Install Portainer with Kubernetes on your Self-Managed Infrastructure
These instructions are for Portainer Community Edition. For Business Edition, please refer to the Business Edition documentation.

Introduction

Portainer consists of two elements, the Portainer Server and the Portainer Agent. Both elements run as lightweight containers on Kubernetes.
To get started, you will need:
  • A working and up to date Kubernetes cluster.
  • Access to run helm or kubectl commands on your cluster.
  • Cluster Admin rights on your Kubernetes cluster. This is so Portainer can create the necessary ServiceAccount and ClusterRoleBinding for it to access the Kubernetes cluster.
  • A default StorageClass configured (see below).
The installation instructions also make the following assumptions about your environment:
  • Your environment meets our requirements. While Portainer may work with other configurations, it may require configuration changes or have limited functionality.
  • Kubernetes RBAC is enabled and working (this is required for the access control functionality in Portainer).
  • You will be using the portainer namespace for Portainer.
  • Kubernetes' metrics server is installed and working (if you wish to use the metrics within Portainer).

Data Persistence

Portainer requires data persistence, and as a result needs at least one StorageClass available to use. Portainer will attempt to use the default StorageClass during deployment. If you do not have a StorageClass tagged as default the deployment will likely fail.
You can check if you have a default StorageClass by running the following command on your cluster:
1
kubectl get sc
Copied!
and looking for a StorageClass with (default) after its name:
1
[email protected]:~# kubectl get sc
2
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
3
managed-nfs-storage (default) k8s-sigs.io/nfs-subdir-external-provisioner Delete Immediate false 11d
Copied!
To set a StorageClass as default, you can use the following:
1
kubectl patch storageclass <storage-class-name> -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
Copied!
replacing <storage-class-name> with the name of your StorageClass. Alternatively, if you are installing using our Helm chart, you can pass the following parameter in your helm install command to specify the StorageClass to use for Portainer:
1
--set persistence.storageClass=<storage-class-name>
Copied!
In some Kubernetes clusters (for example microk8s), the default StorageClass simply creates hostPath volumes, which are not explicitly tied to a particular node. In a multi-node cluster, this can create an issue when the pod is terminated and rescheduled on a different node, "leaving" all the persistent data behind and starting the pod with an "empty" volume.
While this behavior is inherently a limitation of using hostPath volumes, a suitable workaround is to use add a nodeSelector to the deployment, which effectively "pins" the Portainer pod to a particular node. You can do this by editing your own values.yaml file to set the nodeSelector value:
nodeSelector: kubernetes.io/hostname: \<YOUR_NODE_NAME>
or alternatively follow the instructions below for each deployment method.

Deployment

To deploy Portainer within a Kubernetes cluster you can use our provided Helm charts or YAML manifests.

Deploy using Helm

Ensure you're using at least Helm v3.2, which includes support for the --create-namespace argument.
First add the Portainer Helm repository by running the following commands:
1
helm repo add portainer https://portainer.github.io/k8s/
2
helm repo update
Copied!
Once the update completes, you're ready to begin the installation. Which method you choose will depend on how you wish to expose the Portainer service:
Expose via NodePort
Expose via Ingress
Expose via Load Balancer
Using the following command, Portainer will be available on port 30777 for HTTP and 30779 for HTTPS:
1
helm install --create-namespace -n portainer portainer portainer/portainer
Copied!
By default, Portainer generates and uses a self-signed SSL certificate to secure port 30779. Alternatively you can provide your own SSL certificate during installation or via the Portainer UI after installation is complete.
In this example, Portainer will be deployed to your cluster and assigned a Cluster IP, with an nginx Ingress Controller at the defined hostname. For more on Ingress options, refer to the list of Chart Configuration Options.
1
helm install --create-namespace -n portainer portainer portainer/portainer \
2
--set service.type=ClusterIP \
3
--set ingress.enabled=true \
4
--set ingress.annotations.'kubernetes\.io/ingress\.class'=nginx \
5
--set ingress.annotations."nginx\.ingress\.kubernetes\.io/backend-protocol"=HTTPS \
6
--set ingress.hosts[0].host=portainer.example.io \
7
--set ingress.hosts[0].paths[0].path="/"
Copied!
Using the following command, Portainer will be available at an assigned Load Balancer IP on port 9000 for HTTP and 9443 for HTTPS:
1
helm install --create-namespace -n portainer portainer portainer/portainer \
2
--set service.type=LoadBalancer
Copied!
By default, Portainer generates and uses a self-signed SSL certificate to secure port 9443. Alternatively you can provide your own SSL certificate during installation or via the Portainer UI after installation is complete.
To explicitly set the target node when deploying the Helm chart on the CLI, include --set nodeSelector.kubernetes\.io/hostname=<YOUR NODE NAME> in your helm install command.

Deploy using YAML manifests

Our YAML manifests support exposing Portainer via either NodePort or Load Balancer.
Expose via NodePort
Expose via Load Balancer
To expose via NodePort, you can use the following command (Portainer will be available on port 30777 for HTTP and 30779 for HTTPS):
1
kubectl apply -n portainer -f https://raw.githubusercontent.com/portainer/k8s/master/deploy/manifests/portainer/portainer.yaml
Copied!
By default, Portainer generates and uses a self-signed SSL certificate to secure port 30779. Alternatively you can provide your own SSL certificate during installation or via the Portainer UI after installation is complete.
To expose via Load Balancer, this command will provision Portainer at an assigned Load Balancer IP on port 9000 for HTTP and 9443 for HTTPS:
1
kubectl apply -n portainer -f https://raw.githubusercontent.com/portainer/k8s/master/deploy/manifests/portainer/portainer-lb.yaml
Copied!
By default, Portainer generates and uses a self-signed SSL certificate to secure port 9443. Alternatively you can provide your own SSL certificate during installation or via the Portainer UI after installation is complete.
To explicitly set the target node when deploying using YAML manifests, run the following one-liner to "patch" the deployment, forcing the pod to always be scheduled on the node it's currently running on:
1
kubectl patch deployments -n portainer portainer -p '{"spec": {"template": {"spec": {"nodeSelector": {"kubernetes.io/hostname": "'$(kubectl get pods -n portainer -o jsonpath='{ ..nodeName }')'"}}}}}' || (echo Failed to identify current node of portainer pod; exit 1)
Copied!

Logging In

Now that the installation is complete, you can log into your Portainer Server instance. Depending on how you chose to expose your Portainer installation, open a web browser and navigate to the following URL:
NodePort
Ingress
Load Balancer
1
https://localhost:30779/ or http://localhost:30777/
Copied!
Replace localhost with the relevant IP address or FQDN if needed, and adjust the port if you changed it earlier.
1
https://<FQDN>/
Copied!
Replace <FQDN> with the FQDN of your Portainer instance.
1
https://<loadbalancer IP>:9443/ or http://<loadbalancer IP>:9000/
Copied!
Replace <loadbalancer IP> with the IP address or FQDN of the load balancer, and adjust the port if you changed it earlier.
You will be presented with the initial setup page for Portainer Server.
Last modified 4d ago