Installation Guide

# Controller configuration
controller:
  # Resource limits
  resources:
    requests:
      cpu: "100m"
      memory: "128Mi"
    limits:
      cpu: "500m"
      memory: "512Mi"

  # Exclude namespaces from monitoring
  excludedNamespaces:
    - kube-system
    - kguardian
    - monitoring
    - istio-system

  # Image configuration
  image:
    repository: ghcr.io/kguardian-dev/kguardian/controller
    pullPolicy: IfNotPresent

# Broker configuration
broker:
  replicaCount: 1
  resources:
    requests:
      cpu: "100m"
      memory: "256Mi"
    limits:
      memory: "1Gi"

# Frontend (UI)
frontend:
  replicaCount: 1

# Bundled PostgreSQL — see "Use External PostgreSQL" below to disable.
database:
  enabled: true
  user: rust
  databaseName: kube
  image:
    tag: "18-alpine"
  persistence:
    enabled: true
    # Auto-provisioned PVC sizing (only used when existingClaim is unset)
    size: "10Gi"
    # Empty string => use the cluster's default StorageClass.
    storageClassName: ""
    # Or BYO PVC:
    # existingClaim: "my-pg-pvc"

helm install kguardian oci://ghcr.io/kguardian-dev/charts/kguardian \
  --namespace kguardian \
  --create-namespace \
  --values values.yaml \
  --wait

broker:
  replicaCount: 3
  podDisruptionBudget:
    enabled: true
  leaderElection:
    enabled: true          # the default
    leaseDurationSeconds: 15
    renewDeadlineSeconds: 10
    retryPeriodSeconds: 2

(replicaCount + ceil(replicaCount x 0.25)) x dbPoolMaxSize + 13

database:
  # Disable the bundled in-cluster Postgres deployment, PVC, secret, and SA.
  enabled: false

  # Role + database the broker will connect as. Must already exist on the
  # external instance.
  user: kguardian
  databaseName: kguardian_prod

  # The chart will not create a credentials secret when external — supply
  # your own and reference it here.
  existingSecret: kguardian-db-secret
  passwordSecretKey: password

  external:
    # FQDN or hostname of the external Postgres. Can be in any namespace
    # (or outside the cluster) — the broker resolves it via DNS.
    host: postgres.databases.svc.cluster.local
    port: 5432
    # libpq sslmode. Cloud-managed Postgres typically requires "require".
    sslMode: prefer

kubectl create namespace kguardian
kubectl create secret generic kguardian-db-secret \
  --namespace kguardian \
  --from-literal=password='your-secure-password'

helm install kguardian oci://ghcr.io/kguardian-dev/charts/kguardian \
  --namespace kguardian \
  --values values.yaml --wait

kubectl create secret generic kguardian-anthropic \
  --namespace kguardian \
  --from-literal=api-key='sk-ant-...'

ai:
  enabled: true
  # openai | anthropic | gemini | copilot
  provider: anthropic
  secret: kguardian-anthropic

kubectl -n kguardian port-forward svc/kguardian-llm-bridge 8080:8080
curl -s http://localhost:8080/health
# {"status":"healthy","hasProvider":true,"mcp":false}

ai:
  enabled: true
  provider: openai
  secret: kguardian-litellm
  baseUrl: http://litellm.litellm.svc.cluster.local:4000/v1
  model: my-team/llama-3.3-70b

ai:
  enabled: true
  mcp:
    enabled: true
    auth:
      existingSecret: kguardian-mcp-token
      secretKey: token

frontend:
  sso:
    enabled: true
    httpRouteName: kguardian          # the HTTPRoute you expose the UI on
    hostnames: ["kguardian.example.com"]
    parentRefs:
      - name: envoy-external
        namespace: network-system
        sectionName: https
    oauth2Proxy:
      name: oauth2-proxy
      namespace: network-system
      port: 80

frontend:
  allowedHosts:
    - kguardian.internal.example.com
    - "*.corp.example.com"   # corp.example.com and its subdomains at any depth

kubectl get pods -n kguardian

# Expected output:
# NAME                                   READY   STATUS    RESTARTS   AGE
# kguardian-controller-xxxxx             1/1     Running   0          5m
# kguardian-broker-xxxxxxxxxx-xxxxx      1/1     Running   0          5m
# kguardian-db-xxxxxxxxxx-xxxxx          1/1     Running   0          5m
# kguardian-evaluator-xxxxxxxxxx-xxxxx   1/1     Running   0          5m
# kguardian-frontend-xxxxxxxxxx-xxxxx    1/1     Running   0          5m

kubectl logs -n kguardian daemonset/kguardian-controller --tail=50

# Look for:
# - "Network probe eBPF program loaded and attached"
# - "Syscall probe eBPF program loaded and attached"
# - "Ignoring namespaces: [...]"
# - No error messages

# Port-forward to broker
kubectl port-forward -n kguardian svc/kguardian-broker 9090:9090 &

# Test health endpoint
curl http://localhost:9090/health

# Expected: Healthy!
# A 503 with body "Database unavailable" or "Database schema not up to date"
# means the broker is up but cannot serve requests yet.

# Print the command help (the CLI port-forwards to the broker automatically)
kubectl kguardian gen networkpolicy --help

# Try generating a policy for a test pod
kubectl run test-nginx --image=nginx
sleep 30  # Let controller observe it
kubectl kguardian gen networkpolicy test-nginx -n default --dry-run

# 1. Check available versions (optional)
# You can view releases at https://github.com/kguardian-dev/kguardian/releases

# 2. Upgrade to a specific pinned version (preserves your values.yaml)
helm upgrade kguardian oci://ghcr.io/kguardian-dev/charts/kguardian \
  --version 1.14.0 \
  --namespace kguardian \
  --values values.yaml \
  --wait

# 3. Verify new version
kubectl get pods -n kguardian -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[0].image}{"\n"}{end}'

# 1. Uninstall Helm release
helm uninstall kguardian --namespace kguardian

# 2. Delete namespace (removes all resources)
kubectl delete namespace kguardian

# 3. Remove CLI plugin
sudo rm /usr/local/bin/kubectl-kguardian