Skip to content

enhance air-gapped settings section, introducing support for multiple CA certificates #231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danciaclara merged 6 commits into from
Mar 3, 2026
Merged

enhance air-gapped settings section, introducing support for multiple CA certificates #231

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
135e1ff
Update Kubernetes self-hosting documentation to enhance air-gapped se…
akshat5302 Mar 3, 2026
92cbed1
Update OpenSearch version in advanced search documentation to 2.19 fo…
akshat5302 Mar 3, 2026
943d164
Review fixes
danciaclara Mar 3, 2026
46dd33c
minor fixes
danciaclara Mar 3, 2026
67a85cc
minor fixes
danciaclara Mar 3, 2026
500f5b4
formatting fixes
danciaclara Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/self-hosting/govern/advanced-search.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ Plane uses OpenSearch to provide advanced search capabilities across your worksp

You'll need:

- An OpenSearch 2.x instance (self-hosted or managed service like AWS OpenSearch).
- An OpenSearch 2.19 instance (self-hosted or managed service like AWS OpenSearch).

## What you get with advanced search

Expand Down
2 changes: 1 addition & 1 deletion docs/self-hosting/govern/plane-ai.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ For an overview of what Plane AI can do, see the [Plane AI](https://docs.plane.s

You'll need:

- An OpenSearch 2.x instance (self-hosted or AWS OpenSearch) configured for [advanced search](/self-hosting/govern/advanced-search).
- An OpenSearch 2.19 instance (self-hosted or AWS OpenSearch) configured for [advanced search](/self-hosting/govern/advanced-search).
- At least one LLM provider API key or a custom OpenAI-compatible endpoint.
- At least one embedding model configured in OpenSearch.

Expand Down
7 changes: 5 additions & 2 deletions docs/self-hosting/methods/airgapped-edition-kubernetes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,8 +88,11 @@ Consider these alternatives:
airgapped:
enabled: true # Must be TRUE for airgapped installations
# If using custom root CA for S3 storage
s3SecretName: "s3-custom-ca"
s3SecretKey: "s3-custom-ca.crt"
s3Secrets:
- name: plane-s3-ca
key: s3-custom-ca.crt
- name: plane-s3-ca-2
key: s3-custom-ca-2.crt
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
```

**Service images:**
Expand Down
39 changes: 29 additions & 10 deletions docs/self-hosting/methods/kubernetes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,15 +31,15 @@ Ensure you use use the latest Helm chart version.
2. Set the following environment variables:

```bash
PLANE_VERSION=v2.3.1
PLANE_VERSION=v2.4.0
```

```bash
DOMAIN_NAME=<subdomain.domain.tld or domain.tld>
```

::: warning
When configuring the PLANE_VERSION environment variable, **do not** set it to `stable`. Always specify the latest version number (e.g., `2.3.1`). Using `stable` can lead to unexpected issues.
When configuring the PLANE_VERSION environment variable, **do not** set it to `stable`. Always specify the latest version number (e.g., `2.4.0`). Using `stable` can lead to unexpected issues.
Comment thread
coderabbitai[bot] marked this conversation as resolved.
:::

3. Add the Plane helm chart repo.
Expand Down Expand Up @@ -86,7 +86,7 @@ helm repo add plane https://helm.plane.so/
i. Run the script below to download the `values.yaml` file and edit using any editor like Vim or Nano.

Make sure you set the required environment variables listed below:
- `planeVersion: v2.3.1`
- `planeVersion: v2.4.0`
- `license.licenseDomain: <The domain you have specified to host Plane>`
- `license.licenseServer: https://prime.plane.so`
- `ingress.enabled: <true | false>`
Expand All @@ -113,16 +113,35 @@ helm repo add plane https://helm.plane.so/

| Setting | Default | Required | Description |
| --------------------- | :-----------------: | :------: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| planeVersion | v2.3.1 | Yes | Specifies the version of Plane to be deployed. Copy this from prime.plane.so. |
| planeVersion | v2.4.0 | Yes | Specifies the version of Plane to be deployed. Copy this from prime.plane.so. |
| license.licenseDomain | 'plane.example.com' | Yes | The fully-qualified domain name (FQDN) in the format `sudomain.domain.tld` or `domain.tld` that the license is bound to. It is also attached to your `ingress` host to access Plane. |

#### Airgapped settings
### Air-gapped Settings

| Setting | Default | Required | Description |
| ---------------------- | :-----: | :------: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. |
| airgapped.s3SecretName | "" | No | Name of the Secret that contains the CA certificate (.crt). The Secret must include a data key whose filename matches the basename of `airgapped.s3SecretKey` (default: `s3-custom-ca.crt`). Used to override S3’s CA when `airgapped.enabled=true`. Applying this secret looks like: `kubectl -n plane create secret generic plane-s3-ca \ --from-file=s3-custom-ca.crt=/path/to/your/ca.crt` |
| airgapped.s3SecretKey | "" | No | Key name of the secret to load the Custom Root CA from `airgapped.s3SecretName` |
| Setting | Default | Required | Description |
| ----------------------- | :-----: | :------: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. |
| airgapped.s3Secrets | [] | No | List of Kubernetes Secrets containing CA certificates to install. Each item must have `name` (Secret name) and `key` (file key in the Secret). Example: `kubectl -n plane create secret generic plane-s3-ca --from-file=s3-custom-ca.crt=/path/to/ca.crt`. Supports multiple certs (e.g. S3 + internal CA). |
| airgapped.s3SecretName | "" | No | **(Deprecated, backward compatibility)** Name of a single Kubernetes Secret containing the S3 CA cert. Used only when `s3Secrets` is empty. Prefer migrating to `s3Secrets`. |
| airgapped.s3SecretKey | "" | No | **(Deprecated, backward compatibility)** Key (filename) of the cert file inside the Secret. Used only when `s3Secrets` is empty. Set together with `airgapped.s3SecretName`. |

#### Backward compatibility: custom S3 CA (upgrading from older charts)

If you previously used the single-secret custom CA configuration (`airgapped.s3SecretName` and `airgapped.s3SecretKey`), it continues to work. No change is required when upgrading.

- **Old configuration (still supported):** Set `airgapped.s3SecretName` to your Secret name and `airgapped.s3SecretKey` to the key (e.g. `s3-custom-ca.crt`). The chart mounts that single cert, runs `update-ca-certificates`, and sets `AWS_CA_BUNDLE` to the system bundle path.
- **New configuration (recommended):** Use `airgapped.s3Secrets` with a list of `{ name, key }` entries. This allows multiple CA certificates (e.g. S3 endpoint CA and internal PKI) and matches the same runtime behavior.

**Migration (optional):** To move from the deprecated keys to `s3Secrets`, set for example:

```yaml
airgapped:
enabled: true
s3Secrets:
- name: plane-s3-ca # same as your previous s3SecretName
key: s3-custom-ca.crt # same as your previous s3SecretKey
# s3SecretName and s3SecretKey can be removed after migration
``` |
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated

#### Docker Registry

Expand Down
2 changes: 1 addition & 1 deletion docs/self-hosting/methods/podman-quadlets.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ Before we start, make sure you've got these covered:

```bash
mkdir podman-quadlets
curl -fsSL https://prime.plane.so/releases/v2.3.1/podman-quadlets.tar.gz -o podman-quadlets.tar.gz
curl -fsSL https://prime.plane.so/releases/v2.4.0/podman-quadlets.tar.gz -o podman-quadlets.tar.gz
tar -xvzf podman-quadlets.tar.gz -C podman-quadlets
```

Expand Down
Loading