Kubernetes deployment

A Kubernetes deployment requires Kubernetes 1.25+, a configured kubectl, an Ingress Controller, and access to an image registry; the Helm approach requires Helm 3. Scaling API replicas with local upload storage requires a StorageClass that supports ReadWriteMany.

External service requirements: PostgreSQL 17+ with pg_search (0.24.3) and pg_stat_statements preloaded, Redis 6+, Qdrant 1.7+.

Storage and default replicas

The single-file manifest creates three PVCs by default: postgres-data (10Gi, RWO), qdrant-data (10Gi, RWO), and uploads-data (10Gi, RWX, mounted by the API at /app/uploads only). Redis persistence differs: the single-file manifest uses emptyDir (cache recoverable), while Helm defaults to a 5Gi PVC.

Default replicas: api 2, worker 2, sandbox-worker 1, beat 1 (Recreate strategy), frontend 2. The manifest has no HPA; replicas are static and adjusted with kubectl scale.

Helm (recommended)

helm lint deploy/helm/clouisle \
  --set-string secrets.values.INTERNAL_API_TOKEN=lint-only-token
helm upgrade --install clouisle deploy/helm/clouisle \
  --namespace clouisle --create-namespace \
  --set-string secrets.values.INTERNAL_API_TOKEN="$(openssl rand -hex 32)"

In production, put SECRET_KEY, database, Redis, Qdrant, Sandbox, and internal Tokens into Kubernetes Secrets and use values-production.yaml.

Generate a single-file manifest

curl -fsSL https://raw.githubusercontent.com/clouisle/Clouisle/main/deploy/install.sh | \
  CLOUISLE_DEPLOYMENT=k8s CLOUISLE_K8S_MANIFEST="$PWD/clouisle-k8s.yaml" \
  CLOUISLE_YES=1 bash
kubectl apply -f ./clouisle-k8s.yaml

The generated file has 0600 permissions and contains Base64-encoded Secrets; the installer neither applies automatically nor modifies the template. Review images, domains, Ingress, storage, and Secrets before applying.

Scaling and limits

kubectl -n clouisle scale deployment worker --replicas=4
kubectl -n clouisle scale deployment sandbox-worker --replicas=2
kubectl -n clouisle scale deployment api --replicas=3

beat always stays at one replica. With ReadWriteOnce local upload volumes, keep the API at a single replica; production with multiple replicas should configure a shared volume or object storage.