Kubernetes Deployment

Overview

Deploy AgentTrust Edge to Kubernetes using Helm charts or raw manifests in agentrust-edge/k8s/ and k8s/agentrust-edge/.

Why It Matters

Production deployments require HA, secret management, and sidecar patterns for low-latency agent pods.

Prerequisites

• Kubernetes cluster 1.25+
• Helm 3+ (for Helm deployment)
• PostgreSQL and Redis (in-cluster or managed)

Step-by-Step Guide

Helm install

cd agentrust-edge/k8s/helm/agentrust-edge
helm install agentrust-edge . \
  --namespace agentrust \
  --create-namespace \
  -f values-production.yaml

Key values (values.yaml)

gateway:
  replicaCount: 2
  env:
    AUTH_ENABLED: "true"
    RATE_LIMIT_ENABLED: "true"

sidecar:
  enabled: true   # embed gateway alongside app pods
  port: 8765

postgresql:
  enabled: true   # or use external DATABASE_URL

redis:
  enabled: true   # or use external REDIS_URL

Sidecar pattern

App container configuration:

env:
  - name: AGENTRUST_GATEWAY_URL
    value: "http://localhost:8765"

Gateway sidecar runs in same pod — no network hop, air-gap friendly.

Raw manifests

kubectl apply -k k8s/agentrust-edge/

Secrets

kubectl create secret generic agentrust-secrets \
  --from-literal=AGENTRUST_JWT_SECRET=... \
  --from-literal=DATABASE_URL=... \
  --from-literal=REDIS_URL=...

Examples

Health probe:

livenessProbe:
  httpGet:
    path: /health
    port: 8000

Best Practices

• Use external managed Postgres/Redis for production
• Enable sidecar for latency-sensitive agent workloads
• Mount policy packs as ConfigMaps
• Set AGENTRUST_AUTO_MIGRATE=false in multi-replica prod (run migrations as Job)
• Export OTEL to your observability stack

Common Mistakes

• Running migrations on every replica simultaneously
• AUTH_ENABLED=false in production
• Not setting resource limits on judge worker

Troubleshooting

Related Resources

• Docker Compose
• Environment Variables
• OTEL Cookbook