Skip to main content

​
Network requirements

Outbound connectivity required:
  • artifacts-self-hosted.qodo.ai - Helm chart and image registry
  • artif-reg-self-hosted.codium.ai - Container images
  • Your configured AI endpoint. Public provider APIs are needed only when your deployment calls them directly.
  • Git provider APIs (github.com, gitlab.com, or your self-hosted instances)
Inbound connectivity required:
  • Git provider webhooks must reach your ingress endpoints
  • Developer IDEs must reach Qodo API endpoints
  • (For Context Engine) Context retriever MCP endpoint
Choose the controller-specific ingress values before preparing DNS and TLS. Private ingress must remain reachable from your Git provider and users. For more information, see Configure ingress. Firewall considerations:
  • Allow outbound HTTPS (443) to all external dependencies
  • Allow inbound HTTPS (443) for webhooks and API access
  • Ensure K8s cluster can reach external PostgreSQL if not in-cluster

​
Security best practices

Secrets management:
  • Use Kubernetes secrets for all sensitive data
  • Never commit .secrets.toml files to version control
  • Use External Secrets Operator to reconcile credentials through your approved secret manager. See Manage Qodo secrets with External Secrets Operator.
  • Rotate API keys and credentials regularly
For complete provider values, store reuse, and the credential-retention procedure when disabling synchronization, see Configure Kubernetes add-ons with values files. Network policies:
  • Restrict pod-to-pod communication
  • Limit egress to only required endpoints
  • Implement namespace isolation
Access control:
  • Use RBAC for Kubernetes access
  • Implement principle of least privilege
  • Use service accounts with minimal permissions
TLS/SSL:
  • Always use TLS for external endpoints
  • Use cert-manager for certificate management
  • Configure proper certificate validation
Use global.tlsSecretName for the certificate served by your Qodo ingress. For outbound trust of private Git, identity, or external AI endpoints, create the separate custom-ca-cert Secret. For more information, see Private certificate authority. Image security:
  • Images come from trusted Replicated registry
  • Regular updates through Helm for security patches
  • Scan images for vulnerabilities if required by policy