# Install on Kubernetes

Kubernetes gives you enterprise-grade orchestration for Sentinel — flexible scaling, high availability, and a consistent deployment model across cloud, hybrid, or on-premises clusters. It's the recommended target if you're already running production workloads on k8s.

## Prerequisites

- An operational Kubernetes cluster.
- [Helm](https://helm.sh/) installed.
- `kubectl` configured to access your cluster.

## Step 1 — Add the Helm repository

```bash
helm repo add altcha-org https://altcha-org.github.io/helm-charts
helm repo update
```

The chart source is at [altcha-org/helm-charts](https://github.com/altcha-org/helm-charts).

## Step 2 — Install the chart

A minimal install:

```bash
helm install altcha-sentinel altcha-org/sentinel
```

For a production install with a specific version, ingress, and persistent storage:

```bash
helm install altcha-sentinel altcha-org/sentinel \
--namespace sentinel \
--create-namespace \
--set image.tag="1.0.0" \
--set service.type=LoadBalancer \
--set ingress.enabled=true \
--set ingress.hosts[0].host=sentinel.yourdomain.com \
--set persistence.enabled=true \
--set persistence.size="20Gi"
```

Commonly used values:

| Value | Purpose |
|---|---|
| `image.tag` | Sentinel version to deploy — see [Releases](/docs/sentinel/releases/). |
| `service.type` | `ClusterIP`, `NodePort`, or `LoadBalancer`. |
| `ingress.enabled` / `ingress.hosts` | Expose Sentinel through an Ingress controller. |
| `persistence.enabled` / `persistence.size` | Persistent storage for Sentinel's data. |
| `resources.requests` / `resources.limits` | CPU/memory requests and limits for the pod. |
| `env` | Extra environment variables, as a list — see [ENV Variables](/docs/sentinel/operations/env-variables/). |

Extra environment variables can also be set via a `values.yaml` file — this is also how you point Sentinel at the networked database and Redis it needs once you're running more than the embedded default (see [Databases](/docs/sentinel/databases/#enabling-an-external-main-database)):

```yaml
env:
- name: LOG_LEVEL
value: "debug"
- name: POSTGRES_URL
value: "postgresql://user:password@your-db-host:5432/altcha_sentinel"
```

```bash
helm install altcha-sentinel altcha-org/sentinel -f values.yaml
```

## Step 3 — Access the application

Once deployed, Sentinel is reachable at the address determined by your `service.type` / `ingress` configuration:

- Web interface: `http://<service-ip>:8080`
- API: `http://<service-ip>:8080/v1`
- API documentation: `http://<service-ip>:8080/v1/docs`

Sign in with the default credentials `root` / `root` and change the password immediately.

## Production configuration

<Callout>

Multi-replica (multi-instance) deployments require a **Professional** or **Enterprise** license. Trial licenses support up to 3 instances for testing; other tiers are limited to a single replica. See [License](/docs/sentinel/security/license/) and [Pricing](/pricing/).

Production deployments should run multiple replicas for high availability, which needs four variables set identically on every pod:

```yaml
env:
- name: SECRET_SEED
value: "<a long random string, identical on every node>"
- name: LICENSE_KEY
value: "<license key>"
- name: POSTGRES_URL
value: "postgresql://user:password@your-db-host:5432/altcha_sentinel"
- name: REDIS_URL
value: "redis://default@your-redis-host:6379"
```

```bash
helm install altcha-sentinel altcha-org/sentinel \
--namespace sentinel \
--create-namespace \
-f values.yaml
```

Scale to multiple replicas with `--set replicaCount=3` (or the equivalent field in `values.yaml`) once these are set — see the [chart's values reference](https://github.com/altcha-org/helm-charts) for the exact field name.

In production, prefer mounting these through Kubernetes `Secret`s and referencing them with `valueFrom.secretKeyRef` rather than putting them in `values.yaml` directly — or use any `_FILE` variant (e.g. `SECRET_SEED_FILE`) to point at a mounted secret file instead.

See [Clustering](/docs/sentinel/operations/clustering/#minimum-production-configuration) for what each variable does and how Sentinel behaves if the database or Redis becomes unreachable.

## Upgrading Sentinel

```bash
helm upgrade altcha-sentinel altcha-org/sentinel --set image.tag="1.2.3"
```

See [Releases](/docs/sentinel/releases/) for available versions.

## Next steps

- **[Configure](/docs/sentinel/configure/)** — set up your first Security Group and API Key.
- **[Reverse Proxy](/docs/sentinel/operations/reverse-proxy/)** — HTTPS termination if not handled by your Ingress controller.
- **[Monitoring & Logging](/docs/sentinel/operations/monitoring-logging/)** — track Sentinel's health once it's live.