Install the server on Kubernetes Documentation

Before you start

Prepare the cluster and databases

The server chart installs the frontend, backend, and private decoder. It does not install PostgreSQL or an Ingress controller.

Kubernetes with Helm 3 and an existing Ingress controller. Step 3 provides ready-to-edit profiles for managed Azure, GCP, and AWS controllers, a generic controller, and Traefik.
Two PostgreSQL URLs: one control database and one capture database. They may use the same PostgreSQL server.
For host routing, a web hostname that resolves to the Ingress controller. Prefix routing can use the controller address without dedicated web DNS.
A collector hostname and TCP 8601 reachability from collector networks.
TCP 80 for web access, plus TCP 443 when host-based HTTPS is enabled.

Installation

Install the public Helm chart

Download and verify the chart

Shell

VERSION=0.1.9
curl -fLO https://github.com/qwerty-iot/pcapillary-releases/releases/download/v$VERSION/pcapillary-$VERSION.tgz
curl -fLO https://github.com/qwerty-iot/pcapillary-releases/releases/download/v$VERSION/SHA256SUMS
grep "pcapillary-$VERSION.tgz" SHA256SUMS | sha256sum --check -

The packaged chart automatically selects the matching backend, decoder, and frontend container tags.

Create the namespace and database Secret

Shell

kubectl create namespace pcapillary

kubectl -n pcapillary create secret generic pcapillary-database \
  --from-literal=control-database-url='postgresql://CONTROL_USER:CONTROL_PASSWORD@db.example.com:5432/pcapillary_control?sslmode=require' \
  --from-literal=capture-database-url='postgresql://CAPTURE_USER:CAPTURE_PASSWORD@db.example.com:5432/pcapillary_capture?sslmode=require'

Choose your Ingress platform and create a values file

All profiles use standard path-based routing: the console is served at /pcapillary and the API at /pcapillary/api. Choose the profile for the controller installed in your cluster.

Uses the AKS-managed application routing add-on and its standard Kubernetes IngressClass. This is the shortest AKS Ingress setup; Microsoft supports its managed NGINX path through November 2026 and recommends Gateway API for the longer term.

Prerequisite: Enable it first with: az aks approuting enable --resource-group RESOURCE_GROUP --name CLUSTER_NAME

pcapillary-values.yaml

http:
  ingress:
    controller: generic
    className: webapprouting.kubernetes.azure.com
    accessMode: path
    hostname: ""
    pathPrefix: /pcapillary
    annotations: {}

Platform Ingress documentation

Uses GKE's managed external Application Load Balancer. GKE selects this controller through its annotation, so className stays empty.

pcapillary-values.yaml

http:
  ingress:
    controller: generic
    className: ""
    accessMode: path
    hostname: ""
    pathPrefix: /pcapillary
    annotations:
      kubernetes.io/ingress.class: gce

Platform Ingress documentation

Uses an internet-facing ALB with IP targets, which are required because the Pcapillary web Services are ClusterIP Services. The success-code range lets the ALB's shared root health probe accept either routed target while still rejecting server errors.

Prerequisite: Install the AWS Load Balancer Controller before installing Pcapillary.

pcapillary-values.yaml

http:
  ingress:
    controller: generic
    className: alb
    accessMode: path
    hostname: ""
    pathPrefix: /pcapillary
    annotations:
      kubernetes.io/ingress.class: alb
      alb.ingress.kubernetes.io/scheme: internet-facing
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/success-codes: "200-499"

Platform Ingress documentation

Works with any installed controller that implements standard networking.k8s.io/v1 Ingress path routing.

Prerequisite: Run kubectl get ingressclass and replace your-ingress-class with the class provided by your controller.

pcapillary-values.yaml

http:
  ingress:
    controller: generic
    className: your-ingress-class
    accessMode: path
    hostname: ""
    pathPrefix: /pcapillary
    annotations: {}

Platform Ingress documentation

Uses a standard Ingress with Traefik annotations; it does not require an IngressRoute for browser traffic.

Prerequisite: Replace web with your Traefik HTTP entrypoint name, such as http, when your installation uses a different name.

pcapillary-values.yaml

http:
  ingress:
    controller: traefik
    className: traefik
    accessMode: path
    hostname: ""
    pathPrefix: /pcapillary
    annotations: {}
    traefik:
      httpEntryPoint: web

Platform Ingress documentation

Add the collector URL to the same values file for every platform:

pcapillary-values.yaml

collector:
  publicURL: https://collector.pcapillary.example.com:8601

The collector endpoint remains separate from browser Ingress and always uses Pcapillary mutual TLS.

Install and wait for the workloads

Shell

VERSION=0.1.9
helm upgrade --install pcapillary ./pcapillary-$VERSION.tgz \
  --namespace pcapillary \
  --values pcapillary-values.yaml

kubectl -n pcapillary rollout status deployment/pcapillary-backend
kubectl -n pcapillary rollout status deployment/pcapillary-frontend
kubectl -n pcapillary get pods,ingress,services

Configure collector DNS and sign in

Point the collector hostname at the collector LoadBalancer. Open http://INGRESS_ADDRESS/pcapillary, sign in as admin with password pcapillary, and complete the required password change.