Deploy DevGuard with Helm

Deploy DevGuard to a Kubernetes cluster using the official Helm chart. This is the recommended method for production deployments.

Prerequisites

  • Kubernetes cluster (1.24+)
  • Helm 3.x installed
  • kubectl configured for your cluster

Create namespace

In-Toto signing key

DevGuard signs In-Toto attestations with an EC (prime256v1) private key. By default, the chart generates this key on the first install. It stores it in a secret named ec-private-key and keeps the same key across upgrades. You don't need to do anything.

To bring your own key, for example to reuse an existing key or because your deployment tool doesn't support Helm's lookup function (such as Argo CD), create the secret and reference it:

Create your values file

Create a values.yaml with your configuration:

Install the chart

Verify deployment

All pods should reach Running status within a few minutes. You will find the postgres pod, kratos pod, API deployment, and web deployment.

Optional: CSAF Support

For CSAF advisory generation, create a PGP key pair:

Then add the CSAF section to your values.yaml (under the existing api: block):

Then upgrade the release:

Next Steps

Have feedback? We want to hear from you!

Fields marked with * are required