Helm

Deploy the Kitaru server on Kubernetes with the first-party Helm chart, covering external Postgres, automatic migrations, ingress, and TLS.

The repository ships a first-party chart under helm/ that deploys the Kitaru server on Kubernetes: a server Deployment (with optional autoscaling), a Service, ingress or Gateway API routing, and a database migration Job that runs before each install and upgrade so the server never starts against an unmigrated schema.

The chart deploys the server only. Postgres is yours to provide (managed Postgres is the expected shape), and workers deploy separately in the environments your agents run in.

helm install kitaru oci://public.ecr.aws/zenml/kitaru \
  --namespace kitaru --create-namespace \
  --values my-values.yaml

The values that matter

A minimal production my-values.yaml:

server:
  serverURL: https://kitaru.internal.example.com

  database:
    host: your-postgres-host
    username: kitaru
    passwordSecretRef:
      name: kitaru-db
      key: password
    sslMode: require

  auth:
    authScheme: local
    defaultAccount:
      passwordSecretRef:
        name: kitaru-bootstrap
        key: password

ingress:
  enabled: true
  host: kitaru.internal.example.com

The chart mirrors the same KITARU_SERVER_* configuration surface as the Docker deployment: every server setting has a values path, secrets can be inline for a quick start or secretRefs for real deployments, and database TLS supports disable through verify-full with custom CA bundles.

The image is the published zenmldocker/kitaru-server, tagged to match the chart version by default; pin server.image.tag explicitly if you want upgrades to be deliberate.

Operational notes

• Migrations run as a Helm hook Job before the server pods roll, so an upgrade that needs a schema change can't race its own pods. If the migration fails, the release fails and the previous version keeps running.
• Scaling: the server is stateless between requests; enable the HPA block or set replicas directly. All state is in Postgres.
• Routing: classic Ingress (nginx by default) and Gateway API HTTPRoute are both supported; enable exactly one.

After install, point your team at it:

kitaru login https://kitaru.internal.example.com
kitaru status

Then create accounts and API keys and start workers where your agents live.