Install the Hybrid Runtime for GitOps through a Helm chart.

If you already have a Codefresh acccount, go for the[quick install](#quick-helm-install-for-hybrid-gitops-runtime). For step-by-step installation from the Codefresh UI, see[Step-by-step Hybrid GitOps Runtime installation walkthrough](/#step-by-step-hybrid-gitops-runtime-installation-walkthrough).

If you already have a Codefresh acccount, go for the[quick install](#quick-helm-install-for-hybrid-gitops-runtime). For step-by-step installation from the Codefresh UI, see[Step-by-step Hybrid GitOps Runtime installation walkthrough](#step-by-step-hybrid-gitops-runtime-installation-walkthrough).

Install the Hybrid GitOps Runtime via Helm with the default tunnel-based access mode.

The Codefresh`values.yaml` is located[here](https://github.com/codefresh-io/gitops-runtime-helm/tree/main/charts/gitops-runtime){:target="\_blank"}.

The Codefresh`values.yaml` is located[here](https://github.com/codefresh-io/gitops-runtime-helm/blob/main/charts/gitops-runtime/){:target="\_blank"}.

Quick Helm install assumes:

* Run:

where:

*`<helm-release-name>` is the name of the Helm release.

*`gitops-runtime` is the chart name defined by Codefresh.

*`--wait` waits until all the pods are up and running for the deployment.

**Automated validation**

Codefresh automatically validates the`values` file before initiating the installation. If there is a validation failure, Codefresh terminates the installation.

To get more details on the reasons for the failure, run:

where:

*`{NAMESPACE}` must be replaced with the namespace of the Hybrid GitOps Runtime.

To disable automated validation, add`--set installer.skipValidation=true` to the install command.

For more details, see[Step 1: (Optional) Validate Helm values file](#step-1-optional-validate-helm-values-file) in this article.

Hybrid GitOps installation requires a cluster without Argo project CRDs.

The Codefresh`values.yaml` is located[here](https://github.com/codefresh-io/gitops-runtime-helm/tree/main/charts/gitops-runtime){:target="\_blank"}.

* Make sure you meet the[minimum requirements]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#minimum-system-requirements) for installation

* Make sure you meet the[minimum requirements](#minimum-system-requirements) for installation

* Git provider requirements:

*[Runtime token with the required scopes]({{site.baseurl}}/docs/reference/git-tokens/#git-runtime-token-scopes). You need to supply as part of the Helm install command.

*[Personal Access Token (PAT)]({{site.baseurl}}/docs/reference/git-tokens/#git-personal-tokens) with the required scopes for Git-based actions.

* Server URLs for on-premises Git providers

* Verify there are no Argo project CRDs in the target namespace or that you have adopted the CRDs (see[Argo project CRDs](#argo-project-crds))

* For ingress-based runtimes only, verify that these ingress controllers are configured correctly:

*[Ambassador ingress configuration]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#ambassador-ingress-configuration)

*[AWS ALB ingress configuration]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#alb-aws-ingress-configuration)

*[Istio ingress configuration]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#istio-ingress-configuration)

*[NGINX Enterprise ingress configuration]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#nginx-enterprise-ingress-configuration)

*[NGINX Community ingress configuration]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#nginx-community-version-ingress-configuration)

*[Traefik ingress configuration]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#traefik-ingress-configuration)

*[Ambassador ingress configuration](#ambassador-ingress-configuration)

*[AWS ALB ingress configuration](#aws-alb-ingress-configuration)

*[Istio ingress configuration](#istio-ingress-configuration)

*[NGINX Enterprise ingress configuration](#nginx-enterprise-ingress-configuration)

*[NGINX Community ingress configuration](#nginx-community-version-ingress-configuration)

*[Traefik ingress configuration](#traefik-ingress-configuration)

<br><br>

Codefresh automatically validates the`values.yaml` file before starting the installation to verify that the settings are correct.

If you prefer, you can also manually validate the file.

Codefresh automatically validates the`values.yaml` file before initiating the installation to verify that the supplied values are correct.

You also have the option to manually run the validation if desired.

The table below lists the settings that are validated in the`values` file.

The table below lists the settings validated in the`values` file.

{: .table .table-bordered .table-hover}

| Setting| Validation|

| --------------| --------------|

|**`userToken`**| If explicitly defined, or defined as a`secretKeyRef` which exists in the current k8s context and the defined namespace.|

|**Account permissions**| If the user has admin permissions for the account in which they are installing the runtime.|

|**Runtime name**| If defined, and is unique to the account.|

|**Access mode**| {::nomarkdown}<ul><li>For tunnel-based, the default, if <codeclass="highlighter-rouge">accountId</code> is defined, and matches the account of the <codeclass="highlighter-rouge">userToken</code> defined in the file.</li><li>For ingress-based, if the <codeclass="highlighter-rouge">hosts</code> array contains at least one entry that is a valid URL (successful HTTP GET).</li></ul>{:/}|

|**Access mode**| {::nomarkdown}<ul><li>For tunnel-based, the default, if <codeclass="highlighter-rouge">accountId</code> is defined, and matches the account of the <codeclass="highlighter-rouge">userToken</code> defined in the file.</li><li>For ingress-based, if the <codeclass="highlighter-rouge">hosts</code> array contains at least one entry that is a valid URL (successful HTTP GET).</li><li>If both tunnel-based and ingress-based access modes are disabled, if <codeclass="highlighter-rouge">runtime.ingressUrl</code> is defined.</li></ul>{:/}|

|**`gitCredentials`**| {::nomarkdown}<ul><li>When defined, includes a Git password either explicitly, or as a <codeclass="highlighter-rouge">secretKeyRef</code>, similar to <codeclass="highlighter-rouge">userToken</code>.</li><li>The password or token has the required permissions in the Git provider.</li></ul>{:/}|

**How to**

**How to: Manually validate values file**

1.Run:

1.To manually validate the`values` file, run:

where:

*`<values_file>` is the name of the values.yaml used by the Helm installation.

*`<namespace>` is the namespace in which to install the Hybrid GitOps runtime, either the default`codefresh`, or the custom name you intend to use for the installation. The Namespace must conform to the naming conventions for Kubernetes objects.

*`<version>` is the version of the runtime to install.

1. Continue with[Step 2: Select Hybrid Runtime install option](#step-2-select-hybrid-runtime-install-option).

* If you have already provisioned a Hybrid GitOps Runtime, to provision additional runtimes:

1. In the Codefresh UI, on the toolbar, click the**Settings** icon, and from Runtimes in the sidebar, select[**GitOps Runtimes**](https://g.codefresh.io/2.0/account-settings/runtimes){:target="\_blank"}.

1. Click**+ Add Runtimes**, and then select**Hybrid Runtimes**.

1. Continue with[Step 3: Set up GitOps Gitaccount](#step-3-set-up-gitops-git-account).

1. Continue with[Step 3: Set up GitOps Gitprovider](#step-3-set-up-gitops-git-provider).

Select the Git provider, define the provider's API URL, and the Shared Configuration Repository for your account.

The[Shared Configuration Repository]({{site.baseurl}}docs/reference/shared-configuration/) is a Git repository with configuration manifests shared between all the Hybrid GitOps Runtimes within the same account.

The[Shared Configuration Repository]({{site.baseurl}}/docs/reference/shared-configuration/) is a Git repository with configuration manifests shared between all the Hybrid GitOps Runtimes within the same account.

This is a one-time action, required once per account.

1. Define the URL of the**Shared Configuration Repository**.

1. Click**Next**.

1. Continue with[Step 4: Install Hybrid Runtime](#step-4-install-hybrid-runtime).

1. Continue with[Step 4: Install Hybrid Runtime](#step-4-install-hybrid-gitops-runtime).

**Namespace**

The Namespace must conform to the naming conventions for Kubernetes objects.

1. To generate your Codefresh API key, click**Generate**.

1. If needed, select**Customize runtime values**, and define the**Runtime Name** and**Namespace**.

1. Wait for a few minutes, and then click**Close**.

You are taken to the List View for GitOps Runtimes where you can see the Hybrid GitOps Runtime you added prefixed with a red dot.

1. Continue with[Step 5: Configure Git credentials for runtime](#step-5-configure-git-credentials-for-runtime).

1. Continue with[Step 5: Configure Git credentials for runtime](#step-5-configure-git-credentials-for-hybrid-gitops-runtime).

Required only for ALB AWS, Istio, or NGINX Enterprise ingress-controllers.<br>

* Complete configuring these ingress controllers:

*[ALB AWS: Alias DNS record in route53 to load balancer]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#create-an-alias-to-load-balancer-in-route53)

*[Istio: Configure cluster routing service]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#cluster-routing-service)

*[NGINX Enterprise ingress controller: Patch certificate secret]({{site.baseurl}}/docs/installation/gitops/hybrid-gitops/#patch-certificate-secret)

*[ALB AWS: Alias DNS record in route53 to load balancer](#create-an-alias-to-load-balancer-in-route53)

*[Istio: Configure cluster routing service](#cluster-routing-service)

*[NGINX Enterprise ingress controller: Patch certificate secret](#patch-certificate-secret)

That's it! You have successfully completed installing a Hybrid GitOps Runtime with Helm. See the Runtime in the[Runtimes]({{site.baseurl}}/docs/installation/gitops/monitor-manage-runtimes/#gitops-runtime-views) page.