Skip to content
PromptGlassDocs

Deploy on Kubernetes

PromptGlass installs on any conformant Kubernetes cluster, version 1.29 or later, with one Helm chart. The chart deploys the gateway, console, API, detector workers and NATS. It can also run PostgreSQL, ClickHouse and S3-compatible storage for you, or connect to the managed services you already operate.

Terminal window
helm install promptglass oci://registry.promptglass.ai/charts/promptglass \
  -n promptglass --create-namespace -f values.yaml

Prerequisites

Section titled “Prerequisites”
  • Kubernetes 1.29+ (EKS, AKS, GKE, OpenShift 4.16+, Rancher RKE2 and upstream are all supported)
  • Helm 3.14+
  • An ingress controller (NGINX, Traefik or OpenShift routes) and cert-manager or your own TLS certificates
  • A default StorageClass if you use the bundled data stores
  • A license key and registry credentials from PromptGlass

Install

Section titled “Install”

  1. Create the namespace and pull secret

    Terminal window
    kubectl create namespace promptglass
    kubectl -n promptglass create secret docker-registry promptglass-registry \
      --docker-server=registry.promptglass.ai \
      --docker-username="$PG_REGISTRY_USER" --docker-password="$PG_REGISTRY_TOKEN"
    kubectl -n promptglass create secret generic promptglass-license --from-literal=license="$PG_LICENSE"

  2. Create the gateway signing CA (used for TLS inspection of AI domains only)

    Terminal window
    kubectl -n promptglass create secret tls promptglass-gateway-ca \
      --cert=ca.crt --key=ca.key

    Issue it from your enterprise PKI as a subordinate CA restricted by name constraints if your PKI supports them. Endpoints must trust it. See gateway forward proxy.

  3. Write values.yaml (see below) and install

  4. Verify

    Terminal window
    kubectl -n promptglass get pods
    promptglass login --url https://promptglass.example.com
    promptglass gateway status

Example values.yaml

Section titled “Example values.yaml”
global:
  domain: promptglass.example.com
  imagePullSecrets: [{ name: promptglass-registry }]
  licenseSecret: promptglass-license
  region: eu            # used for data-residency labels and catalog updates


ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  tls: true


auth:
  oidc:
    issuer: https://login.microsoftonline.com/<tenant-id>/v2.0
    clientId: <client-id>
    clientSecretRef: { name: promptglass-oidc, key: secret }
  scim:
    enabled: true


gateway:
  replicas: 3
  autoscaling:
    enabled: true
    minReplicas: 3
    maxReplicas: 20
    targetCPUUtilizationPercentage: 65
  forwardProxy:
    enabled: true
    port: 3128
    caSecret: promptglass-gateway-ca
  api:
    enabled: true
    host: ai-gateway.example.com
  service:
    type: LoadBalancer
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-internal: "true"


detectors:
  workers: 2
  mlClassifiers: true        # loads NER and code classifiers (needs ~2 GiB RAM per pod)


encryption:
  provider: aws-kms          # aws-kms | azure-keyvault | gcp-kms | vault-transit | pkcs11
  keyId: arn:aws:kms:eu-west-1:111122223333:key/abcd-...


postgresql:
  bundled: false
  external:
    host: pg.example.internal
    database: promptglass
    existingSecret: promptglass-postgres


clickhouse:
  bundled: true
  persistence: { size: 500Gi }


objectStorage:
  bundled: false
  s3:
    endpoint: https://s3.eu-west-1.amazonaws.com
    bucket: acme-promptglass-content
    existingSecret: promptglass-s3


telemetry:
  otlpEndpoint: http://otel-collector.observability:4317
  serviceMonitor: true

For the full key list, see the Helm values reference.

Bundled vs external data stores

Section titled “Bundled vs external data stores”

The chart runs PostgreSQL, ClickHouse, NATS and SeaweedFS (S3-compatible object storage) as StatefulSets, with every listener restricted to TLS 1.3. This suits evaluations and small production deployments. You are responsible for backing up the PVCs.

Sizing starting points

Section titled “Sizing starting points”

These are starting points for capacity planning, not benchmarks. Measure with your own traffic mix and adjust.

Organization size Gateway pods Detector workers ClickHouse PostgreSQL Object storage / year (redacted mode)
Up to 1,000 users 2 × (1 vCPU, 2 GiB) 1 4 vCPU, 16 GiB, 250 GiB 2 vCPU, 4 GiB 50–200 GiB
1,000–10,000 users 3–6 × (2 vCPU, 4 GiB) 2–4 8 vCPU, 32 GiB, 1 TiB 4 vCPU, 8 GiB 0.5–2 TiB
10,000+ users HPA 6–30 4–12 3-node replicated cluster HA pair Contact us

Upgrades

Section titled “Upgrades”
Terminal window
helm upgrade promptglass oci://registry.promptglass.ai/charts/promptglass \
  -n promptglass -f values.yaml --version 2026.11.0

Schema migrations run as a pre-upgrade Job. Gateway pods roll with maxUnavailable: 0, so in-flight AI requests are drained gracefully.

Next

Section titled “Next”