Install

Bring up the control plane with Helm, then apply an Agent CR. cert-manager is the only hard external prerequisite.

Prerequisites

cert-manager (≥ 1.13) — hard. Issues every serving / mTLS cert and injects the caBundles.
Postgres — bundled by the chart (eval), or external for prod (postgres.mode=external).
KEDA — optional, only for claim-mode autoscaling. The chart installs and runs fully without it.

1 · cert-manager

bash

kubectl apply -f https://github.com/cert-manager/\
  cert-manager/releases/latest/download/cert-manager.yaml

2 · the control plane

No control-plane component needs hostPath / hostPID / privilege — every component is an ordinary pod on the pod network — so the baseline PodSecurity level suffices.

bash

kubectl create namespace agentctl-system
kubectl label  namespace agentctl-system \
  pod-security.kubernetes.io/enforce=baseline

helm install agentctl ./charts/agentctl -n agentctl-system

kubectl -n agentctl-system get pods         # all Running
kubectl -n agentctl-system get certificate  # all READY=True
kubectl get apiservice v1alpha1.management.agentctl.dev  # AVAILABLE

On upgrade use helm upgrade --reset-then-reuse-values — plain --reuse-values drops newly added value blocks.

3 · run an agent

Declare an Agent. The operator renders a restricted-PSS pod that serves mTLS :8443/mcp and dials its bound provider directly — secret-free with AAuth, so no credential need land on the pod.

agent.yaml

apiVersion: agentctl.dev/v1alpha1
kind: Agent
metadata: { name: hello, namespace: team-a }
spec:
  image: ghcr.io/agentd-dev/agentd:1.0.0
  mode: reactive
  surfaces: { a2a: true }     # reachable over the A2A gateway (its wake source)
  # model: { pool: gpt }      # agent dials the pool's provider directly (AAuth or a mounted INTELLIGENCE_TOKEN)
  # mcpServers: [{ name: tools, endpoint: https://…, auth: { mode: aauth } }] # dialed directly

bash

kubectl apply -f agent.yaml
kubectl get agents -n team-a    # READY=True

Production notes

External Postgres: --set postgres.mode=external --set postgres.external.dsnSecretName=my-pg.
Private registry: --set image.registry=ghcr.io/your-org --set image.tag=vX.Y.Z.
Your own CA: --set certManager.caIssuerRef=my-ca-clusterissuer to chain into an existing PKI.