---
title: "Kubernetes via Helm Chart"
description: "Use our Helm chart to Install Infisical on your Kubernetes cluster"
--- 
**Prerequisites**
- You have understanding of [Kubernetes](https://kubernetes.io/)
- Installed [Helm package manager](https://helm.sh/) version v3.11.3 or greater
- You have [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) installed and connected to your kubernetes cluster

<iframe width="100%" height="375" src="https://www.youtube.com/embed/ugJZSCcZaV8" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
 

By deploying Infisical on Kubernetes, you can take advantage of its features to ensure that the application is fault-tolerant, highly available, and scalable.
To make the installation process easier and more streamlined, we have created a Helm chart that you can use to install Infisical on Kubernetes. 

Helm is a package manager for Kubernetes that simplifies the installation and management of Kubernetes applications. 
With our Helm chart, you can easily install Infisical on Kubernetes, configure it to your liking, and scale it up or down as needed. 

## Install Infisical Helm repository 

```bash
helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' 
  
helm repo update
```

## Add Helm values 

Create a values.yaml file to configure various installation settings, such as the docker image tags and environment variables for both the frontend and backend. To explore all configurable properties for your values file, [visit this page](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical).

#### Set image tags

By default, the application will use the latest tag to retrieve the required Docker images, which may be appropriate for most cases. 
However, it's important to specify a particular version of Infisical during installation to prevent any significant updates from disrupting your deployment.
View [properties for frontend and backend](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical#parameters).


To determine the appropriate versions to use for the docker images, follow the links bellow 
- [frontend Docker image](https://hub.docker.com/r/infisical/frontend/tags) 
- [backend Docker image](https://hub.docker.com/r/infisical/backend/tags)

```yaml simple-values-example.yaml 
frontend:
  name: frontend
  replicaCount: 2
  image:
    repository: infisical/frontend
    tag: "v0.1.3"
    pullPolicy: Always

backend:
  replicaCount: 2
  image:
    repository: infisical/backend
    tag: "v0.1.3"
    pullPolicy: Always
```

#### Configure environment variables

You can configure environment variables for the frontend and backend in your Helm values file under the property `frontendEnvironmentVariables` and `backendEnvironmentVariables` respectively. View configurable [environment variables](../configuration/envars).

Infisical requires the following backend environment variables to be defined: _`ENCRYPTION_KEY`_, _`JWT_SIGNUP_SECRET`_, _`JWT_REFRESH_SECRET`_, _`JWT_AUTH_SECRET`_, _`JWT_MFA_SECRET`_ and _`JWT_SERVICE_SECRET`_. 

<Info>
Each of the above environment variables can be generated by running the command `openssl rand -hex 16` in your terminal. 
</Info>

However, when the above environment variables are not defined, the Helm chart 
will automatically generate these environment variables for you. The generated environment variables will be saved to a Kubernetes secret and will be preserved between upgrades or uninstalls. 

```yaml simple-values-example.yaml 
...
backendEnvironmentVariables:
  HTTPS_ENABLED: true
  INVITE_ONLY_SIGNUP: false
  ...
```

<Info>
  Infisical assumes that you have configured HTTPS. If you didn't configure HTTPS, set `HTTPS_ENABLED` to `false` in the backend environment variable to avoid frequent logouts.
</Info>

#### Routing external traffic
By default, Infisical takes all traffic coming to your external load balancer's IP address and routes them Infisical's services. 
Infisical uses Nginx to route external traffic. You can install Nginx along with Infisical by setting `ingress.enabled` to `true` in the Helm values file. View all [properties for ingress](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical).

```yaml simple-values-example.yaml 
...
ingress:
  nginx:
    enabled: false #<-- if you would like to install nginx along with Infisical
```

#### Database 
Infisical uses a document database as its persistence layer. With this Helm chart, you spin up a MongoDB instance power by Bitnami along side other Infisical services in your cluster. 
When persistence is enabled, the data will be stored a Kubernetes Persistence Volume. View all [properties for mongodb](https://github.com/Infisical/infisical/tree/main/helm-charts/infisical).

```yaml simple-values-example.yaml 
mongodb:
  enabled: false
  persistence:
    enabled: false
```

To increase data redundancy, we recommend that you use a managed document database service such as AWS Document DB, MongoDB or similar services instead. 
Managed database connection string can be set in the `backendEnvironmentVariables`.

#### Example helm values
```yaml simple-values-example.yaml 
frontend:
  name: frontend
  replicaCount: 2
  image:
    repository: infisical/frontend
    tag: "v0.1.3"
    pullPolicy: Always

backend:
  replicaCount: 2
  image:
    repository: infisical/backend
    tag: "v0.1.3"
    pullPolicy: Always

backendEnvironmentVariables:
  HTTPS_ENABLED: true

ingress:
  nginx:
    enabled: false #<-- if you would like to install nginx along with Infisical

```

<Accordion title="Full helm values example">
  ```yaml values.yaml 
  ingress:
    nginx:
      enabled: true

  frontend:
    enabled: true
    name: frontend
    podAnnotations: {}
    deploymentAnnotations: {}
    replicaCount: 4
    image:
      repository: infisical/frontend
      tag: "v0.1.3"
      pullPolicy: IfNotPresent
    kubeSecretRef: null
    service:
      annotations: {}
      type: ClusterIP
      nodePort: ""

  backend:
    enabled: true
    name: backend
    podAnnotations: {}
    deploymentAnnotations: {}
    replicaCount: 4
    image:
      repository: infisical/backend
      tag: "v0.1.3"
      pullPolicy: IfNotPresent
    kubeSecretRef: null
    service:
      annotations: {}
      type: ClusterIP
      nodePort: ""
  
  # View all environment variables https://infisical.com/docs/self-hosting/configuration/envars
  backendEnvironmentVariables:
    MONGO_URL: <>
    HTTPS_ENABLED: <>
    

  ## Mongo DB persistence 
  mongodb:
    enabled: false
    persistence:
      enabled: false

  ingress:
    enabled: true
    annotations:
      cert-manager.io/cluster-issuer: "letsencrypt-prod" # <-- if you are setting up HTTPS
    hostName: app.infisical.com ## <- Replace with your own domain
    frontend:
      path: /
      pathType: Prefix
    backend:
      path: /api
      pathType: Prefix
    tls: # <-- if you are setting up HTTPS
      - secretName: echo-tls
        hosts:
          - app.infisical.com

  ```
</Accordion>

## Install the Helm chart 

By default, the helm chart will be installed on your default namespace. If you wish to install the Chart on a different namespace, you may specify
that by adding the `--namespace <namespace-to-install-to>` to your `helm install` command.

```bash
## Installs to default namespace
helm install infisical-helm-charts/infisical --generate-name --values /path/to/values.yaml
```

## Access Infisical
Allow 3-5 minutes for the deployment to complete. Once done, you should now be able to access Infisical on the IP address exposed via Ingress on your load balancer. If you are not sure what the IP address is run `kubectl get ingress` to view the external IP address exposing Infisical.
  
<Info>
Once installation is complete, you will have to create the first account. No default account is provided.
</Info>