# Overview of Dashboard ## Introduction The **Modern Kubernetes Dashboard** by Devtron provides a unified interface for managing and observing all Kubernetes resources across your clusters. It simplifies resource management by offering visualizations, RBAC controls, multi-cluster support, thus making it intuitive for you to view and manage your microservices. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/dashboard-overview.gif) *** ## Key Offerings Discover how Devtron’s Modern Kubernetes Dashboard simplifies operations by managing all your clusters with the Resource Browser. Visualize Helm releases and ArgoCD/FluxCD apps easily, with fine-tuned RBAC controls and OCI registry support. The intuitive interface removes the complexity of Kubernetes, so you can focus on delivering great software and services. ### Resource Browser View and manage the resource kinds available across all your clusters. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/resource-browser-showcase-db.jpg) ### Helm Release Management Easily view, manage, and deploy your Helm releases. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/helm-applist.jpg) ### Argo CD App Listing Visualize your Argo CD apps across all your clusters on a single pane. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/argocd-applist.jpg) ### Flux CD App Listing Visualize your Flux CD apps across all your clusters on a single pane. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/fluxcd-applist.jpg) ### Fine-Grained Access Control User management with Single Sign-On (SSO) and Role-Based Access Control (RBAC) for enhanced security. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/access-control.gif) ### OCI Registry Support Support to add your OCI registry for uploading and downloading helm charts. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/oci-registry-showcase.jpg) *** ## Additional Options [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) For your advanced and challenging use-cases, Devtron offers enterprise-grade features too: * **Resource Watcher**: Trigger webhook to notify about any intercepting changes to your resources. * **Advanced CEL Filtering**: Filter Kubernetes resources with advanced CEL-based queries. * **Cluster & Helm Apps Catalog**: Manage and browse the data of clusters and Helm apps using Catalog Framework. * **Simplified Kubeconfig Sharing**: Get Kubeconfig file for gaining cluster access through your local machine. * **Fine-grained Access Control**: Supports time-based access control for user management. * **Pod Restart Snapshot**: View snapshots of Pod states for troubleshooting. * **Cluster Access via SSH & Proxy**: Securely access clusters through SSH or proxy. # Prerequisites Before installing Devtron's Modern Kubernetes Dashboard, make sure to fulfill the following requirements: * Create a [Kubernetes cluster](#create-a-kubernetes-cluster) * [Install Helm](https://helm.sh/docs/intro/install/) * [Recommended Resources](#recommended-resources) *** ## Create a Kubernetes Cluster You can create any [Kubernetes cluster](https://kubernetes.io/docs/tutorials/kubernetes-basics/create-cluster/) (preferably K8s version 1.16 or higher) for installing Devtron. You can create a cluster using one of the following cloud providers as per your requirements: | Cloud Provider | Description | | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | **AWS EKS** | Create a cluster using [AWS EKS](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html). | | **Google Kubernetes Engine (GKE)** | Create a cluster using [GKE](https://cloud.google.com/kubernetes-engine/). | | **Azure Kubernetes Service (AKS)** | Create a cluster using [AKS](https://learn.microsoft.com/en-us/azure/aks/). | | **k3s - Lightweight Kubernetes** | Create a cluster using [k3s - Lightweight Kubernetes](https://devtron.ai/blog/deploy-your-applications-over-k3s-lightweight-kubernetes-in-no-time/). | {% hint style="info" %} #### Note The above is not an exhaustive list. You may create a cluster using a platform of your choice, such as [Minikube](https://minikube.sigs.k8s.io/docs/start/?arch=%2Fmacos%2Farm64%2Fstable%2Fbinary+download), [MicroK8s](https://microk8s.io/docs), [Kind](https://kind.sigs.k8s.io/docs/user/quick-start) on your local machine or cloud. {% endhint %} ### Recommended Resources The minimum cluster resource requirements for installing **Modern Kubernetes Dashboard** (as per the number of applications you want to manage on Devtron) are provided below: | Resource Type | CPU | Memory | | ---------------------------------------------------- | --- | ------ | | **For configuring small resources (≤5 apps)** | 1 | 1 GB | | **For configuring medium/large resources (>5 apps)** | 2 | 3 GB | *** ## Install Helm Refer [Helm's official site](https://helm.sh/docs/intro/install/) to know the process of installing Helm on your target machine. *** ## Next Steps Refer [Install Modern Kubernetes Dashboard by Devton](/getting-started/install-devtron-dashboard) # Install Modern Kubernetes Dashboard {% hint style="warning" %} #### Prerequisites Make sure to meet [all the requirements](/getting-started/requirements) for installing Modern Kubernetes Dashboard. {% endhint %} *** ## 1. Add Helm Repo Add the Devtron Helm repository to pull the necessary charts ```bash helm repo add devtron https://helm.devtron.ai ``` *** ## 2. Update Helm Repo Update the Helm repo to ensure you are using the latest version. ```bash helm repo update devtron ``` *** ## 3. Install Dashboard {% hint style="info" %} #### Having a Multi-Arch Cluster? If you wish to install Devtron on clusters with multi-architecture nodes (ARM and AMD), append the below Devtron installation command with `--set installer.arch=multi-arch`. {% endhint %} ### For EKS, AKS, GKE Users ```bash helm install devtron devtron/devtron-operator \ --create-namespace --namespace devtroncd ``` ### For Minikube, MicroK8s, Kind, K3s Users Click the relevant tab given below to get the command: {% tabs %} {% tab title="Minikube/MicroK8s/Kind Cluster" %} To install on **Minikube/MicroK8s/Kind/** cluster, run the following command: ```bash helm install devtron devtron/devtron-operator \ --create-namespace --namespace devtroncd \ --set components.devtron.service.type=NodePort ``` {% endtab %} {% tab title="K3s Cluster" %} To install on **K3s** cluster, run the following command: ```bash kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml helm install devtron devtron/devtron-operator \ --create-namespace --namespace devtroncd \ --set components.devtron.service.type=NodePort ``` {% endtab %} {% endtabs %} ### For Cloud VM Users (AWS EC2, Azure VM, GCP VM) It is recommended to use Cloud VM with 2vCPU+, 4GB+ free memory, 20GB+ storage, Compute Optimized VM type, and Ubuntu Flavoured OS. First, create a MicroK8s Cluster: ```bash sudo snap install microk8s --classic --channel=1.22 sudo usermod -a -G microk8s $USER sudo chown -f -R $USER ~/.kube newgrp microk8s microk8s enable dns storage helm3 echo "alias kubectl='microk8s kubectl '" >> .bashrc echo "alias helm='microk8s helm3 '" >> .bashrc source .bashrc ``` Then use these commands after setting up MicroK8s: ```bash helm install devtron devtron/devtron-operator \ --create-namespace --namespace devtroncd \ --set components.devtron.service.type=NodePort ``` ## 4. Get Dashboard URL ### For EKS, AKS, GKE Users Run the following command to get the dashboard URL: ```bash kubectl get svc -n devtroncd devtron-service -o jsonpath='{.status.loadBalancer.ingress}' ``` Assuming you have an EKS cluster, you might get a similar message as shown below: ``` [test2@server ~]$ kubectl get svc -n devtroncd devtron-service -o jsonpath='{.status.loadBalancer.ingress}' [map[hostname:aaff16e9760594a92afa0140dbfd99f7-305259315.us-east-1.elb.amazonaws.com]] ``` here, hostname `aaff16e9760594a92afa0140dbfd99f7-305259315.us-east-1.elb.amazonaws.com` is the Loadbalancer URL at which you can access the Devtron dashboard. ### For Minikube, MicroK8s, Kind, K3s Users {% tabs %} {% tab title="Minikube" %} To access the dashboard on **Minikube** cluster, run the following command: ```bash minikube service devtron-service --namespace devtroncd ``` This will directly open the dashboard URL on your browser {% endtab %} {% tab title="MicroK8s/Kind/K3s Cluster" %} To install on **MicroK8s/Kind/K3s** cluster, run the following command to port-forward the devtron service to port 8000: ```bash kubectl -n devtroncd port-forward service/devtron-service 8000:80 ``` After port-fowarding, you can access the dashboard on this URL: {% endtab %} {% endtabs %} ### For Cloud VM Users (AWS EC2, Azure VM, GCP VM) Get devtron-service port number using the following command: ```bash kubectl get svc -n devtroncd devtron-service -o jsonpath='{.spec.ports[0].nodePort}' ``` The dashboard URL will be: `http://:/dashboard` {% hint style="warning" %} #### Note Make sure that the port on which the devtron-service runs remain open in the VM's security group or network security group. {% endhint %} *** ## 5. Get Admin Login credentials By default, the username will be `admin`. Run the below command to get the admin password. ```bash kubectl -n devtroncd get secret devtron-secret \ -o jsonpath='{.data.ADMIN_PASSWORD}' | base64 -d ``` {% hint style="info" %} #### Next Recommended Action When you install Devtron for the first time, it creates a default admin user and password (with unrestricted access to Devtron). You can use it to log in as an administrator. After the initial login, we recommend you set up any [Single Sign-On (SSO) service](/operator-guide/authorization/sso-login-services) like Google, GitHub, etc., and then add other users (including yourself). Subsequently, all the users can use the same SSO (let's say, GitHub) to log in to the Dashboard. {% endhint %} # Explore Kubernetes Resources ## Introduction The Devtron Resource Browser provides you a central interface to view and manage all your [Kubernetes objects](/resources/glossary#objects) across clusters. It helps you perform key actions like viewing logs, editing live manifests, and even creating/deleting resources directly from the user interface. This is especially useful for troubleshooting purposes as it supports multi-cluster too. {% hint style="info" %} #### Additional References * [Resource browser versus traditional tools like kubectl](https://devtron.ai/blog/managing-kubernetes-resources-across-multiple-clusters) * [Why you should use Devtron's Resource Browser](https://devtron.ai/blog/what-is-the-kubernetes-resource-browser-in-devtron) {% endhint %} First, the Resource Browser shows you a list of clusters added to your Devtron setup. By default, it displays a cluster named '*default\_cluster*' after the [initial setup](/getting-started/install-devtron-dashboard) is successful. ![Figure 1: Devtron Resource Browser - List of Clusters](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/resource-browser-db2.jpg) In the image above, you can see a visual display of the health status for all clusters connected to Devtron. If any node within a cluster encounters an issue and is not ready, it will be highlighted in red, allowing you to quickly address the problem. If you are a superadmin, you can connect more clusters by clicking the **Add Cluster** button located at the top of the browser. This will take you to the [Clusters](/operator-guide/cluster-environments) page within **Global Configurations**. You may click a cluster to view and manage all its resources as shown below. ![Figure 2: Resources within Cluster](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/resource-list-db.jpg) # Overview Page ![Figure 1: Resource Browser - Overview Page](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/rb-overview-db.jpg) ## Resource Utilization This shows the combined CPU and memory consumption of all running pods in the cluster. | Parameter | Description | | --------------- | ----------------------------------------------------------------------------------------------------------- | | CPU Usage | Percentage of CPU resources currently being used across all the pods in the cluster. | | CPU Capacity | Total amount of CPU resources available across all the nodes in the cluster. Measured in millicores (m). | | CPU Requests | Total amount of CPU resources requested by all the pods in the cluster. | | CPU Limits | Maximum amount of CPU resources that a total number of pods can use in the cluster. | | Memory Usage | Percentage of memory resources currently being used across all the pods in the cluster. | | Memory Capacity | Total amount of memory resources available across all the nodes in the cluster. Measured in Megabytes (Mi). | | Memory Requests | Total amount of memory resources requested by all the pods in the cluster. | | Memory Limits | Maximum amount of memory resources that a total number of pods can use in the cluster. | *** ## Errors in Cluster This shows errors in the cluster. If no error is present in the cluster, Resource Browser will not display this section. *** ## Catalog Framework [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) {% hint style="warning" %} #### Who Can Perform This Action? Users need to have super-admin permission to edit the catalog framework. {% endhint %} Based on the schema provided in the catalog framework, you can add relevant details for each cluster. Refer [Catalog Framework](/operator-guide/catalog-framework) for more details. *** ## Readme {% hint style="warning" %} #### Who Can Perform This Action? Users need to have super-admin permission to edit the readme file. {% endhint %} You can also include additional information about your cluster using the Markdown editor. *** ## Check Compatibility before Cluster Upgrade [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) Whenever you upgrade your Kubernetes version, the API versions change and your workloads/resources may not be compatible with those API versions. Therefore, the resources need to be upgraded first. This could mean changing the API version of the resources itself or changing their outdated spec. The **Check Compatibility** feature within Resource Browser scans your cluster and automatically identifies all such resources/workloads that need manual intervention before proceeding with an actual cluster upgrade. ![Figure 2: Checking Compatibility](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/check-compatibility.jpg) ### Walkthrough {% embed url="" %} # Discover and Manage Resources {% hint style="warning" %} #### Who Can Perform This Action? Users need to have [access to the cluster](/operator-guide/authorization/user-permissions#kubernetes-resources-permissions) to discover resources. {% endhint %} ## Search a Resource You can use the searchbox to browse the resources. ![Figure 1: Locate Resources using Searchbox](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/discover-resource.gif) ### Filter Resources [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) Moreover, you can use filters that allow you to quickly filter your workload as per labels, field selectors, or [CEL expression](https://kubernetes.io/docs/reference/using-api/cel/) as shown below. {% embed url="" %} ### Resource Kinds Resource kinds displayed upfront for you to manage: * Nodes * Events * Namespaces Further resources in the cluster are grouped under the following categories: * Namespace * Workloads * Config & Storage * Networking * RBAC * Administration * Other Resources * Custom Resource ![Figure 2: Resources within Cluster](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/resource-list-db.jpg) *** ## Edit a Manifest {% hint style="warning" %} #### Who Can Perform This Action? User needs to be an [admin of the Kubernetes resource](/operator-guide/authorization/user-permissions#kubernetes-resources-permissions) to edit its manifest. The [fields/paths locked by superadmins](/operator-guide/edit-lock-schema) in the manifest cannot be edited by non-superadmins. {% endhint %} You can edit the [manifest](/resources/glossary#manifest) of a Kubernetes object. This can be for fixing errors, scaling resources, or changing configuration. Moreover, you can edit a manifest [using YAML](#edit-using-yaml) or [GUI](#edit-using-gui), as per your convenience. ### Edit using YAML ![Figure 3a: Editing Manifest (Using YAML)](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/edit-live-manifest-yaml.gif) ### Edit using GUI [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) ![Figure 3b: Editing Manifest (Using GUI)](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/edit-live-manifest-gui.gif) {% hint style="info" %} #### Note The fields displayed in GUI mode will be as per the [GUI schema configured by the operator](https://github.com/devtron-labs/devtron-documentation/blob/stage/k8s-dashboard/db-docs/operations/edit-manifest-schema.md) for that resource kind. {% endhint %} *** ## View Events You can monitor activities like creation, deletion, updation, scaling, or errors in the resources involved. Refer [Events](https://kubernetes.io/docs/reference/kubernetes-api/cluster-resources/event-v1/) to learn more. ![Figure 4a: Viewing All Events](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/events.gif) ### AI-assistance on Events [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) For events with warnings, you can take the assistance of AI. Clicking the **Explain** button will help you identify the root cause of the issue along with suggestions to fix those. ![Figure 4b: AI-assistance](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/ai-assist-eventfix.gif) *** ## Delete a Resource {% hint style="warning" %} #### Who Can Perform This Action? User needs to be an [admin of the Kubernetes resource](/operator-guide/authorization/user-permissions#kubernetes-resources-permissions) to delete it. {% endhint %} You can delete an unwanted resource if it is orphaned and no longer required by your applications. ![Figure 5: Deleting a Resource](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/delete.gif) *** ## Create a Resource {% hint style="warning" %} #### Who Can Perform This Action? User needs to be an [admin of the Kubernetes resources](/operator-guide/authorization/user-permissions#kubernetes-resources-permissions) to create resources. {% endhint %} You can create one or more [Kubernetes objects](/resources/glossary#objects) in your cluster using YAML. In case you wish to create multiple objects, separate each resource definition by three dashes (---). Once you select a cluster in Resource Browser, click **+ Create Resource**, and add the resource definition. In the below example, we have created a simple pod named `nginx`: ![Figure 6: Creating Resources within Cluster](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/create-resource.gif) Here's one more example that shows the required fields and object specifications for a Kubernetes Deployment: {% code title="Spec File" overflow="wrap" lineNumbers="true" %} ```yml apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 2 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ``` {% endcode %} *** ## Bulk Actions on Resources [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) You can use the checkbox to select the resources/workloads you wish to delete or restart. ### Bulk Delete ![Figure 7a: Deleting Resources in Bulk](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/bulk-delete-resources.gif) ### Bulk Restart ![Figure 7b: Restarting Workloads in Bulk](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/bulk-restart-resources.gif) {% hint style="info" %} #### Note You can only restart certain workloads such as Deployment, DaemonSet, StatefulSet, etc. and not all resource types. {% endhint %} # Nodes and Operations You can see the list of nodes available in your cluster. Typically you have several nodes in a cluster; in a learning or resource-limited environment, you might have only one node. The components on a typical node include the `kubelet`, a `container runtime`, and the `kube-proxy`. If you have multiple nodes, you can search a node by name or label in the search bar. The search result will display the following information about the node. To display a parameter of a node, use `Columns` on the right side, select the parameter to display from the drop-down list, and click **Apply**. ![Figure 1: Searching and Filtering Nodes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/cluster-nodes-db.jpg) | Fields | Description | | ----------- | ---------------------------------------------------------- | | Node | Alphanumeric name of the node | | Status | Status of a node. It can be either `Ready` or `Not Ready`. | | Roles | Shows the roles of a node, e.g., agent | | Errors | Shows the number of errors in nodes (if any) | | K8s Version | Shows the version of Kubernetes cluster | | Node Group | Shows which collection of worker nodes it belongs to | | No. of Pods | Shows the total number of pods present in the node | Clicking on a node shows you a number of details such as: * CPU Usage and Memory Usage of Node * CPU Usage and Memory Usage of Each Pod * Number of Pods in the Node * List of Pods * Age of Pods * Labels, Annotations, and Taints * Node IP ![Figure 2: Checking Node Summary](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/node-summary-db.jpg) Further using the Devtron UI, you will be able to: * [Debug a Node](#debug-a-node) * [Cordon a Node](#cordon-a-node) * [Drain a Node](#drain-a-node) * [Taint a Node](#taint-a-node) * [Edit a Node Config](#edit-a-node-config) * [Delete a Node](#delete-a-node) {% hint style="info" %} #### Why Are Node Operations Required? Your applications run on pods, and pods run on nodes. But sometimes, Kubernetes scheduler cannot deploy a pod on a node for several reasons, e.g., node is not ready, node is not reachable, network is unavailable, etc. In such cases, node operations help you manage the nodes better. {% endhint %} {% hint style="warning" %} #### Who Can Perform These Actions? Users need to have super-admin permission to perform node operations. {% endhint %} ## Debug a Node You can debug a node via [Cluster Terminal](/user-guide/resource-browser/terminal) by selecting your namespace and image from the list that has all CLI utilities like kubectl, helm, netshoot etc. or can use a custom image, which is publicly available. * Click **Debug**. ![Figure 3a: Debugging a Node](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/debug-db.jpg) * Debug a node by selecting the terminal shell, i.e., `bash` or `sh`. ![Figure 3b: Debug Terminal](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/debug-terminal-db.jpg) *** ## Cordon a Node Cordoning a node means making the node unschedulable. After [cordoning a node](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_cordon/), new pods cannot be scheduled on this node. ![Figure 4a: Visual Representation - Cordoning a Node](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/cordon-visual.jpg) * Click **Cordon**. ![Figure 4b: Cordoning a Node](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/cordon-db.jpg) * A confirmation dialog box will appear, click **Cordon Node** to proceed. ![Figure 4c: Cordon Confirmation](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/cordon-dialog-db.jpg) The status of the node shows `SchedulingDisabled` with `Unschedulable` parameter set as `true`. Similarly, you can uncordon a node by clicking `Uncordon`. After a node is uncordoned, new pods can be scheduled on the node. *** ## Drain a Node Before performing maintenance on a node, [draining a node](https://kubernetes.io/docs/tasks/administer-cluster/safely-drain-node/) evicts all of your pods safely from a node. Safe evictions allow the pod’s containers to gracefully terminate and honour the `PodDisruptionBudgets` you have specified (if relevant). ![Figure 5a: Visual Representation - Draining a Node](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/drain-visual.jpg) After the node is drained, all pods (including those managed by DaemonSets) in the node will be automatically drained to other nodes in the cluster, and the drained node will be set to cordoned status. * Click **Drain**. ![Figure 5b: Draining a Node](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/drain-db.jpg) * A confirmation dialog box will appear, click **Drain Node** to proceed. ![Figure 5c: Drain Confirmation](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/drain-dialog-db.jpg) You can also select from the following conditions before draining a node: | Name | Usage | | ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Grace Period | Period of time in seconds given to each pod to terminate gracefully. If negative, the default value specified in the pod will be used. | | Delete empty directory data | Enabling this field will delete the pods using empty directory data when the node is drained. | | Disable eviction (use with caution) |

Enabling this field will force drain to use delete, even if eviction is supported. This will bypass checking PodDisruptionBudgets.
Note: Make sure to use with caution.

| | Force drain | Enabling this field will force drain a node even if there are pods that do not declare a controller. | | Ignore DaemonSets | Enabling this field will ignore DaemonSet-managed pods. | *** ## Taint a Node Taints are `key:value` pairs associated with effect. After you add taints to nodes, you can set tolerations on a pod to allow the pod to be scheduled to nodes with certain taints. When you taint a node, it will repel all the pods except those that have a toleration for that taint. A node can have one or many taints associated with it. ![Figure 6a: Visual Representation - Tainting a Node](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/taint-visual.jpg) **Note**: Make sure to check taint validations before you add a taint. * Click **Edit taints**. ![Figure 6b: Tainting a Node](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/edit-taints-db.jpg) * Enter the `key:value` pairs and select the [taint effect](#taint-effects) from the drop-down list. ![Figure 6c: Adding Taints](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/taint-dialog-db.jpg) * Click **Save**. You can also add more taints using **+ Add taint button**, or delete the existing taint by using the delete icon. {% hint style="info" %} #### Additional Reference [Click here](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/#concepts) to read about taint effects. {% endhint %} *** ## Edit a Node Config This allows you to directly edit any node. It will open the editor which contains all the configuration settings in which the default format is YAML. You can edit multiple objects, although changes are applied one at a time. ![Figure 7: Editing Node Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/edit-config.gif) * Go to the `YAML` tab and click **Edit YAML**. * Make the changes using the editor. * Click **Review & Save changes** to compare the changes in the YAML file. * Click **Apply changes** to confirm. *** ## Delete a Node You can also delete a node by clicking the **Delete** button present on the right-hand side. ![Figure 8a: Deleting a Node](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/delete-node-db.jpg) ![Figure 8b: Delete Confirmation](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/delete-dialog-db.jpg) The node will be deleted from the cluster. {% hint style="info" %} You can also access [Cluster Terminal](/user-guide/resource-browser/terminal) from your node. {% endhint %} # Pod Management and Debugging {% hint style="warning" %} #### Who Can Perform This Action? Users need to have [access to the cluster](/operator-guide/authorization/user-permissions#kubernetes-resources-permissions) to view its pods and its data. {% endhint %} ## Manifest Shows you the [configuration](/resources/glossary#manifest) of the selected pod and allows you to edit it. Refer [Edit Manifest](#edit-manifest) to learn more. *** ## Events Shows you all the activities (create/update/delete) of the selected pod. Refer [View Events](#view-events) to know more. *** ## Logs Examining your cluster's pods helps you understand the health of your application. By inspecting pod logs, you can check the performance and identify if there are any failures. This is especially useful for debugging any issues effectively. Moreover, you can download the pod logs for ease of sharing and troubleshooting as shown in the below video. {% embed url="" %} ### Pod Last Restart Snapshot [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) Frequent pod restarts can impact your application as it might lead to unexpected downtimes. In such cases, it is important to determine the root cause and take actions (both preventive and corrective) if needed. In case any of your pod restarts, you can view its details from the pod listing screen: * Last pod restart event, along with the timestamp and message * Reason behind restart * Container log before restart * Node status and events ![Figure 1: Checking Restart Pod Log](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/restart-pod-log.gif) *** ## Terminal {% hint style="warning" %} #### Who Can Perform This Action? User needs to be an [admin of the Kubernetes resource](/operator-guide/authorization/user-permissions#kubernetes-resources-permissions) to access pod terminal. {% endhint %} You can access the terminal within a running container of a pod to view its logs, troubleshoot issues, or execute commands directly. This is different from the [cluster terminal](#cluster-terminal) you get at node level. ### Launching Ephemeral Container This is a part of [Pod Terminal](#pod-terminal). It is especially useful when `kubectl exec` is insufficient because a container has crashed or a container image doesn't include debugging utilities. {% embed url="" %} 1. In the Resource Browser, select **Pod** within `Workloads`. 2. Use the searchbar to find and locate the pod you wish to debug. Click the pod. 3. Go to the **Terminal** tab 4. Click **Launch Ephemeral Container** as shown below. You get 2 tabs: 1. **Basic** - It provides the bare minimum configurations required to launch an ephemeral container. ![Figure 2: Basic Tab](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/debugging-deployment-and-monitoring/basic.jpg) It contains 3 mandatory fields: * **Container name prefix** - Type a prefix to give to your ephemeral container, for e.g., *debug*. Your container name would look like `debug-jndvs`. * **Image** - Choose an image to run from the dropdown. Ephemeral containers need an image to run and provide the capability to debug, such as `curl`. You can use a custom image too. * **Target Container name** - Since a pod can have one or more containers, choose a target container you wish to debug, from the dropdown. * **Advanced** - It is particularly useful for advanced users that wish to use labels or annotations since it provides additional key-value options. Refer [Ephemeral Container Spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#ephemeralcontainer-v1-core) to view the supported options. {% hint style="info" %} Devtron ignores the 'command' field while launching an ephemeral container {% endhint %} # Cluster Terminal User with [super-admin](/operator-guide/authorization/user-permissions#assign-super-admin-permission) access can now troubleshoot cluster issues by accessing the cluster terminal from Devtron. You can select an image from the list that has all CLI utilities like kubectl, helm, netshoot etc. or can use a custom image, which is publicly available. To troubleshoot a cluster or a specific node in a cluster, click the terminal icon on the right side. ![Figure 1: Terminal Icon](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/cluster-terminal.gif) * You will see the user-defined name for the cluster in Devtron. E.g. `default-cluster`. * Select the node you wish to troubleshoot from the `Node` drop-down. E.g. `demo-new`. * Select the namespace from the drop-down list which you have added in the [Environment](/operator-guide/cluster-environments#add-environment) section. * Select the image from the drop-down list which includes all CLI utilities or you can use a custom image, which is publicly available. * Select the terminal shell from the drop-down list (e.g. `sh`, `bash`) to troubleshoot a node. ## Use Case - Debugging Pods You can also create a pod for debugging which will connect to the pod terminal. To find out why a particular pod is not running, you can check `Pod Events` and `Pod Manifest` for details. The **Auto select** option automatically selects a node from a list of nodes and then creates a pod. Alternatively, you can choose a node of your choice from the same dropdown for debugging. The **Debug Mode** is helpful in scenarios where you can't access your node by using an SSH connection. Enabling this feature opens an interactive shell directly on the node. This shell provides unrestricted access to the node, giving you enhanced debugging capabilities. * Check the current state of the pod and recent events with the following command: ```bash kubectl get pods ``` * To know more information about each of these pods and to debug a pod depending on the state of the pods, run the following command: ```bash kubectl describe pod ``` Here, you can see configuration information about the container(s) and pod (labels, resource requirements, etc.), as well as status information about the container(s) and pod (state, readiness, restart count, events, etc.). [Click here](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/) to know more about pod lifecycle. {% hint style="info" %} A container can have no shells or multiple shells running in it. If you are unable to create a successful connection, try changing the shell, as the container may not have that shell running. {% endhint %} # Add Monitoring Dashboards/Graphs ## Introduction [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) The Resource Browser allows you to integrate monitoring graphs and dashboards from tools like Grafana, Kibana, Prometheus, and many more tools, with each cluster. This centralizes all monitoring visuals for your clusters in one place within Devtron, streamlining troubleshooting and significantly reducing manual effort. It works similarly to a 'Single Pane of Glass (SPOG)' that displays data coming from different sources in a single unified view. ![Adding Monitoring Visualizations](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/monitoring-graphs.gif) *** ## Tutorial {% embed url="" %} *** ## Steps 1. Go to **Resource Browser** and select your cluster. 2. Click the graph icon as shown below and click the **Add Panel** button. ![Adding Monitoring](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/add-graph1.jpg) 3. Give a name to the monitoring dashboard and add the `iframe` code supplied by your graph/dashboard tool. ![Adding Monitoring](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/fields-filled.jpg) 4. Click **Save**. You can also rearrange and resize the graphs/dashboards in case you have added many of them. Refer the [tutorial](#tutorial) to know more. # Run Kubectl Commands Locally ## Introduction [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) If you wish to run kubectl commands from your local system, you need to have access to your cluster. Traditionally, the kubeconfig file (`./kube/config`) helps you connect with the cluster from your local system. ![Figure 21: Kubeconfig File](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/kubeconfig.jpg) *** ## Challenges in Kubeconfig Kubeconfig becomes painstakingly difficult to maintain especially when it comes to: * Granting or revoking access to the cluster for multiple people * Changing the permissions and subsequently the access token * Adding/Updating/Deleting the entries of cluster URLs and tokens * Keeping a record of multiple kubeconfig files *** ## Our Solution Devtron helps in reducing the challenges and simplifying the maintenance of kubeconfig file through: * **Devtron's Proxy URL for Cluster** - A standardized URL that you can use in place of your Kubernetes cluster URL. * **Devtron's Access Token** - A kubectl-compatible token which can be generated and centrally maintained from [Global Configurations → Authorization → API tokens](/operator-guide/authorization/api-tokens). *** ## Steps **Prerequisite**: An [API token with necessary permissions](/operator-guide/authorization/api-tokens) for the user(s) to access the cluster. If you are not a super-admin and can't generate a token yourself, you can find the session token (argocd.token) using the Developer Tools available in your web browser as shown below. ![Figure 22: Using Session Token](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/argocd-token-v1.gif) There are 2 methods of getting kubeconfig in your system: * [Quick Method](#quick-method) * [Manual Method](#manual-method) ### Quick Method 1. In Resource Browser, hover on the cluster name and click the `Get kubeconfig` icon. ![Figure 23: Get Kubeconfig](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/getkubeconfig.gif) 2. Copy the commands and run them on your terminal. ### Manual Method 1. Go to `~/.kube` folder on your local machine and open the `config` file. Or you may create one with the following content: {% code title="kubeconfig" overflow="wrap" lineNumbers="true" %} ```yml apiVersion: v1 kind: Config clusters: - cluster: insecure-skip-tls-verify: true server: https:///orchestrator/k8s/proxy/cluster/ name: devtron-cluster contexts: - context: cluster: devtron-cluster user: admin name: devtron-cluster current-context: devtron-cluster users: - name: admin user: token: ``` {% endcode %} 2. Edit the following placeholders in the `server` field and the `token` field: | Placeholder | Description | Example | Where to Find | | ---------------------- | ----------------------------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | \ | Hostname of the Devtron server | demo.devtron.ai | [Host URL Page](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/hostname-page.jpg) | | \ | Name of the cluster (or cluster ID) | devtron-cluster | [Applications Page](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/applications-page.jpg) | | \ | API token or session token | - | [Authorization Page](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/authorization-page.jpg) | ![Figure 23: Editing Kubeconfig File](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/kubeconfig.gif) 3. Test the connection to the cluster by running any kubectl command, e.g., `kubectl get ns` or `kubectl get po -A` {% hint style="info" %} #### Additional References Once the connection is successful, you may run any [kubectl operations](https://kubernetes.io/docs/reference/kubectl/#operations) from your system. {% endhint %} *** ## Use Case - Port Forwarding [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) Assume your applications are running in a Kubernetes cluster on cloud. Now, if you wish to test or debug them on your local machine, you can perform [port forwarding](https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/). It creates a tunnel between a port on your machine and a port on a resource within your cluster. Therefore, you can access applications running inside the cluster as though they are running locally on your machine. Once you have successfully connected to the cluster, you may run the port-forward command. Refer [kubectl port-forward](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_port-forward/) to see a few examples. ![Figure 24: Example - Port Forwarding](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/port-forward.gif) # Use Resource Watcher ## Introduction [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) An incident response if delayed can impact businesses, revenue, and waste valuable engineering time. Devtron's Resource Watcher enables you to perform automated actions upon the occurrence of events: * **Create Event** - Occurs when a new Kubernetes resource is created, for e.g., a new pod spun up to handle increased traffic. * **Update Event** - Occurs when an existing Kubernetes resource is modified, for e.g., deployment configuration tweaked to increase the replica count. * **Delete Event** - Occurs when an existing Kubernetes resource is deleted, for e.g., deletion of an orphaned pod. You can make the Resource Watcher listen to the above events and accordingly trigger a webhook to notify the relevant party. Since manual intervention is absent, the timely response of this auto-remediation system improves your operational efficiency. *** ## Creating a Watcher {% hint style="warning" %} #### Who Can Perform This Action? Users need to have super-admin permission to create a watcher. {% endhint %} This page allows you to create a watcher to track events and trigger a webhook. It also shows the existing list of watchers (if any). 1. Click **+ Create Watcher**. ![Figure 1: Watchers - Page](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/watchers-page-db.jpg) 2. Creating a watcher consists of 4 parts, fill all the sections one by one: * [Basic Details](#basic-details) * [Namespaces to Watch](#namespaces-to-watch) * [Intercept Change in Resources](#intercept-change-in-resources) * [Execute Runbook](#execute-runbook) ![Figure 2: Create Watcher - Window](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/create-watcher-window.jpg) ### Basic Details Here, you can give a name and description to your watcher. ![Figure 3: Adding Name and Description of Watcher](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/basic-details.gif) ### Namespaces to Watch Here, you can select the [namespaces](https://github.com/devtron-labs/devtron-documentation/blob/stage/k8s-dashboard/reference/glossary.md#namespace) whose [Kubernetes resource](https://github.com/devtron-labs/devtron-documentation/blob/stage/k8s-dashboard/reference/glossary.md#objects) you wish to monitor for changes. * You can watch the namespace(s) across **All Clusters** (existing and future). ![Figure 4: Choosing Namespaces of all Clusters](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/all-cluster.gif) * Or you can watch namespace(s) of **Specific Clusters**. ![Figure 5: Choosing Namespaces of Specific Clusters](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/specific-cluster.gif) {% hint style="info" %} In both the above options, if you choose 'Specific Namespaces', you can further decide whether to track the namespaces you enter (by clicking 'Include selections') or to track the namespaces except the ones you enter (by clicking 'Exclude selections'). {% endhint %} ### Intercept Change in Resources Here, you can select the exact Kubernetes resource(s) you wish to track for changes (in the namespace(s) you selected in the previous step). ![Figure 6: Picking Resources to Track](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/intercept-changes.gif) * You can choose the resource from the **Resource kind(s) to watch** dropdown. Enter the Group/Version/Kind (GVK) if it's a custom resource definition (CRD), for e.g., `install.istio.io/v1apha1/IstioOperator` * Choose the event type your watcher should listen to: `Created`, `Updated`, `Deleted`. | Event Type | Description | | ---------- | ----------------------------------------------------------------------- | | Created | Triggers the watcher when your Kubernetes resource is created | | Updated | Triggers the watcher when your existing Kubernetes resource is modified | | Deleted | Triggers the watcher when your existing Kubernetes resource is deleted | * Enter a [CEL expression](https://github.com/google/cel-spec/blob/master/doc/langdef.md) to catch a specific change in the resource's manifest. {% hint style="info" %} * **If resource is created** - Use 'DEVTRON\_FINAL\_MANIFEST' * **If resource is updated** - Both 'DEVTRON\_INITIAL\_MANIFEST' and 'DEVTRON\_FINAL\_MANIFEST' can exist * **If resource is deleted** - Use 'DEVTRON\_INITIAL\_MANIFEST' {% endhint %} **Example**: `DEVTRON_FINAL_MANIFEST.status.currentReplicas == DEVTRON_FINAL_MANIFEST.spec.maxReplicas` ### Execute Runbook Here, you can set up a webhook to receive notifications when specified changes in Kubernetes resources are detected. ![Figure 7: Webhook to Trigger](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/run-webhook.gif) * **Webhook URL**: Here, you'll provide the Webhook URL where you want the payload delivered. It must be valid and reachable for the watcher to work properly. * **Header Key-Value**: Fill in any relevant header key-value pairs necessary for authentication or to include additional metadata for the receiving endpoint. * **Payload**: Define what you want to deliver to the Webhook when this watcher is triggered. You can customize this payload with information related to changes in the intercepted resources. You can pass the properties of resource manifest in the webhook payload using the following keys: * To access initial resource manifest use `DEVTRON_INITIAL_MANIFEST` * To access final resource manifest use `DEVTRON_FINAL_MANIFEST` The above keys return values as stringified JSON Click **Create Watcher**. Your watcher is now ready to intercept the changes to the selected resources. *** ## Viewing Intercepted Changes {% hint style="warning" %} #### Who Can Perform This Action? Users need to have super-admin permission to view intercepted changes. {% endhint %} ### Details This page allows you to view the changes to Kubernetes resources that you have selected for tracking changes. ![Figure 8: Intercepted Changes - Page](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/intercepted-changes-page-db.jpg) It comes with the following items to help you locate the resource, where the event has been intercepted: * Searchbox * Cluster filter * Namespace filter * Action filter (event type, i.e., `Created`, `Updated`, `Deleted`) * Watcher filter (to check the intercepted changes of a specific watcher) You get the following details in the results shown on the page. | Field | Description | | ----------------------------------------- | ----------------------------------------------------------------------------------------- | | [Change In Resource](#change-in-resource) | Describes the type of change to the Kubernetes resource along with a link to its manifest | | [Cluster/Namespace](#namespaces-to-watch) | Shows the cluster and namespace where the tracked Kubernetes resource belongs to | | Intercepted By | Shows the name of the watcher that intercepted the change | | Intercepted At | Shows the date and time when the event occurred | | Execution Status | Shows the status of the execution of webhook, e.g., `Succeeded`, `Failed` | ### Change in Resource You can check the changes in manifest by clicking **View Manifest** in `Change In Resource` column. ![Figure 9a: Created Resource Manifest - Final Manifest](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/view-manifest-db1.gif) ![Figure 9b: Updated Resource - Initial and Final Manifest](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/view-manifest-db2.gif) ![Figure 9c: Deleted Resource - Initial Manifest](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/resource-watcher/view-manifest-db3.gif) *** ## Use Cases ### Live Stream Traffic Surge A live streaming sports application experiences a surge in viewers during a major game. The Horizontal Pod Autoscaler (HPA) might not be able to handle the unexpected traffic if it's capped at a low max replica count. 1. Create a watcher named 'Live Stream Scaling Alert'. 2. Monitor updates to HPA resource in the application's namespace. 3. When `currentReplicas` count reaches `maxReplicas`, trigger a webhook to intimate the concerned users. ### Pod Health Monitoring A stock trading application constantly updates stock prices for its traders. If the pods become unhealthy, traders might see incorrect stock prices leading to bad investments. 1. Create a watcher named 'Pod Health Monitor'. 2. Track the pod workload of your application, if `DEVTRON_FINAL_MANIFEST.status.phase != 'Running'`, trigger a webhook to notify the stakeholders. # Manage Helm Apps The Devtron Dashboard displays the helm applications deployed to your cluster and lets you deploy your own helm charts or third-party charts (e.g. postgresql) using the [Chart Store](/user-guide/chart-store). ## View Helm Apps 1. From the left pane, go to **Applications**. 2. Click the **Helm Apps** tab. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/helm-applist.jpg) You can see the Helm Apps available in your cluster. If you have connected more than one cluster to Devtron, you can use the **Cluster** selection dropdown to view the respective Helm Apps in your other clusters. *** ## Deploy Helm Charts ### 1. Discover the Chart from Chart Store * Select the `Charts` section from the left pane, you will be landed to the `Chart Store` page. * Search `nginx` or any other charts in search filter. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/search-chart-db.jpg) * Click on chart and it will redirect you to `Chart Details` page where you can see a number of instances deployed by using the same chart. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/chart-details-db.jpg) *** ### 2. Configure the Chart * You may refer the `README.md` attached to the chart to know more about the chart configurations. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/chart-readme.gif) * Click **Configure & Deploy** and enter the following details: | Key | Description | | ------------------------- | ----------------------------------------------------------------------------------------- | | **App Name** | Unique name of the chart | | **Project** | Select the project of the application | | **Deploy to Environment** | Environment in which you want to deploy the chart | | **Chart Version** | Shows all available versions of the chart. Select the version of the chart to be used. | | **Chart Value** | Shows the latest default value or you may [create a custom value](#create-a-preset-value) | ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/values-field-db.jpg) * Once you choose a preferred chart version, chart value, and update the values.yaml using the editor, click **Deploy** to deploy the chart. #### Create a Preset Value * You can use the default values or create preset value by clicking on `Create preset value`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/preset-value.jpg) * You can name your preset value, select a chart version, and change the configurations in the YAML file using the editor. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/preset-value-db.gif) * Click on `Save Value` to save the template, and go back and choose your template from the dropdown for deployment. *** ### 3. Check Deployment Status After clicking the **Deploy** button, you will land on the **App Details** page that shows the status of the chart deployment. The status of the chart should be `Healthy`. It might take a few seconds after initiating the deployment of the chart. In case the status of the deployment shows `Degraded` or if takes a long time to get deployed, click **Details** in `Application Status` section on the same page or check the logs of the pods to debug the issue. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/chart-app-details-db.jpg) 1. Shows status of deployed chart. 2. Shows the controller service accounts being used. 3. In the **Configure** tab, you can update, upgrade, or delete your chart instance. 4. From the `Chart used` section you can go to the charts page where you can see all the running instances of this chart. 5. Click the **Deployment history** tab to view the deployment history of Helm application and values.yaml corresponding to the deployment. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/chart-deployment-history-db.jpg) *** ## Update or Upgrade Helm Chart * For update, you can change its `Chart Version` or `values.yaml` and then click **Update And Deploy**. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/update-chart-db.jpg) * For upgrade, click on `Helm Chart` field, search a chart name, change its values corresponding, and click **Update And Deploy**. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/upgrade-chart-db.jpg) * After an update or upgrade, you will land on the **App Details** page where you can check the pods and service name. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/charts-status-db.jpg) *** ## 5. Delete Chart Instances Clicking on `View Chart` in `Chart Used` section in the **App Details** page will redirect you to the `Chart Details` page where you can see the number of instances installed by that chart along with an option to delete those chart instances too. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deployment-of-charts/delete-chart-instance-db.jpg) # Manage Argo CD Apps ## Preface In Argo CD, a user manages one dashboard for one ArgoCD instance. Therefore, with multiple ArgoCD instances, the process becomes cumbersome for the user to manage several dashboards. With Devtron, you get an entire Argo CD app listing in one place. This listing includes: * Argo CD apps present in the cluster where Devtron is installed * Argo CD apps present in other clusters you added to Devtron *** ## View ArgoCD App Listing {% hint style="warning" %} #### Who Can Perform This Action? Users need super-admin permission to view ArgoCD App listing. {% endhint %} In the **ArgoCD Apps** tab, select the cluster(s) from the dropdown to view the Argo CD apps available in the chosen cluster(s). ![Figure 1: ArgoCD App List](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/creating-application/argocd/app-details-argo-db.gif) *** ## Advantages Devtron also bridges the gap for ArgoCD users by providing additional features as follows: * **Single-pane View**: All Argo CD apps will show details such as their app status, environment, cluster, and namespace together in one dashboard. * **Feature-rich Options**: Clicking an Argo CD app will give you access to its logs, terminal, events, manifest, available resource kinds, pod restart log, and many more. {% hint style="info" %} #### Additional References [ArgoCD: Standalone Configuration vs Devtron Configuration](https://devtron.ai/blog/argocd-standalone-configuration-vs-devtron-configuration/#argocd-installation-and-configuration) {% endhint %} # Manage Flux CD Apps {% hint style="warning" %} #### Who Can Perform This Action? Users need super-admin permission to view/enable/disable the FluxCD listing. {% endhint %} ## Preface Flux CD doesn't have any official dashboard; however, Devtron supports the listing of your [Flux CD](https://fluxcd.io/) apps in one dashboard. With Devtron, you get an entire Flux CD app listing in one place. This listing includes: * Flux CD apps present in the cluster where Devtron is installed * Flux CD apps present in other clusters you added to Devtron *** ## View FluxCD App Listing {% hint style="warning" %} #### Who Can Perform This Action? Users need super-admin permission to view FluxCD App listing. {% endhint %} In the **FluxCD Apps** tab, select the cluster(s) from the dropdown to view the Flux CD apps available in the chosen cluster(s). ![Figure 1: Selecting Cluster](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/creating-application/fluxcd/cluster-selection-db.jpg) (Optional) Once you choose cluster(s), you may use the **Template Type** dropdown to further filter your Flux CD app listing based on its type, i.e., [Kustomization](https://fluxcd.io/flux/components/kustomize/kustomizations/) or [Helmrelease](https://fluxcd.io/flux/components/helm/helmreleases/). Click any Flux CD app to view its details as shown below. ![Figure 2: Flux App Details](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/creating-application/fluxcd/app-details-flux-db.gif) *** ## Advantages Devtron also bridges the gap for Flux CD users by providing additional features as follows: * **Single-pane View**: All Flux CD apps will show details such as their app status, environment, cluster, and namespace together in one dashboard. * **Feature-rich Options**: Clicking an Flux CD app will give you access to its logs, terminal, events, manifest, available resource kinds, pod restart log, and many more. {% hint style="info" %} #### Additional References [Visualize Argo CD and Flux CD Apps on a Single Dashboard](https://devtron.ai/blog/devtrons-september-2024-release-now-visualize-your-argo-cd-and-flux-cd-applications-on-a-single-dashboard/) {% endhint %} # Chart Store ## Introduction The **Chart Store** shows all the Helm Charts added to the Chart Repository/OCI registry connected to Devtron. Refer [Manage Helm Apps](/user-guide/helm-apps) to know the process of deploy helm charts from the chart store. ![Figure 1: Chart Store](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/charts-store-page.jpg) *** ## Populating your Charts to the Chart Store 1. From the left sidebar, go to **Chart Store**. 2. You can find your chart(s) either by using the search bar or by selecting your chart source. ![Figure 2: Searching your Chart](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/use-cases/oci-pull/chart-search.jpg) You have successfully pulled your charts to the chart store. ![Figure 3: Uploaded Helm Charts](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/use-cases/oci-pull/chart-list.jpg) ### Unable to find your Charts? Deprecated charts won't show up in the Chart Store unless you enable the **Show deprecated charts** filter as shown below ![Figure 4: Checking Deprecated Charts](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/use-cases/oci-pull/deprecated.jpg) Or, you may try performing a chart resync as shown below: ![Figure 5: Performing a Resync](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/use-cases/oci-pull/chart-sync.jpg) # Examples This documentation helps you deploy a few Helm Charts available on Devtron. **Parts of Documentation** [Deploying mySQL Helm Chart](/user-guide/chart-store/examples/deploying-mysql-helm-chart) [Deploying mongoDB Helm Chart](/user-guide/chart-store/examples/deploying-mongodb-helm-chart) # Deploying MySQL Helm Chart ## Introduction `bitnami/mysql` Helm chart bootstraps a single node MySQL deployment on a Kubernetes cluster using the Helm package manager. ## 1. Discover MySQL chart from Chart Store Select `Charts` from the left panel to visit the `Chart Store` page. You will see numerous of charts on the page from which you have to find `bitnami/mysql` chart. You also can use the search bar to search the MySQL chart. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mysql-helm-chart/mysql-chart-db.jpg) ## 2. Configure the Chart * After selecting the `bitnami/mysql` Helm chart, click on `Configure & Deploy`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mysql-helm-chart/configure-deploy-mysql.jpg) * Enter the following details, to deploy MySQL chart: | Key | Description | | --------------- | --------------------------------------------------------------------- | | `App Name` | Name of the Chart | | `Project` | Select the name of your Project in which you want to deploy the chart | | `Environment` | Select the environment in which you want to deploy the chart | | `Chart Version` | Select the latest Chart Version | | `Chart Value` | Select the default value or create a custom value | ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mysql-helm-chart/details-mysql.jpg) ### Configure Values #### Using GUI Set the following parameters in the chart, to be later used to connect MySQL with your Django Application. | Parameters | Description | | ---------------------------------- | ----------------------------------------------------------------- | | `MySQL architecture` | Available options: Standalone or Replication | | `MySQL custom username` | Username of new user to create | | `MySQL custom password` | Password for the new user. Ignored if existing secret is provided | | `Primary database configuration` | Persistent Volume Size in Gibibytes | | `Secondary database configuration` | Persistent Volume Size in Gibibytes | ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mysql-helm-chart/gui-mysql.jpg) #### Using YAML Apart from GUI, you can directly edit the `values.yaml` file using the editor as shown below: ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mysql-helm-chart/yaml-mysql.jpg) Finally, click on `Deploy Chart` to deploy the Chart. ## 3. Check the Status of Deployment After clicking on `Deploy` you will be redirected to app details page where you can see deployment status of the chart. The Status of the chart should be `Healthy`. It might take few seconds after initiating the deployment of the chart. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mysql-helm-chart/deployment-status-mysql.jpg) In case the Status, of the deployment is `Degraded` or takes a long time to get deployed. Click on the `Status` or check the logs of the pods to debug the issue. ## 4. Extract the Service Name Copy the service name, it will be used to connect your application to MySQL. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mysql-helm-chart/mysql-service-db.jpg) # Deploying MongoDB Helm Chart ## Introduction Let's assume that you are creating an application and want to use mongodb to store data of your application. You can deploy mongodb using `bitnami/mongodb` Helm chart and connect it to your application. This guide will introduce you to how to deploy the mongoDB's Helm chart. ## 1. Discover the Chart from the Chart Store Visit the `Chart Store` page by clicking on `Charts` present on left panel and find `bitnami/mongodb` Helm Chart. You also can search mongodb chart using the search bar. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mongodb-helm-chart/mongo-chart-db.jpg) ## 2. Configure the Chart * After selecting the `bitnami/mongodb` Helm chart, click on `Configure & Deploy`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mongodb-helm-chart/configure-deploy-mongo.jpg) * Enter the following details before deploying the mongoDB chart: | Key | Description | | --------------- | --------------------------------------------------------------------- | | `App Name` | Name of the Chart | | `Project` | Select the name of your Project in which you want to deploy the chart | | `Environment` | Select the environment in which you want to deploy the chart | | `Chart Version` | Select the latest Chart Version | | `Chart Value` | Select the latest default value or create a custom value | ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mongodb-helm-chart/details-mongo.jpg) ### Configure Values #### Using GUI Set the following parameters in the chart. | Parameters | Description | | ---------------------------------- | ----------------------------------------------------------------- | | `MongoDB architecture` | Available options: Standalone or Replication | | `MongoDB admin user` | Username of admin | | `MongoDB admin password` | Password for the admin | | `MongoDB custom user` | Username of new user to create | | `Password for MongoDB custom user` | Password for the new user. Ignored if existing secret is provided | ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mongodb-helm-chart/gui-mongo.jpg) #### Using YAML You can configure the `values.yaml` according to your project's requirements. To learn about different parameters used in the chart, you can check [Documentation of mongodb Helm chart](https://hub.helm.sh/charts/bitnami/mongodb) ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mongodb-helm-chart/yaml-mongo.jpg) Click on `Deploy Chart` once you have finished configuring the chart. ## 3. Check the Status of Deployment After clicking on `Deploy Chart`, you will be redirected to `App Details` page that shows the deployment status of the chart. The Status of the chart should be `Healthy`. It might take few seconds after initiating the deployment. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mongodb-helm-chart/deployment-status-mongo.jpg) In case the status of the deployment is `Degraded` or takes a long time to get deployed, click on `Status` or check the logs of the pods to debug the issue. ## 4. Extract the Service name Copy the service name, it will be used to connect your application to mongoDB. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/deploying-mongodb-helm-chart/mongo-service-db.jpg) # Projects Projects are the logical grouping of your applications so that you can manage and control the access level of users. Refer [user permissions](/operator-guide/authorization/user-permissions) for more detail. ## Add Project 1. To add a project name, go to the `Projects` section of `Global Configurations`. 2. Click `Add Project`. 3. Provide a project name in the field and click `Save`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/projects/project-creation.gif) # Clusters ## Introduction You can add your existing Kubernetes clusters and environments on the `Clusters and Environments` section. You must have a [super admin](/operator-guide/authorization/user-permissions#assign-super-admin-permissions) access to add a cluster. ![Figure 1: Clusters and Environments in Devtron](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/cluster-and-environments/cluster-db.jpg) *** ## Add Kubernetes Cluster Use this option to add a managed or on-premise Kubernetes cluster. 1. Go to **Global Configurations** → **Clusters & Environments**. 2. Click the **Add Cluster** button on the top-right corner. ![Figure 2: Adding a Cluster](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/cluster-and-environments/add-clusters-db.jpg) 3. You can choose to add your Kubernetes cluster using either of the following methods: * [Server URL & Bearer Token](#add-clusters-using-server-url--bearer-token) * [Kubeconfig](#add-clusters-using-kubeconfig) ![Figure 3: Adding a Kubernetes Cluster](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/cluster-and-environments/add-kubernetes-cluster-db.jpg) ### Add Clusters Using Server URL & Bearer Token {% hint style="info" %} #### Note Refer [Get Cluster Credentials](#get-cluster-credentials) to know the process of getting Server URL and bearer token. {% endhint %} To add a Kubernetes cluster on Devtron using a Server URL and bearer token, provide the information in the following fields: | Field | Description | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `Name` | Enter a name of your cluster | | `Server URL` |

Server URL of a cluster.
Note: We recommended to use a self-hosted URL instead of cloud hosted URL.

| | `Bearer Token` | Bearer token of a cluster | ![Figure 4: Entering Cluster Credentials](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/cluster-and-environments/add-cluster-cred-db.jpg) ### Add Clusters Using Kubeconfig To add clusters using kubeconfig, follow these steps: 1. First, navigate to the global configurations menu, and then go to "clusters and environment" section. 2. Click on the `Add cluster` button. In the options provided, choose the `From kubeconfig` option. 3. Next, either paste the kubeconfig file or browse for it and select the appropriate file. 4. Afterward, click on the `Get cluster` button. This action will display the cluster details alongside the kubeconfig. ![Figure 5: Using Kubeconfig](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/cluster-and-environments/add-cluster-kubeconfig-db.jpg) 5. Select the desired cluster and click on `Save` to successfully add the cluster to Devtron. ![Figure 6: Saving Cluster](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/cluster-and-environments/kubeconfig-save-cluster.jpg) {% hint style="info" %} #### Note Please ensure that the kubeconfig file you use has `admin permissions`. It is crucial for Devtron to have the necessary administrative privileges; otherwise, it may encounter failures or disruptions during deployments and other operations. Admin permission is essential to ensure the smooth functioning of Devtron and to prevent any potential issues that may arise due to insufficient privileges. {% endhint %} *** *** ## Add Environment Once you have added your cluster in the `Clusters & Environments`, you can add the environment by clicking `Add environment`. A new environment window pops up. | Field | Description | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Environment Name` | Enter a name of your environment. | | `Enter Namespace` |

Enter a namespace corresponding to your environment.
Note: If this namespace does not already exist in your cluster, Devtron will create it. If it exists already, Devtron will map the environment to the existing namespace.

| | `Environment Type` |

Select your environment type:

  • Production
  • Non-production

Note: Devtron shows deployment metrics (DORA metrics) for environments tagged as Production only.

| Click **Save** and your environment will be created. ![Figure 11: Adding an Environment in Cluster](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/cluster-and-environments/add-environment-db.jpg) *** ## Update Environment * You can also update an environment by clicking the environment. * You can change `Production` and `Non-Production` options only. * You cannot change the `Environment Name` and `Namespace Name`. * Make sure to click **Update** to update your environment. *** ## Extras ### Get Cluster Credentials {% hint style="info" %} #### Prerequisites `kubectl` must be installed on the bastion. {% endhint %} {% hint style="info" %} #### Note We recommend to use a self-hosted URL instead of cloud hosted URL. Refer the benefits of [self-hosted URL](#benefits-of-self-hosted-url). {% endhint %} You can get the **Server URL** and **Bearer Token** by running the following command depending on the cluster provider: {% tabs %} {% tab title="k8s Cluster Providers" %} If you are using EKS, AKS, GKE, Kops, Digital Ocean managed Kubernetes, run the following command to generate the server URL and bearer token: ```bash curl -O https://raw.githubusercontent.com/devtron-labs/utilities/main/kubeconfig-exporter/kubernetes_export_sa.sh && bash kubernetes_export_sa.sh cd-user devtroncd ``` {% endtab %} {% tab title="Microk8s Cluster" %} If you are using a **`microk8s cluster`**, run the following command to generate the server URL and bearer token: ```bash curl -O https://raw.githubusercontent.com/devtron-labs/utilities/main/kubeconfig-exporter/kubernetes_export_sa.sh && sed -i 's/kubectl/microk8s kubectl/g' \ kubernetes_export_sa.sh && bash kubernetes_export_sa.sh cd-user \ devtroncd ``` {% endtab %} {% endtabs %} ![Figure 12: Generating Cluster Credentials](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/cluster-and-environments/generate-cluster-credentials.png) ### Benefits of Self-hosted URL * Disaster Recovery: * It is not possible to edit the server URL of a cloud specific provider. If you're using an EKS URL (e.g. `*****.eu-west-1.elb.amazonaws.com`), it will be a tedious task to add a new cluster and migrate all the services one by one. * But in case of using a self-hosted URL (e.g. `clear.example.com`), you can just point to the new cluster's server URL in DNS manager and update the new cluster token and sync all the deployments. * Easy Cluster Migrations: * In case of managed Kubernetes clusters (like EKS, AKS, GKE etc) which is a cloud provider specific, migrating your cluster from one provider to another will result in waste of time and effort. * On the other hand, migration for a self-hosted URL is easy as the URL is of single hosted domain independent of the cloud provider. # OCI Registry If you have [helm charts](/resources/glossary#helm-charts-packages) stored in your [OCI registry](/resources/glossary#container-registry), you can add the OCI registry to Devtron's Modern Kubernetes Dashboard and pull those [helm charts](/resources/glossary#helm-charts-packages) to Devtron's \[Chart Store]. You can configure an OCI registry using any registry provider of your choice, including: * ECR * Docker * Azure * Artifact Registry (GCP) * Quay *** ## Add Registry 1. From the left sidebar, go to **Global Configurations** → **OCI Registry**. ![Figure 1: OCI Registry](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/container-registries/add-registry-db.jpg) 2. Click **Add Registry**. ![Figure 2: Add a Registry](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/container-registries/add-ociregistry-db.jpg) 3. Choose a provider from the **Registry provider** dropdown. View the [Supported Registry Providers](#supported-registry-providers). ![Figure 3: Choose a Provider](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/container-registries/choose-provider-db.jpg) 4. Under **Registry type**, you get the following options: * **Private Registry**: Choose this if your artifacts are hosted or should be hosted on a private registry restricted to authenticated users of that registry. Selecting this option requires you to enter your registry credentials (username and password/token). * **Public Registry**: Unlike private registry, this doesn't require your registry credentials. Only the registry URL and repository name(s) would suffice. 5. Assuming your registry type is private, here are few of the common fields you can expect: | Fields | Description | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name** | Provide a name to your registry | | **Registry URL** | Provide the URL of your registry in case it doesn't come prefilled. Do not include `oci://`, `http://`, or `/https://` in the URL. | | **Authentication Type** | The credential input fields may differ depending on the registry provider, check [Registry Providers](#supported-registry-providers) | | **Use as chart repository** | Tick this checkbox if you want Devtron to [pull helm charts from your registry and display them on chart store](#use-as-chart-repository). Also, you will have to provide a list of repositories (present within your registry) for Devtron to successfully pull the helm charts. | 6. Click **Save**. ### Use as Chart Repository {% hint style="info" %} #### Prerequisite OCI registry with `Use as chart repository` option enabled. {% endhint %} Unlike Helm repos, OCI registries do not have an index file to discover all the charts. If you have helm charts pushed to your OCI registry, you can use that registry as a chart repository. Upon enabling this option, Devtron can use your OCI registry as the chart source and pull the helm charts to display them on your [Chart Store](/user-guide/chart-store) for easy deployment. #### Tutorial {% embed url="" %} #### Steps Search your OCI registry in the list and click it. In the **List of repositories** field, add your chart repo(s). The format should be `username/chartname`. You can [find the username](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/use-cases/oci-pull/find-username.jpg) from your registry provider account. ![Figure 3: Adding Chart Repos](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/container-registries/registry-config-db.jpg) *** ## Supported Registry Providers ### ECR Amazon ECR is an AWS-managed container image registry service. The ECR provides resource-based permissions to the private repositories using AWS Identity and Access Management (IAM). ECR allows both Key-based and Role-based authentications. Before you begin, create an [IAM user](https://docs.aws.amazon.com/AmazonECR/latest/userguide/get-set-up-for-amazon-ecr.html) and attach the ECR policy according to the authentication type. Provide the following additional information apart from the common fields: | Fields | Description | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Registry URL** | Example of URL format: `xxxxxxxxxxxx.dkr.ecr..amazonaws.com` where `xxxxxxxxxxxx` is your 12-digit AWS account ID | | **Authentication Type** |

Select one of the authentication types:

  • EC2 IAM Role: Authenticate with workernode IAM role and attach the ECR policy (AmazonEC2ContainerRegistryFullAccess) to the cluster worker nodes IAM role of your Kubernetes cluster.

  • User Auth: It is a key-based authentication, attach the ECR policy (AmazonEC2ContainerRegistryFullAccess) to the IAM user.

    • Access key ID: Your AWS access key
    • Secret access key: Your AWS secret access key ID
| ### Docker Provide the following additional information apart from the common fields: | Fields | Description | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Username** | Provide the username of the Docker Hub account you used for creating your registry. | | **Password/Token** | Provide the password/[Token](https://docs.docker.com/docker-hub/access-tokens/) corresponding to your docker hub account. It is recommended to use `Token` for security purpose. | ### Azure For Azure, the service principal authentication method can be used to authenticate with username and password. Visit this [link](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal) to get the username and password for this registry. Provide the following additional information apart from the common fields: | Fields | Description | | ----------------------------- | ----------------------------------------------------- | | **Registry URL/Login Server** | Example of URL format: `xxx.azurecr.io` | | **Username/Registry Name** | Provide the username of your Azure container registry | | **Password** | Provide the password of your Azure container registry | ### Artifact Registry (GCP) JSON key file authentication method can be used to authenticate with username and service account JSON file. Visit this [link](https://cloud.google.com/artifact-registry/docs/docker/authentication#json-key) to get the username and service account JSON file for this registry. {% hint style="warning" %} Remove all the white spaces from JSON key and wrap it in a single quote before pasting it in `Service Account JSON File` field {% endhint %} Provide the following additional information apart from the common fields: | Fields | Description | | ----------------------------- | -------------------------------------------------- | | **Registry URL** | Example of URL format: `region-docker.pkg.dev` | | **Service Account JSON File** | Paste the content of the service account JSON file | ### Quay Provide the following additional information apart from the common fields: | Fields | Description | | ------------ | ----------------------------------------- | | **Username** | Provide the username of your Quay account | | **Token** | Provide the password of your Quay account | ### Other Provide below information if you select the registry type as `Other`. | Fields | Description | | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Registry URL** | Enter the URL of your private registry | | **Username** | Provide the username of your account where you have created your registry | | **Password/Token** | Provide the password or token corresponding to the username of your registry | | **Advanced Registry URL Connection Options** |
  • Allow Only Secure Connection: Tick this option for the registry to allow only secure connections
  • Allow Secure Connection With CA Certificate: Tick this option for the registry to allow secure connection by providing a private CA certificate (ca.crt)
  • Allow Insecure Connection: Tick this option to make an insecure communication with the registry (for e.g., when SSL certificate is expired)
| {% hint style="info" %} You can use any registry which can be authenticated using `docker login -u -p `. However these registries might provide a more secured way for authentication, which we will support later. {% endhint %} # Chart Repositories You can add more chart repositories to Devtron. Once added, they will be available in the `All Charts` section of the [Chart Store](/user-guide/chart-store). **Note**: After the successful installation of Devtron, click `Refetch Charts` to sync and download all the default charts listed on the dashboard. ## Add Chart Repository 1. From the left sidebar, go to **Global Configurations** → **Chart Repositories**. ![Figure 1: Chart Repositories](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/chart-repo-db.jpg) 2. Click **Add repository**. ![Figure 2: Add Chart Repository](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/add-chartrepo-db.jpg) 3. You can connect public and private chart repositories on Devtron. ![Figure 3: Select Repo Type](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/repo-type-db.jpg) 4. Provide the following information in each field: | Fields | Description | | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name** | Provide a `Name` for your chart repository. This name is used as a prefix for the chart names listed in the Helm chart section of your application. | | **URL** | Enter the URL of your chart repository. For example: `https://charts.bitnami.com/bitnami` | | **Username** | For private repositories, provide the username required for access. | | **Password** | Enter the password associated with the username. | 5. Check this box '**Allow Insecure Connection**' if you want to allow insecure connections, such as HTTP connections, which may not verify SSL certificates. ## Update Chart Repository You can also update your saved chart repository settings. 1. Click the chart repository which you want to update. 2. Modify the required changes and click `Update` to save you changes. **Note**: * You can perform a dry run to validate the below chart repo configurations by clicking `Validate`. * You can enable or disable your chart repository. If you enable it, then you will be able to see the enabled chart in `All Charts` section of the [Chart Store](/user-guide/chart-store). # Manage Authorization (RBAC) The **Authorization** section describes how to authenticate and authorize access to resources, also managing role-based access levels in Devtron. Access can be granted to a user via: * [SSO Login Services](/operator-guide/authorization/sso-login-services) * [User Permissions](/operator-guide/authorization/user-permissions) * [Permission Groups](/operator-guide/authorization/permission-groups) * [API Tokens](/operator-guide/authorization/api-tokens) # SSO Login Services Once Devtron is installed, it has a built-in `admin` user with super-admin privileges having unrestricted access to all Devtron resources. We recommended to use this user only for initial and global configurations and then switch to local users or configure SSO-login. Only users with [super-admin](/operator-guide/authorization/user-permissions#role-based-access-levels) privileges can configure the SSO. Devtron uses [Dex](https://dexidp.io/docs/connectors/google/) for authenticating a user against the identity provider. Below are the SSO providers which are available in Devtron. Select one of the SSO providers (e.g., GitHub) to configure SSO: * [Google](/operator-guide/authorization/sso-login-services/google) * [GitHub](/operator-guide/authorization/sso-login-services/github) * [GitLab](/operator-guide/authorization/sso-login-services/gitlab) * [Microsoft](/operator-guide/authorization/sso-login-services/microsoft) * [LDAP](/operator-guide/authorization/sso-login-services/ldap) * [OpenID Connect](/operator-guide/authorization/sso-login-services/oidc) * [OpenShift](/operator-guide/authorization/sso-login-services/openshift) Dex implements connectors that target specific `identity providers` for each connector configuration. You must have a created account for the corresponding identity provider and registered an app for client key and secret. Refer the following documents for more detail. * * *** ## Create SSO Configuration Make sure that you have a [super admin access](/operator-guide/authorization/user-permissions#assign-super-admin-permission). * From the left sidebar, go to **Global Configurations** → **Authorization** → **SSO Login Services** * Click any `SSO Provider` of your choice. * In the `URL` field, enter the valid Devtron application `URL` where it is hosted. * For providing `redirectURI` or `callbackURI` registered with the SSO provider, you can either select `Configuration` or `Sample Script`. * Provide the `client ID` and `client Secret` of your SSO provider (e.g. If you select `Google` as SSO provider, then you must enter `$GOOGLE_CLIENT_ID` and `$GOOGLE_CLIENT_SECRET` in the `client ID` and `client Secret` respectively.) * Select `Save` to create and activate SSO Login Service. **Note**: * Only single SSO login configuration can be active at one time. Whenever you create or update any SSO configuration, it will be activated and used by Devtron and previous configurations will be deleted. * Except for the domain substring, URL and redirectURI remains same. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/sso-login-db.jpg) ## Update SSO Configuration You can change SSO configuration anytime by updating the configuration and click `Update`. **Note**: In case of configuration change, all users will be logged out of Devtron and will have to login again. ## Configuration Payload * `type` : Any platform name such as (Google, GitLab, GitHub etc.) * `name` : Identity provider platform name * `id` : Identity provider platform which is a unique ID in string. (Refer to [dexidp.io](https://dexidp.io/) * `config` : User can put connector details for this key. Platforms may not have same structure but common configurations are `clientID`, `clientSecret`, `redirectURI`. * `hostedDomains` : Domains authorized for SSO login (e.g. *gmail.com*, *devtron.ai*) *** ## Next Steps After configuring an SSO for authentication, you must [add users](/operator-guide/authorization/user-permissions#add-user) in Devtron for them to be able to log in via SSO. In case you have enabled auto-assign permissions in [Microsoft](/operator-guide/authorization/sso-login-services/microsoft) or [LDAP](/operator-guide/authorization/sso-login-services/ldap), relevant [permission groups](/operator-guide/authorization/permission-groups#add-group) must also exist in Devtron for a successful login. # Google ## Sample Configuration ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/google.jpg) *** ## Values You Would Require at SSO Provider Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider. ### Values to Fetch * clientID * clientSecret ![Fetching Client ID and Secret](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/google-id-secret.jpg) ### Values to Provide * redirectURI (provided in SSO Login Services by Devtron) ![Copying Redirect URI from Devtron](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/google-redurl.jpg) ![Pasting Redirect URI](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/google-redirect.jpg) *** ## Reference * [View Google Documentation](https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid) * [View Dex IdP Documentation](https://dexidp.io/docs/connectors/google/) # GitHub ## Sample Configuration ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/github.jpg) *** ## Values You Would Require at SSO Provider Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider. ### Values to Fetch * clientID * clientSecret ![Fetching Client ID and Secret](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/github-id-secret.jpg) ### Values to Provide * redirectURI (provided in SSO Login Services by Devtron) ![Copying Redirect URI from Devtron](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/github-redurl.jpg) ![Pasting Redirect URI](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/github-redirect.jpg) *** ## Reference * [View GitHub Documentation](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app) * [View Dex IdP Documentation](https://dexidp.io/docs/connectors/github/) # GitLab ## Sample Configuration ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/gitlab.jpg) *** ## Values You Would Require at SSO Provider Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider. ### Values to Fetch * clientID * clientSecret ![Fetching Client ID and Secret](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/gitlab-id-secret.jpg) ### Values to Provide * redirectURI (provided in SSO Login Services by Devtron) ![Copying Redirect URI from Devtron](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/gitlab-redurl.jpg) ![Pasting Redirect URI](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/gitlab-redirect-v2.jpg) *** ## Reference * [View GitLab Documentation](https://docs.gitlab.com/ee/integration/oauth_provider.html) * [View Dex IdP Documentation](https://dexidp.io/docs/connectors/gitlab/) # Microsoft ## Sample Configuration ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/microsoft.jpg) *** ## Values You Would Require at SSO Provider Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider. ### Values to Fetch * clientID * tenantID (required only if you want to use Azure AD for auto-assigning permissions) ![Fetching Client ID and Tenant ID](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/ms-id-secret1.jpg) * clientSecret ![Fetching Secret](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/ms-id-secret2.jpg) ### Values to Provide * redirectURI (provided in SSO Login Services by Devtron) ![Copying Redirect URI from Devtron](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/microsoft-redurl.jpg) ![Pasting Redirect URI](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/ms-redirect.jpg) *** ## Reference * [View Microsoft Documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) * [View Dex IdP Documentation](https://dexidp.io/docs/connectors/microsoft/) *** ## Auto-assign Permissions [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) {% hint style="info" %} Make sure to add tenantID in the SSO configuration field without fail. {% endhint %} Since Microsoft supports [Active Directory (AD)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview) , this feature further simplifies the onboarding process of organizations having a large headcount of users. It also eliminates repetitive permission assignment by automatically mapping your Azure AD groups to Devtron's [Permission Groups](/operator-guide/authorization/permission-groups) during single sign-on (SSO) login. ![Enabling Permission Auto-assignment](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/auto-grant.jpg) If you've defined groups in your Active Directory, you can create corresponding permission groups in Devtron with the same names. When members of those Active Directory groups first log in to Devtron, they'll automatically inherit the permissions from their Devtron permission group. This means you can't manually adjust or add [individual permissions for users](/operator-guide/authorization/user-permissions) mapped to a permission group. {% hint style="warning" %} SSO login requires exact matching between Devtron permission group names and AD groups. Any discrepancies or missing groups will prevent successful login. Once you save the configuration with this feature enabled, existing user permissions will be cleared and the future permissions will be managed through [permission groups](/operator-guide/authorization/permission-groups) linked to Azure Active Directory (Microsoft Entra ID) groups. {% endhint %} {% hint style="info" %} If your AD permissions aren't reflecting in Devtron, a quick sign-out and sign-in can resolve the issue. {% endhint %} # LDAP ## Sample Configuration ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/ldap.jpg) *** ## Values to fetch from LDAP Devtron provides a sample configuration out of the box. Here are some values you need to fetch from your LDAP. * bindDN * bindPW * baseDN *** ## Reference [What is LDAP](https://www.okta.com/identity-101/what-is-ldap/) *** ## Auto-assign Permissions [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) Since LDAP supports creation of User Groups, this feature simplifies the onboarding process of organizations having a large headcount of users. It also eliminates repetitive permission assignment by automatically mapping your LDAP User groups to Devtron's [Permission Groups](/operator-guide/authorization/permission-groups) during single sign-on (SSO) login. ![Enabling Permission Auto-assignment](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/auto-grant-ldap.jpg) If you've created user groups in LDAP, you can create corresponding permission groups in Devtron with the same names. When members of those user groups first log in to Devtron, they'll automatically inherit the permissions from their Devtron permission group. This means you can't manually adjust or add [individual permissions for users](/operator-guide/authorization/user-permissions) mapped to a permission group. {% hint style="warning" %} SSO login requires exact matching between Devtron permission group names and LDAP user groups. Any discrepancies or missing groups will prevent successful login. Once you save the configuration with this auto-assign feature enabled, existing user permissions will be cleared and the future permissions will be managed through [Permission Groups](/operator-guide/authorization/permission-groups) linked to LDAP user groups. {% endhint %} {% hint style="info" %} If you're missing some permissions that you know you should have, try logging out and signing back in to Devtron. This will refresh your permissions based on your latest LDAP user group. {% endhint %} # OIDC ## Sample Configuration ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/oidc.jpg) *** ## Values You Would Require at SSO Provider Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider. ### Values to Fetch * clientID * clientSecret ![Fetching Client ID and Secret](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/oidc-id-secret.jpg) ### Values to Provide * redirectURI (provided in SSO Login Services by Devtron) ![Copying Redirect URI from Devtron](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/oidc-redurl.jpg) ![Pasting Redirect URI](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/oidc-redirect.jpg) *** ## Reference * [View Okta Documentation](https://developer.okta.com/docs/guides/find-your-app-credentials/main/) * [Configure Keycloak SSO](/operator-guide/authorization/sso-login-services/oidc/keycloak) * [Configure Okta SSO](/operator-guide/authorization/sso-login-services/oidc/okta) * [View Dex IdP Documentation](https://dexidp.io/docs/connectors/oidc/) # Keycloak ## Prerequisites * Install and [configure Keycloak](https://www.keycloak.org/guides#getting-started) on your server or cloud environment. * Create a new [realm in Keycloak](https://www.keycloak.org/getting-started/getting-started-kube#_create_a_realm) for your application. *** ## Steps on Keycloak Admin Console ### Creating a Client Here, we will add Devtron as a client for using Keycloak SSO. 1. In the Admin Console, go to **Clients** and click **Create client**. ![Figure 1: Creating Client on Keycloak](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/create-client.gif) 2. Within **General Settings**: * Enter `devtron` in the **Client ID** field. We will use this ID while configuring SSO later in Devtron. * Enter `Devtron` in the **Name** field. ![Figure 2: Client ID and Name](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/client-id.jpg) 3. Within **Capability config**, turn on **Client Authentication**. ![Figure 3: Enabling Client Authentication Toggle](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/enable-client-auth.gif) 4. Within **Login settings**, enter `https:///orchestrator/api/dex/callback` in the following fields. * **Valid redirect URIs** * **Valid post logout redirect URIs** * **Web origins** [Click here](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/base-url.jpg) to know where to find `DEVTRON_BASE_URL`. ![Figure 4: Entering Callback/Redirect URIs](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/redirect-url.gif) 5. Click **Save**. ### Getting Client Secret Here, we will obtain the secret we need while configuring SSO in Devtron. 1. Go to the **Credentials** tab of the client you created. ![Figure 5: Obtaining Client Secret](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/client-secret.gif) 2. Use the copy button next to the **Client Secret** field and paste it somewhere for future reference. ### Creating Users Here, we will create a user that can log in to Devtron via SSO. We will assign a username and password that the user can enter while logging in to Devtron via Keycloak SSO. 1. In the Admin Console, go to **Users** and click **Add user**. 2. Give a username (e.g., *usertest*) in the **Username** field and enter the user's email address (e.g., **) in the **Email** field. ![Figure 6: Creating User Data](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/create-user.gif) 3. Click **Create**. Your user creation will be successful. 4. Go to the **Credentials** tab of the user you created. ![Figure 7: Adding User Password](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/set-user-password.gif) 5. Click **Set password**. 6. Enter the password and confirm it. 7. Click **Save**. ### Retrieving Issuer URL Here, we will obtain the Issuer URL we need while configuring SSO in Devtron. 1. In the Admin Console, go to **Realm settings**. 2. In the **General** tab, scroll down to the **Endpoints** field, and click the **OpenID Endpoint Configuration** link. ![Figure 8: OpenID Endpoint Configuration Link](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/endpoint-config.gif) 3. This will open a new page, copy the value of the key named `issuer`, and paste it somewhere for future reference. ![Figure 9: Locating Issuer URL](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/issuer-url.jpg) *** ## Steps on Devtron ### Configuring OIDC SSO {% hint style="warning" %} #### Who Can Perform This Action? Users need to have super-admin permission to configure SSO. {% endhint %} Here, we will set up an OIDC SSO and enter the values we obtained in the [previous section](#steps-on-keycloak-admin-console). 1. Go to **Global Configurations** → **SSO Login Services** → **OIDC**. ![Figure 10: Choosing OIDC SSO](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/oidc.jpg) 2. Below the URL field, take the help of the **Click to use** option to populate the exact URL if the displayed one is incorrect. ![Figure 11: Populating Correct Orchestrator URL](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/click-to-use.jpg) 3. In the **Configuration** editor, do the following: * In the `issuer` field, paste the URL you got while [retrieving issuer URL](#retrieving-issuer-url). * In the `clientID` field, paste the ID you entered while [creating the client](#creating-a-client). * In the `clientSecret` field, paste the secret you got under [client credentials tab](#getting-client-secret). * In the `redirectURI` field, make sure to enter the same redirect URI you gave in step 4 of [client creation](#creating-a-client). ![Figure 12: Sample Keycloak SSO Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/keycloak-sso-config.jpg) 4. Click **Save** or **Update** to activate Keycloak SSO login. ### Adding Users {% hint style="warning" %} #### Who Can Perform This Action? Users need to have super-admin permission to add users. {% endhint %} Here, we will add the user we created in the Keycloak Admin Console. If this step is skipped, the user might not be able to log in to Devtron via Keycloak. 1. Go to **Global Configurations** → **Authorization** → **User Permissions**. 2. Click **+ Add Users**. ![Figure 13: Adding Users to Devtron](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/add-user.jpg) 3. In the **Email addresses** field, enter the email address of the user you created in Keycloak. ![Figure 14: Entering User Data and Permissions](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/add-email.jpg) 4. Assign necessary permissions to this new user. Refer [user permissions](/operator-guide/authorization/user-permissions) to know more. 5. Click **Save**. Now, you may log out and test the Keycloak OIDC login method using the [user credentials](#creating-users). Clicking the **Login with Oidc** button will land you on Keycloak's login page. ![Figure 15a: Login using OIDC method](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/login-oidc.jpg) ![Figure 15b: Keycloak's Login Page](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/keycloak/keycloak-login.jpg) {% hint style="warning" %} #### Note Kindly get in touch with us if you encounter any issues while logging out of Keycloak on Devtron as it might be buggy. {% endhint %} # Okta ## Prerequisites A verified account on [Okta](https://www.okta.com/). Okta activates your account only if email verification is successful. Here's a reference guide to set up your Okta org and application: [Link](https://developer.okta.com/docs/guides/oie-embedded-common-org-setup/go/main/) ## Tutorial {% embed url="" %} ## Steps on Okta Admin Console Once your Okta org is set up, create an app integration on Okta to get a Client ID and Client Secret. 1. In the Admin Console, go to **Applications** → **Applications**. 2. Click **Create App Integration**. 3. Select **OIDC - OpenID Connect** as the **Sign-in method**. {% hint style="info" %} OIDC stands for OpenID Connect. [Click here](https://www.okta.com/openid-connect/) to read more. {% endhint %} 4. Select **Web** as the application type and click **Next**. 5. On the **App Integration** page: * Give a name to your application. * Select the **Interaction Code** and **Refresh Token** checkbox. * Now go to Devtron's Global Configurations → SSO Login Services → OIDC. * Copy the redirect URI given in the helper text (might look like: ). * Return to the Okta screen, and remove the prefilled value in **Sign-in redirect URIs**. * Paste the copied URI in **Sign-in redirect URIs**. * Click **Save**. 6. On the **General** tab: * Note the **Client ID** value. * Click the **Edit** option. * In Client Authentication, choose **Client Secret**. * Click **Save**. * Click **Generate new secret**. * Note the **Client Secret** value. ## Steps on Devtron 1. Go to the Global Configurations → SSO Login Services → OIDC. 2. In the **URL** field, enter the Devtron application URL (a valid https link) where it is hosted. 3. Under `Configuration` tab, locate the config object, and provide the `clientID` and `clientSecret` of the app integration you created on Okta. 4. Add a key `insecureSkipEmailVerified: true`. Note that this key is only required for Okta SSO. For other types of OIDC SSO, refer [OIDC supported configurations](https://dexidp.io/docs/connectors/oidc/). 5. Provide `issuer` value as `https://${yourOktaDomain}`. Replace `${yourOktaDomain}` with your domain on Okta as shown in the video. 6. For providing `redirectURI` or `callbackURI` registered with the SSO provider, you can either select `Configuration` or `Sample Script`. Note that the redirect URI is already given in the helper text (as seen in the previous section). 7. Click **Save** to create and activate Okta SSO login. Now your users will be able to log in to Devtron using the Okta authentication method. Note that existing signed-in users will be logged out and they have to log in again using their OIDC account. ## Sample Configuration ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/sample-config-okta.jpg) # OpenShift ## Sample Configuration ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/openshift.jpg) *** ## Values You Would Require at SSO Provider Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider. ### Values to Fetch * clientID ![Fetching Client ID](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/openshift-id-secret1.jpg) * clientSecret ![Fetching Secret](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/secret/openshift-id-secret2.jpg) ### Values to Provide * redirectURI (already provided in SSO Login Services by Devtron) ![Copying Redirect URI from Devtron](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/openshift-redurl.jpg) ![Pasting Redirect URI](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/sso-login-service/redirect/openshift-redirect.jpg) *** ## Reference * [View Openshift Documentation](https://docs.openshift.com/container-platform/4.14/authentication/configuring-oauth-clients.html) * [View Dex IdP Documentation](https://dexidp.io/docs/connectors/openshift/) # User Permissions ## Add User To add a user, go to the `Authorization > User Permissions` section of `Global Configurations`. Click **Add user**. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/add-user-db.jpg) There are two types of permissions in Devtron: | Permission Type | Description | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Specific permissions** |

Selecting Specific permission option allows you to manage access and provide the role-based access accordingly for:

  • Helm Apps
  • Kubernetes Resources
| | **Super admin permission** | Selecting [Super admin permission](#assign-super-admin-permission) option will get full access to Devtron resources and the rest of the options will not be available. | ### Assign Super admin permission To assign a super admin access, go to the `Authorization > User Permissions` section of `Global Configurations`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/superadmin-permission-db.jpg) * Click **Add user**. * Provide the email address of a user. You can add more than one email address. Please note that email address must be same as that in the `email` field in the JWT token returned by OIDC provider. * Select `Super admin permission` and click `Save`. * A user now will have a [Super admin](#role-based-access-levels) access. **Note**: * Only users with `Super admin permission` can assign super admin permissions to a user. * We suggest that super admin access must be given to the selected users only. ### Assign Specific permissions To assign a specific permission, go to the `Authorization > User Permissions` section of `Global Configurations`. * Click **Add user**. * Provide the email address of a user. You can add more than one email address. Please note that email address must be same as that in the `email` field in the JWT token returned by OIDC provider. * Select `Specific permissions`. * Select the group permission from the drop-down list, if required. * Selecting `Specific permission` option allows you to manage access and provide the [role-based access](#role-based-access-levels) accordingly for * [Helm Apps](#helm-apps-permissions) * [Kubernetes Resources](#kubernetes-resources-permissions) #### Helm Apps Permissions In `Helm Apps` option, you can provide access to a user to manage permission for Helm apps deployed from Devtron or outside Devtron. Provide the information in the following fields: ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/helmapp-permissions-db.jpg) | Registry Type | Credentials | | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Project** |

Select a project from the drop-down list to which you want to give permission to the user. You can select only one project at a time.
Note: If you want to select more than one project, then click Add row.

| | **Environment or cluster/namespace** |

Select the specific environment or all existing environments in default cluster from the drop-down list.
Note: If you select all existing + future environments in default cluster option, then a user gets access to all the current environments including any new environment which gets associated with the application later.

| | **Application** |

Select the specific application or all applications from the drop-down list corresponding to your selected Environments.
Note: If All applications option is selected, then a user gets access to all the current applications including any new application which gets associated with the project later
.

| | **Role** |

Select one of the roles to which you want to give permission to the user:

  • View only
  • View & Edit
  • Admin
| You can add multiple rows for Helm app permission. Once you have finished assigning the appropriate permissions for the users, Click `Save`. #### Kubernetes Resources Permissions In `Kubernetes Resources` option, you can provide permission to view, inspect, manage, and delete resources in your clusters from [Resource Browser](/user-guide/resource-browser) page in Devtron. You can also create resources from the Resource Browser. **Note**: Only super admin users will be able to see `Kubernetes Resources` tab and provide permission to other users to access `Resource Browser`. To provide Kubernetes resource permission, click `Add permission`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/resource-permissions1.jpg) On the `Kubernetes resource permission`, provide the information in the following fields: ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/resource-permissions2.jpg) | Registry Type | Credentials | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Cluster** |

Select a cluster from the drop-down list to which you want to give permission to the user. You can select only one cluster at a time.
Note: To add another cluster, then click Add another.

| | **Namespace** | Select the namespace from the drop-down list. | | **API Group** | Select the specific API group or `All API groups` from the drop-down list corresponding to the K8s resource. | | **Kind** | Select the kind or `All kind` from the drop-down list corresponding to the K8s resource. | | **Resource name** | Select the resource name or `All resources` from the drop-down list to which you want to give permission to the user. | | **Role** |

Select one of the roles to which you want to give permission to the user and click Done:

  • View
  • Admin
| **Role-based Access Levels** Devtron supports the following levels of access: 1. **View only**: User with `View only` access has the least privilege. This user can only view the combination of environments and helm charts whose access is granted to that user. This user cannot view sensitive data like secrets used in the charts. 2. **View and Edit**: User with `View and Edit` access can view as well as edit the helm charts whose access is granted to that user. 3. **Admin**: User with `Admin` access can create, edit, delete, and view permitted Helm apps in the permitted projects. | User Roles | View | Deploy | Edit | Delete | | :-----------: | :--: | :----: | :--: | :----: | | View Only | Yes | No | No | No | | View and Edit | Yes | Yes | Yes | No | | Admin | Yes | Yes | Yes | Yes | You can add multiple rows for Kubernetes resource permission. Once you have finished assigning the appropriate permissions for the users, Click `Save`. *** ## Edit User Permissions {% hint style="warning" %} Direct user permissions cannot be edited if you're using [LDAP](/operator-guide/authorization/sso-login-services/ldap)/[Microsoft](/operator-guide/authorization/sso-login-services/microsoft) for SSO and 'auto-assign permission' is enabled. Permissions can only be [managed via permission groups](/operator-guide/authorization/permission-groups#edit-permissions-groups) in such a scenario. {% endhint %} You can edit the user permissions by clicking the edit icon. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/edit-user-db.jpg) Edit the user permissions. After you have done editing the user permissions, click `Save`. If you want to delete the user/users with particular permissions, click `Delete`. # Permission Groups Using the `Permission groups`, you can assign a user to a particular group and a user inherits all the permissions granted to the group. The advantage of the `Permission groups` is to define a set of privileges like create, edit, or delete for the given set of resources that can be shared among the users within the group. {% hint style="info" %} The [User permissions](/operator-guide/authorization/user-permissions) section for `Specific permissions` contains a drop-down list of all existing groups for which a user has an access. This is an optional field and more than one groups can be selected for a user. {% endhint %} *** ## Add Group Go to **Global Configurations** → **Authorization** → **Permissions groups** → **Add group**. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/permission-group/add-group-db.jpg) Enter the `Group Name` and `Description`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/permission-group/create-group-db.jpg) You can either grant [super-admin](/operator-guide/authorization/user-permissions#role-based-access-levels) permission to a user group or specific permissions to manage access for: * [Helm Apps](#helm-apps-permissions) * [Kubernetes Resources](#kubernetes-resources-permissions) ### Helm Apps Permissions In `Helm Apps` option, you can provide access to a group to manage permission for Helm apps deployed from Devtron or outside Devtron. Provide the information in the following fields: ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/permission-group/group-helmapp-permdb.jpg) | Dropdown | Description | | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Project** |

Select a project from the drop-down list to which you want to give permission to the group. You can select only one project at a time.
Note: If you want to select more than one project, then click Add row.

| | **Environment or cluster/namespace** |

Select the specific environment or all existing environments in default cluster from the drop-down list.
Note: If you select all existing + future environments in default cluster option, then a user gets access to all the current environments including any new environment which gets associated with the application later.

| | **Application** |

Select the specific application or all applications from the drop-down list corresponding to your selected Environments.
Note: If All applications option is selected, then a user gets access to all the current applications including any new application which gets associated with the project later
.

| | **Role** |

Select one of the roles to which you want to give permission to the user:

  • View only
  • View & Edit
  • Admin
| You can add multiple rows for Devtron app permission. Once you have finished assigning the appropriate permissions for the groups, Click **Save**. ### Kubernetes Resources Permissions In `Kubernetes Resources` option, you can provide permission to view, inspect, manage, and delete resources in your clusters from [Resource Browser](/user-guide/resource-browser) in Devtron. You can also create resources from Resource Browser. {% hint style="info" %} Only super admin users will be able to see `Kubernetes Resources` tab and provide permission to other users to access `Resource Browser`. {% endhint %} To provide Kubernetes resource permission, click `Add permission`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/permission-group/group-resource-permdb1.jpg) On the `Kubernetes resource permission`, provide the information in the following fields: ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/user-access/user-permission/group-resource-permdb2.jpg) | Dropdown | Description | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Cluster** |

Select a cluster from the drop-down list to which you want to give permission to the user. You can select only one cluster at a time.
Note: To add another cluster, then click Add another.

| | **Namespace** | Select the namespace from the drop-down list. | | **API Group** | Select the specific API group or `All API groups` from the drop-down list corresponding to the K8s resource. | | **Kind** | Select the kind or `All kind` from the drop-down list corresponding to the K8s resource. | | **Resource name** | Select the resource name or `All resources` from the drop-down list to which you want to give permission to the user. | | **Role** |

Select one of the roles to which you want to give permission to the user and click Done:

  • View
  • Admin
| You can add multiple rows for Kubernetes resource permission. Once you have finished assigning the appropriate permissions for the groups, Click **Save**. *** ## Edit Permissions Group You can edit the permission groups by clicking the `downward arrow.` ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/permission-group/edit-group-db.jpg) Edit the permission group. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/permission-group/edit-perm-group.jpg) Once you are done editing the permission group, click **Save**. *** ## Delete Permissions Group If you want to delete a particular permission group, click the delete icon. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/permission-group/delete-group-db.jpg) # API Tokens API tokens are the access tokens for authentication. Instead of using username and password, it can be used for programmatic access to API. It allows users to generate API tokens with the desired access. Only super admin users can generate API tokens and see the generated tokens. ## Generate API Token To generate API tokens, go to `Global Configurations -> Authorization -> API tokens` and click `Generate New Token`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/api-token-generate.jpg) * Enter a name for the token. * Add Description. * Select an expiration date for the token (7 days, 30 days, 60 days, 90 days, custom and no expiration). ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/expiration-db.jpg) * To select a custom expiration date, select `Custom` from the drop-down list. In the adjacent field, you can select your custom expiration date for the API token. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/api-token-custom.jpg) * You can assign permission to the token either with: * **Super admin permission**: To generate a token with super admin permission, select `Super admin permission`. * **Specific permissions**: Selecting `Specific permissions` option allows you to generate a token with a specific role for: * `Devtron Apps` * `Helm Apps` * `Kubernetes Resources` * `Chart Groups` ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/specific-permissions-db.jpg) * Click `Generate Token`. A pop-up window will appear on the screen from where you can copy the API token. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/generated-token.jpg) ## Use API Token Once Devtron API token has been generated, you can use this token to request Devtron APIs using any API testing tool like Jmeter, Postman, Citrus. Using Postman here as an example. Open Postman. Enter the request URL with `POST` method and under HEADERS, enter the API token as shown in the image below. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/api-token-6.jpg) In the `Body` section, provide the API payload as shown below and click `Send`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/api-token-7.jpg) As soon as you click `Send`, the created application API will be triggered and a new Devtron app will be created as provided in the payload. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/api-token-8.jpg) ## Update API Token To set a new expiration date or to make changes in permissions assigned to the token, we need to update the API token in Devtron. To update the API token, click the token name or click on the edit icon. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/edit-token-db.jpg) To set a new expiration date, you can regenerate the API token. Any scripts or applications using this token must be updated. To regenerate a token, click `Regenerate token`. A pop-up window will appear on the screen from where you can select a new expiration date. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/regenerate-token-db.jpg) Select a new expiration date and click `Regenerate token`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/regenerated-token.jpg) This will generate a new token with a new expiration date. To update API token permissions, give the permissions as you want to and click `Update Token`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/update-token-db.jpg) ## Delete API Token To delete an API token, click `delete` icon. Any applications or scripts using this token will no longer be able to access the Devtron API. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/api-token/delete-token-db.jpg) # External Links External Links allow you to connect to the third-party applications within your Devtron dashboard for seamlessly monitoring/debugging/logging/analyzing your applications. You can select from the pre-defined third-party applications such as `Grafana` to link to your application for quick access. Configured external links will be available on the `App details` page. You can also integrate `Document` or `Folder` using **External Links**. Some of the third-party applications which are pre-defined on `Devtron` Dashboard are: * Grafana * Kibana * Newrelic * Coralogix * Datadog * Loki * Cloudwatch * Swagger * Jira etc. *** ## Use Case for Monitoring Tool To monitor/debug an application using a specific Monitoring Tool (such as Grafana, Kibana, etc.), you may need to navigate to the tool's page, then to the respective app/resource page. `External Links` can take you directly to the tool's page, which includes the context of the application, environment, pod, and container. *** ## Prerequisites Before you begin, configure an application in the Devtron dashboard. * Super admin access * Monitoring tool URL **Note**: External links can only be added/managed by a super admin, but non-super admin users can access the configured external links on the `App Configuration` page of Helm App. *** ## Add an External Link 1. On the Devtron dashboard, go to the `Global Configurations` from the left navigation pane. 2. Select `External links`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/external-link-db.jpg) 3. Select **Add Link**. 4. On the `Add Link` page, select the external link (e.g. Grafana) which you want to link to your application from Webpage. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/empty-link-fields.jpg) ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/add-link-db.jpg) The following fields are provided on the **Add Link** page: | Field | Description | | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Link name | Provide name of the link. | | Description | Description of the link name. | | Show link in |
  • All apps in specific clusters: Select this option to select the cluster.
  • Specific applications: Select this option to select the application.
| | Clusters |

Choose the clusters for which you want to configure the selected external link with.

  • Select one or more than one cluster to enable the link on the specified clusters.
  • Select All Clusters to enable the link on all the clusters.
| | Applications |

Choose the application for which you want to configure the selected external link with.

  • Select one or more than one application to enable the link on the specified application.
  • Select All applications to enable the link on all the applications.
| | URL Template |

The configured URL Template is used by apps deployed on the selected clusters/applications. By combining one or more of the env variables, a URL with the structure shown below can be created:



If you include the variables {podName} and {containerName} in the URL template, then the configured links (e.g. Grafana) will be visible only on the pod level and container level respectively.

The env variables:

  • {appName}
  • {appId}
  • {envId}
  • {namespace}
  • {podName}: If used, the link will only be visible at the pod level on the App details page.
  • {containerName}: If used, the link will only be visible at the container level on the App details page.

Note: The env variables will be dynamically replaced by the values that you used to configure the link.

| > Note: To add multiple links, select **+ Add another** at the top-left corner. Click **Save**. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/created-link-db.jpg) *** ## Access an external link The users (admin and others) can access the configured external link on the App Details page. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/displayed-link-db.jpg) *** ## Manage External links On the `External Links` page, the configured external links can be filtered/searched, as well as edited/deleted. Select `Global Configurations > External links`. ![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/manage-external-links-db.jpg) * Filter and search the links based on the link's name or a user-defined name. * Edit a link by selecting the edit icon next to an external link. * Delete an external link by selecting the delete icon next to a link. The bookmarked link will be removed in the clusters for which it was configured. # Catalog Framework ## Introduction [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) Ideally, all resources such as microservices, clusters, jobs, pods, etc. should contain detailed information so that its users know what each of those resources do, how to use them, as well as all their technical specs. Access to such data makes it easier for engineers to quickly discover and understand the relevant resources. To achieve this, Devtron supports a feature known as **Catalog Framework**. Using this, you as a [super-admin](/operator-guide/authorization/user-permissions#role-based-access-levels) can decide the data you expect from the managers of different resource types. In other words, you can create a custom [JSON schema](https://json-schema.org/understanding-json-schema/reference) that would ultimately render a form for the resource owners to fill. Once the form is filled, a GUI output will appear as shown below. ![Sample Catalog Data for a Cluster](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/rb-overview-db.jpg) ![Sample Catalog Data for a Helm App](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/helm-app-cframework.jpg) Currently, **Modern Kubernetes Dashboard** supports catalog framework for the following resource types (a.k.a. resource kind): * [Helm applications](/resources/glossary#helm-apps) * [Clusters](/resources/glossary#cluster) There are two parts involved in the creation of a desirable resource catalog: 1. [Defining a Schema](#defining-a-schema) 2. [Filling the Schema-Generated Form](#filling-the-schema-generated-form) *** ## Defining a Schema {% hint style="warning" %} #### Who Can Perform This Action? Only a super-admin can create/edit a schema. {% endhint %} 1. Go to **Global Configurations** → **Catalog Framework**. 2. Choose a resource type, for which you wish to define a schema, for e.g., Helm applications. ![Figure 1: Choosing a Schema](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/catalog-framework/catalog-framework.jpg) 3. You can edit the schema name and description. 4. There is a sample schema available for you to create your own customized schema. Using this schema, you can decide the input types that renders within the form, for e.g., a dropdown of enum values, a boolean toggle button, text field, label, and many more. ![Figure 2a: Using Sample Schema](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/catalog-framework/schema.jpg) ![Figure 2b: Expected Future Output](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/catalog-framework/rendering.jpg) 5. After defining your schema, click **Review Changes**. 6. You get a side-by-side comparison (diff) highlighting the changes you made. ![Figure 3: Change Diff](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/catalog-framework/changed-schema.jpg) 7. Click **Save**. Similarly, you can define schemas for other resource types. **Note**: If you edit a field (of an existing schema) for which users have already filled the data, that data will be erased. You will receive a prompt (as shown below) to confirm whether you want to proceed with the changes. ![Figure 4: Indication of Existing Data](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/catalog-framework/existing-filled-data.jpg) *** ## Filling the Schema-Generated Form Once a catalog schema exists for a resource type, its corresponding form would be available in the overview section of that resource type. 1. Since we defined a schema for Helm applications in the above example, go to the **Overview** tab of your application (any Helm application). Click the **Edit** button within the `About` section. ![Figure 5: Unfilled Details](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/app-overview-db.jpg) 2. The schema created for Helm applications would render into an empty form as shown below. ![Figure 6: Rendered Empty Form](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/edit-catalog-db.jpg) 3. Fill as many details as an application owner to the best of your knowledge and click **Save**. ![Figure 7: Filled Form](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/filled-catalog-db.jpg) 4. Your saved data would be visible in a GUI format (and also in JSON format) as shown below. ![Figure 8: App Catalog Data](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/helm-app-cframework.jpg) This catalog data would be visible to all the users who have access to the application, but its data can be edited only by the resource owners (in this case, application admin/managers). # Charts and Chart Store ## Introduction Devtron makes it easier for you to populate your charts from multiple sources to the [chart store](/resources/glossary#chart-store). These sources are: * [Chart Repository](/operator-guide/chart-repo) * [OCI Registry](/operator-guide/oci-registry#use-as-chart-repository) ![Figure 1: Chart Store](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/charts-store-page.jpg) ### Prerequisites * Helm Chart(s) * Chart Repository added to Devtron * OCI-Compliant Registry (e.g. Docker Hub and [many more](/operator-guide/oci-registry#supported-registry-providers)) ## Removing your Charts from the Chart Store {% hint style="warning" %} #### Who Can Perform This Action? You cannot remove a chart from the Chart Store if the source was a [chart repository](/operator-guide/chart-repo). Removal is possible only if the charts [come from OCI registry](/operator-guide/oci-registry#push-helm-packages). {% endhint %} 1. Go to your OCI registry settings in Devtron. 2. In the **List of repositories** field, remove the unwanted chart repo. ![Figure 6: Removing a Chart Repo](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/dashboard/remove-chart-repo.gif) 3. Click **Update**. The removed chart will no longer appear in the Chart Store. {% hint style="info" %} Deleting a chart repo from your OCI registry will not lead to the removal of chart from the Chart Store {% endhint %} A light alternative is to disable the chart source as shown below, but this doesn't imply the removal of a chart. ![Figure 7: Disabling a Chart Source](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/deploy-chart/overview-of-charts/disable-chart-source-db.jpg) # Show/Hide Argo CD App Listing ## Prerequisite The cluster in which Argo CD apps exist should be added in **Global Configurations** → **Clusters and Environments** *** ## Steps {% hint style="warning" %} #### Who Can Perform This Action? Users need super-admin permission to view/enable/disable the ArgoCD listing. {% endhint %} {% embed url="" %} 1. Go to the **Resource Browser** of Devtron. 2. Select the cluster (in which your Argo CD app exists). 3. Type `ConfigMap` in the 'Jump to Kind' field. 4. Search for `dashboard-cm` using the available search bar and click it. 5. Click **Edit Live Manifest**. 6. Set the feature flag accordingly: * **`ENABLE_EXTERNAL_ARGO_CD: "true"`** - Use this to show the Argo CD App Listing * **`ENABLE_EXTERNAL_ARGO_CD: "false"`** - Use this to hide the Argo CD App Listing 7. Click **Apply Changes**. 8. Go back to the 'Jump to Kind' field and type `Pod`. 9. Search for `dashboard` pod and use the kebab menu (3 vertical dots) to delete the pod. 10. Go to **Applications** and refresh the page (the **ArgoCD Apps** tab will be visible if you enabled it in step 6). # Show/Hide Flux CD App Listing ## Prerequisite The cluster in which Flux CD apps exist should be added in **Global Configurations** → **Clusters and Environments** *** ## Steps to Enable {% hint style="warning" %} #### Who Can Perform This Action? Users need super-admin permission to view/enable/disable the FluxCD listing. {% endhint %} 1. Go to the **Resource Browser** of Devtron. 2. Select the cluster (in which your Argo CD app exists). 3. Type `ConfigMap` in the 'Jump to Kind' field. 4. Search for `dashboard-cm` using the available search bar and click it. 5. Click **Edit Live Manifest**. 6. Set the feature flag accordingly: * **`FEATURE_EXTERNAL_FLUX_CD_ENABLE: "true"`** - Use this to show the Flux CD App Listing * **`FEATURE_EXTERNAL_FLUX_CD_ENABLE: "false"`** - Use this to hide the Flux CD App Listing ![Figure 2: Editing Dashboard ConfigMap](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/creating-application/fluxcd/flux-feature-flag.jpg) 7. Click **Apply Changes**. 8. Go back to the 'Jump to Kind' field and type `Pod`. 9. Search for `dashboard` pod and use the kebab menu (3 vertical dots) to delete the pod. 10. Go to **Applications** and refresh the page (the **FluxCD Apps** tab will be visible if you enabled it in step 6). # Configure GUI Schema for Manifests ## Introduction [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) In Devtron, you can create [CRDs](/resources/glossary#crd) for defining the GUI schema. Your GUI schema will be used to determine the fields displayed to the user when they [edit the manifest in GUI mode](/user-guide/resource-browser/manage-resources#edit-using-gui). ## Editing GUI Schema 1. Go to **Resource Browser** and select your cluster. 2. Use the searchbox labelled 'Jump to Kind' and search for `Guischema`. ![Figure 1: Searching GUI Schema](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/search-gui-schema.gif) 3. Click the GUI schema you wish to edit. In case no GUI schema exists, you may [create a GUI schema](#create-your-own-gui-schema) for your resource kind. ![Figure 2: Click GUI Schema](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/click-schema.gif) 4. Click **Edit Live Manifest** to modify the YAML. ![Figure 3: Edit Live Manifest](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/edit-live-manifest.gif) 5. Locate the `schema` object and customize it according to your requirements. ![Figure 4: Modifying Schema](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/locate-schema.gif) 6. Click **Apply Changes**. *** ## Create your own GUI Schema 1. Go to **Resource Browser** and select your cluster. 2. Click **Create Resource** at the top. 3. Use the following template and define your schema in the `schema` object, also specify the resource kinds in `applyTo`. Once done, click **Apply**. 
apiVersion: crd.devtron.ai/alpha1
   kind: GuiSchema
   metadata:
   creationTimestamp: 2024-11-08T13:01:00Z
   generation: 1
   name: devtron-pod-gui
   resourceVersion: "216257"
   uid: 70e91158-288e-4c4a-8448-012e820148ca
   spec:
   applyTo:
       - group: ""
       kind: Pod
       version: v1
   schema: |
       {
       "title": "Pod Configuration",
       "description": "A form to create a Kubernetes pod manifest",
       "type": "object",
       "required": [
           "metadata",
           "spec"
       ],
       "properties": {
           "metadata": {
           "type": "object",
           "properties": {
               "name": {
               "type": "string",
               "title": "Pod Name",
               "default": "my-pod",
               "pattern": "^[a-z0-9][a-z0-9-]*[a-z0-9]$",
               "description": "Lower case letters, numbers, and hyphens only"
               }
           }
           },
           "spec": {
           "type": "object",
           "required": [
               "containers"
           ],
           "properties": {
               "containers": {
               "type": "array",
               "minItems": 1,
               "items": {
                   "type": "object",
                   "required": [
                   "name",
                   "image"
                   ],
                   "properties": {
                   "name": {
                       "type": "string",
                       "title": "Container Name",
                       "default": "container-1",
                       "pattern": "^[a-z0-9][a-z0-9-]*[a-z0-9]$",
                       "description": "Lower case letters, numbers, and hyphens only"
                   },
                   "image": {
                       "type": "string",
                       "title": "Container Image",
                       "description": "Docker image name with optional tag (e.g., nginx:1.14.2)"
                   },
                   "ports": {
                       "type": "array",
                       "title": "Container Ports",
                       "items": {
                       "type": "object",
                       "required": [
                           "containerPort"
                       ],
                       "properties": {
                           "containerPort": {
                           "type": "integer",
                           "title": "Port Number",
                           "minimum": 1,
                           "maximum": 65535
                           }
                       }
                       }
                   }
                   }
               }
               }
           }
           }
       }
       }
# Configure Lock Schema for Manifests ## Introduction [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) In Devtron, you can create [CRDs](/resources/glossary#crd) for defining lock schema. Your lock schema will be used to determine the fields (in the resource manifest) that cannot be added/updated/deleted by non-superadmins. This is especially useful for preventing unwanted edits to the manifests of pod, deployment, configmap, and many more. ## Editing Lock Schema 1. Go to **Resource Browser** and select your cluster. 2. Use the searchbox labelled 'Jump to Kind' and search for `LockSchema`. ![Figure 1: Searching Lock Schema](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/search-lock-schema.gif) 3. Click the Lock Schema you wish to edit. In case no Lock Schema exists, you may [create a Lock Schema](#create-your-own-lock-schema) for your resource kind. ![Figure 2: Click Lock Schema](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/click-lock-schema.gif) 4. Click **Edit Live Manifest** to modify the YAML. ![Figure 3: Edit Live Manifest](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/edit-live-manifest-lock.gif) 5. Locate the `lockedPaths` list and specify the fields/paths you wish to lock from unwanted edits by non-superadmins in the manifest. ![Figure 4: Modifying Schema](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/kubernetes-resource-browser/locate-lockedpaths.jpg) 6. Click **Apply Changes**. *** ## Create your own Lock Schema 1. Go to **Resource Browser** and select your cluster. 2. Click **Create Resource** at the top. 3. Use the following template and specify the fields/paths you wish to lock in the `lockedPaths` list, also specify the resource kinds in `applyTo`. Once done, click **Apply**. 
apiVersion: crd.devtron.ai/alpha1
   kind: LockSchema
   name: devtron-cm-lock-schema
   spec:
   applyTo:
       - group: ""
       kind: ConfigMap
       version: v1
   lockedPaths:
       - data.ENABLE_CI_JOB
# Glossary ### Artifacts An immutable blob of data generated as an output after the execution of a job, build, or deployment process, e.g., container image, helm chart. In Devtron, you can view the artifacts in the `Build History` and `Deployment History` of your application. Whereas, job artifacts are visible in the `Run history` of your job. * Once a build is complete, you can view the build artifacts by going to Applications (choose your app) → Build History (tab) → (choose a pipeline and date of triggering the build) → Artifacts (tab). * Once a deployment is complete, you can view the deployment artifacts by going to Applications (choose your app) → Deployment History (tab) → (choose an environment and date of deployment) → Artifacts (tab). * Once a job is complete, you can view the job artifacts by going to Jobs → Run history (tab) → (choose a pipeline and date of triggering the build) → Artifacts (tab). ### ArgoCD Apps ArgoCD Apps are the micro-services deployed using a [GitOps](#gitops) deployment tool named [Argo CD](https://argo-cd.readthedocs.io/en/stable/). If ArgoCD applications are present in your cluster, they will appear in the [ArgoCD Apps listing](/operator-guide/enable-argocd-listing). ### Base Deployment Template A deployment template is a manifest of the application defining its runtime behavior. You can select one of the default deployment charts or custom deployment charts created by super-admin. It’s a single entry point for you to enter the values, so that when the application is deployed your filled values go to the respective template files (YAML), and accordingly the resources would be created. In Devtron, you get the option to select a base deployment template in the `App Configuration` tab at the time of creating an application. ### Build Context For building a docker image we require a [Dockerfile](#dockerfile) and a build context. The Dockerfile contains the instructions to build. Context is the path where the build process may refer for getting the files required for build. To build files from the root, use (.) as the build context. Or to refer a subdirectory, enter the path in the format `/myfolder` or `/myfolder/mysubfolder`. If the path is not set, the default path will be the root directory of selected git repository. Go to Applications (choose your app) → App Configuration (tab) → Build Configuration → (choose 'I have a Dockerfile') → Set Build Context. ### Build Pipeline A series of automated steps that transform source code into a deployable container image. In Devtron, you can create a build pipeline by going to Applications (choose your app) → App Configuration (tab) → Workflow Editor → New Workflow. ### Chart Store A place where all Helm charts are centrally listed for users to deploy applications on Kubernetes. In Devtron, the chart store is available in the left sidebar. You can view, configure, and deploy the existing charts or add new chart repositories too. ### Cluster A cluster in Kubernetes refers to a set of connected computers (nodes) that collectively manage containerized applications using Kubernetes. It provides resources and services to run, manage, and scale applications. In Devtron, you can view the list of clusters in 'Global Configurations' as well as 'Resource Browser'. ### Commit Hash A unique identifier representing a specific version of source code in a Git [repository](#repo). In Devtron, you can view the commit hash of the top 15 commits you pushed to your branch while selecting the git material under the `Build & Deploy` tab of your application. ### ConfigMaps Kubernetes objects used to store configuration data as key-value pairs. They allow separation of configuration from application code, making it easier to manage and update settings. You can use different ConfigMaps for respective environments too. ### Container/OCI Registry It is a collection of repositories that store container images. It allows developers to store, share, and manage images used to deploy containers. In Devtron, you can add a container registry by going to Global Configurations → Container / OCI Registry. Your CI images are pushed to the container registry you configure. . An OCI-compliant registry can also store artifacts (such as helm charts). Here, OCI stands for Open Container Initiative. It is an open industry standard for container formats and registries. ### Cordoning Temporarily marking a node as unschedulable, preventing new pods from being assigned to it. In Devtron, you can cordon a node by going to Resource Browser → (choose a cluster) → Nodes → (click on a node) → Cordon (available in blue). ### CronJob CronJob is used to create Jobs on a repeating schedule. It is commonly used for running periodic tasks with no manual intervention. In Devtron, you can view a list of cronjobs by going to Resource Browser → (choose a cluster) → Workloads → CronJob. ### CRD A Custom Resource Definition (CRD) allows you to add custom resource types to Kubernetes, extending its capabilities to support configurations specific to your application. In Devtron, CRDs enable you to manage these custom resources alongside standard Kubernetes resources, making it easier to handle specialized application requirements within the platform. ### Deployment Charts Devtron offers a variety of ready-made Helm charts for common tasks and functions. If you have a specific need that isn't met by these preconfigured charts, super-admins have the permission to upload their own charts. Once uploaded, these charts become accessible for use by all users on the Devtron platform. ### DaemonSet A Kubernetes object that ensures a specific pod runs on all or certain nodes within a cluster, often used for tasks such as logging or monitoring. In Devtron, you can view a list of DaemonSets by going to Resource Browser → (choose a cluster) → Workloads → DaemonSet. ### Deployment Strategy A defined approach for deploying updates or changes to applications. Devtron supports rolling updates, blue-green deployments, canary releases, and recreate strategy. In Devtron, you can choose a deployment strategy by going to Applications (choose your app) → App Configuration (tab) → Workflow Editor → (edit deployment pipeline) → Deployment Strategy. ### Devtron Agent Your Kubernetes cluster gets mapped with Devtron when you save the cluster configurations. Now, the Devtron agent (rollout controller) must be installed from the chart store on the added cluster so that you can deploy your applications on that cluster. ### Devtron Apps Devtron Apps are the micro-services deployed using Kubernetes-native CI/CD with Devtron. To create one, go to Applications → Create (button) → Custom App. ### Dockerfile A script that defines how to build a Docker [container image](#image). It includes instructions to assemble the image's base, dependencies, and application code. It's recommended that you include a Dockerfile with your source code. However, in case you don't have a Dockerfile, Devtron helps you create one. Go to Applications (choose your app) → App Configuration (tab) → Build Configuration. ### Draining Evacuating pods from a node before cordoning it, ensuring that running pods are gracefully rescheduled on other nodes. In Devtron, you can drain a node by going to Resource Browser → (choose a cluster) → Nodes → (click on a node) → Drain (available in blue). ### Environment You can deploy your application to one or more environments (e.g., development, testing, production). In Devtron, Environment = [Cluster](#cluster) + [Namespace](#namespace). For a given application, you cannot have multiple CD pipelines for an environment. For e.g., if an application named 'test-app' is deployed on an environment named 'test-environment', you cannot create another deployment (CD) pipeline for the same app and environment. Your application can have different deployment configurations for respective environments. For e.g., the number of [ReplicaSet](#replicaset) could be 2 for staging environment, whereas it could be 5 for production. Similarly, the CPU and memory resources can be different for each environment. This is possible through Environment Overrides. ### External Links You can add external links related to the application. For e.g., you can add Prometheus, Grafana, and many more to your application by going to Global Configurations → External Links. ### FluxCD Apps FluxCD Apps are the micro-services deployed using a [GitOps](#gitops) deployment tool named [Flux CD](https://fluxcd.io/). If FluxCD applications are present in your cluster, they will appear in the [FluxCD Apps listing](/operator-guide/enable-fluxcd-listing). ### GitOps A methodology for managing and automating Kubernetes deployments using Git repositories as the source of truth. Changes to the desired state of the cluster are driven by Git commits. ### Helm Apps Apps deployed using Helm Chart from the `Chart Store` section of Devtron. In Devtron, you can view such apps under a tab named `Helm Apps` in the Applications section. To create one, go to Applications → Create (button) → From Chart store. ### Helm Charts/Packages Packages that contain pre-configured Kubernetes resources and configurations. Helm charts are used to define, install, and upgrade applications on Kubernetes clusters. Refer [chart store](#chart-store) to know more. ### Image A packaged and standalone software that contains the code and dependencies needed to run a containerized application. Using Devtron, you can build a container image of your application, push it to a container registry, and deploy it on your Kubernetes cluster. Since images are platform-agnostic, you don't have to worry about compiling your application to work on different systems. With Devtron, you can enable automatic image builds and vulnerability scanning whenever you make edits to your source code. You can also view the list of image builds while preparing your deployment in the `Build & Deploy` tab of your application (provided the CI stage is successful). ### Job In Devtron, there is a job that is very similar to Kubernetes job. A Kubernetes job is an object used to create one or more pods to complete a specific task or job and then terminate. If you are a super-admin in Devtron, you can view Jobs in the sidebar. ### Load Balancer Distributes incoming network traffic across multiple instances or nodes to ensure efficient resource utilization and improved performance. In Kubernetes, Load Balancer is a service type. Behind the scenes, the managed Kubernetes service connects to the load balancer service of the respective cloud service provider and creates a load balancer, mapping it to the Kubernetes service. GKE and AKS provide the public IP of the Load Balancer as the service endpoint, while in the case of EKS, it provides a non-customizable DNS name. ### Manifest A manifest is a YAML file that describes each component or resource of your Kubernetes object and the state you want your cluster to be in once applied. A manifest specifies the desired state of an object that Kubernetes will maintain when you apply the manifest. In Devtron, you can view the manifest of K8s resources under `App Details` and also under `Resource Browser`. ### Material In Git Repo, the source code of your application in a given commit is referred as material. The option to choose a Git material will be available in the CI stage under the `Build & Deploy` tab of your application. ### Namespace A namespace is a way to organize and isolate resources within a Kubernetes cluster. It provides a logical separation between different applications or environments within a cluster. In Devtron, you can view a list of namespaces by going to Resource Browser → (choose a cluster) → Namespaces. ### Node Taint A setting applied to a node that influences the scheduling of pods. Taints can restrict which pods are allowed to run on the node. In Devtron, you can edit the taints of a node by going to Resource Browser → (choose a cluster) → Nodes → (click on a node) → Edit taints (available in blue). ### NodePort A Kubernetes service type that exposes a port on each node in the cluster, making a service accessible externally. ### Nodes The physical or virtual machines that make up a Kubernetes cluster, where containers are scheduled to run. In Devtron, you can view nodes by going to Resource Browser → (choose a cluster) → Nodes. ### Objects Kubernetes objects are the building blocks that define and manage your applications running on the platform. They are also known as 'Resources' or 'Kinds'. This includes nodes, pods, deployment, cronjob, configmap, and many more. Devtron's [Resource Browser](/user-guide/resource-browser) helps you manage all such objects present in your clusters. ### Pod The smallest deployable unit in Kubernetes, consisting of one or more containers that share storage and network resources within the same context. In Devtron, you can view a list of Pods by going to Resource Browser → (choose a cluster) → Workloads → Pod. In Devtron, you can create a pod by going to Resource Browser → Create Resource (button). ### Pre-build Actions or processes performed before the actual image-building process in a containerized application's deployment pipeline, e.g., Jira Issue Validator. In Devtron, you can configure pre-build actions by going to Applications (choose your app) → App Configuration (tab) → Workflow Editor → (edit build pipeline) → Pre-build stage (tab) → Add task (button). ### Post-build Actions or processes performed after the [image](#image) building process in a containerized application's deployment pipeline, e.g., email notification about build status. In Devtron, you can configure post-build actions by going to Applications (choose your app) → App Configuration (tab) → Workflow Editor → (edit build pipeline) → Post-build stage (tab) → Add task (button). ### Pre-deployment Steps, scripts, or configurations executed before deploying a new version of an application to a Kubernetes cluster. In Devtron, you can configure pre-deployment actions by going to Applications (choose your app) → App Configuration (tab) → Workflow Editor → (edit deployment pipeline) → Pre-deployment stage (tab) → Add task (button). ### Post-deployment Actions, checks, or processes carried out after a new version of an application is successfully deployed to a Kubernetes cluster, e.g., Jira Issue Updater. In Devtron, you can configure post-deployment actions by going to Applications (choose your app) → App Configuration (tab) → Workflow Editor → (edit deployment pipeline) → Post-deployment stage (tab) → Add task (button). ### ReplicaSet A Kubernetes object responsible for maintaining a specified number of replica pods, ensuring high availability and desired scaling. In Devtron, you can view the deployed ReplicaSet by going to Applications (choose your app) → App Details (tab) → K8s Resources (under Application Metrics section). ### Repo Abbreviation for "repository". It could either signify a Git repo, container repo, or helm repo. **Git repo** - A version control system (like Git) that stores and manages source code and other project assets. Once you create a git repo, you can add it in Applications (choose your app) → App Configuration (tab) → Git Repository → Add Git Repository. **Container repo** - A collection of [container images](#image), e.g., Docker repository. **Helm repo** - Also known as chart repo. You can add it in Global Configurations. ### Rollback The process of reverting a deployment to a previously known working version in case of errors or issues with the current version. In Devtron, you can rollback a deployment by going to Applications (choose your app) → Build & Deploy (tab) → (click the rollback icon in the deployment pipeline). ### Secrets Kubernetes objects used to store sensitive information, such as passwords and API keys. Secrets are encoded and can be mounted as files or environment variables in pods. In Devtron, you get the option to add secrets in the `App Configuration` tab of your application. You can use different secrets for respective environments too. ### Security Context A Kubernetes resource configuration that defines security settings and permissions for pods and containers. A security context defines privilege and access control settings for a pod or container. ### StatefulSet A Kubernetes object designed for managing stateful applications, maintaining stable network identities and storage across pod rescheduling. In Devtron, view the list of StatefulSets by going to Resource Browser → (choose a cluster) → Workloads → StatefulSet. ### Target Platform The operating system and architecture for which the [container image](#image) will be built, e.g., ubuntu/arm64, linux/amd64. The image will only be compatible to run only on the target platform chosen in the build configuration. In Devtron, you can choose the target platform by going to Applications (choose your app) → App Configuration (tab) → Build Configuration → (create build pipeline) → (click `Allow Override` button) → Target platform for the build (section). # FAQ