Helm chart repository for KubeGraf — the AI SRE platform for Kubernetes. Two charts to choose between: the agent for our hosted control plane, or the whole platform inside your own network.

Add the repository

helm repo add kubegraf https://charts.kubegraf.io
helm repo update

Charts

kubegraf

The in-cluster agent. Install it into any cluster you want monitored; it dials out to the hosted KubeGraf control plane at kubegraf.io. Outbound only — no inbound ports. 

helm install kubegraf kubegraf/kubegraf \
  -n kubegraf --create-namespace \
  --set kubegraf.agentToken=kgagent_xxxxxxxx \
  --set kubegraf.clusterName=prod

The token comes from kubegraf.io → Settings → Agent Tokens and always starts with kgagent_ — the chart's schema rejects anything else.

EU data residency: add --set kubegraf.cloudRegion=eu. Pointing at a self-hosted platform instead: --set kubegraf.cloudApiUrl=https://kubegraf.example.com.

Documentation kubegraf.io
kubegraf-selfhosted

The whole platform, in your network. One umbrella chart brings up web, api, connect, Postgres and the agent inside your own cluster — EKS, GKE, AKS, on-prem or OpenShift. Your data never leaves; the only egress is the AI Gateway call for LLM steps. 

helm install kubegraf kubegraf/kubegraf-selfhosted \
  -n kubegraf --create-namespace \
  --set hostname=kubegraf.example.com \
  --set ingressClassName=nginx \
  --set subscription.installKey=kginstall_xxxxxxxx

Evaluating on kind or minikube? Install with no flags and port-forward svc/kubegraf-web — every secret is generated for you. Either way the images need the pull credential issued with your subscription.

Self-hosted & enterprise Documentation
kubegraf-platform Superseded

The original self-hosted chart, replaced by kubegraf-selfhosted and left at 0.1.0. It is still in index.yaml so existing installs keep resolving, but it is no longer built or released. Don't start here.

Self-hosted, in practice

Air-gapped and private registries. Point the whole platform at your mirror with --set global.kubegrafImageRegistry=registry.internal.example.com/kubegraf. Deliberate digest overrides need --set imagePins.enforce=off; the chart pins and verifies digests by default.

OpenShift. --set global.openshift.enabled=true adapts the security contexts to run under the restricted-v2 SCC.

Exposure. Gateway API is the forward path — --set gateway=<namespace>/<gateway-name> emits an HTTPRoute against a Gateway you already run. For Ingress instead, --set ingressClassName=<class>. Both read the hostname from --set hostname=. The chart never installs a controller, a Gateway or a certificate — TLS and DNS stay at your edge.