Full systems, one helm install

Stacks are curated umbrella charts that bundle the same hardened building blocks as our individual charts (0-CVE, nonroot, cosign-signed, digest-pinned, multi-arch) and pre-wire them together. Instead of assembling six charts by hand and figuring out how they talk to each other, you get a working system from a single install.

Most stacks are operator-free: plain Helm, no CRDs and no operators to run, and what you deploy is exactly the wiring you can read in the chart. Four are built around a controller and install its CRDs: GitOps (Argo), backup (Velero), ingress (cert-manager) and supply chain (Kyverno).

• 0 CVE

  Observability Stack

  Metrics, alerting, and populated Kubernetes dashboards from a single install.

  observability-stack

  • ├─Prometheus
  • ├─Grafana
  • ├─Alertmanager
  • ├─kube-state-metrics
  • ├─node-exporter
  • └─cAdvisor

  chart v0.0.26·6 components·Operator-free

  helm install observability-stack oci://ghcr.io/quenchworks/charts/observability-stackCopy
• 0 CVE

  LGTM Stack

  The logs + metrics + traces superset, all in one pane of glass.

  lgtm-stack

  • ├─Loki
  • ├─Grafana
  • ├─Tempo
  • ├─VictoriaMetrics
  • ├─OpenTelemetry Collector
  • └─Alertmanager

  chart v0.0.34·6 components·Operator-free

  helm install lgtm-stack oci://ghcr.io/quenchworks/charts/lgtm-stackCopy
• 0 CVE

  Logging Stack

  Cluster-wide log aggregation and browsing, ready to query.

  logging-stack

  • ├─Loki
  • ├─Grafana
  • └─Vector

  chart v0.0.19·3 components·Operator-free

  helm install logging-stack oci://ghcr.io/quenchworks/charts/logging-stackCopy
• 0 CVE

  Tracing Stack

  Distributed tracing with an OTLP ingest gateway, ready for your services.

  tracing-stack

  • ├─Tempo
  • ├─Grafana
  • └─OpenTelemetry Collector

  chart v0.0.17·3 components·Operator-free

  helm install tracing-stack oci://ghcr.io/quenchworks/charts/tracing-stackCopy
• 0 CVE

  Identity Stack

  SSO via OIDC and SAML in front of your apps, with a database that comes with it.

  identity-stack

  • ├─Keycloak
  • ├─PostgreSQL
  • └─oauth2-proxy

  chart v0.0.27·3 components·Operator-free

  helm install identity-stack oci://ghcr.io/quenchworks/charts/identity-stackCopy
• 0 CVE

  Postgres HA Stack

  A 3-node PostgreSQL cluster that fails over on its own, with pooling and dashboards.

  postgres-ha-stack

  • ├─PostgreSQL
  • ├─Patroni
  • ├─PgBouncer
  • ├─postgres_exporter
  • ├─Prometheus
  • └─Grafana

  chart v0.0.9·6 components·Operator-free

  helm install postgres-ha-stack oci://ghcr.io/quenchworks/charts/postgres-ha-stackCopy
• 0 CVE

  Cache Stack

  A Redis-compatible cache with its metrics already on a dashboard.

  cache-stack

  • ├─Valkey
  • ├─redis_exporter
  • ├─Prometheus
  • └─Grafana

  chart v0.0.11·4 components·Operator-free

  helm install cache-stack oci://ghcr.io/quenchworks/charts/cache-stackCopy
• 0 CVE

  Streaming Stack

  Kafka with a schema registry, a REST proxy and a web console, already connected.

  streaming-stack

  • ├─Kafka
  • ├─Karapace
  • └─AKHQ

  chart v0.0.10·3 components·Operator-free

  helm install streaming-stack oci://ghcr.io/quenchworks/charts/streaming-stackCopy
• 0 CVE

  Secrets Stack

  A self-initializing secrets vault with single sign-on for people and tokens for services.

  secrets-stack

  • ├─OpenBao
  • └─Keycloak

  chart v0.0.13·2 components·Operator-free

  helm install secrets-stack oci://ghcr.io/quenchworks/charts/secrets-stackCopy
• 0 CVE

  ML Stack

  Notebooks, experiment tracking and data labeling, with every notebook already pointed at MLflow.

  ml-stack

  • ├─JupyterHub
  • ├─MLflow
  • ├─Label Studio
  • └─PostgreSQL

  chart v0.0.17·4 components·Operator-free

  helm install ml-stack oci://ghcr.io/quenchworks/charts/ml-stackCopy
• 0 CVE

  Sigstore Stack

  Your own keyless signing: a certificate authority, a transparency log and a timestamp authority for cosign.

  sigstore-stack

  • ├─Fulcio
  • ├─Rekor v2
  • ├─Timestamp Authority
  • └─Caddy

  chart v0.0.9·4 components·Operator-free

  helm install sigstore-stack oci://ghcr.io/quenchworks/charts/sigstore-stackCopy
• 0 CVE

  GitOps Stack

  Git-driven deploys, canary releases and pipelines, with webhooks already able to start a workflow.

  gitops-stack

  • ├─Argo CD
  • ├─Argo Rollouts
  • ├─Argo Workflows
  • ├─Argo Events
  • └─NATS

  chart v0.0.12·5 components·Installs CRDs

  helm install gitops-stack oci://ghcr.io/quenchworks/charts/gitops-stackCopy
• 0 CVE

  LLM Stack

  Local models behind one OpenAI-compatible API, with a vector database for retrieval and the models pulled at install.

  llm-stack

  • ├─Ollama
  • ├─LiteLLM
  • └─Qdrant

  chart v0.0.21·3 components·Operator-free

  helm install llm-stack oci://ghcr.io/quenchworks/charts/llm-stackCopy
• 0 CVE

  Lakehouse Stack

  SQL over Apache Iceberg tables on your own S3 storage, with the catalog, keys and bucket already wired.

  lakehouse-stack

  • ├─Trino
  • ├─Nessie
  • ├─SeaweedFS
  • └─Apache Iceberg

  chart v0.0.16·4 components·Operator-free

  helm install lakehouse-stack oci://ghcr.io/quenchworks/charts/lakehouse-stackCopy
• 0 CVE

  Backup Stack

  Back up and restore namespaces to S3 storage installed beside it, with the keys, bucket and backup location already set.

  backup-stack

  • ├─Velero
  • ├─Velero AWS plugin
  • └─SeaweedFS

  chart v0.0.9·3 components·Installs CRDs

  helm install backup-stack oci://ghcr.io/quenchworks/charts/backup-stackCopy
• 0 CVE

  Ingress Stack

  An ingress controller and cert-manager with a cluster CA, so an Ingress gets a TLS certificate from one annotation.

  ingress-stack

  • ├─ingress-nginx
  • ├─cert-manager
  • └─Cluster CA issuer

  chart v0.0.6·3 components·Installs CRDs

  helm install ingress-stack oci://ghcr.io/quenchworks/charts/ingress-stackCopy
• 0 CVE

  DNS Stack

  PowerDNS serves your zones and external-dns fills them from annotated Services and Ingresses, through one generated API key.

  dns-stack

  • ├─PowerDNS Authoritative
  • ├─external-dns
  • └─Zone setup Job

  chart v0.0.6·3 components·Operator-free

  helm install dns-stack oci://ghcr.io/quenchworks/charts/dns-stackCopy
• 0 CVE

  Mesh Stack

  mesh-stack

  • ├─istiod
  • ├─Istio CNI
  • └─ztunnel (ambient mTLS)

  chart v0.0.3·3 components·Operator-free

  helm install mesh-stack oci://ghcr.io/quenchworks/charts/mesh-stackCopy
• 0 CVE

  Supply Chain Stack

  Admit only signed QuenchWorks images in the namespaces you label, checked against Sigstore, and scan what runs.

  supply-chain-stack

  • ├─Kyverno
  • ├─trivy-operator
  • └─Signed-image policy

  chart v0.0.8·3 components·Installs CRDs

  helm install supply-chain-stack oci://ghcr.io/quenchworks/charts/supply-chain-stackCopy