One pod, deploymentMode: standalone, everything in one process. This is the shape Choose your deployment points at for Kubernetes running everything in one pod.

1. Prerequisites

A cluster with a default StorageClass (for the event log's PVC) and helm installed locally.

2. Install

helm install jaque oci://<registry>/jaque/charts/jaque --version <chart version> \
  -f values.yaml

See Kubernetes for what deploymentMode selects and what the chart refuses to render.

3. The values file

The canonical copy is deploy/kubernetes/single/values.yaml in the repository.

# deploy/kubernetes/single/values.yaml
deploymentMode: standalone

image:
  tag: ""

config: |
  hosts: {
  	self: {
  		address: "127.0.0.1"
  		check: {type: "icmp", host: "127.0.0.1"}
  	}
  }

apiToken: ""

standalone:
  persistence:
    enabled: true
    size: 1Gi
  livestatus:
    enabled: false

Replace config with your own hosts before installing, and apiToken with a real token if you want the command API to require one.

4. Start

helm install jaque oci://<registry>/jaque/charts/jaque --version <chart version> \
  -f deploy/kubernetes/single/values.yaml

5. Verify

kubectl exec deploy/jaque -- /jaque version
kubectl port-forward svc/jaque 8080:8080
curl http://localhost:8080/status.json

The dashboard is at http://localhost:8080/ once the port-forward is up.

6. Where things live

Config is the config value, mounted as a ConfigMap at /etc/jaque/config.cue. State (the event log) is the PVC standalone.persistence creates, mounted at /data. Logs go to kubectl logs deploy/jaque.

7. Upgrade

helm upgrade jaque oci://<registry>/jaque/charts/jaque --version <chart version> \
  -f deploy/kubernetes/single/values.yaml

Leave image.tag empty so the chart and the binary it deploys stay the same release; the PVC survives the upgrade.

8. Next steps

CUE in practice adds services and contacts to config. Contacts and policies wires a hard state to a person. Metrics is what /metrics on the same Service exposes, and the dashboard it describes at the bottom of that page.

9. Security considerations

Without standalone.persistence.enabled, a restart starts the projections over from an empty log. ui.ingress.tls (split mode's knob) is the chart's only TLS termination; without it, and without an authenticating proxy in front of the port-forward or a Service you expose further, the dashboard, /metrics and any exposed Livestatus port are unauthenticated. See Kubernetes, section 7, and Security.