One-click templates

The environment page lists the catalogue under One-click templates. Press Use template on one, enter an App name, and press Deploy: Kuben creates the app, its volume and its credentials, and tells you the name of the credentials secret and how to connect another app to it.

Deploying a template writes a secret, so it needs the admin role or higher. The name is a DNS label of at most 40 characters, and the deploy stops if a secret <name>-credentials already exists.

curl -fsS -X POST "$KUBEN_URL/api/v1/projects/shop/environments/staging/templates/postgres" \
  -H "Authorization: Bearer $KUBEN_TOKEN" -H 'Content-Type: application/json' \
  -d '{"name": "db"}'

The full list with images, ports and volumes is in the template catalogue.

Generated credentials

Every template that needs a password gets one generated, 32 random characters, into the secret <name>-credentials. The app only references that secret, so:

• no password appears in the app spec,
• none appears in the release history,
• and none appears in the audit log (request bodies are never recorded anyway).

Databases also get a ready-made url key. Connect another app in the same environment with an environment variable that references it:

DATABASE_URL=@db-credentials/url

In the API that is a secret reference:

{ "name": "DATABASE_URL", "secret": { "name": "db-credentials", "key": "url" } }

Reading the credentials yourself

Kuben never shows the values in the console or the API. The credentials are an ordinary Kubernetes Secret in the environment namespace, so someone with cluster access can read them: kubectl -n kb-shop-staging get secret db-credentials -o jsonpath='{.data.url}' | base64 -d. Database templates have the keys url, host, port, username and database (Redis: url, host, port).

Internal only

Database templates use protocol: tcp. They get a cluster-internal Service named after the app (db above), reachable from the other apps in the environment and never from the internet. The NetworkPolicy of the environment blocks connections from other environments; namespaces Kuben does not manage, such as the Gateway’s and monitoring, can still connect.

HTTP templates (n8n, Uptime Kuma, Vaultwarden, Gitea, whoami) get a public route like any other web app: https://<name>-<project>-<environment>.<baseDomain> (for example n8n-shop-staging.apps.example.com) plus any custom domains.

After deploying

A template deploy is an ordinary app afterwards: it has releases, volumes, logs and the same day-2 operations. You can change its image tag to upgrade the database, which creates a new revision you can roll back from. A new major version of PostgreSQL or MariaDB needs a data migration first, and rolling back the image does not undo changes the new version made to the files on the volume: take a backup before you upgrade.