Installation

The supported install method is the Helm chart, published as an OCI artifact (Cosign-signed):

helm install tekton-events-relay \
  oci://ghcr.io/fabioluciano/charts/tekton-events-relay \
  --namespace tekton-events-relay --create-namespace \
  -f values.yaml

The chart renders your config: values into the application ConfigMap, mounts the referenced Secrets at the conventional paths, and wires probes, ServiceMonitor, PodDisruptionBudget, HPA and NetworkPolicy. A values.schema.json validates your values at install time — typos fail helm install, not the pod.

A realistic values file

replicaCount: 1            # >1 requires config.store.backend valkey/olric — see Operations

config:
  dashboard_url: "https://tekton.company.example.com"

  scm:
    github:
      - name: github       # matched by the scm.provider annotation
        enabled: true
        auth:
          secretRef:
            name: github-token             # Secret with key "token"
        actions:
          - name: ci-status
            type: commit_status
            enabled: true
          - name: pr-summary
            type: pr_comment
            enabled: true
            mode: upsert
            when: 'isPipelineRun() && stateIn("success", "failure")'
            template: |
              ## Pipeline {{.State}}
              **Run:** {{.RunName}} · `{{ .CommitSHA | trunc 8 }}`

  notifiers:
    slack:
      - name: prod-alerts
        enabled: true
      secretRef:
        name: slack-webhook               # Secret with key "webhook_url"
        channel: "#prod-alerts"
        when: 'event.Namespace == "production" && stateIn("failure", "error")'

Secrets

You create plain Kubernetes Secrets; the chart mounts them read-only under /etc/secrets/<provider>/<instance>/ and points the app config at the files. Conventional keys:

Where	Values key	Secret key(s)
GitHub (token)	`auth.secretRef.name`	`token`
GitHub (App)	`auth.app_id`, `auth.installation_id`, `auth.private_key.secretRef.name`	`private-key.pem`
GitLab / Gitea (PAT)	`auth.secretRef.name`	`token`
GitLab / Gitea / Bitbucket (OAuth2)	`auth.oauth2.client_id.secretRef.name`, `auth.oauth2.client_secret.secretRef.name` + `token_url`	`client_id`, `client_secret`
Bitbucket Cloud	`auth.username.secretRef.name`, `auth.app_password.secretRef.name`	`username`, `app_password`
Bitbucket Server / Azure DevOps / SourceHut	`secretRef.name`	`token`
Slack / Teams / Discord	`webhook_url.secretRef.name` (or `bot_token.token.secretRef.name` for Slack/Discord bots)	`webhook_url` (or `token`)
PagerDuty	`integration_key.secretRef.name`	`integration_key`
Datadog	`api_key.secretRef.name`	`api_key`
Grafana / Sentry	`token.secretRef.name`	`token`
Webhook	`url.secretRef.name`	`url`
Receiver auth	`config.server.auth.secret_file`	(file path; mount it yourself or via env expansion)

A custom secretRef.key field is available where you need a non-default key name.

Connecting Tekton

Point the Tekton controller’s CloudEvents sink at the relay Service (config-defaults ConfigMap in tekton-pipelines):

data:
  default-cloud-events-sink: http://tekton-events-relay.tekton-events-relay.svc.cluster.local

Then annotate your PipelineRuns.

Embedded Valkey (optional)

When using config.store.valkey.embedded.enabled: true, the chart deploys a Valkey subchart. You must first add the Valkey Helm repo:

helm repo add valkey https://valkey.io/valkey-helm/
helm dependency build charts/tekton-events-relay

Without this step, helm install or helm template will fail with a missing dependency error.

Chart switches worth knowing

Values key	Default	Notes
`replicaCount`	`1`	⚠️ Set to `1` unless you configured a shared store.
`config.store.*`	`memory`	Valkey/Olric backends; Olric mode auto-creates the gossip headless Service + NetworkPolicy rules.
`config.dlq.enabled`	`false`	Mounts a writable emptyDir and enables the DLQ API.
`config.server.auth.*`	off	HMAC/bearer auth + optional timestamp replay protection.
`config.server.tls.*`	off	Native HTTPS (mount your cert via extra volumes).
`networkPolicy.enabled`	`true`	DNS + 443/80 egress; conditional Valkey/Olric rules. `networkPolicy.valkeyPort` if non-6379.
`autoscaling.*`	off	Only enable with a shared store.
`serviceMonitor` / probes / PDB	sensible defaults	Standard knobs.
`templates.enabled`	off	Ship large message templates as a separate ConfigMap. Reference them with `template.configmapRef.name` / `template.configmapRef.key`.

Verifying signatures

cosign verify \
  --certificate-identity-regexp='https://github.com/fabioluciano/tekton-events-relay' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/fabioluciano/tekton-events-relay:latest

(same command with oci://ghcr.io/fabioluciano/charts/tekton-events-relay for the chart).

Upgrades

helm upgrade with your values. Config-only changes don’t even need a rollout: the relay hot-reloads the ConfigMap when Kubernetes propagates it (typically within a minute), validating before applying. Check tekton_events_relay_config_reloads_total or the logs to confirm.