GlassFlow on Kubernetes using Helm

This guide will walk you through the process of installing GlassFlow on Kubernetes using Helm.

ℹ️ Note:

The official Helm chart is available at github.com/glassflow/charts .

The current Helm deployment does not expose GlassFlow to the internet by default. You must use kubectl port-forward to access the UI or API.

To expose GlassFlow externally (e.g., via a domain), you must configure ingress in your values.yaml. Refer to the section Using Ingress for more details.

Prerequisites

A running Kubernetes cluster
Helm installed
kubectl for interacting with your cluster (e.g., port forwarding the UI)

Installation

Add the GlassFlow Helm repository:


helm repo add glassflow https://glassflow.github.io/charts

Update the Helm repository:


helm repo update

Install the GlassFlow Helm chart:


helm install glassflow glassflow/glassflow-etl --create-namespace --namespace glassflow

This installs the GlassFlow Helm chart into the glassflow namespace. The --create-namespace flag ensures the namespace is created if it doesn’t already exist.

💡 Note:
By default, the deployment is not publicly accessible. To expose it, you must configure ingress settings in your values.yaml. You can use the default template as a starting point:
glassflow-etl values.yaml

Verify that the installation is successful:


helm list -n glassflow

The output should look like this:


NAME     	NAMESPACE	REVISION	UPDATED                              	STATUS  	CHART              	APP VERSION
glassflow	glassflow	1       	2025-09-03 15:07:47.125128 +0200 CEST	deployed	glassflow-etl-0.2.0	2.0.0

To check the services that were deployed:


kubectl get svc -n glassflow

The output should look like this:


NAME                                           TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
glassflow-api                                  ClusterIP   34.118.235.223   <none>        8081/TCP                     2m9s
glassflow-controller-manager-metrics-service   ClusterIP   34.118.227.29    <none>        8443/TCP                     2m10s
glassflow-nats                                 ClusterIP   34.118.237.53    <none>        4222/TCP                     2m10s
glassflow-nats-headless                        ClusterIP   None             <none>        4222/TCP,6222/TCP,8222/TCP   2m10s
glassflow-ui                                   ClusterIP   34.118.225.1     <none>        8080/TCP                     2m9s

List the pods that were deployed:


kubectl get pods -n glassflow

The output should look like this:


kubectl get pods -n glassflow
NAME                                            READY   STATUS    RESTARTS      AGE
glassflow-api-7f4bfd94b4-gdw5c                  1/1     Running   0             83s
glassflow-controller-manager-7d5dd699f9-cgj2c   1/1     Running   0             83s
glassflow-nats-0                                2/2     Running   0             82s
glassflow-nats-1                                2/2     Running   0             82s
glassflow-nats-2                                2/2     Running   0             82s
glassflow-nats-box-784bcdcf64-gdwwq             1/1     Running   0             83s
glassflow-ui-76bf46ff6d-lx4ng                   1/1     Running   0             83s

Port forward the UI service to your local machine to access the web interface:


kubectl port-forward service/glassflow-ui 8080:8080 -n glassflow

The GlassFlow UI service runs on port 8080. The command above forwards it to your local machine on the same port. If you’d prefer a different local port, simply adjust the command accordingly.

To access the API, you can port forward the API service to your local machine:


kubectl port-forward service/glassflow-api 8081:8081 -n glassflow

The GlassFlow API service runs on port 8081. The command above forwards it to port 8081 on your machine. You can modify this port if needed.

Open http://localhost:8080 in your browser to access the GlassFlow UI. You can now start creating pipelines. For help with your first pipeline, see the Usage Guide.

Exposing GlassFlow externally

Using Ingress

To expose GlassFlow externally, you must configure ingress in your values.yaml. You can see the complete configuration here . Update the values.yaml with the ingress configuration as shown below:


ingress:
  # Enable or disable ingress
  # Set to true to expose the application externally
  enabled: true  
  # Ingress class name (required for Kubernetes 1.18+)
  # Example: "nginx", "traefik", "istio"
  ingressClassName: "nginx"
 
  # Annotations for the ingress resource
  # Useful for SSL termination, rate limiting, etc.
  annotations: {}
  # Host configurations for the ingress  
  hosts: 
  - host: "glassflow.example.com"
    paths:
    - path: "/"
      pathType: Prefix
      serviceName: "glassflow-ui"
      servicePort: 8080
    - path: "/api/v1"
      pathType: Prefix
      serviceName: "glassflow-api"
      servicePort: 8081
  tls: []

Update the hosts with the domain you want to use for GlassFlow. After updating the values.yaml, run the following command to apply the changes:


helm upgrade glassflow glassflow/glassflow-etl -f values.yaml --namespace glassflow

You must configure your DNS to point to the IP address of the ingress controller. You can get the IP address of the ingress controller by running the following command:


kubectl get ingress -n glassflow
NAME                      CLASS   HOSTS              ADDRESS       PORTS     AGE
glassflow-glassflow-etl   nginx   glassflow.example.com   34.40.1.1   80, 443   5h16m

Update the DNS record to point to the IP address of the ingress controller.

Setting up TLS

By default, the ingress does not have TLS enabled. This means the traffic is via http. You can enable TLS by adding the following to the values.yaml:


ingress:
  # Enable or disable ingress
  # Set to true to expose the application externally
  enabled: true
  
  # Ingress class name (required for Kubernetes 1.18+)
  # Example: "nginx", "traefik", "istio"
  ingressClassName: "nginx"
 
  # Annotations for the ingress resource
  # Cert-manager annotations for automatic TLS certificate management
  annotations:
    # Cert-manager cluster issuer for Let's Encrypt
    cert-manager.io/cluster-issuer: "letsencrypt-prod"    
    # Nginx ingress controller annotations
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"        
 
  hosts: 
  - host: "glassflow.example.com"
    paths:
    - path: "/"
      pathType: Prefix
      serviceName: "glassflow-ui"
      servicePort: 8080
    - path: "/api/v1"
      pathType: Prefix
      serviceName: "glassflow-api"
      servicePort: 8081
 
  # TLS configuration for HTTPS with Let's Encrypt
  # Cert-manager will automatically create and manage the TLS secret
  tls:
    - hosts:
        - "glassflow.example.com"
      secretName: "glassflow-tls-secret"

After updating the values.yaml, run the following command to apply the changes:


helm upgrade glassflow glassflow/glassflow-etl -f values.yaml --namespace glassflow

The above configuration will use Cert-manager to automatically create and manage the TLS secret. You must have Cert-manager installed in your cluster. Create a file called cert-manager-issuer.yaml with the following content:


# Cert-manager ClusterIssuer for Let's Encrypt
# This file should be applied to your cluster before deploying the Helm chart
# with TLS configuration.
 
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager
spec:
  acme:
    # Let's Encrypt production server
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address for Let's Encrypt account
    email: [email protected]  # CHANGE THIS TO YOUR EMAIL
    # Private key secret for storing the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-prod
    # HTTP01 challenge solver
    solvers:
    - http01:
        ingress:
          class: nginx

You can apply the above file to your cluster by running the following command:


kubectl apply -f cert-manager-issuer.yaml

This will create a ClusterIssuer in the cert-manager namespace and automatically create and manage the TLS secret.

In case you have your own TLS certificate, you can create the secret manually by running the following command: Please replace path/to/your/cert.pem and path/to/your/key.pem with the path to your own TLS certificate and key. Please replace glassflow-tls-secret with the name of the secret you want to create.


kubectl create secret tls glassflow-tls-secret \
  --cert=path/to/your/cert.pem \
  --key=path/to/your/key.pem \
  --namespace glassflow

Getting Help

If you encounter any issues during installation:

Join our Slack community
Email our support team at [email protected]
Open an issue on GitHub
Start a conversation on GitHub Discussions