Helm charts for deploying the Synapse dataplane and its Kubernetes operator.
Requires Helm 3 and a conformant Kubernetes cluster. Published to
https://helm.gen0sec.com.
| Chart | Version | App | Purpose |
|---|---|---|---|
synapse-stack |
0.5.3 | 0.7.0 | Umbrella — two synapse workloads from one release, aliased proxy and agent |
synapse |
0.4.2 | 0.7.0 | Synapse reverse proxy / dataplane. Depends on valkey; optional clamav (clamavIntegration.enabled) |
synapse-operator |
1.4.2 | 0.1.8 | The Synapse Kubernetes operator (config-sync controller) |
synapse-stack deploys the dataplane twice from the same subchart, each alias getting its
own values tree and identity:
| Alias | Workload | Role | Condition |
|---|---|---|---|
proxy |
synapse-proxy |
TLS passthrough / L7 / Tier-2 terminate | proxy.enabled |
agent |
synapse-agent |
XDP transparent observe (edge only) | agent.enabled |
It does not include the operator — install synapse-operator separately if you want it.
helm repo add gen0sec https://helm.gen0sec.com
helm repo update
helm search repo gen0sec # list available charts + versionsA single dataplane:
helm install synapse gen0sec/synapse -n synapse --create-namespaceProxy and edge agent together, from the umbrella:
helm install synapse-stack gen0sec/synapse-stack -n synapse --create-namespaceBoth aliases default to enabled. Turn one off with --set agent.enabled=false, and set
per-alias values under the alias key — --set proxy.service.type=LoadBalancer, not
--set service.type=....
The operator (separate release):
helm install synapse-operator gen0sec/synapse-operator -n synapse-os --create-namespaceThe synapse-operator chart deploys the operator as a config-sync controller (its default mode, source):
- Watches ConfigMaps and Secrets matching a label selector (default
app.kubernetes.io/name=synapse). - Hashes their combined data and stamps the hash onto the Synapse workload under the
synapse.gen0sec.com/config-hashannotation. - A changed hash bumps the pod template, so Kubernetes rolls the pods to pick up new config — no manual restarts.
The chart wires these operator flags from values.yaml:
| Value | Operator flag | Default |
|---|---|---|
operator.leaderElect |
--leader-elect |
true |
operator.labelSelector |
--label-selector |
app.kubernetes.io/name in (synapse,synapse-proxy,synapse-agent) |
operator.configHashAnnotation |
--config-hash-annotation |
synapse.gen0sec.com/config-hash |
operator.ignoreConfigMapKeys |
--ignore-configmap-keys |
upstreams.yaml |
operator.ignoreSecretKeys |
--ignore-secret-keys |
(empty) |
The operator binary also supports an Ingress + Gateway API mode (
--ingress-mode); this chart does not enable it (config-sync mode only).
| Value | Chart | Notes |
|---|---|---|
service.type |
synapse | ClusterIP by default. Every Service port becomes a load balancer listener on LoadBalancer |
service.exposeHealth |
synapse | false. The health endpoint binds loopback in the container, so publishing its port routes nowhere — see below |
service.externalTrafficPolicy |
synapse | Unset (Kubernetes defaults to Cluster, which SNATs the client IP away). Set Local on a LoadBalancer/NodePort Service to preserve the real source address |
clamavIntegration.enabled |
synapse | Pulls in the clamav subchart for content scanning |
operator.image.repository / tag |
synapse-operator | ghcr.io/gen0sec/synapse-operator; an empty tag falls back to the chart's appVersion |
synapse.config is a block scalar — the literal config.yaml the container reads, rendered
into a ConfigMap. It is not a structured values tree, so its contents cannot be reached with
--set synapse.something. To change the platform endpoint or key, edit that block:
synapse:
config: |
platform:
api_key: ""
base_url: "https://api.gen0sec.com/v1"The chart does not template an API-key Secret. Supply the key through the config block, or
override it at runtime with the container's AX_-prefixed environment variables.
service.healthPort (8080) names a container port. The health endpoint listens on loopback
inside the container, so nothing answers on the Pod IP there — which is why the default probes,
pointing at that port, have to be repointed at httpPort in practice.
Publishing it on the Service is therefore off by default. Enabling it on a LoadBalancer
service is the case to avoid: the cloud controller creates a listener for it and opens the load
balancer's security group to 0.0.0.0/0, giving you an internet-facing port that accepts
nothing.
See each chart's values.yaml for the full set:
synapse ·
synapse-operator ·
synapse-stack
Charts are published to GitHub Pages (https://helm.gen0sec.com) by per-chart GitHub Actions workflows (chart-releaser, config in .cr.yaml). A workflow runs when its chart directory changes on main, or via manual workflow_dispatch:
| Workflow | Triggers on |
|---|---|
release-synapse.yaml |
charts/synapse/** |
release-synapse-operator.yaml |
charts/synapse-operator/** |
release-synapse-stack.yaml |
charts/synapse-stack/** |
To cut a release, bump the chart's version in its Chart.yaml and merge to main.
| Gen0Sec Docs | Product documentation and guides |
| synapse | The Synapse dataplane this chart deploys |
| synapse-operator | The operator source and full flag reference |
These charts are distributed under the Apache-2.0 license — see LICENSE.