> ## Documentation Index
> Fetch the complete documentation index at: https://docs.acornops.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy the platform on Kubernetes

> Install the central AcornOps services with the platform Helm chart

This page deploys the central platform. To add a cluster for AcornOps to manage, see [Connect a Kubernetes cluster](/use/connect-kubernetes).

## Before you begin

Complete the [deployment prerequisites](/deploy/prerequisites). In particular, prepare external Postgres, external Redis, public API and console hosts, TLS, identity settings, a model policy and credential plan, and the platform Secret.

## Services installed

The `acornops-platform` chart installs:

* management console,
* control plane,
* execution engine,
* LLM gateway,
* optional platform admin console when explicitly enabled,
* database migration Jobs.

The chart references operator-managed secret values rather than placing them directly in Helm values.

## Install

Choose `ACORNOPS_PLATFORM_VERSION` from the `acornopsPlatform` entry in the
[`stack-versions.yaml` release matrix](https://github.com/acornops/acornops-deployment/blob/main/release/stack-versions.yaml).
Create the Secret expected by your values, then install that exact chart version:

```bash theme={null}
export ACORNOPS_PLATFORM_VERSION="<version-from-stack-versions.yaml>"

helm upgrade --install acornops-platform oci://ghcr.io/acornops/charts/acornops-platform \
  --version "${ACORNOPS_PLATFORM_VERSION}" \
  --namespace acornops-platform \
  --create-namespace \
  --values values.prod.yaml
```

The chart pins the compatible platform images. Do not override one component
with an independently released tag unless a newer complete stack matrix lists
that combination.

Review public hosts, auth, workspace roles, run policy, model settings, target connectivity, gateway controls, internal transport, and network egress before installation.

## Exposure

For the core platform, expose only:

* the management console,
* the public control-plane API,
* the control-plane Agent WebSocket route.

Do not expose execution-engine or LLM-gateway service endpoints publicly.

If you enable the platform admin console, expose its dedicated host through the console BFF and keep direct public `/admin/v1` ingress disabled. See [Platform admin console](/deploy/platform-admin-console#enable-the-console).

## Replicas and rollout behavior

The chart supports multiple replicas for the management console, control plane, execution engine, and LLM gateway. Redis coordinates agent routing, run reservation, and event fanout where required. Connected target agents reconnect during a control-plane rollout, but active commands can fail or time out and may need to be retried.

## Continue

* Review the complete [deployment reference](/deploy/deployment-reference#kubernetes).
* Apply the [configuration guide](/deploy/configuration).
* Complete [production readiness validation](/deploy/production-readiness).