MetalBear Helm Charts

Overview

This repository contains Helm charts for deploying mirrord components to Kubernetes:

• mirrord-operator: Manages concurrent usage of mirrord in multi-user environments.
• mirrord-license-server: Handles license management without external telemetry (Enterprise only).

NOTE: This repository is read-only. If you would like to suggest changes, please open an issue or a discussion. Feel free to join to our Slack for help and guidance.

---

mirrord Operator

The mirrord Operator is a Kubernetes component that facilitates the concurrent use of mirrord by multiple team members.

For full feature details, visit the mirrord pricing page.

---

mirrord License Server

The mirrord License Server enables on-prem license seat tracking without any data leaving your infrastructure. It aggregates metrics across clusters and provides centralized license visibility.

⚠️ Only available in the Enterprise plan.

---

Quick Start

Add the MetalBear Helm repository:

helm repo add metalbear https://metalbear-co.github.io/charts

Download the default values file:

curl https://raw.githubusercontent.com/metalbear-co/charts/main/mirrord-operator/values.yaml --output values.yaml

Edit values.yaml to include your license:

• Team license key: insert your key in the license field.
• Enterprise license .pem: paste your certificate content.

Configure TLS:

• Option A: Use your own cert (certManager.enabled: false) and provide tls.crt / tls.key.
• Option B: Enable certManager.enabled: true and install cert-manager.

Install the operator:

helm install -f values.yaml mirrord-operator metalbear/mirrord-operator

---

Advanced Configuration

Operator License

🧑‍💻 Team License

Set the license key directly:

license:
  key: "my-team-license-key"

Or use a Kubernetes secret:

license:
  keyRef: "license-server-key"

Or use Google Secret Manager:

license:
  keyGsmRef: "projects/PROJECT_ID/secrets/SECRET_NAME/versions/SECRET_VERSION"

license.key, license.keyRef, and license.keyGsmRef are mutually exclusive, but one of them can be combined with another supported license source such as license.file.data or license.pemRef.

🧑‍💼 Enterprise License

Paste the .pem certificate:

license:
  file:
    data:
      license.pem: |
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
        -----BEGIN PRIVATE KEY-----
        ...
        -----END PRIVATE KEY-----

Or reference a secret:

license:
  pemRef: "mirrord-operator-license-pem"

Or use Google Secret Manager:

license:
  pemGsmRef: "projects/PROJECT_ID/secrets/SECRET_NAME/versions/SECRET_VERSION"

license.file.data, license.pemRef, and license.pemGsmRef are mutually exclusive.

NOTE: When using the license server, you may need to configure the license certificate and keys differently. See the section below for more details.

---

Namespace & Role Configuration

Specify the namespace and control role-based access:

namespace: mirrord
createNamespace: true
roleNamespaces: []

Set user privileges using role and clusterRole labels:

role:
  mirrord-operator-user:
    labels:
      team: platform

clusterRole:
  mirrord-operator-user-basic:
    labels:
      team: basic
  mirrord-operator-user:
    labels:
      team: platform
  mirrord-operator-ci:
    labels:
      team: ci

Use roleNamespaces to limit users or groups to exact operator target names within a namespace:

roleNamespaces:
  my-namespace:
    deployment.api:
      - type: User
        subject: developer@example.com
      - type: Group
        subject: api-team@example.com

Target names do not support wildcards, and must use . as path separators. Add .container.<name> to further restrict access to one container. Restricted subjects must name their target explicitly and must also have Kubernetes get access to the workload.

NOTE: These roles do not grant session deletion.

To limit the operator's own permissions to some namespaces, set namespaced and list the namespaces in allowedNamespaces:

namespaced: true
allowedNamespaces:
  - team-a
  - team-b

The mirrord-operator ClusterRole then keeps only the rules for cluster-scoped resources. The chart puts the rules for namespaced resources in a mirrord-operator-namespaced Role and RoleBinding in each allowed namespace and in the operator namespace. The operator refuses sessions in other namespaces. This mode does not support multi-cluster.

Learn more about copy-target namespaces.

---

Operator Settings

Basic configuration:

operator:
  image: ghcr.io/metalbear-co/operator
  podAnnotations:
    prometheus.io/scrape: "true"
  ## Applied only to pods.
  podLabels:
    environment: staging
  ## Applied to ALL resources (Deployment, Service, etc).
  labels:
    team: platform
  limits:
    cpu: 200m
    memory: 200Mi
  metrics: true
  extraEnv:
    OPERATOR_METRICS_ADDR: "0.0.0.0:9000"
  disableTelemetries: false
  port: 443
  imagePullSecrets:
    - name: regcred
  jsonLog: false

---

Feature Toggles

👥 SQS Splitting

Enable SQS message routing for shared queues:

operator:
  sqsSplitting: true

More info: SQS Splitting Docs

🪶 Kafka Splitting

Enable topic-level session isolation for Kafka:

operator:
  kafkaSplitting: true
  idleKafkaSplitTtlMillis: 30000

Learn about:

• Kafka setup
• TTL behavior

☁️ GCP Pub/Sub Splitting

Enable subscription-level session isolation for Google Cloud Pub/Sub:

operator:
  gcpPubsubSplitting: true

Learn about:

• GCP Pub/Sub setup

📝 Copy Target

Control agent image usage:

operator:
  copyTarget:
    useAgentImage: true

---

mirrord-agent Configuration

Customize the mirrord-agent container:

agent:
  image: ghcr.io/metalbear-co/agent
  port: 7777
  tls: true
  extraConfig:
    agent:
      metrics: "0.0.0.0:9000"
      annotations:
        prometheus.io/scrape: "true"
      log_level: "mirrord=debug,warn"

Refer to the agent configuration docs for more details.

---

mirrord License Server chart

Chart source: mirrord-license-server

Configure this chart if you use a .pem license and want full control of your seat usage on-premise. See full instructions in the license server docs.

---

Contributing

The workflow for creating pull requests to this repository from forks doesn't work at the moment. When contributing, create a pull request from a fork, and one of our team members will manually ensure it goes through CI and is merged.

Team members contributing to this repository should create a branch instead of a fork.

---

Useful Links

• 🌐 mirrord Documentation
• 💰 mirrord Pricing