Prerequisites and deployment contract
Supported baseline
- Kubernetes 1.28 or newer with
networking.k8s.io/v1Ingress andpolicy/v1disruption budgets. - A GitOps controller capable of reconciling Helm charts from OCI registries.
- PostgreSQL 18 reachable through one TLS-protected connection URL.
- Either an external Valkey reachable through a Redis-compatible connection URL, or storage capacity for the optional bundled Valkey dependency.
- S3-compatible object storage with an existing bucket and read/write credentials.
- Either an Ingress controller, or Gateway API CRDs plus a conformant controller and existing Gateway.
- A DNS record and TLS configuration owned by the customer. For HTTPRoute, TLS belongs to the Gateway listener.
- Pull access to
registry.gitlab.com/asfadev/loadouthqfor both cluster nodes and Helm clients. - A default-deny-aware network path from API pods to PostgreSQL, Valkey, S3, and configured OIDC providers.
Preflight checklist
Record these before installation:
| Decision | Required answer |
|---|---|
| Kubernetes version and distribution | Customer value |
| Namespace and release name | Customer value |
| Public HTTPS URL | Customer value |
| Routing mode: Ingress or HTTPRoute | Customer value |
| Ingress class, or Gateway parent and listener | Customer value |
| TLS Secret or Gateway listener certificate | Customer value |
| PostgreSQL owner and recovery target | Customer value |
| Valkey mode (external or bundled), owner, and persistence policy | Customer value |
| S3 endpoint, region, bucket, and backup owner | Customer value |
| OCI registry credential owner and rotation date | Customer value |
| Platform-admin email | Customer value |
| OIDC issuer and callback approval owner | Customer value |
| License management mode: mounted or admin upload | Customer value |
| Monitoring and incident contacts | Customer value |
Current limitations
- The API process also runs BullMQ workers. Scaling API replicas increases worker concurrency.
- Schema migrations run automatically under a PostgreSQL advisory lock. Only one migrator proceeds at a time.
- The parent chart does not create application NetworkPolicies because allowed destinations are environment-specific. The bundled Valkey chart accepts an operator-supplied policy.
- Rollback after a schema-changing upgrade may require database and object-storage restoration.
- Offline licenses cannot be revoked before expiry.
- Deliberately modified self-hosted binaries are governed contractually; technical licensing protects official distributions.