ChiefOnboarding

Employee onboarding automation platform. ChiefOnboarding lets HR teams define onboarding sequences for new hires — assigning tasks, collecting documents, sending introductions, and integrating with tools like Slack and Google Workspace. All onboarding data and workflow definitions are stored in PostgreSQL.

Key Features

• Onboarding sequences — ordered tasks, automated triggers, and conditional workflows
• Integrations — Slack, Google Workspace, email notifications, and webhook support
• Multi-role access — admin, manager, and buddy role assignments
• PostgreSQL backend — bundled subchart or external database
• Django application — secure SECRET_KEY management for sessions and CSRF protection
• Ingress support — TLS via cert-manager with configurable ingress class

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install chiefonboarding helmforge/chiefonboarding

OCI registry:

helm install chiefonboarding oci://ghcr.io/helmforgedev/helm/chiefonboarding

Deployment Examples

# values.yaml — ChiefOnboarding with bundled PostgreSQL (default)
chiefonboarding:
  baseUrl: 'https://onboarding.example.com'
  allowedHosts:
    - onboarding.example.com
  secretKey: 'a-random-50-char-django-secret-key-here-replace-me'

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: onboarding.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — ChiefOnboarding with external PostgreSQL
chiefonboarding:
  baseUrl: 'https://onboarding.example.com'
  allowedHosts:
    - onboarding.example.com
  secretKey: 'a-random-50-char-django-secret-key-here-replace-me'

postgresql:
  enabled: false

database:
  external:
    host: postgresql.database.svc
    port: '5432'
    name: chiefonboarding
    username: chiefonboarding
    password: 'db-password'

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: onboarding.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Production setup with secrets, TLS, and Slack integration
chiefonboarding:
  baseUrl: 'https://onboarding.example.com'
  allowedHosts:
    - onboarding.example.com
  existingSecret: chiefonboarding-secret
  existingSecretKey: secret-key
  extraEnv:
    # Slack integration
    - name: SLACK_APP_TOKEN
      valueFrom:
        secretKeyRef:
          name: chiefonboarding-integrations
          key: slack-app-token
    - name: SLACK_BOT_TOKEN
      valueFrom:
        secretKeyRef:
          name: chiefonboarding-integrations
          key: slack-bot-token

postgresql:
  enabled: false

database:
  external:
    host: postgresql.production.svc
    port: '5432'
    name: chiefonboarding
    username: chiefonboarding
    existingSecret: chiefonboarding-db-secret
    existingSecretPasswordKey: password

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: onboarding.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: chiefonboarding-tls
      hosts:
        - onboarding.example.com

networkPolicy:
  ingressFrom:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: ingress-system

Configuration Reference

Application and Service ports

chiefonboarding.port configures the real Gunicorn listener in the official Supervisor topology. service.port remains an independent client-facing port and targets the named application listener:

chiefonboarding:
  port: 9080

service:
  port: 8080

The chart copies the upstream Supervisor configuration to a writable temporary file and replaces only its fixed 8000 bind value before startup. The k3d custom-port scenario performs an HTTP request against the overridden listener. It also applies idempotent migrations before Supervisor starts, preventing the upstream Django Q process from querying queue tables while a fresh database is still being migrated.

Security Scan

Kubescape scan for the chart standards backfill:

Production hardening should include stable existing Secrets, explicit CPU and memory requests and limits, TLS ingress, and an explicit ingress-controller peer in the default NetworkPolicy.

Core

Image

ChiefOnboarding Configuration

Database — Embedded Subchart

Database — External

Service

Ingress

Probes

Resources and Security

Service Account

NetworkPolicy

The default policy permits pods from the same Helm release. Add the actual ingress-controller namespace and pod selectors when the controller runs elsewhere. Egress stays unrestricted for SMTP, Slack, OIDC, S3, and custom integration destinations. A NetworkPolicy-capable CNI is required.

Scheduling

Extra

Common Issues

More Information

• ChiefOnboarding Official Website
• ChiefOnboarding Documentation
• ChiefOnboarding GitHub Repository
• HelmForge ChiefOnboarding Chart Source

Upgrading to 2.5.0

Upstream 2.5.0 adds access reports and CSV exports, external user-ID backfill, pagination fixes, and background offboarding account checks. Back up PostgreSQL and preserve the Django secret before upgrading; startup applies the application migrations. Update custom integration manifests for user-ID lookup before using backfill.

Presigned S3 uploads remain the upstream default. The optional AWS_USE_PRESIGNED_UPLOADS=False environment variable routes uploads through the server; account for proxy timeouts and upload limits. AWS_CDN_URL optionally sets the download URL base. Configure these through chiefonboarding.extraEnv, with S3 credentials from Secrets. Existing ports, database configuration and deployment topology are unchanged.