Bundled Charts
The operator drives upstream capability operators by installing their official Helm charts. Every chart is vendored as a standalone .tgz, embedded in the operator binary via go:embed, and installed as its own Helm release — never a subchart dependency. Because the charts are embedded, chart installs need no network access (only the images they reference are pulled from registries).
Chart matrix
| Operator / workload | Chart | Release name | Namespace | Ships CRDs | Installed when |
|---|---|---|---|---|---|
| External Secrets | external-secrets | external-secrets | external-secrets | yes | SecretsManagement.backend=eso |
| Sealed Secrets | sealed-secrets | sealed-secrets | sealed-secrets | yes | SecretsManagement.backend=sealedSecrets |
| CloudNativePG | cloudnative-pg | cloudnative-pg | cnpg-system | yes | PostgresCluster managed, type=cnpg |
| cert-manager | cert-manager | cert-manager | cert-manager | yes | Observability ingress TLS enabled (and as a prerequisite for some operators) |
| LiteLLM operator | litellm-operator | litellm-operator | litellm-system | yes | any Gateway (type: litellm, the default) |
| Wäg operator | waeg-operator | waeg-operator | waeg-system | yes | any Gateway with type: waeg |
| Langfuse operator | langfuse-operator | langfuse-operator | langfuse-system | yes | any Observability (type: langfuse) |
| Redis operator | redis-operator | redis-operator | redis-system | yes | RedisInstance managed |
| ClickHouse operator | clickhouse-operator-helm | clickhouse-operator | clickhouse-system | yes | ClickHouseCluster managed |
| MongoDB (MCK) | mongodb-kubernetes | mongodb-kubernetes | mongodb-system | yes | MongoCluster managed, type=mck |
| LibreChat (workload) | librechat | per-ChatUI (<cr-name>) | the ChatUI namespace | no | each ChatUI |
| Meilisearch (workload) | meilisearch | per-MeilisearchInstance (<cr-name>) | the MeilisearchInstance namespace | no | MeilisearchInstance managed |
| Web search (workload, shared) | palena | navique-mcp-palena (shared, ref-counted) | navique-mcp-system | yes | catalog-mode MCPServer (websearch, licensed) |
| PII pseudonymizer (guardrail engine, shared) | pseudonymizer | navique-guardrail-pseudonymizer (shared, ref-counted) | navique-guardrail-system | yes | catalog-mode Guardrail (pseudonymizer, licensed guardrail) |
Two of these are workloads, not operators: librechat and meilisearch get one release per resource in that resource's namespace — they are not singletons and not provenance-shared.
Lazy installation
A capability operator chart is installed only when a resource needs it. If every datastore is external or adopt, none of the datastore operators are installed — only the operators the present workloads truly require. See Provenance & Lifecycle.
Versions
Each operator build pins specific chart versions. The pinned versions are recorded in the operator's chart manifest and surfaced in resource status for auditability. To move to newer bundled charts for the releases the operator owns, upgrade the operator. Upstream version bumps are driven by Renovate/Dependabot watching the source chart repositories.
Adopting instead of letting the operator install
If you already run any of these operators, the operator adopts your install and never manages its lifecycle. You stay on your version; the operator coexists. See Provenance & Lifecycle.
Upstream custom resource API groups
The resources the operator emits live in these upstream groups:
| Component | Group / kinds |
|---|---|
| CloudNativePG | postgresql.cnpg.io/v1 — Cluster, Database |
| External Secrets | external-secrets.io/v1 — SecretStore, ExternalSecret |
| Sealed Secrets | bitnami.com/v1alpha1 — SealedSecret |
| LiteLLM | litellm.palena.ai/v1alpha1 — LiteLLMInstance, LiteLLMModel, … |
| Langfuse | langfuse.palena.ai/v1alpha1 — LangfuseInstance, … |
| Redis (OT-Container-Kit) | redis.redis.opstreelabs.in/v1beta2 |
| MongoDB (MCK) | MongoDBCommunity |
Air-gapped installs
The charts are embedded, so no chart pulls are needed. Mirror the images those charts reference into your internal registry and supply image overrides. See Configuration.
Redistribution & licenses
The operator binary redistributes these third-party charts; each is OSS (Apache-2.0 / MIT) and permits redistribution. Attribution is kept in the operator's chart attribution file.