Deploy with Helm on Kubernetes

To deploy SUPERWISE® Sentinel on Kubernetes, install the SUPERWISE Helm chart with helm upgrade --install, setting the Sentinel ID, your SUPERWISE API client ID and secret, and optionally the gateway's public address. The chart works on any distribution, including EKS, GKE, AKS, OpenShift, and self-managed clusters, and suits production deployments that need horizontal scaling and high availability.

Before you start

• Complete Before you deploy: create the Sentinel, and have SENTINEL_ID, SW_CLIENT_ID, and SW_CLIENT_SECRET in your shell, plus SENTINEL_EXTERNAL_HOST if the gateway sits behind an ingress or load balancer.
• helm and kubectl access to the cluster.

Install the chart

helm upgrade --install sentinel-customers \
  oci://us-central1-docker.pkg.dev/admina33d6818/sentinel-public/sentinel-customers \
  --set global.imageRegistry=us-central1-docker.pkg.dev/admina33d6818/sentinel-public \
  --set gateway-server.image.repository=sentinel \
  --set gateway-server.image.tag=latest \
  --set "gateway-server.env[0].name=SENTINEL_ID,gateway-server.env[0].value=$SENTINEL_ID" \
  --set "gateway-server.env[1].name=SW_CLIENT_ID,gateway-server.env[1].value=$SW_CLIENT_ID" \
  --set "gateway-server.env[2].name=SW_CLIENT_SECRET,gateway-server.env[2].value=$SW_CLIENT_SECRET" \
  --set "gateway-server.env[3].name=SENTINEL_EXTERNAL_HOST,gateway-server.env[3].value=$SENTINEL_EXTERNAL_HOST"

The last line is optional: omit it to let the gateway auto-detect its address, which is reachable only from inside the cluster. Because Helm replaces the whole gateway-server.env list when you set entries with --set, keep the credential entries alongside it as shown.

The gateway answers health checks on /healthz and returns 404 on /. Keep the gateway always on, because it sends a heartbeat every 60 seconds. If your ingress has a request timeout, raise it so long streaming responses are not cut short. See Raise the request timeout.

Verify the gateway

The Sentinel turns Active in the SUPERWISE app within about a minute. First check that the container is serving. /healthz answers 200 OK:

curl -i "$SENTINEL_EXTERNAL_HOST"/healthz

HTTP/1.1 200 OK
...
{"status":"ok"}

/healthz shows only that the gateway is up. Then confirm a guardrail fires with POST /test, as described in Verify the gateway.

Update or remove it

To update, run the same helm upgrade --install command again, for example with a new gateway-server.image.tag. To remove the gateway, uninstall the release. The Sentinel's configuration stays in the SUPERWISE app.

helm uninstall sentinel-customers

Common errors

The gateway lost its credentials after a later helm upgrade

Helm replaces the whole gateway-server.env list when you set entries with --set, so an upgrade that sets only one entry drops the others. Pass every entry in each helm upgrade --install, as in Install the chart.

Health checks fail on /

The gateway returns 404 on /. Point liveness, readiness, and load balancer checks at /healthz.

Nobody outside the cluster can reach the gateway

SENTINEL_EXTERNAL_HOST is unset, so the gateway registered an address that is reachable only inside the cluster. Set it to the ingress or load balancer URL.

Get Sentinel: Create a free SUPERWISE account.

See also

• Deploy a gateway: every way to deploy, and what a team gateway needs on any platform.
• Deploy with Docker: one container on one host.
• Deploy on AWS (ECS Express Mode), Google Cloud (Cloud Run), and Azure (Container Apps): managed container services without Kubernetes.
• Gateway reference: environment variables, routes, and states.