Skip to main content
Kubernetes support is currently in early access. To get on the list, book a demo call with the Tembo team: Book a Demo
Tembo runs entirely in your cloud as a single Helm chart. It deploys the whole platform into your cluster: web, API, background jobs and supporting services. Postgres and Redis can run in your cluster alongside it or as managed services you already operate. Agents get stronger isolation than containers can offer. Every agent session runs in its own virtual machine on a dedicated agent host, not in a Kubernetes pod. Your cluster runs no privileged workloads, your nodes stay untouched, and agent code never shares a kernel with your apps.

​
How it works

Tembo on Kubernetes has three layers: You install the platform once. The agent layer adds hosts as your workload grows. See How it works for the services in your cluster, and Agent hosts for the agent layer.

​
Agent hosts

You describe the agent hosts you want in your Helm values, and the controller runs them. If you’ve used Karpenter or the GitHub Actions Runner Controller, the model will feel familiar. The controller:
  • Scales on demand. It launches hosts as sessions need room, within the limits you set. Removing idle hosts is coming.
  • Joins hosts automatically. New hosts register with your Tembo installation.
  • Replaces hosts that fail to start. A host that doesn’t register in time is replaced.

​
Supported providers

​
Configured as code

Everything about your deployment lives in files you can review, version and promote between environments:
  • Helm values: domain, ingress, TLS, images, and whether to use the bundled database and cache or bring your own.
  • Agent hosts: instance types, network placement and scaling limits.
  • Terraform: the cloud permissions and object storage, from Tembo’s module.
All of it works with your existing pipeline, whether that’s helm upgrade in CI or a GitOps tool.

​
Security

  • Runs in your account. The platform, agent hosts and session data all stay in infrastructure you own.
  • VM isolation for agents. Each session runs in its own virtual machine with its own kernel, separate from your cluster.
  • No privileged pods. The chart doesn’t need host access, privileged containers or special node configuration.
  • Least-privilege cloud access. The controller only manages resources it created and tagged.

​
Get started

Install the prerequisites with Tembo’s Terraform module, then deploy the Helm chart. To join early access, book a demo.

​
Need Help?

If you run into any issues, contact support@tembo.io.