Deploy the control plane
Infrapilot runs as a self-hosted control plane inside your network or as a dedicated single-tenant instance in a region you choose. In both models, execution runners live in your perimeter and connect outbound only. This guide covers the self-hosted path on Kubernetes.
Before you begin
You will need a Kubernetes cluster running 1.28 or later with at least twelve vCPU and 48 GB of memory available across three worker nodes, a PostgreSQL 15 or later database, and object storage compatible with the S3 API for the audit ledger and artefact store.
- A namespace you control, with permission to create custom resource definitions
- Outbound HTTPS to your secrets broker and to any cloud provider APIs you intend to manage
- A TLS certificate for the console hostname, or cert-manager configured in the cluster
Deployment models
Self-hosted keeps every component inside your network, including model inference on the Sovereign plan. Dedicated cloud runs the control plane as a single-tenant instance in your chosen region while runners remain inside your perimeter. The runner protocol is identical in both models, so moving between them does not change your workflows.
Install the control plane
Add the Helm repository and install the chart. The operator reconciles the control-plane components, database schema and default policy bundle.
helm repo add infrapilot https://charts.infrapilot.io
helm repo update
helm install infrapilot infrapilot/control-plane \
--namespace infrapilot --create-namespace \
--set global.hostname=infrapilot.internal.example.com \
--set postgres.dsn="postgres://infrapilot@db.internal:5432/infrapilot" \
--set objectStore.endpoint="https://s3.internal.example.com" \
--set objectStore.bucket=infrapilot-ledger \
--set licence.key="$AETHERION_LICENCE"Verify the installation
The operator reports readiness once every component has passed its health check and the audit ledger has written its genesis entry.
$ kubectl -n infrapilot get infrapilot/control-plane
NAME VERSION PHASE LEDGER AGE
control-plane 2026.8.1 Ready sealed 3m12s
$ infrapilot status
control plane Ready 2026.8.1
database Connected PostgreSQL 16.3
object store Connected s3.internal.example.com
ledger Sealed genesis 9f2c41e0…b73a
runners 0 registeredNext steps
With the control plane running, the next step is to register a runner in each network segment you intend to manage, then run a scoped discovery scan to populate the knowledge graph.