Skip to content
Omnimatch DocsOpen app

Kubernetes reference

On this pageDeployHTTPS and setup

For teams with an existing Kubernetes cluster. For a single server or cloud VM, start with Docker Compose.

Omnimatch needs one replica, a writable volume at /data owned by UID/GID 1000, and port 8787. Keep the Recreate strategy so two pods never write to the volume together. This is a single-instance deployment, not a highly available service.

Deploy

The image is public; no registry credentials or pull secret are needed. Run these commands with kubectl configured for your cluster:

Download the manifest, or copy the YAML below into kubernetes.yaml. It uses your cluster’s default storage class and a 10 GiB volume. Keep one replica.

curl -fsSLO https://omnimatch.ai/on-prem/kubernetes.yaml
kubectl create namespace omnimatch
kubectl -n omnimatch apply -f kubernetes.yaml
kubectl -n omnimatch rollout status deployment/omnimatch

kubernetes.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: omnimatch-state
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 10Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: omnimatch
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: omnimatch
  template:
    metadata:
      labels:
        app: omnimatch
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        fsGroup: 1000
      containers:
        - name: app
          image: ghcr.io/omnimatch/omnimatch-agents:onprem-stable
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8787
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          volumeMounts:
            - name: state
              mountPath: /data
              subPath: omnimatch
      volumes:
        - name: state
          persistentVolumeClaim:
            claimName: omnimatch-state
---
apiVersion: v1
kind: Service
metadata:
  name: omnimatch
spec:
  selector:
    app: omnimatch
  ports:
    - port: 8787
      targetPort: 8787
  type: ClusterIP

HTTPS and setup

Configure your ingress controller with TLS, preserving the original Host header and supporting WebSockets. Route to service omnimatch on port 8787 in namespace omnimatch. Restrict access to the administrator until setup is complete, then open your chosen HTTPS address and follow the wizard.

For a local trial only, run kubectl -n omnimatch port-forward service/omnimatch 8787:8787 and open http://localhost:8787 while the command is running. For a shared installation, configure HTTPS access before setup.