Self-hosted
DERequest a demo →
Skip to documentation content
ClusterPilot Docs
Product tour Self-hosted
Start with:EvaluateInstallCreate a clusterOperateRecoverAutomate
Documentation/Administer
Administer

Configuration

Configure durable dependencies, replicas, secret protection, clock health, and feature gates without unsafe fallbacks.

AudiencePlatform administrators, release engineersReading time15 minCommands in contextNo terminal requiredReviewed source9552586 · 1 August 2026

Configuration sources

Use the release-owned example and chart values as the schema for the exact version you deploy. Separate non-secret settings from secret material and record the effective configuration revision in change evidence.

DataPreferred source
Non-secret application settingsVersion-controlled Helm values or managed environment configuration.
Database and object-store credentialsKubernetes Secret or protected host secret file/reference.
Secrets protection master keyExternal key escrow/secret manager delivered as a runtime secret.
Provider, registry, SSH, and cluster credentialsClusterPilot typed secret references, materialized only at the approved agent boundary.
Release identity and locksSigned release metadata and immutable digests.

Production-critical settings

SettingRequired posture
ConnectionStrings__ClusterPilotDurable PostgreSQL; no ephemeral local database.
Hosting__ApiReplicas / WorkerReplicasActual deployed counts.
ControlPlane__LeaderElection__Enabledtrue when either replica count exceeds one.
ArtifactStorage__ProviderExplicit filesystem or s3-compatible.
ArtifactStorage__FileSystem__Sharedtrue for multi-replica filesystem storage on a durable shared volume.
Secrets__Protection__MasterKeyBase64-encoded 32-byte key from a managed secret source.
Secrets__Protection__KeyIdManaged identifier; never local-dev.
Secrets__Protection__AllowInsecureDevelopmentFallbackfalse in Preprod and Production.

Clock health

Accurate UTC is required for signatures, sessions, leases, events, agent heartbeat, and evidence ordering. The default direct NTP mode can be replaced with a trusted local service for restricted networks.

Command
Clock__Health__ReferenceMode=trusted_local_service
Clock__Health__NtpServer=ntp.internal.example
Clock__Health__ServerWarningThresholdSeconds=5
Clock__Health__ServerDegradedThresholdSeconds=30
Clock__Health__AgentWarningThresholdSeconds=5
Clock__Health__AgentRejectionThresholdSeconds=30

Feature gates

Keep one reviewed register for every active capability. Record the owner, target environment, evidence, expiry, rollback and exact configuration revision.

CapabilityStatus
Control plane operationsAvailable
Hetzner and IONOS lifecycleAvailable
Kubernetes inventory and diagnosticsAvailable
Built-in and custom add-on installationAvailable
Independent Kubernetes validationAvailable for managed Ready clusters

Configuration change procedure

  1. 01

    Diff effective configuration

    Compare intended values with the active non-secret configuration and release compatibility manifest.

  2. 02

    Validate secrets and dependencies

    Resolve references and reachability without printing values.

  3. 03

    Run preflight

    Block on startup, replica, storage, migration, trust, and release-integrity failures.

  4. 04

    Apply through the deployment surface

    Use Helm or the release-owned Compose entrypoint; avoid live container edits.

  5. 05

    Verify and retain evidence

    Check health, readiness, clock, build identity, workers, agents, and one bounded read path.