Install Meshery on Kubernetes Using Helm

Prerequisites

Install Helm and kubectl on your local machine.
Access to the cluster where you want to deploy Meshery.
A kubeconfig whose current context points at that cluster.

Install Meshery on Your Kubernetes Cluster Using Helm

	
		helm repo add meshery https://meshery.io/charts/
helm install meshery meshery/meshery --namespace meshery --create-namespace

Optionally, customize the callback URL that your Remote Provider redirects to after sign-in:

	
		helm install meshery meshery/meshery --namespace meshery --set env.MESHERY_SERVER_CALLBACK_URL=https://custom-host --create-namespace

Customizing Meshery’s Installation with values.yaml

Meshery’s Helm chart supports many configuration options. See the Meshery Helm chart and Meshery Operator Helm Chart for more information.

Configuring Kubernetes Configuration Location

By default, Meshery Server looks for Kubernetes configuration in the /home/appuser/.kube directory inside the container. To change this location, set the KUBECONFIG_FOLDER environment variable:

	
		helm install meshery meshery/meshery --namespace meshery --set env.KUBECONFIG_FOLDER=/custom/path/to/.kube --create-namespace

A custom location helps when you give a Meshery deployment a predefined Kubernetes context or mount kubeconfig files from a custom volume.

Upgrading Meshery with Helm

To upgrade an existing Meshery deployment:

	
		helm repo update
helm upgrade meshery meshery/meshery --namespace meshery

Alternatively, run this command instead to use the upgrade-specific values file, which tunes the health checks for a rolling upgrade:

	
		helm upgrade meshery meshery/meshery --namespace meshery -f https://raw.githubusercontent.com/meshery/meshery/master/install/kubernetes/helm/meshery/values-upgrade.yaml --wait --timeout 10m

The upgrade configuration includes:

Startup probes to protect pods during initialization
Optimized probe timing for capability reloading
Higher failure thresholds to tolerate temporary unavailability during upgrades

For details, see the Health Check Configuration Guide.

Health Checks and Monitoring

Meshery Server exposes health check endpoints modeled on the Kubernetes API server’s:

Liveness probe (/healthz/live): checks that Meshery is running and responsive.
Readiness probe (/healthz/ready): checks that Meshery is ready to accept traffic.

Monitoring Deployment Status

Watch the status of your Meshery pods:

	
		kubectl get pods --namespace meshery -w

Checking Health Status

To see each health check’s result, query the readiness endpoint in verbose mode. The Meshery Server image does not include curl, so forward a local port to the deployment first:

	
		kubectl port-forward --namespace meshery deployment/meshery 8080:8080

Then, in another terminal:

	
		curl -s 'http://localhost:8080/healthz/ready?verbose=1'

Example output:

[+]capabilities ok
[i]extension extension package found
healthz check passed

Legend:

[+]: the check passed.
[-]: the check failed, and Kubernetes marks the pod unhealthy.
[i]: informational only; it does not affect health.

Health Check Configuration

The Helm chart configures health checks with these defaults:

Liveness probe: an initial delay of 80 seconds, to allow for server startup and provider initialization.
Readiness probe: an initial delay of 10 seconds, with frequent checks to detect readiness quickly.
Startup probe: optional and disabled by default, for slow-starting containers.

To customize the probes, set them in your values.yaml:

	
		probe:
  livenessProbe:
    enabled: true
    initialDelaySeconds: 80
    periodSeconds: 12
    failureThreshold: 4
    timeoutSeconds: 5

  readinessProbe:
    enabled: true
    initialDelaySeconds: 10
    periodSeconds: 4
    failureThreshold: 4
    timeoutSeconds: 3

For guidance on configuring health checks for installation, upgrades, and troubleshooting, see the Health Check Configuration Guide.

Post-Installation Steps

Optionally, verify the health of your Meshery deployment with mesheryctl system check.

You’re ready to use Meshery. Open Meshery UI in your browser.

Accessing Meshery UI

Once Meshery is running, mesheryctl system start opens Meshery UI in your default browser. On Docker, Meshery UI listens at http://localhost:9081 by default. On Kubernetes, mesheryctl opens the address of the meshery service in the meshery namespace, which the Helm chart creates as a LoadBalancer service on port 9081.

To open Meshery UI in your default browser at any time, run:


mesheryctl system dashboard

If your cluster does not give the meshery service a reachable address, forward a local port to Meshery instead. By default, mesheryctl listens on local port 9081; use -p to choose another port.


mesheryctl system dashboard --port-forward

You can also port-forward with kubectl:


kubectl port-forward svc/meshery 9081:9081 --namespace meshery

Verify Kubernetes Connection

Whichever way you installed Meshery, verify that Meshery is connected to your cluster:

In the Meshery UI, navigate to Lifecycle from the menu on the left.
Select Connections.
Ensure that your cluster appears in the list of connections and is marked as Connected.
Click the cluster name to run a connectivity test and confirm that Meshery can reach your cluster.

Customizing Your Meshery Provider Callback URL

You can customize the callback URL that your Meshery Provider redirects to after sign-in. This helps when Meshery runs behind several layers of networking infrastructure.

For production deployments, we recommend that you expose Meshery UI through a reverse proxy or a load balancer. A custom callback URL makes sure that sign-in completes even when requests pass through several routing layers.

Note: For production deployments, use a Remote Provider so that you control which identity providers can sign users in. Learn more about this in the Extensibility: Providers guide.

To set a custom callback URL, set the MESHERY_SERVER_CALLBACK_URL environment variable when you start Meshery:


MESHERY_SERVER_CALLBACK_URL=https://custom-host mesheryctl system start

On Kubernetes, Meshery UI is then available at the EXTERNAL-IP of the meshery service. Run kubectl get svc meshery -n meshery to find it.

GKE

KinD