namespaces:
        create: false  # Set true to auto-create
        names:
          - airflow-prod
          - airflow-staging
          - airflow-dev

Storage class

Specify a storage class for all persistent volumes:

global:
  storageClass: "gp3"

OpenShift support

global:
  openshiftEnabled: true
  sccEnabled: true  # Security context constraints

Astronomer platform components

APC API

The APC API is the core internal API that powers the platform:

astronomer:
  houston:
    replicas: 2

    resources:
      requests:
        cpu: "500m"
        memory: "1024Mi"
      limits:
        cpu: "1000m"
        memory: "2048Mi"

    # Database connection
    backendSecretName: "houston-backend-secret"
    # Or specify directly:
    backendConnection:
      user: houston
      pass: "password"
      host: postgres.example.com
      port: 5432
      db: houston

    # Airflow database connection template
    airflowBackendSecretName: "airflow-backend-secret"

    # Houston configuration (see houston.config section below)
    config: {}

    # Environment variables common to all houston containers
    env:
      - name: LOG_LEVEL
        value: "info"

    # Worker pods for async processing
    worker:
      enabled: true
      replicas: 2

    # Upgrade all airflow helm deployments when upgrading APC helm deployment
    upgradeDeployments:
      enabled: true

    # Cleanup soft-deleted deployments
    cleanupDeployments:
      enabled: true
      schedule: "0 0 * * *"
      olderThan: 14

    # Cleanup Airflow database metadata
    cleanupAirflowDb:
      enabled: false
      schedule: "23 5 * * *"
      olderThan: 365

APC API configuration (`houston.config`)

The APC API accepts extensive configuration via houston.config:

Authentication

astronomer:
  houston:
    config:
      auth:
        # Local username/password auth
        local:
          enabled: true

        # OpenID Connect
        openidConnect:
          # Auth flow: "code" (recommended) or "implicit"
          flow: "code"

          # Microsoft/Azure AD
          microsoft:
            enabled: true
            clientId: "<YOUR_CLIENT_ID>"
            clientSecret: "<YOUR_CLIENT_SECRET>"
            discoveryUrl: "https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration"

          # Google OAuth
          google:
            enabled: false
            clientId: ""
            clientSecret: ""

          # Okta
          okta:
            enabled: false
            clientId: ""
            clientSecret: ""
            discoveryUrl: ""

          # Import groups from IDP (nested `.enabled` in APC 2.0)
          idpGroupsImport:
            enabled: true
          idpGroupsRefresh:
            enabled: false

        # GitHub via Auth0
        github:
          enabled: false

Deployment defaults (`deployments`)

APC 2.0 groups deployment-related settings under domains (for example deployMechanisms, deploymentLifecycle, runtimeManagement) using nested objects and feature.enabled toggles—not flat keys such as dagOnlyDeployment or hardDeleteDeployment. For tables of defaults, allowed values, and override semantics, see APC API configuration earlier on this page. For how cluster, workspace, and deployment layers merge, see Config governance. Example shape (abbreviated):

astronomer:
  houston:
    config:
      deployments:
        deployMechanisms:
          dagOnlyDeployment:
            enabled: true
          gitSyncDagDeployment:
            enabled: true
        deploymentLifecycle:
          hardDeleteDeployment:
            enabled: false
          deployRollback:
            enabled: true
        resourceManagement:
          components: []

Airflow Helm value defaults merged per deployment live under deployments.helm in the APC API’s config/default.yaml; see Deployments Helm defaults earlier on this page.

Email configuration

astronomer:
  houston:
    config:
      email:
        enabled: true
        smtpUrl: "smtp://smtp.example.com:587"
        reply: "noreply@example.com"

      # Root-level toggles (APC 2.0 nested `.enabled` pattern)
      emailConfirmation:
        enabled: true

      publicSignups:
        enabled: false

Prometheus integration

astronomer:
  houston:
    config:
      prometheus:
        enabled: true
        host: "http://astronomer-prometheus:9090"

Deployment orchestrator

The deployment orchestrator manages Kubernetes resources for Deployments:

astronomer:
  commander:
    replicas: 2

    resources:
      requests:
        cpu: "250m"
        memory: "1Gi"
      limits:
        cpu: "500m"
        memory: "2Gi"

    # Air-gapped mode (no external registry access)
    airGapped:
      enabled: false

    # Helm upgrade timeout (seconds)
    upgradeTimeout: 600

    # Environment variables
    env: []

Registry

Container registry for deployment images:

astronomer:
  registry:
    replicas: 1

    resources:
      requests:
        cpu: "250m"
        memory: "512Mi"
      limits:
        cpu: "500m"
        memory: "1024Mi"

    # Persistent storage
    persistence:
      enabled: true
      size: "100Gi"
      storageClassName: ~

    # Use external storage backends
    # AWS S3
    s3:
      enabled: false
      accesskey: ""
      secretkey: ""
      region: "us-east-1"
      bucket: "astronomer-registry"

    # Google Cloud Storage
    gcs:
      enabled: false
      bucket: ""
      useKeyfile: true
      keyfile: /var/gcs-keyfile/astronomer-gcs-keyfile

    # Azure Blob Storage
    azure:
      enabled: false
      accountname: ""
      accountkey: ""
      container: ""

Astro UI

astronomer:
  astroUI:
    replicas: 2

    resources:
      requests:
        cpu: "100m"
        memory: "256Mi"
      limits:
        cpu: "500m"
        memory: "1024Mi"

    env: []

NGINX ingress

nginx:
  replicas: 2

  resources:
    requests:
      cpu: "500m"
      memory: "1024Mi"
    limits:
      cpu: "1"
      memory: "2048Mi"

  # Service type: LoadBalancer, ClusterIP, or NodePort
  serviceType: "LoadBalancer"

  # Specific load balancer IP (optional)
  loadBalancerIP: ~

  # Restrict source IPs
  loadBalancerSourceRanges:
    - "10.0.0.0/8"

  # Private/internal load balancer
  privateLoadBalancer: false

  # NodePort configuration (when serviceType: NodePort)
  httpNodePort: ~
  httpsNodePort: ~

  # Ingress annotations
  ingressAnnotations:
    # AWS
    service.beta.kubernetes.io/aws-load-balancer-internal: "true"
    # GCP
    cloud.google.com/load-balancer-type: "Internal"
    # Azure
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"

  # Proxy settings
  proxyConnectTimeout: 15
  proxyReadTimeout: 600
  proxySendTimeout: 600
  proxyBodySize: "1024m"

  # Default backend
  defaultBackend:
    enabled: true
    resources:
      requests:
        cpu: "100m"
        memory: "50Mi"

Prometheus (monitoring)

prometheus:
  # Data retention period
  retention: 15d

  # Persistent storage
  persistence:
    enabled: true
    size: "150Gi"

  resources:
    requests:
      cpu: "1000m"
      memory: "4Gi"
    limits:
      cpu: "2000m"
      memory: "8Gi"

Grafana

grafana:
  resources:
    requests:
      cpu: "250m"
      memory: "512Mi"
    limits:
      cpu: "500m"
      memory: "1024Mi"

  # Custom dashboards
  dashboards:
    default:
      custom-dashboard:
        file: dashboards/custom.json

  # Extra environment variables (for example, SMTP for alerts)
  extraEnvVars:
    - name: GF_SMTP_ENABLED
      value: "true"
    - name: GF_SMTP_HOST
      value: "smtp.example.com:587"

Elasticsearch (logging)

elasticsearch:
  # Enable persistence
  common:
    persistence:
      enabled: true

  # Client nodes
  client:
    replicas: 2
    heapMemory: "2g"
    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "4Gi"

  # Data nodes
  data:
    replicas: 3
    heapMemory: "2g"
    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "4Gi"
    persistence:
      size: "100Gi"

  # Master nodes
  master:
    replicas: 3
    heapMemory: "2g"
    resources:
      requests:
        cpu: "1"
        memory: "2Gi"
      limits:
        cpu: "2"
        memory: "4Gi"
    persistence:
      size: "20Gi"

Vector (log collection)

vector:
  vector:
    resources:
      requests:
        cpu: "250m"
        memory: "512Mi"
      limits:
        cpu: "1000m"
        memory: "1024Mi"

External logging

Forward logs to external Elasticsearch:

global:
  customLogging:
    enabled: true
    scheme: https
    host: "elasticsearch.example.com"
    port: "9200"
    secret: "es-credentials"

NATS (messaging)

global:
  nats:
    enabled: true
    replicas: 3
    jetStream:
      enabled: true
      tls: false

nats:
  nats:
    resources:
      requests:
        cpu: "75m"
        memory: "30Mi"
      limits:
        cpu: "250m"
        memory: "100Mi"

Database configuration

External PostgreSQL (recommended)

global:
  # Disable in-cluster PostgreSQL
  postgresql:
    enabled: false

astronomer:
  houston:
    backendSecretName: "houston-db-secret"
    # Secret should contain: connection=postgres://user:pass@host:5432/houston
    airflowBackendSecretName: "airflow-db-secret"

Database SSL

global:
  ssl:
    enabled: true
    mode: "require"  # disable, allow, prefer, require, verify-ca, verify-full
    grafana:
      sslmode: "require"

PgBouncer (connection pooling)

global:
  pgbouncer:
    enabled: true
    gssSupport: true
    secretName: "astronomer-pgbouncer-config"
    servicePort: "6543"

Auth sidecar (OpenShift)

global.authSidecar configures the chart-level platform auth proxy used for OpenShift and similar environments. This is separate from astronomer.houston.config.deployments.authSideCar, which controls the per-Deployment auth sidecar injected by the APC API (default tag 1.29.2).

global:
  authSidecar:
    enabled: true
    repository: quay.io/astronomer/ap-auth-sidecar
    tag: 1.29.8
    port: 8084
    resources:
      requests:
        cpu: "500m"
        memory: "512Mi"
      limits:
        cpu: "1000m"
        memory: "1024Mi"

Logging sidecar

Add Vector sidecar to Airflow Pods:

global:
  logging:
    loggingSidecar:
      enabled: true
      name: sidecar-log-consumer
      repository: quay.io/astronomer/ap-vector
      tag: 0.54.0
      resources:
        requests:
          cpu: "100m"
          memory: "386Mi"

Dag-only deployments

global:
  dagOnlyDeployment:
    enabled: true
    repository: quay.io/astronomer/ap-dag-deploy
    tag: 0.9.4
    resources: {}
    persistence: {}

Airflow operator

Enable Kubernetes operator-based deployments:

global:
  airflowOperator:
    enabled: false

Extra objects

Add custom Kubernetes resources:

astronomer:
  extraObjects:
    # Custom LimitRange
    - apiVersion: v1
      kind: LimitRange
      metadata:
        name: default-limits
        namespace: astronomer
      spec:
        limits:
          - default:
              cpu: "1"
              memory: "1Gi"
            defaultRequest:
              cpu: "100m"
              memory: "128Mi"
            type: Container

    # Custom NetworkPolicy
    - apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: custom-policy
      spec:
        podSelector: {}
        policyTypes:
          - Ingress

Complete example

Here’s an example configuration:

global:
  baseDomain: "airflow.example.com"
  tlsSecret: "astronomer-tls"

  plane:
    mode: "unified"

  rbac:
    enabled: true
  clusterRoles: true

  networkPolicy:
    enabled: true

  postgresql:
    enabled: false

  privateRegistry:
    enabled: true
    repository: "registry.example.com/astronomer"
    secretName: "registry-creds"

  platformNodePool:
    nodeSelector:
      node-type: platform
    tolerations:
      - key: "dedicated"
        value: "platform"
        effect: "NoSchedule"

  ssl:
    enabled: true
    mode: "require"

tags:
  platform: true
  monitoring: true
  logging: true

astronomer:
  houston:
    replicas: 2
    resources:
      requests:
        cpu: "500m"
        memory: "1Gi"
      limits:
        cpu: "1000m"
        memory: "2Gi"
    backendSecretName: "houston-db-secret"
    config:
      auth:
        local:
          enabled: false
        openidConnect:
          microsoft:
            enabled: true
            clientId: "<YOUR_CLIENT_ID>"
            clientSecret: "<YOUR_CLIENT_SECRET>"
            discoveryUrl: "https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration"
      email:
        enabled: true
        smtpUrl: "smtp://smtp.example.com:587"
      publicSignups:
        enabled: false
      deployments:
        deploymentLifecycle:
          hardDeleteDeployment:
            enabled: true
        namespaceManagement:
          manualReleaseNames:
            enabled: true

  commander:
    replicas: 2
    resources:
      requests:
        cpu: "250m"
        memory: "1Gi"
      limits:
        cpu: "500m"
        memory: "2Gi"

  registry:
    persistence:
      enabled: true
      size: "200Gi"

nginx:
  replicas: 2
  serviceType: LoadBalancer
  privateLoadBalancer: true
  resources:
    requests:
      cpu: "500m"
      memory: "1Gi"

prometheus:
  retention: 30d
  persistence:
    enabled: true
    size: "200Gi"
  resources:
    requests:
      cpu: "1"
      memory: "4Gi"

elasticsearch:
  data:
    replicas: 3
    persistence:
      size: "200Gi"
    resources:
      requests:
        cpu: "1"
        memory: "4Gi"

Validate configuration

After creating your values file, validate it:

# Dry-run to check for errors
helm template astronomer astronomer/astronomer \
  -f values.yaml \
  --namespace astronomer \
  --debug

# Check rendered templates
helm template astronomer astronomer/astronomer \
  -f values.yaml \
  --namespace astronomer > rendered.yaml

Upgrade configuration

(Optional) When updating your values file, you can use the helm diff plugin, and then run the following command to see a diff of your changes:

# Compare changes
helm diff upgrade astronomer astronomer/astronomer \
  -f values.yaml \
  --namespace astronomer

# Apply changes
helm upgrade astronomer astronomer/astronomer \
  -f values.yaml \
  --namespace astronomer

⌘I

​Values file structure

​Required configuration

​Helm chart parameter tables

​Tags

​Global settings

​Astronomer platform images

​Astronomer workload defaults

​APC API configuration

​Outside the deployments subtree

​The APC API deployment defaults

​Operational and platform defaults

​Runtime management

​Logging

​Dag deploy

​Deploy mechanisms

​Airflow components

​Auth sidecar

​Resource management

​Namespace management

​Deployment lifecycle

​Database management

​Image registry

​Metrics reporting

​Orchestration mode

​Deployments Helm defaults

​Mock webhook (test only)

​Global configuration

​Base domain and TLS

​Plane mode (control, data, unified)

​Network policies

​RBAC and cluster roles

​Node selection

​Private registry

​Namespace pools

​Storage class

​OpenShift support

​Astronomer platform components

​APC API

​APC API configuration (houston.config)

​Authentication

​Deployment defaults (deployments)

​Email configuration

​Prometheus integration

​Deployment orchestrator

​Registry

​Astro UI

​NGINX ingress

​Prometheus (monitoring)

​Grafana

​Elasticsearch (logging)

​Vector (log collection)

​External logging

​NATS (messaging)

​Database configuration

​External PostgreSQL (recommended)

​Database SSL

​PgBouncer (connection pooling)

​Auth sidecar (OpenShift)

​Logging sidecar

​Dag-only deployments

​Airflow operator

​Extra objects

​Complete example

​Validate configuration

​Upgrade configuration

​Related documentation