Kubernetes

This guide covers how to get started with Deephaven quickly in a Kubernetes environment. Commands are shown for running in a Unix-like environment.

Note

This installation is intended for trial use only. System defaults are used throughout this document, which are not suitable for many production environments. For complete coverage of the Deephaven Kubernetes installation, see the Kubernetes installation guide.

Prerequisites

Before deploying Deephaven Enterprise with Kubernetes, you need the following prerequisites:

  • A Kubernetes cluster, with a dedicated namespace created for the Deephaven installation.
  • kubectl and helm command line tools.
  • A deephaven-helm package with the Helm charts (including the bundled deephaven-etcd and deephaven-nfs charts) and support scripts. This guide uses version 2026.01.055 as an example, though yours may differ.
  • A username and password for the repo.deephaven.io image repository, used to create an image pull secret. Deephaven's container images (including deephaven_etcd) are pulled directly from repo.deephaven.io.
    • Alternatively, Deephaven can provide the application images as a deephaven-containers package that you push to your own artifact repository (which then also requires docker and access to that repository). See Deephaven images.
  • A TLS webserver certificate and the private key that corresponds to it. The webserver and certificate must meet Deephaven's requirements. The Deephaven installation includes a LoadBalancer service (Envoy) that is the entry point for the application. A DNS entry for the hostname associated with this certificate must be created after the installation.

Set the namespace for your Kubernetes context

If you haven't already, create your Kubernetes namespace and set it to the default for your kubectl context.

Unzip the Deephaven Helm chart

Deephaven provides the Helm charts and support scripts in a deephaven-helm package. Unpack it:

If you plan to push the images to your own repository instead of pulling from repo.deephaven.io (see Deephaven images), place the deephaven-containers-2026.01.055.tar.gz package in the same directory; leave it zipped for now.

Deephaven images

Deephaven publishes the application container images to its image repository at repo.deephaven.io. By default, your cluster pulls them directly from there, so there is no separate load-and-push step. Create an image pull secret in your namespace using the username and password provided by your Deephaven associate - the same secret is also used for the deephaven_etcd image:

The Deephaven Helm chart references these images through image.repositoryUrl (set to repo.deephaven.io) and the pull secret through imagePullSecrets; both are configured when installing the Deephaven Helm chart.

Change directory

The rest of the commands in this guide are run from the helm subdirectory of the unpackaged Helm distribution.

Set up an NFS deployment

The Deephaven deployment needs a read-write-many (RWX) store. You can use an existing RWX volume in your environment, or install the bundled deephaven-nfs chart, which deploys an in-cluster NFS server and automatically creates the directory layout Deephaven expects (db/Systems, db/Users, and an etcd-backup directory).

The only required value is a storage class for the backing volume. premium-rwo is suitable for a GKE environment; for other providers, use, for example, gp2 for EKS or managed-csi for AKS. You can list the available storage classes with kubectl get storageclass.

It may take a minute for the NFS pod to become ready — check with kubectl get pods. The chart also creates a ClusterIP service named deephaven-nfs, which is used for the nfs.server value when installing the Deephaven Helm chart below.

Install the etcd Helm chart

The setup-deephaven-etcd.sh script in the setupTools directory of the deephaven-helm package installs the deephaven-etcd chart. The command below creates a single-node etcd deployment named dh-etcd without backup snapshots, which is suitable for a trial installation. Note the etcd installation name, as it is needed when installing the Deephaven Helm chart below.

The deephaven_etcd image is pulled from repo.deephaven.io/deephaven_etcd using the repo-deephaven-io-imgpull pull secret created in Deephaven images. Install etcd, passing the image repository and that pull secret:

Note

If you mirrored the deephaven_etcd image into your own repository instead, use that location for --repository and the corresponding pull secret.

Create a Kubernetes secret for the TLS certificate

With the TLS certificate and private key stored as files named tls.crt and tls.key, respectively, run this command to create a deephaven-tls secret from them.

Install the Deephaven Helm chart

You can now install the Deephaven Helm chart with a command similar to below, though note that the last --set option for the Envoy annotation networking.gke.io/load-balancer-type is specific to GKE and will not have an effect with other Kubernetes providers.

Note

Deephaven's primary point of service is the Envoy service load balancer. You can optionally provide annotation for this service which can affect how it operates.

  • You can set arbitrary properties on the Envoy service by prefacing the property with envoy.serviceAnnotations.
  • The example command sets a property named networking.gke.io/load-balancer-type. In GKE environments, this results in a non-external IP address for the Envoy service.
  • If you do not use an external IP address, you may need certain firewall rules to access the Envoy service in your Kubernetes cluster.
  • Omitting annotations can result in your cluster allocating an external IP address for the Envoy service.

You must provide your own values for these properties:

  • etcd.release: The name of the etcd release created earlier.
  • global.storageClass: An appropriate storage class for your Kubernetes environment that allows for auto-provisioning volumes.
  • nfs.pvPrefix: A prefix that will be prepended to pvc and pv objects.
  • nfs.server: The IP address of the NFS server. The example below uses a command to find it dynamically and can be left as is.
  • image.repositoryUrl: The container registry that holds the Deephaven Docker images. Use repo.deephaven.io to pull directly from Deephaven, or your own repository if you pushed the images there.
  • imagePullSecrets[0].name: The image pull secret created in the Deephaven images step.
  • image.tag: The tag for the Deephaven Docker images to use. This is the Deephaven version, e.g., 2026.01.055.
  • envoyFrontProxyUrl: The hostname/DNS entry used for your Deephaven cluster. It should match the hostname in the TLS certificate created earlier.

The installation takes a couple of minutes. You can see progress by tailing the log output of the install job with the command:

Create a DNS entry for the application

A DNS entry is required for the hostname referenced by the TLS certificate. It should use the IP address listed under the EXTERNAL-IP column after running kubectl get svc envoy. The process for creating a DNS entry varies depending on your Kubernetes provider and/or infrastructure.

The following command example creates a DNS entry in a GCP environment.

Set a password for the admin user

The following block contains two shell commands:

  • The first command opens a shell in the management shell pod.
  • The second command runs the dhconfig command to set the password. It sets it to adminpw1, but you are encouraged to provide your own that is more secure.

Log in

You can now access the application at a URL similar to https://yourhost.domain.com:8000/iriside, using the hostname that matches your webserver TLS certificate.

The Deephaven login screen