Skip to main content
For organizations that need full control over where their data flows. Deploy the gateway and coordinator in your Kubernetes cluster.

​
Prerequisites

RequirementMinimum Version
Kubernetes1.27+
Helm3.x
PostgreSQL15+ (or Neon Postgres)
Redis7+
Container registry accessAccess to ghcr.io/sirtingling for Takumo images

​
Deployment

1

Add the Helm repository

helm repo add takumo https://charts.takumo.io
helm repo update
2

Create namespace and secrets

kubectl create namespace takumo
Create the database credentials for the coordinator:
kubectl create secret generic coordinator-database \
  --namespace takumo \
  --from-literal=database-url="postgres://user:pass@host:5432/takumo" \
  --from-literal=database-url-direct="postgres://user:pass@host:5432/takumo"
Create the JWT signing and verification keys:
kubectl create secret generic coordinator-jwt-signing \
  --namespace takumo \
  --from-file=signing.pem=./signing.pem \
  --from-file=verification.pem=./verification.pem
Create the image pull secret for ghcr.io:
kubectl create secret docker-registry ghcr-pull-secret \
  --namespace takumo \
  --docker-server=ghcr.io \
  --docker-username=YOUR_USERNAME \
  --docker-password=YOUR_PAT
3

Deploy the coordinator

The coordinator uses the manual secrets provider for on-prem, meaning it expects you to create Kubernetes secrets yourself (done in the previous step).
helm install gateway-coordinator takumo/gateway-coordinator \
  --namespace takumo \
  --values https://charts.takumo.io/gateway-coordinator/values-onprem.yaml
This sets:
  • secrets.provider: manual
  • secrets.database.enabled: true with secret name coordinator-database
  • secrets.jwtSigning.enabled: true with secret name coordinator-jwt-signing
Verify the coordinator is running:
kubectl get pods -n takumo -l app.kubernetes.io/name=gateway-coordinator
4

Deploy the gateway

helm install aegis-shield takumo/aegis-shield \
  --namespace takumo \
  --values https://charts.takumo.io/aegis-shield/values-onprem.yaml \
  --set connector.grpcUrl="gateway-coordinator.takumo.svc.cluster.local:9090"
This configures the gateway to connect to the coordinator via gRPC on port 9090 and disables the cloud connector (cloud.enabled: false).Verify the gateway is running:
kubectl get pods -n takumo -l app.kubernetes.io/name=aegis-shield
5

Create a join key in the dashboard

Go to Settings > Gateway in the dashboard and click Create Join Key. Give it a name (e.g., production-cluster). Copy the key immediately.
6

Configure the gateway with the join key

Create the join key secret:
kubectl create secret generic aegis-join-key \
  --namespace takumo \
  --from-literal=join-key="your-join-key-here"
Upgrade the gateway to use it:
helm upgrade aegis-shield takumo/aegis-shield \
  --namespace takumo \
  --reuse-values \
  --set secrets.joinKey.enabled=true \
  --set secrets.joinKey.secretName=aegis-join-key
7

Verify the connection

Check the Fleet page in the dashboard. Your gateway instance should appear with a Connected state.You can also verify locally:
kubectl logs -n takumo -l app.kubernetes.io/name=aegis-shield --tail=20
Look for a log line indicating successful registration with the coordinator.
The join key is shown once. Store it in your secrets management system (Vault, AWS Secrets Manager, etc.) before closing the dialog.

​
Required secrets reference

​
Coordinator

Secret NameKeysDescription
coordinator-databasedatabase-url, database-url-directPostgreSQL connection strings (pooled and direct)
coordinator-jwt-signingsigning.pem, verification.pemJWT signing and verification key pair
coordinator-join-keyjoin-keyJoin key for gateway authentication (optional)

​
Gateway

Secret NameKeysDescription
aegis-jwt-keypublic.pemJWT public key for auth verification
aegis-join-keyjoin-keyJoin key for coordinator registration
ghcr-pull-secretDocker registry credentialsImage pull secret for ghcr.io

​
Network requirements

The gateway needs outbound access to:
  • Your AI provider (e.g., api.anthropic.com, api.openai.com)
  • The coordinator gRPC endpoint (port 9090)
The coordinator needs:
  • Access to PostgreSQL
  • Inbound gRPC from gateway pods (port 9090)
  • Inbound HTTP for health checks (port 8080)
Both services create NetworkPolicy resources by default (networkPolicy.enabled: true).