Deploy your first Pro DAG
Take a DAG from Lite to a Kubernetes control plane — your first Pro deployment.
Deploy & operate
Take Leoflow to production — deploy from CI, run the Helm chart, upgrade, back up, and keep the scheduler resilient.
Running Leoflow in production: promotion from Lite to Pro, the deploy pipeline, and the day-2 operations that keep a control plane healthy.
Start here
Deploy your first Pro DAG
Take a DAG from Lite to a Kubernetes control plane, end to end.
Go to production →
Deploy prerequisites & why shortcuts fail
Every gate a Pro deploy enforces, its exact error, and the fix.
Check the gates →
CI/CD & deploy
Build, push, and register DAGs from CI — GitHub Actions, GitLab, Cloud Build.
Wire up CI/CD →
Helm chart
Install and configure the Pro control plane on Kubernetes.
Install with Helm →
Troubleshooting & observability
Diagnose DAG, scheduler, and executor problems — and find where the logs live.
Diagnose issues →
Resilience & latency
Scheduler resilience, control-plane HA & disruption posture, and warm worker pools — availability and latency.
Security & data-path internals
Agent credential transport, Pro TLS, the staging volume, and external secrets.
Deploy prerequisites & why shortcuts fail
Every gate leoflow deploy/push enforces — the exact error, why it exists, and the fix.
CI/CD & deploy examples
Build, push and register DAGs from CI — GitHub Actions, GitLab CI, Cloud Build.
Helm chart
Install and configure the Leoflow Pro control plane on Kubernetes with the official Helm chart.
Upgrades
Upgrade a Leoflow control plane safely, edition by edition.
Backup & restore
Back up and restore Leoflow state — metadata, secrets, and logs.
Trigger a run from an external system
Obtain a token, trigger a DAG run with conf over the REST API, and poll it — the raw-HTTP path for an external integrator.
External secrets (keyless, ESO, and mounted secrets)
Reach credentials that live in your cloud secret store or Vault from task pods — keyless first, then External Secrets Operator or a mounted Kubernetes Secret — without duplicating them in Leoflow.
Validate the native resolver on a real cluster (before enabling)
A turnkey runbook to prove the keyless external-secrets resolver end-to-end on EKS or GKE — the one thing an emulated store cannot validate — before turning the backend on in production.
Troubleshooting & observability
Diagnose DAG, scheduler and executor problems; where the logs and signals live.
Scheduler resilience
How the scheduler survives restarts, leader loss and partial failure.
Control-plane HA and disruption posture
Why a single control-plane replica is evicted as routine housekeeping, what each restart costs, and the one-switch HA profile that turns it into seconds of failover.
Cataloguing leoflow in OpenMetadata
Point OpenMetadata’s Airflow connector at leoflow over REST, and understand what it does and does not give you.
Task pod hardening
What the executor puts in every task pod’s securityContext, what readOnlyRootFilesystem changes, and how to run task pods in a Pod Security Admission restricted namespace.
Warm worker pools
Cut task start latency with pre-warmed worker pods.
Agent credential transport
How declared secrets reach the in-container agent, and the trust boundary.
Single sign-on with Google Workspace
Turn on OIDC login against Google Workspace, and read the audit log when it denies.
Single sign-on with Microsoft Entra ID, Okta, or another OIDC provider
Turn on OIDC login against an IdP other than Google Workspace, and the two settings that differ per provider.
Single sign-on with Amazon Cognito
Turn on OIDC login against a Cognito user pool, including the three things that differ from every other provider.
Pro TLS (cert-manager)
Terminate TLS on the Pro control plane with cert-manager.
Staging volume
The ephemeral per-run volume that shares large data between tasks.