Skip to content
MCP server built inHow that works
lavalake
Start for free

Installing on Kubernetes

An umbrella Helm chart ships for cluster deployments. It installs the platform along with MinIO, Nessie, Trino, Keycloak, PostgreSQL, cert-manager and an nginx ingress into a namespace of its own.

On this page

To simply try the platform, the Docker Compose stack is the faster route. This page covers the cluster installation.

Installing

  1. Create the cluster and roll out the chart

    On first run this generates .env with the secrets and installs into the namespace flaky-platform.

    ./scripts/bootstrap.sh

  2. Configure Keycloak

    Realm, Trino client with its audience mapper, and a test user.

    ./scripts/configure-keycloak.sh

  3. Prove that it holds

    An end-to-end proof: authenticated SQL, an Iceberg time-travel read, and the expected 401 and 403 refusals.

    ./scripts/verify.sh

  4. Reach the ingress

    One port-forward is enough; the console is then at http://localhost:8080/.

    kubectl -n flaky-platform port-forward svc/flaky-platform-ingress-nginx-controller 8080:8080

One issuer, in lockstep

As in the compose stack: Keycloak is served under /auth, which pins the public issuer. Every token — from the browser login as well as from the exchange for Trino — carries exactly that iss, while backchannel calls stay inside the cluster. Trino therefore runs with OIDC discovery disabled and every OAuth2 endpoint pinned to the in-cluster Keycloak service.

The purpose of this construction: the public address never has to resolve inside the cluster — and the issuer in every token still matches.

Tearing down

kind delete cluster --name flaky-platform

That removes all data; the .env file stays behind.

What comes next

The chart delivers a working installation. The build-out for sustained production is planned and tracked:

  • High availability with no single points of failureIn development
  • Observability: metrics, logs, traces, alertingIn development
  • Secrets management through Vault or External SecretsIn development
  • TLS or mTLS between all servicesIn development
  • Migration away from the bitnamilegacy image baseIn development
  • Air-gapped operation with a self-hosted language model as a supported optionIn development

Applies to: This page describes lavalake 0.16.0. Product and documentation live in separate repositories — when in doubt, what the console shows is authoritative.

Something missing?

If these pages do not answer your question, we will walk through the platform against your own case in half an hour.

Book a demo