Skip to content

Installation with Helm

Deploy AntFlow on Kubernetes with the official Helm chart. The default deployment includes the Server, UI, a Kubernetes launcher, and PostgreSQL.

Requirements

  • A Kubernetes cluster with DNS and persistent storage, including shared writable storage for Kubernetes workflow jobs (ReadWriteMany).
  • kubectl configured to access the cluster and Helm.
  • A GitLab.com account.
  • An existing S3-compatible bucket and credentials with permission to write job results. Provision the access key ID and secret access key as two local files through your approved credential-management procedure. Each file must contain only its credential value, without an added newline.

Use the same configured Kubernetes context throughout. The commands below create resources in that cluster and deploy AntFlow; they do not modify the demo. Interactive prompts use Bash.

1. Set up authentication

On GitLab.com, open User Settings > Applications and create an OAuth application:

  • Application name: AntFlow.
  • Confidential: off.
  • Redirect URI: http://localhost:8080/.
  • Scopes: openid, profile, email, read_api.

Keep the Application ID for the Helm values in the next step.

2. Install AntFlow

Create a namespace and a Secret from your credential files. Enter their paths, not the credential values, at the prompts:

kubectl create namespace antflow
read -r -p "S3 access key ID file: " S3_ACCESS_KEY_FILE
read -r -p "S3 secret access key file: " S3_SECRET_KEY_FILE
kubectl create secret generic antflow-s3 --namespace antflow \
  --from-file="s3_access_key_id=$S3_ACCESS_KEY_FILE" \
  --from-file="s3_secret_access_key=$S3_SECRET_KEY_FILE"

Protect credential files

Restrict access to the source files, keep them out of Git, and remove them according to your credential-management policy after provisioning. If your platform manages Kubernetes Secrets centrally, have it provision antflow-s3 with these two keys instead.

Create a values file named antflow-values.yaml, replacing the Application ID, administrator email, S3 endpoint, bucket name, and storage class:

configs:
  admins:
    - admin@example.com
  oidc:
    clientId: "<gitlab-application-id>"
  s3:
    endpoint_url: https://s3.example.com
    bucket_name: antflow-data
    credentials:
      existingSecret: antflow-s3

launcher:
  persistence:
    storageClass: "<rwx-storage-class>"

The chart defaults to https://gitlab.com for repositories and authentication.

Install the latest chart version:

helm install antflow \
  oci://registry.gitlab.com/csgroup-oss/antflow/antflow/charts/antflow \
  --namespace antflow \
  --values antflow-values.yaml

The chart registers the integrated launcher and supplies its token automatically. No separate component installations or manual launcher registration are needed.

Wait for the UI and server to be ready:

kubectl rollout status deployment/antflow-ui --namespace antflow
kubectl rollout status deployment/antflow-server --namespace antflow

3. Access AntFlow

In one terminal, forward the UI port:

kubectl port-forward --namespace antflow service/antflow-ui 8080:80

In a second terminal, forward the API port:

kubectl port-forward --namespace antflow service/antflow-server 8000:8000

Keep both commands running and open http://localhost:8080/.

4. Sign in

Sign in with your GitLab account.

Administrator access

Sign in with an email listed in configs.admins.

The integrated launcher is ready for Kubernetes workflow execution.

What's next