This repository contains Helm charts for deploying and managing Lamassu services within Kubernetes environments. Lamassu is an IoT device identity management platform that provides certificate management and device lifecycle management capabilities.
This table shows the relationship between Helm chart versions, application versions, and the Docker image versions used for each component.
| Helm Chart | App Version | UI Image | Backend Images (CA/VA/DevMgr/DMS/Alerts) | KMS Image | Notes |
|---|---|---|---|---|---|
| 3.8.0 | 3.8.0 | 4.3.0 | 3.8.0 | 3.8.0 | mTLS + Webhook authentication method introduced. Full chain validation in enroll |
| 3.7.0 | 3.7.0 | 4.2.0 | 3.7.0 | 3.7.0 | NEW: KMS service introduced as first-class service |
| 3.6.1 | 3.6.1 | 4.1.1 | 3.6.1 | N/A | Latest stable release on main branch |
| 3.6.0 | 3.6.0 | 4.1.0 | 3.6.0 | N/A | |
| 3.5.2 | 3.5.2 | 4.0.5 | 3.5.2 | N/A | |
| 3.5.1 | 3.5.1 | 4.0.3 | 3.5.1 | N/A | |
| 3.5.0 | 3.5.0 | 4.0.2 | 3.5.0 | N/A | |
| 3.4.0 | 3.4.0 | 3.4.0 | 3.4.0 | N/A | |
| 3.3.1 | 3.3.1 | 3.3.1 | 3.3.1 | N/A | Multiple OIDC providers support |
| 3.3.0 | 3.3.0 | 3.3.0 | 3.3.0 | N/A | MAJOR: Migration from Ingress to Envoy Gateway |
| 3.2.1 | 3.2.2 | 3.2.1 | 3.2.2 | N/A | Automatic DB migrations introduced |
| 3.2.0 | 3.2.2 | 3.2.1 | 3.2.2 | N/A | Crypto engines restructure |
| 3.1.1 | 2.8.0 | 3.1.0 | 2.8.0 | N/A | |
| 3.1.0 | 2.8.0 | 3.1.0 | 2.8.0 | N/A | |
| 3.0.0 | 2.7.0 | 3.0.0 | 2.7.0 | N/A | MAJOR: First 3.x release |
Component Legend:
- UI Image: Frontend web application (
lamassu-ui) - Backend Images: Core services with synchronized versions:
lamassu-ca: Certificate Authority servicelamassu-va: Validation Authority servicelamassu-devmanager: Device Manager servicelamassu-dmsmanager: DMS Manager servicelamassu-alerts: Alerts service
- KMS Image: Key Management Service (
lamassu-kms) - introduced in 3.7.0
For detailed migration instructions between versions, see the CHANGELOG directory:
- 3.3.2 → 3.7.0 - KMS service introduction
- 3.3.0 → 3.3.1 - Multiple OIDC providers
- 3.2.X → 3.3.0 - Ingress to Envoy Gateway migration
- 3.0.X → 3.2.X - Crypto engines restructure
.
├── charts/ # Helm charts
│ ├── lamassu/ # Lamassu main chart
│ └── softhsm/ # SoftHSM chart for HSM emulation
├── ci/ # CI/CD related resources
└── scripts/ # Lamassu fast lane deployment script
- Kubernetes 1.19+
- Helm 3.2.0+
- cert-manager v1.14.0+ (for TLS certificate management)
- Envoy Gateway v1.3.0+ (for API Gateway functionality)
- Add the Lamassu Helm repository:
helm repo add lamassu https://lamassuiot.github.io/lamassu-helm
helm repo update- Install the Lamassu chart:
helm install lamassu lamassu/lamassu -n lamassu --create-namespaceFor quick deployment, you can use the provided fast lane script:
./scripts/lamassu-fast-lane.shThe main configuration file for Lamassu is lamassu.yaml. You can create your own configuration file based on this template and customize it according to your needs:
helm install lamassu lamassu/lamassu -f your-values.yaml -n lamassu --create-namespaceLamassu requires the following external services:
- PostgreSQL database
- Keycloak for authentication
- RabbitMQ for messaging
You can deploy these dependencies independently or let the Lamassu chart handle them.
Each Lamassu service supports configurable replica counts and optional HorizontalPodAutoscaler (HPA) via replicaCount and autoscaling blocks in values.yaml.
Static replicas (no HPA):
services:
ca:
replicaCount: 2
dmsManager:
replicaCount: 3HPA-managed replicas (replicas field is omitted from the Deployment, fully managed by Kubernetes):
services:
ca:
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 5
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 75 # optionalThe same autoscaling block is supported per AWS connector instance:
services:
connectors:
- id: aws.myconnector
type: awsiot
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 4
targetCPUUtilizationPercentage: 80PodDisruptionBudget:
A PodDisruptionBudget is automatically created for each service when replicaCount > 1, preventing all pods from being terminated simultaneously during node drains or rolling upgrades. The minimum available pods is configurable:
services:
ca:
replicaCount: 2
pdb:
minAvailable: 1Resource requests and limits:
Each service has default resource requests (100m CPU / 256Mi memory) and limits (500m CPU / 1Gi memory). These are required for HPA CPU/memory-based scaling and can be overridden per service:
services:
ca:
resources:
requests:
cpu: 200m
memory: 512Mi
limits:
cpu: 1000m
memory: 2GiPod anti-affinity and topology spread:
By default the chart applies soft pod anti-affinity (spread across nodes) and two ScheduleAnyway topology spread constraints (zone and hostname). These can be overridden per service:
services:
ca:
# Override affinity (empty map = use chart default)
affinity: {}
# Override topology spread (empty list = use chart defaults)
topologySpreadConstraints: []VA CRL storage for multi-replica deployments:
The VA uses a local PVC (fileStore.type: local) by default. This is a ReadWriteOnce volume — incompatible with replicaCount > 1. For HA deployments, switch to S3:
services:
va:
replicaCount: 2
fileStore:
id: "s3-1"
type: "s3"
s3:
bucket_name: "my-crl-bucket"
auth_method: "default" # static | default | role
region: "us-east-1"KMS constraint:
replicaCount > 1andautoscaling.enabled: trueare blocked when thefilesystemcrypto engine is configured (it uses aReadWriteOncePVC). Use an external engine (hashicorp_vault,aws_kms,aws_secrets_manager,pkcs11) to scale KMS.VA constraint:
replicaCount > 1requiresservices.va.fileStore.typeto be changed fromlocalto a shared backend (e.g., S3), otherwise CRL files are not shared across replicas.
For detailed migration steps, please refer to the /charts/lamassu/CHANGELOG folder in this repository.
Important Note: Starting from version 3.x, Lamassu uses Envoy Gateway instead of Ingress for routing traffic. See the migration guides for details.
# Lint the chart
helm lint charts/lamassu
# Test installation with dry run
helm install lamassu charts/lamassu --dry-run --debugThis repository uses GitHub Actions for CI/CD:
.github/workflows/test-chart.yaml: Tests and validates the Helm charts.github/workflows/release.yaml: Handles the release processtest-fast-lane.yaml: Tests the fast lane deployment script
This project is licensed under the Mozilla Public License 2.0 - see the LICENSE file for details.
For issues, questions, or contributions, please open an issue or pull request in this repository.