Installation

Install celld-operator with Helm (recommended) or kustomize. The operator runs in its own namespace and watches WorkerApp resources cluster-wide.

Prerequisites

Kubernetes 1.30 or newer (the version this is developed and tested against; the chart sets no kubeVersion floor, so older clusters install without warning and are untested) and cluster-admin access to install CRDs.
A qualified object store. celld's ownership fencing requires atomically enforced conditional writes (If-None-Match: *, If-Match) and read-after-write consistency, and celld speaks only the S3 and Google Cloud Storage dialects. Qualified: Amazon S3, Cloudflare R2, Tigris, Google Cloud Storage. Not qualified: MinIO community edition, Backblaze B2, DigitalOcean Spaces, Hetzner. Stores with no S3-compatible API, Azure Blob Storage among them, cannot back a fleet at all. For anything else, run store qualification first: an unenforced condition silently splits cell ownership.

Each of these is optional. The first three report their absence as a status condition on every WorkerApp; the last two are silent, so their absence shows up as an Ingress that no controller acts on or a certificate that is never issued:

Integration	What it enables	Condition when absent
Gateway API CRDs + an implementation (Istio recommended)	Hostname ingress via HTTPRoutes on a shared Gateway. Install the experimental channel: the standard channel drops `HTTPRouteRule.retry`, so drain 503s reach clients during rollouts (reported as `RouteReconciledRetryDropped`)	`IngressReady`: hostnames are not routed
Istio (ambient mode recommended)	AuthorizationPolicies on the internal listener, mTLS for the peer network	`MeshPolicyReady`: NetworkPolicy alone guards `:8081`
KEDA + Prometheus (scraping the operator)	Custom-metrics autoscaling	`AutoscalingReady`: `spec.autoscaling` has no effect (KEDA's absence only; a missing Prometheus is not detected)
An ingress controller (ingress-nginx, Traefik, a cloud controller)	`--ingress-mode=ingress`: serving the Ingress objects the operator emits	None — the Ingress is created and simply not acted on
cert-manager	`--cluster-issuer`: per-app TLS certificates on emitted Ingresses	None — the annotation is written and no certificate is issued

Ambient mode specifically, not sidecars: celld makes outbound peer and bucket calls during termination, and a sidecar exiting first would break the cell handoff. Ambient encrypts the peer network without putting a proxy in celld's drain path.

Install with Helm

The chart is published to GHCR as an OCI artifact on every release:

$ helm install celld-operator oci://ghcr.io/ezgamehost/charts/celld-operator \
    --namespace celld-operator-system --create-namespace \
    --set operator.ingressMode=httproute   # or virtualservice / ingress / none

Nearly every operator flag is a Helm value: operator.ingressMode, operator.gatewayName, operator.istioGateways, operator.ingressClass, operator.clusterIssuer, operator.prometheusURL, operator.deployPollInterval, and friends. See the operator configuration reference for all of them. The chart's default image tag is its appVersion, pinned at package time to the operator build it was released with.

Install with kustomize

From a clone of the repository:

$ make install                        # CRDs only
$ make docker-build docker-push IMG=<registry>/celld-operator:tag
$ make deploy IMG=<registry>/celld-operator:tag

Run locally during development

The operator can run outside the cluster against your current kubeconfig:

$ make run

Verify the installation

$ kubectl get pods -n celld-operator-system
NAME                                                  READY   STATUS    RESTARTS
celld-operator-controller-manager-7d9c6bf9c9-x2m4p    1/1     Running   0

$ kubectl get crd workerapps.celld-operator.io
NAME                                  CREATED AT
workerapps.celld-operator.io     2026-08-14T00:00:00Z

With the operator running, continue to the quick start to deploy your first WorkerApp.

Upgrading the operator

Upgrade with helm upgrade using the new chart version. The operator version-pins its expectations of celld's alpha operator API, so keep the operator current as you track new celld releases. celld ships security fixes for its latest release only, and the compatibility table gates fleet upgrades across breaking boundaries.