inrun

Inrun Helm Chart

Inrun is the intent runner for Kubernetes. A caller sends an intent through the gateway; Inrun turns it into a custom resource, reconciles it, and returns a view.

This chart deploys:

Runtime: reconciles the custom resources declared in your Catalog.
Gateway: takes intents in, serves admission webhooks, and enforces deletion and namespace protection.
Console: a web UI over one or more runtimes.

Prerequisites

Kubernetes 1.28+
Helm 3.10+
The inrun CLI:

curl -sSL https://get.inrun.dev | bash

Install

Inrun does not create RBAC or its Catalog ConfigMap itself. You generate them from your Catalog, review them, and apply them, so every permission is visible before it reaches the cluster.

1. Install the CRD

This uses the Website CRD from the hello-website example:

kubectl apply -f https://raw.githubusercontent.com/intentd/inrun/main/examples/reconcilers/declarative/01-hello-website/manifests/crd.yaml

2. Write a Catalog

Save as catalog.yaml:

apiVersion: inrun.dev/v1
kind: Catalog
metadata:
  name: hello-website
spec:
  crds:
    website:
      apiTypes:
        group: demo.inrun.dev
        version: v1alpha1
        kind: Website
        plural: websites
      operatorBox:
        reconcile:
          onCreate:
            deployments:
              - name: ""
                image: ""
                replicas: ""
                port: ""
                reconcile: true
            services:
              - name: "-svc"
                port: "80"
                targetPort: ""
                reconcile: true

3. Review the permissions

inrun validate --full -f catalog.yaml

This prints every RBAC rule the Catalog needs, per CRD and per component, with a note on why each one exists. No cluster required.

4. Generate and apply the bundle

inrun generate bundle -f catalog.yaml -o bundle.yaml

kubectl apply -f bundle.yaml

The bundle holds the inrun-system Namespace, the ServiceAccounts, a ClusterRole with only the permissions the Catalog needs, its binding, and the inrun-catalog ConfigMap. Commit it to your GitOps repo if you use one.

5. Install the chart

helm repo add inrun https://intentd.github.io/inrun

helm upgrade --install inrun inrun/inrun \
  --namespace inrun-system \
  --set gateway.enabled=true

The chart uses the ServiceAccounts and ConfigMap from the bundle.

6. Verify

kubectl get pods -n inrun-system

Topologies

The runtime and gateway deploy independently.

Topology	`runtime.enabled`	`gateway.enabled`	Use
Runtime only	`true`	`false`	Reconcile without intents or admission
Gateway only	`false`	`true`	Deletion and namespace protection only
Full	`true`	`true`	Intents in, reconcile, views out

For gateway only, set gateway.standalone: true in the Catalog and generate with inrun generate bundle --for gateway.

Values

Runtime

Parameter	Description	Default
`runtime.enabled`	Deploy the runtime	`true`
`runtime.image.repository`	Image	`ghcr.io/intentd/inrun`
`runtime.image.tag`	Tag	Chart `appVersion`
`runtime.replicaCount`	Replicas; one leader reconciles	`2`
`runtime.serviceAccount`	ServiceAccount from the bundle	`inrun`
`runtime.server.httpPort`	Health, metrics and API port	`8080`
`runtime.config.logLevel`	debug, info, warn, error	`info`
`runtime.config.defaultWorkers`	Workers per CRD	`2`
`runtime.config.defaultResync`	Resync interval	`30s`
`runtime.config.maxDepth`	Max queue depth per CRD	`500`
`runtime.config.failureThreshold`	Failures before degraded	`10`
`runtime.leaderElection.enabled`	Leader election	`true`
`runtime.catalog.existingConfigMap`	Catalog ConfigMap	`<release>-catalog`
`runtime.catalog.configMapKey`	Key in the ConfigMap	`catalog.yaml`
`runtime.gatewayEndpoint`	Gateway URL shown to the console	`""`
`runtime.registry.url`	Pattern registry	`""`

Gateway

Parameter	Description	Default
`gateway.enabled`	Deploy the gateway	`false`
`gateway.image.repository`	Image	`ghcr.io/intentd/inrun-gateway`
`gateway.replicaCount`	Replicas; stateless	`2`
`gateway.serviceAccount`	ServiceAccount from the bundle	`inrun-gateway`
`gateway.server.httpPort`	Gateway API, health and metrics	`8080`
`gateway.server.httpsPort`	Webhook port	`8443`
`gateway.webhooks.enabled`	Serve webhooks with your own TLS secret	`false`
`gateway.webhooks.existingSecret`	TLS secret for webhooks	`""`
`gateway.catalog.existingConfigMap`	Catalog ConfigMap	the runtime’s
`gateway.ingress.enabled`	Expose the Gateway API	`false`

Console

Parameter	Description	Default
`console.enabled`	Deploy the console	`true`
`console.image.repository`	Image	`ghcr.io/intentd/inrun-console`
`console.config.inrunURLs`	Runtimes to watch	this release’s runtime
`console.config.refreshInterval`	Refresh interval	`10s`
`console.gatewayToken.secretRef.name`	Gateway token Secret for serving intents	`""`
`console.ingress.enabled`	Expose the console	`false`

Every component

These apply under runtime:, gateway: and console:: imagePullSecrets, resources, pdb, networkPolicy (runtime and console), hpa (gateway and console), nodeSelector, tolerations, affinity, topologySpreadConstraints, extraEnv, extraEnvFrom, extraVolumes, extraVolumeMounts, podAnnotations and podLabels. See values.yaml for the full list.

Observe

inrun proxy

This forwards the runtime, gateway and console ports to localhost. The console is then at http://localhost:8081/console.

Uninstall

helm uninstall inrun --namespace inrun-system

CRDs and the custom resources Inrun managed stay in the cluster.

License

Apache 2.0.

This site is open source. Improve this page.