🚀 EDDI 6.5.0

19 LLM providers, knowledge bases that crawl your site and read your files, and conversations that follow compatible agent versionsWhat's new

Managed Cloud Get Started
All integrations
Infrastructurek8s / Helm / Kustomize

Kubernetes and Helm

Run EDDI on any conformant Kubernetes cluster with a single-file quickstart, a Helm chart or Kustomize overlays, with MongoDB or PostgreSQL.

ConfigurationDocs ↗

What you get

  • A quickstart manifest that deploys EDDI and MongoDB
  • A Helm chart and Kustomize overlays for production profiles
  • Optional components: Keycloak authentication, NATS JetStream, monitoring, ingress, pod disruption budget and network policy
  • MongoDB or PostgreSQL as the datastore

How it works in EDDI

  1. Apply the quickstart manifest, or install the Helm chart with a vault master key.
  2. Create the eddi-secrets Secret that holds the vault master key. No manifest writes it, on purpose.
  3. Choose the database overlay or Helm values for MongoDB or PostgreSQL.
  4. Add the optional components you need, such as Keycloak and ingress.
  5. For production secrets, sync eddi-secrets with the External Secrets Operator.

Configuration

Taken from the EDDI documentation. Placeholders such as your-agent-id are yours to replace.

Quickstart manifest (EDDI + MongoDB)EDDI and MongoDB in one command. The pod waits until the eddi-secrets Secret exists.
kubectl apply -f https://raw.githubusercontent.com/labsai/EDDI/main/k8s/quickstart.yaml
HelmHelm install with a generated vault master key.
helm install eddi ./helm/eddi \
  --set eddi.vaultMasterKey="$(openssl rand -base64 24)" \
  --namespace eddi --create-namespace
Helm: PostgreSQL instead of MongoDBThe Helm values that switch the datastore to PostgreSQL.
--set postgres.enabled=true --set mongodb.enabled=false --set eddi.datastoreType=postgres

Governance

  • No manifest ever writes the master-key Secret, so a re-apply cannot replace a live key and make existing secrets undecryptable.
  • The shipped Keycloak realm for Helm and Kustomize sets no default password for the privileged accounts.
  • The production profile adds a pod disruption budget and a network policy.

Good to know

  • The External Secrets Operator can sync the eddi-secrets Secret from AWS Secrets Manager, HashiCorp Vault, Azure Key Vault and similar. EDDI itself has no native client for those.
  • EDDI Solutions can run EDDI for you in your own cloud, on-premises or as a dedicated managed instance.
Get startedDocs ↗

Need it built and run for you?

EDDI Solutions builds and maintains connectors, runs EDDI as a managed or co-operated instance, and supports you in your own cloud or on-premises.

Talk to EDDI Solutions ↗

Related integrations

InfrastructureRed Hat OpenShiftEDDI ships a Red Hat certified container image built on UBI 10 that runs non-root on OpenShift 4.12 or newer, plus an Operator for OperatorHub.Identity and securitySecrets VaultA built-in, envelope-encrypted secrets vault. Configuration references secrets as ${vault:keyName}, and the value never lands in agent configs, exports or logs.Identity and securityKeycloak / OIDCPut OpenID Connect authentication in front of EDDI with Keycloak or another OIDC provider, with roles for admins, editors, users, viewers and approvers.

Configuration and behavior on this page follow the EDDI documentation, checked on 2026-10-14. Field names and defaults can change between releases, so confirm them in the docs for your version.