Optional configuration
Apply optional installation-wide settings safely after Lifecycle is running.
After the GitHub App setup, use these optional settings to improve security and usability.
Configure BuildKit
The standard Helm installation supplies a BuildKit endpoint. Select the build
engine for each Service in lifecycle.yaml. See the GitHub Service builder
schema.
Lifecycle build pods include
cluster-autoscaler.kubernetes.io/safe-to-evict: "false". Add other
annotations for each Service with github.docker.builder.podAnnotations. The
Service configuration cannot override the safe-to-evict value.
The installation-wide IP allowlist starts open to 0.0.0.0/0. Before an
Environment is reachable, limit each public Service to approved networks.
Apply your organization’s network, identity, and security controls.
Limit public Service access
Use the supported service-level deployment.network.ipWhitelist field. Replace
the documentation CIDR shown with the networks that must reach the Service:
This documentation uses 203.0.113.0/24 only as an example. It does not grant
your users access. Supply your office, VPN, or gateway CIDRs.
Set deployment.public: false for a Service that must have no public
ingress. See the GitHub service network
schema for hostname and port-mapping options.
Enable Environment Lens for a Service
When you want an Environment banner on a Service ingress, set envLens on that
Service:
Commit the change. Then, create or redeploy an Environment and make sure that the banner appears.
Change other settings
Use the runtime configuration map to select a documented configuration surface. After each change, test one affected workflow.