Installation

The canette Helm chart deploys the full platform into your cluster: API, UI, builder, controller, logstreamer, BuildKit daemon, in-cluster PostgreSQL, and an in-cluster container registry. The registry is exposed through your Gateway — the same one that serves the UI and your app URLs — so a working Gateway with TLS termination is the main prerequisite.

Before you installCopy Anchor Link

1. Gateway API with TLS terminationCopy Anchor Link

canette creates HTTPRoute resources for the UI, the registry, and every app you deploy. A Gateway must exist before installation.

Check that Gateway API CRDs are installed:

kubectl get crd gateways.gateway.networking.k8s.io

Check what Gateways exist in your cluster:

kubectl get gateways -A

Note the Gateway's name and namespace — you'll need them in your values file. The defaults canette expects are can-gateway in kube-system; override them if yours are different.

The Gateway must handle TLS termination — without it, the in-cluster registry HTTPRoute serves plain HTTP and kubelets will refuse to pull images from it. How you set up TLS depends on your environment:

• cert-manager + Let's Encrypt — the standard approach for clusters with a public IP. Install cert-manager and configure an Issuer or ClusterIssuer pointing at Let's Encrypt; your Gateway implementation picks up certificates automatically.
• mkcert (local testing) — generates locally-trusted certificates without a commercial CA, but requires manually installing the CA in the cluster and on every client machine. See In-cluster registry for a step-by-step walkthrough.
• AWS ALB + ACM — on EKS, the AWS Load Balancer Controller combined with AWS Certificate Manager handles TLS at the load balancer level without cert-manager. See the AWS installation guide for details.

2. A domain with wildcard DNSCopy Anchor Link

canette builds URLs from a single base domain:

Point a wildcard record at your Gateway's external IP:

# Find your Gateway's external IP
kubectl get gateway -n <gateway-namespace> <gateway-name> \
  -o jsonpath='{.status.addresses[0].value}'

Then create: *.apps.example.com → <gateway-ip> (and make sure canette.example.com also resolves there).

3. Node configuration for buildsCopy Anchor Link

Build jobs run rootless BuildKit. Nodes that run builds need user namespace support enabled — see Requirements for the kernel settings per Linux distribution.

InstallCopy Anchor Link

Create a values.yaml:

domain: apps.example.com         # base domain — *.apps.example.com → Gateway IP
ui:
  hostname: canette.example.com  # public URL for the canette UI

controller:
  gateway:
    name: traefik                 # name of your pre-existing Gateway resource
    namespace: traefik            # namespace where the Gateway lives

Then install:

helm install canette oci://ghcr.io/canette/canette \
  --namespace canette-system \
  --create-namespace \
  -f values.yaml

AuthenticationCopy Anchor Link

By default, canette enables email and password login — no OAuth app or SMTP required to evaluate it. You can create an account directly from the login page.

To add GitHub or Google OAuth, include either or both in your values file:

api:
  githubClientId: "<client-id>"
  githubClientSecret: "<client-secret>"

  googleClientId: "<client-id>"
  googleClientSecret: "<client-secret>"

Create a GitHub OAuth App at github.com/settings/developers with the callback URL https://<your-canette-hostname>/api/auth/callback/github.

VerifyCopy Anchor Link

kubectl -n canette-system rollout status deploy/canette-api
kubectl -n canette-system rollout status deploy/canette-ui

Then open ui.hostname in your browser — you should see the canette login page.

Next stepsCopy Anchor Link

• Your first deploy — create a project and deploy an app
• Helm reference — full values reference, upgrading, and operations
• Requirements — node requirements for rootless builds
• Production setup — external database, external registry, HA considerations