Prerequisites

Before installing the operator, make sure your environment meets the following.

Cluster

• A Kubernetes cluster, v1.28 or newer. Tested on AKS, EKS, GKE, OpenShift, and local clusters (Kind / Minikube) for development.
• kubectl configured against the target cluster with cluster-admin privileges for the install (the operator installs CRDs, RBAC, and webhooks).
• A default StorageClass that supports dynamic provisioning if you plan to run managed datastores (Postgres, ClickHouse, Redis, MongoDB, Meilisearch).
• An ingress controller (e.g. ingress-nginx) and DNS if you want public endpoints for the gateway, chat UI, Langfuse, or the management console.

Resources

The operator installs and waits on several upstream operators, some of which run admission webhooks. Give the cluster enough headroom:

• The manager itself requests modest CPU but benefits from ~1Gi of memory — the in-binary Helm engine and chart rendering are memory-hungry, and the default Kubebuilder limits are too low for in-cluster operation.
• Each managed datastore brings up its own operator and pods; size nodes accordingly.

Secrets backend

SecretsManagement is required, so pick a backend before you start:

• External Secrets (ESO) with one of:
  • Azure Key Vault via Workload Identity (the production default on AKS) — needs a federated identity credential and a workload-identity-enabled ServiceAccount.
  • Azure Key Vault via a Service Principal — works anywhere, including non-AKS clusters and Kind.
  • HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, or any other ESO provider (a raw provider passthrough supports them all).
• Sealed Secrets — encrypted manifests decrypted in-cluster, no external store.

See Secrets Management for the full matrix.

Outbound access (or a mirror)

On first use the operator installs upstream charts that are embedded in the binary — so chart pulls do not require network access. However, the images those charts reference are pulled from public registries (ghcr.io, quay.io, Docker Hub, etc.). For air-gapped clusters, mirror those images into your internal registry and point the charts at it via the operator's value overrides.

Optional: an Enterprise license

The operator runs fully as the open-source Community edition with no license. To unlock multi-instance, multi-tenancy, auto-wiring, SSO/SCIM, or the PII guardrail, you need a signed license token from Navique. It is applied as a Secret referenced by the License resource. Get one — a trial, a purchase, or a download of your existing license — from the Navique customer portal at portal.navique.dev; see Managing a License.

Next

Continue to Installation.