Configuration

How to configure the operator manager itself. For configuring the platform, see the custom resource reference pages. A condensed list of flags and environment variables is on the Configuration Reference page.

Watched namespaces

By default the operator watches all namespaces. To restrict it — for example to give one operator instance a slice of a large cluster — set --watch-namespaces (or the WATCH_NAMESPACES environment variable) to a comma-separated list:

--watch-namespaces=forge-gateway,forge-langfuse,forge-ui,forge-data

Keep system namespaces reachable

When you scope the watch, the cluster-scoped License and the capability operators' *-system namespaces must remain reachable. The operator uses an uncached reader for those cross-namespace reads, but make sure your RBAC still permits them.

In Helm, set watchNamespaces: [...] (empty list = all namespaces).

Leader election

Leader election is on by default. Because the in-binary Helm engine relies on a single active reconciler (the Helm action.Configuration is not concurrency-safe), you should keep leader election enabled even when running a single replica. Each controller also runs with MaxConcurrentReconciles = 1.

Resources

The manager renders and installs Helm charts in-process, which is memory-hungry. Give it adequate memory — ~1Gi is a safe baseline:

resources:
  requests: { cpu: 100m, memory: 512Mi }
  limits:   { memory: 1Gi }

The default Kubebuilder limits are too low and will manifest as OOM kills only in-cluster (not under local make run, which uses your kubeconfig and your machine's memory).

RBAC

The operator ships a broad ClusterRole because it installs CRDs, cluster RBAC, admission webhooks, and workloads across namespaces. The install methods provision this for you. If you assemble RBAC by hand, the operator needs, among others:

• Full management of *.core.navique.com resources and their /status.
• Management of the upstream CRDs it emits (postgresql.cnpg.io, external-secrets.io, litellm.palena.ai, langfuse.palena.ai, …).
• customresourcedefinitions get/list/watch (to wait for Established).
• Helm-release management objects (Secrets in the release namespaces).
• Lease objects for leader election.
• The management-plane console's least-privilege ServiceAccount and RBAC.

Capability-operator install behavior

Each bundled chart has vetted default install values baked into the operator's registry — see Bundled Charts. You generally do not need to touch these. Where a chart's upstream defaults are stale (for example a pinned-but-old image tag), the operator overrides them to match the chart version it ships with.

For air-gapped clusters, mirror the upstream images into your registry and supply image overrides; the charts themselves are embedded in the binary and need no network access.

Management console

The operator deploys the management-plane console by default, even with no ManagementPlane resource present. To change its host, ingress, SSO, image, or discovery behavior, create a ManagementPlane resource. To disable it entirely, set the corresponding chart/install value (the console can be turned off where it is not wanted).

High availability

Run the manager with multiple replicas and leader election on; only the leader reconciles, and failover is automatic. The platform workloads themselves are made HA through their own resources (e.g. PostgresCluster.managed.instances: 3, Gateway.instance.replicas, Langfuse datastore replicas).