RegScale Helm Repository

Continuous Compliance Automation Platform Helm Installation for Kubernetes

📋 Prerequisites

Required Components

⚠️ Important - Ensure that your storage controllers are running and healthy and your database is setup prior to installing the RegScale helm chart.

1 Add the RegScale Helm repository:
helm repo add regscale https://regscale.github.io/helm
helm repo update
2 Download and configure the values file:

Download the values.yaml template:

💡 All values file or cloud-specific values file examples: All Values | AWS EKS Values | Azure AKS Values

🔧 Required Configuration

🔐 Security Keys

Must be exactly 32 characters

💡 Generate with: openssl rand -hex 16 2>/dev/null

  • jwtSecretKey: "YourJWTSecretKey"
  • encryptionKey: "YourEncryptionKey"

🗄️ Database Configuration

  • Server: "YourDatabaseServer"
  • User ID: "YourDatabaseUserID"
  • Password: "YourDatabasePassword"

💾 Azure Blob Storage

Requires Azure Blob CSI driver

azureBlob:
    enabled: true
    resourceGroup: "" # Required
    storageAccount: "regscale-files" # Required
    containerName: "" # Required
    secretName: "" # Required: Secret containing storage account key

💾 AWS EFS (Elastic File System)

Requires AWS EFS CSI driver. Supports ReadWriteMany (multiple replicas).

⚠️ EFS Access Point Required: For proper permissions and security, create an EFS access point with UID/GID 1001:1001.

awsEFS:
    enabled: true
    fileSystemId: "" # Required: EFS file system ID (fs-xxxxxx)
    accessPoint: "" # Required: EFS access point ID (fsap-xxxxxx)
    region: "" # Required: AWS region
    size: 50Gi # Storage size for PVC
    reclaimPolicy: "Retain" # Retain data when deleted
3 Install RegScale:
helm install regscale regscale/regscale --values my-values.yaml --namespace regscale --create-namespace

🔐 Custom CA Trust (AWS GovCloud RDS, Internal PKI)

If your SQL Server presents a certificate signed by a CA that isn't in the container's default trust store (most commonly AWS GovCloud RDS, internal PKI, or private MSSQL), RegScale fails at startup with Certificate failed chain validation ... PartialChain during the SQL pre-login handshake.

Setting TrustServerCertificate=True is usually blocked by production compliance policy. As of chart 3.1.9, the chart supports adding extra trusted CAs the right way — without an image rebuild and while keeping readOnlyRootFilesystem: true.

Quick recipe (AWS GovCloud RDS, us-gov-east-1):

curl -fLO https://truststore.pki.us-gov-west-1.rds.amazonaws.com/us-gov-east-1/us-gov-east-1-bundle.pem kubectl -n <regscale-namespace> create configmap rds-gov-ca \ --from-file=rds-gov-ca.pem=us-gov-east-1-bundle.pem

Then in your values:

app: extraCATrust: enabled: true configMapName: rds-gov-ca # or secretName: rds-gov-ca

The chart adds an init container that merges your PEMs with the image's system CA bundle into a shared emptyDir, and the main container reads it via SSL_CERT_FILE. Keep TrustServerCertificate=False in your connection string — real chain validation will succeed.

📘 Full guide: Custom CA Trust Setup →

🔄 Upgrading

# Update repository helm repo update regscale # Upgrade release helm upgrade regscale regscale/regscale --values my-values.yaml --namespace regscale

📚 Resources

📦 Current Versions

  • Helm Chart Version: 3.1.15
  • RegScale Image Version: 6.31.1.3

📋 Example Values Files

📘 Setup Guides

🔗 External Links

🏢 About RegScale

RegScale is a continuous compliance automation platform that helps organizations maintain security and compliance across their infrastructure.

Learn more about RegScale →