# Standard Installation (/docs/enterprise/helm/installation/standard-install)



<Callout type="info">
  Installation Journey
  [Prerequisites](/enterprise/helm/installation/prerequisites/) → **Standard Installation** (you are here) → [Configure](/enterprise/helm/configuration/helm-values/)
</Callout>

This guide walks through a production-ready NetBox Enterprise installation with a custom values file, TLS, resource configuration, and post-install verification.

## 1. Create a Values File [#1-create-a-values-file]

Create `netbox-values.yaml` with your configuration:

```yaml
# Enable the NetBoxEnterprise custom resource
netboxEnterprise:
  enabled: true
  spec:
    # NetBox application
    netbox:
      replicas: 2
      resources:
        cpu: 500
        memory: 1024
      limits:
        cpu: 2000
        memory: 2048
      worker:
        replicas: 2
        resources:
          cpu: 200
          memory: 256
        limits:
          cpu: 1000
          memory: 1500
      config:
        metricsEnabled: true

    # Internal PostgreSQL (default)
    postgresql:
      external: false
      instances: 2          # Redundant with 2 replicas
      storageSize: "20Gi"

    # Internal Redis (default)
    redis:
      external: false
      clusterSize: 3

    # Diode data ingestion
    diode:
      enabled: true
      config:
        reconciler:
          # autoApplyChangesets: true  # false recommended if using Assurance
```

## 2. Create the Namespace [#2-create-the-namespace]

```bash
kubectl create namespace netbox
```

## 3. Configure Superuser (Optional) [#3-configure-superuser-optional]

By default the operator auto-generates a superuser with the username `admin` and a random password. To use your own credentials instead, create a secret **before installing**:

```bash
kubectl -n netbox create secret generic netbox-superuser \
  --from-literal=username=admin \
  --from-literal=email=admin@example.com \
  --from-literal=password=<secure-password> \
  --from-literal=api_token=<your-api-token>
```

Then add to your values file:

```yaml
netboxEnterprise:
  spec:
    netbox:
      config:
        superuser:
          username:
            name: netbox-superuser
            key: username
          email:
            name: netbox-superuser
            key: email
          password:
            name: netbox-superuser
            key: password
          apiToken:
            name: netbox-superuser
            key: api_token
```

<Callout type="warn">
  Superuser credentials are only applied during the initial database setup. If you skip this step, you can [retrieve the auto-generated password](/enterprise/helm/configuration/netbox#superuser-password) later.
</Callout>

## 4. Configure TLS (Optional) [#4-configure-tls-optional]

To serve NetBox over HTTPS, create a TLS secret:

```bash
kubectl -n netbox create secret tls netbox-tls \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key
```

Add URLs to your values file so the operator configures routing:

```yaml
netboxEnterprise:
  spec:
    netbox:
      urls:
        - "https://netbox.example.com"
```

See [Ingress & TLS](/enterprise/helm/configuration/ingress-tls) for detailed configuration options.

## 5. Install CRDs [#5-install-crds]

Install the three Custom Resource Definition charts before the operator:

```bash
helm install netbox-enterprise-crds \
  oci://registry.enterprise.netboxlabs.com/netbox-enterprise/stable-v2/netbox-enterprise-crds \
  --version 2.2.1 \
  --namespace netbox

helm install netbox-enterprise-crds-pgo \
  oci://registry.enterprise.netboxlabs.com/netbox-enterprise/stable-v2/netbox-enterprise-crds-pgo \
  --version 2.2.1 \
  --namespace netbox

helm install netbox-enterprise-crds-redis \
  oci://registry.enterprise.netboxlabs.com/netbox-enterprise/stable-v2/netbox-enterprise-crds-redis \
  --version 2.2.1 \
  --namespace netbox
```

<Callout type="info" title="Using the bundled gateway?">
  These three CRD charts cover a default installation, which routes through your existing ingress controller. If you plan to enable the bundled Traefik gateway (`gateway.enabled: true`), install the Gateway API CRD charts as well. See [Gateway API CRDs](/enterprise/helm/installation/prerequisites/#gateway-api-crds-gateway-routing-only).
</Callout>

## 6. Install the Operator [#6-install-the-operator]

```bash
helm install netbox-enterprise \
  oci://registry.enterprise.netboxlabs.com/netbox-enterprise/stable-v2/netbox-enterprise \
  --version 2.2.1 \
  --namespace netbox \
  --values netbox-values.yaml
```

## 7. Apply Configuration [#7-apply-configuration]

Apply a `NetBoxEnterprise` resource manifest. The example manifests use `namespace: default`, but the manifest must be in the same namespace as your Helm install so that pods can access the image pull secret. Use `curl` and `sed` to substitute the namespace in one step:

```bash
curl -sL https://netboxlabs.com/docs/files/helm/examples/netbox-managed.yaml \
  | sed 's/namespace: default/namespace: netbox/' \
  | kubectl apply -f -
```

If you used a different namespace, replace `netbox` in the `sed` expression to match.

See the [available examples](/enterprise/helm/installation/examples/) for manifests covering external databases, SSO, object storage, and more; apply the same `sed` substitution to any of them.

## 8. Verify the Installation [#8-verify-the-installation]

### Check pod status [#check-pod-status]

```bash
kubectl -n netbox get pods
```

All pods should reach `Running` (or `Completed` for jobs) within a few minutes.

### Check NetBoxEnterprise status [#check-netboxenterprise-status]

```bash
kubectl -n netbox get netboxenterprises -o wide
```

### Inspect detailed status [#inspect-detailed-status]

```bash
kubectl -n netbox describe netboxenterprise netbox-managed
```

Look for the `Ready` condition with status `True`:

```text
Conditions:
  Type        Status  Reason
  ----        ------  ------
  Ready       True    AllComponentsReady
  Progressing False   ReconcileComplete
```

### Check operator logs [#check-operator-logs]

```bash
kubectl -n netbox logs -l app.kubernetes.io/name=nbe-operator --tail=50
```

## Next Steps [#next-steps]

* [Helm Values Reference](/enterprise/helm/configuration/helm-values): Explore all available configuration options
* [Security](/enterprise/helm/guides/security): RBAC modes, pod security, and TLS hardening
* [Monitoring](/enterprise/helm/configuration/monitoring): Set up Prometheus metrics and ServiceMonitor