Helm Chart

github-sts-helm packages the github-sts server for Kubernetes. It renders a Deployment, a Service, and a ConfigMap holding the server configuration, and it mounts each GitHub App private key from a Secret you create yourself. The chart never holds a private key in its values.

The chart is published as a signed OCI artifact at ghcr.io/depthmark/charts/github-sts and carries build provenance attestation.

Quickstart

A working single-app deployment, from an empty namespace

Installation

OCI install, multiple apps, private registries, digest pinning

Values Reference

Every chart value, with its default and its effect

Rendered Resources

What each template renders and what gates it

Networking

Ingress, HTTPRoute, and NetworkPolicy for both CNI families

TLS and mTLS

Serving HTTPS from the pod, certificate rotation, client certificates

Upgrade

Rolling a new chart or image version, and rolling it back

Versioning

Chart pinning, release process, and supported combinations

Where this documentation ends

This section documents the chart: its values, the Kubernetes objects it renders, its upgrade path, and its versioning.

Server behavior lives elsewhere in this site. What the server does with the configuration this chart writes is described in Configuration, trust policy fields and evaluation in Trust Policies, and the exchange endpoint in the API Reference. The client side of the exchange is documented in GitHub Action.