Repository navigation
Conversation
…gistry guides [DEP-371]
…mily and Gateway route details [DEP-371]
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…nders without a CRD check [DEP-371]
pmdroid
marked this pull request as ready for review
October 13, 2026 22:22
teallarson
reviewed
Oct 13, 2026
| - Your network policy requires Services to expose both an IPv4 and an IPv6 ClusterIP. | ||
|
|
||
| ## Values overlay | ||
|
|
Contributor
There was a problem hiding this comment.
this section jumps straight to the code snippet without giving any context. will users know what to do with this?
evantahler
approved these changes
Oct 13, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds three use-case guides under Self-host with Helm (Sterling's split from #1237), as child pages of
/operate/deploy/helm:/operate/deploy/helm/internal-networkinggateway.parentRefs, per-servicegateway.<service>.parentRefs) or private Ingress class;engine.ssrfAllowlist/authSsrfAllowlist/pluginSsrfAllowlist;coordinator.proxyHeaders.forwardedAllowIps/operate/deploy/helm/ipv6-dual-stackglobal.bindAddress,global.ipFamilyPolicy,global.ipFamilies, and which components and Services each covers; explicit list of what is still IPv4-only (Arcade Deploy default egress, external DNS nameservers, deployed-server Services). IPv6-only is not supported./operate/deploy/helm/container-registrysupportImages.*,dockerRegistry.*(and that bundled PostgreSQL/Redis get no pull Secret), Arcade Deploy runner image (deployments.image,deployments.registry.server,deployments.registry.imagePullSecrets)Each page has: when you need it, a values overlay, how to verify, common failures, and what you own vs what the chart handles. Every value name was checked against
deploy/charts/arcade/values.yamlon monorepo main.Follow-up: once this merges, #1237 replaces its IPv6/use-case TODO with links to these pages (it can't link earlier: the broken-link test rejects links to unmerged pages).
Review fixes
ipFamilyPolicyandipFamiliesapply to: Engine, coordinator, dashboard, Experience API, OpenFGA, worker and worker-peers. It also notes that bundled PostgreSQL, Redis and subcharts are not covered, and adds worker-peers to the list at line 33.Proof @ bc3bbc2
Note
Low Risk
Documentation-only changes with no runtime or application code; risk is limited to doc accuracy and navigation.
Overview
Adds three Self-host with Helm child guides and wires them into the docs site via
app/en/operate/deploy/helm/_meta.tsx.Internal networking documents private-only exposure (Gateway API
HTTPRoutes withgateway.parentRefs/ per-service overrides, or legacy private Ingress), SSRF allowlists (engine.ssrfAllowlist,authSsrfAllowlist,pluginSsrfAllowlist), coordinator forwarded-header trust, and troubleshooting—including AWSTargetGroupConfigurationbehavior on non-AWS clusters.IPv6 and dual-stack covers
global.bindAddress,global.ipFamilyPolicy, andglobal.ipFamilies, verification steps, and explicit IPv4-only gaps (especially Arcade Deploy egress, DNS, and deployed-server Services).Use a different container registry explains mirroring per-component image repos,
dockerRegistry/supportImages, bundled Postgres/Redis pull limitations, Arcade Deploy runner pull secrets in the workers namespace, air-gapped install steps, and commonImagePullBackOfffailures.public/llms.txtis regenerated with entries for the three new pages.Reviewed by Cursor Bugbot for commit bc3bbc2. Bugbot is set up for automated code reviews on this repo. Configure here.