Deploy

Up and running in minutes.

Pick the path that matches what you have. Every path ends with the same check: a VM boots, and you see it.

Choose your path

Five ways in. One way to check.

One Helm command from GHCR

Charts and images are published to GitHub Container Registry on every release. kaironctl embeds the same chart, so no helm binary is needed either.

You need

A Kubernetes cluster and kubectl.
KVM and a reachable FluxVM service on each VM node.
The CSI snapshot stack if you want MachineSnapshot.

Drop the -f overlay for the evaluation profile. Helm applies CRDs only on first install; apply them from the same tag before upgrading.

Helm deployment guide

# 1. mark the nodes that can run VMs
kubectl label node worker-1 kairon.zyvor.dev/capable=true

# 2. install the production profile
helm upgrade --install kairon oci://ghcr.io/zyvorai/charts/kairon \
  --version 0.10.0 -n kairon-system --create-namespace \
  -f https://raw.githubusercontent.com/zyvorai/kairon/v0.10.0/charts/kairon/values-production.yaml

# or, without Helm
kaironctl install --profile production

# 3. check it, then prove it
kaironctl doctor
kaironctl selftest --profile quick

What happens

Source in, running VM out.

deploy-remote.sh --remote-build --self-test

Then prove it

Don't trust it. Boot a VM.

kaironctl selftest deploys a tiny CirrOS VM, exercises the platform against it, prints live coloured logs and ends with a PASS, FAIL or SKIP table. A skip always says which flag would enable it.

quick

Control plane, boot, serial console, power. About a minute.

standard

Adds the forwarded-port network, pause and resume, vCPU hotplug and usage samples.

full

Adds NIC and disk hotplug, snapshot-restore, fork and cold migration where the prerequisites exist.

How to read the result Getting started

After day one

Upgrade, roll back, diagnose.

From v0.9: apply deploy/crd.yaml and deploy/rbac.yaml from the v0.10.0 tag first, then upgrade kairon-ui and kairon-node together (both now speak TLS).
kaironctl upgrade keeps your values; --check compares with the latest release first.
kaironctl history and rollback list and restore Helm revisions.
kaironctl doctor explains every problem with a hint.
kaironctl sysdump and diagnose machine --deep collect redacted bundles for support.

Everything is HTTPS by default: the dashboard serves TLS and the console relay is pinned to a server name. Plain HTTP is only ever a named opt-out (ui.insecureHttp, --console-insecure-http).

CLI reference · Security

Stuck? We have a runbook for that.

Troubleshooting, migration failures and recovery drills are all written down.

Getting started Runbooks