phpMyAdmin

Deploy phpMyAdmin on Kubernetes with the official docker.io/phpmyadmin/phpmyadmin:5.2.3 image. The chart supports development installs, internal database administration portals, and production-oriented deployments with optional External Secrets Operator integration, Gateway API, dual-stack Service fields, NetworkPolicy ingress and egress, shared sessions, HPA, PDB, and custom phpMyAdmin configuration.

Key Features

• Official image alignment — uses docker.io/phpmyadmin/phpmyadmin:5.2.3.
• Database target modes — single-server, multi-server dropdown, and arbitrary-server login.
• Auth modes — cookie, config, http, and signon, with non-cookie modes applied through generated config.user.inc.php.
• Secret options — inline Secret for development, existing Kubernetes Secret, or optional External Secrets Operator with external-secrets.io/v1.
• Routing — Ingress and native Kubernetes Gateway API HTTPRoute.
• Networking — optional Service dual-stack fields and NetworkPolicy ingress/egress rules.
• Availability — stateless replicas with optional HPA, PDB, topology spread, and shared sessions.
• Customization — upload limit, generated/custom phpMyAdmin config, MySQL client TLS, control user, custom themes, and extra volumes/manifests.

Architecture

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install phpmyadmin helmforge/phpmyadmin \
  --set phpmyadmin.host=mysql.default.svc.cluster.local

OCI registry:

helm install phpmyadmin oci://ghcr.io/helmforgedev/helm/phpmyadmin \
  --set phpmyadmin.host=mysql.default.svc.cluster.local

For local access without Ingress or Gateway API:

kubectl port-forward svc/phpmyadmin 8080:80

Development vs Production

The default values are intentionally lightweight: one replica, no public route, no NetworkPolicy, no ExternalSecret, and no resource requests. This is appropriate for local validation and temporary administration tasks.

Production deployments should opt in to the controls they need:

• Use auth.existingSecret or externalSecrets.auth instead of inline passwords.
• Keep phpmyadmin.authType: cookie unless config, http, or signon is intentionally required.
• Put access behind VPN, SSO, reverse-proxy auth, or IP allowlists.
• Terminate TLS at Ingress or Gateway API.
• Enable NetworkPolicy and restrict database egress.
• Use least-privilege database accounts, not root/admin accounts.
• Enable sessions.enabled when running multiple replicas with cookie/session-heavy workflows.
• Add resource requests, memory limits, PDB, HPA, topology spread, and anti-affinity as needed.

Deployment Examples

# values.yaml - single fixed MySQL/MariaDB endpoint
phpmyadmin:
  host: mysql.database.svc.cluster.local
  port: 3306
  uploadLimit: '128M'

# values.yaml - curated server dropdown
phpmyadmin:
  hosts: 'mysql-primary.database.svc,mysql-replica.database.svc,mariadb.database.svc'
  ports: '3306,3306,3306'
  verboses: 'Primary,Replica,MariaDB'
  ssl:
    enabled: true
    verify: true

# values.yaml - internal production-oriented portal
phpmyadmin:
  host: mysql-primary.production.svc.cluster.local
  port: 3306
  uploadLimit: '256M'
  absoluteUri: 'https://pma.example.com/'
  authType: cookie
  hidePhpVersion: true

auth:
  existingSecret: phpmyadmin-auth
  existingSecretUsernameKey: username
  existingSecretPasswordKey: password
  existingSecretBlowfishKey: blowfish-secret

replicaCount: 2

sessions:
  enabled: true
  type: persistentVolumeClaim
  accessModes:
    - ReadWriteMany
  size: 1Gi

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    memory: 512Mi

serviceAccount:
  create: true
  automountServiceAccountToken: false

podSecurityContext:
  seccompProfile:
    type: RuntimeDefault

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

pdb:
  enabled: true
  minAvailable: 1

networkPolicy:
  enabled: true
  ingress:
    allowSameNamespace: false
    extraFrom:
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: ingress-nginx
  egress:
    enabled: true
    allowDNS: true
    allowSameNamespaceDatabase: true
    databasePort: 3306

ingress:
  enabled: true
  ingressClassName: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/proxy-body-size: '256m'
  hosts:
    - host: pma.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: phpmyadmin-tls
      hosts:
        - pma.example.com

# values.yaml - Gateway API and External Secrets Operator
phpmyadmin:
  host: mysql-primary.production.svc.cluster.local
  absoluteUri: 'https://pma.example.com/'
  authType: cookie

gatewayAPI:
  enabled: true
  parentRefs:
    - name: public
      namespace: gateway-system
      sectionName: https
  hostnames:
    - pma.example.com

externalSecrets:
  enabled: true
  secretStoreRef:
    name: platform-secrets
    kind: ClusterSecretStore
  auth:
    enabled: true
    usernameRemoteRef:
      key: prod/phpmyadmin
      property: username
    passwordRemoteRef:
      key: prod/phpmyadmin
      property: password
    blowfishSecretRemoteRef:
      key: prod/phpmyadmin
      property: blowfish-secret

# values.yaml - restricted traffic and dual-stack Service fields
phpmyadmin:
  host: mysql.default.svc.cluster.local

service:
  ipFamilyPolicy: PreferDualStack
  ipFamilies:
    - IPv4
    - IPv6

networkPolicy:
  enabled: true
  ingress:
    allowSameNamespace: true
  egress:
    enabled: true
    allowDNS: true
    allowSameNamespaceDatabase: true
    databasePort: 3306

# values.yaml - generated and custom phpMyAdmin config
phpmyadmin:
  host: mysql.database.svc.cluster.local
  authType: http
  uploadLimit: '256M'

auth:
  blowfishSecret: 'use-a-32-byte-random-secret-here'

config:
  customConfig: |
    <?php
    $cfg['ShowPhpInfo'] = false;
    $cfg['MaxRows'] = 100;

Database Connectivity

Single Server

Use phpmyadmin.host and phpmyadmin.port to lock the login form to one MySQL or MariaDB endpoint.

phpmyadmin:
  host: mysql.default.svc.cluster.local
  port: 3306

Multi-Server

Use comma-separated hosts, ports, and verboses to present a server dropdown. Leave phpmyadmin.host empty in this mode.

phpmyadmin:
  hosts: 'mysql-prod.svc,mysql-stage.svc'
  ports: '3306,3307'
  verboses: 'Production,Staging'

Arbitrary Server

phpmyadmin.arbitrary=true lets users enter a database host at login time. Use it only when the user population is trusted and the NetworkPolicy/database network path limits what can be reached.

phpmyadmin:
  arbitrary: true

Authentication And Secrets

Default cookie auth shows the phpMyAdmin login screen and lets users authenticate directly against the configured database target.

phpmyadmin:
  authType: cookie
auth:
  blowfishSecret: 'use-a-32-byte-random-secret-here'

The chart supports auto-login through auth.username and auth.password, but that bypasses the phpMyAdmin login form. Use it only behind another authentication layer.

auth:
  existingSecret: phpmyadmin-auth
  existingSecretUsernameKey: username
  existingSecretPasswordKey: password
  existingSecretBlowfishKey: blowfish-secret

auth.blowfishSecret, auth.existingSecret, and externalSecrets.auth all feed HELMFORGE_BLOWFISH_SECRET. The generated config.user.inc.php writes the value to $cfg['blowfish_secret'], which gives stable cookie encryption across pod restarts and replicas.

Custom Configuration

Use config.customConfig to append phpMyAdmin PHP settings to generated config.user.inc.php.

config:
  customConfig: |
    <?php
    $cfg['LoginCookieValidity'] = 14400;

Use config.existingConfigMap when another delivery mechanism owns config.user.inc.php. Use phpmyadmin.configBase64 for the official image’s PMA_CONFIG_BASE64 path when you need to replace the main config file instead of appending user config.

Configuration Reference

Core And Image

phpMyAdmin

Authentication

Config, Sessions, And Themes

Service, Ingress, And Gateway API

External Secrets Operator

NetworkPolicy

Availability, Probes, And Scheduling

Extension Points

Operational Notes

• Chart.yaml does not define chart dependencies and the chart does not require Chart.lock.
• Defaults are development-friendly, not production-ready by themselves.
• Ingress and Gateway API resources expose only the phpMyAdmin HTTP service.
• Gateway API requires Gateway API CRDs and an existing Gateway controller.
• External Secrets requires an existing External Secrets Operator and SecretStore or ClusterSecretStore.
• Dual-stack Service values require a dual-stack Kubernetes cluster.
• authType: http uses TCP probes by default because HTTP probes receive 401.
• networkPolicy.ingress.allowSameNamespace=false with no extraFrom denies ingress instead of opening it.

Validation

Recommended local checks before promotion:

helm lint charts/phpmyadmin
helm unittest charts/phpmyadmin
helm template phpmyadmin charts/phpmyadmin -f charts/phpmyadmin/examples/production.yaml

For cluster validation, install into K3D or K3S with a test MySQL/MariaDB target and check:

• pod readiness and restarts;
• container logs;
• namespace events;
• Service endpoints;
• Ingress or HTTPRoute status when routing is enabled;
• ExternalSecret reconciliation when ESO is enabled.

Official References

• phpMyAdmin website
• phpMyAdmin documentation
• Official phpMyAdmin Docker image
• External Secrets Operator
• Gateway API HTTPRoute
• Kubernetes Service dual-stack
• HelmForge phpMyAdmin chart source