← Back to reference

Kubernetes Deployment Guide

Prerequisites

  • kubectl ≥ 1.27
  • helm ≥ 3.13
  • cert-manager ≥ 1.13 (for production)
  • A K8s cluster with at least 8 GPUs (H100 or A100 recommended)

Step 1: Install cert-manager

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager \
    --namespace cert-manager --create-namespace \
    --set installCRDs=true

Step 2: Create the namespace

kubectl create namespace denpex-system

Step 3: Install the platform Helm chart

helm repo add denpex https://charts.denpex.ai
helm install denpex denpex/denpex-platform \
    --namespace denpex-system \
    --set controlPlane.image.tag=v0.7.0 \
    --set agent.image.tag=v0.7.0 \
    --set rbac.enabled=true \
    --set airgapped=false

Step 4: Install CRDs

kubectl apply -f https://charts.denpex.ai/crds/denpex-noderemediation.yaml
kubectl apply -f https://charts.denpex.ai/crds/denpex-policy.yaml
kubectl apply -f https://charts.denpex.ai/crds/denpex-cluster.yaml

Step 5: Create a DenpexCluster CR

apiVersion: denpex.ai/v1
kind: DenpexCluster
metadata:
  name: prod-cluster-a
  namespace: denpex-system
spec:
  ptp:
    server: ptp.example.com
  fabricManager:
    url: https://fm.example.com
    tokenSecret: fabric-manager-token
  ufm:
    url: https://ufm.example.com
    caBundle: <base64>
  rmaWebhook:
    url: https://rma.example.com
    tokenSecret: rma-token
kubectl apply -f cluster.yaml

Step 6: Verify

kubectl -n denpex-system get pods
kubectl -n denpex-system logs -l app=denpex-control-plane

RBAC Setup

The agent uses ServiceAccount: denpex-agent. The chart installs a ClusterRole granting read access to nodes, pods, and the GPU device plugin.

Production Hardening

  • Set podSecurityProfile: restricted.
  • Set networkPolicy.enabled: true.
  • Set rbac.minTlsVersion: TLSv1.3.
  • Set kms.mode: external with a customer-managed key.

Multi-Cluster

Repeat steps 1–5 in each cluster. Point the agent's DENPEX_CP_ENDPOINT to your SaaS control plane.