Deploy Cerbos to Kubernetes with Helm

Install and manage the Cerbos PDP on Kubernetes using the official Helm chart with production-ready defaults.

Helm chart documentation Helm chart repository

Production defaults

The chart ships with sensible defaults for resource limits, health checks, and service configuration.

Configurable policy sources

Load policies from the filesystem, a Git repository, or Cerbos Hub using Helm values.

Observable

Built-in support for Prometheus metrics, distributed tracing, and structured logging.

What is Cerbos?

Cerbos is an open-source authorization layer that decouples access control from your application code. It runs as a stateless Policy Decision Point (PDP) that evaluates fine-grained policies at request time.

Authorization policies are written in human-readable YAML supporting RBAC, ABAC, and conditional rules. They can be updated, tested, and deployed independently of your application.

Deploying Cerbos via Helm gives you a production-ready authorization service that scales horizontally and fits naturally into your existing infrastructure and observability stack.

Policy-as-code Human-readable YAML policies managed like source code Scalable PDP Stateless policy decision point with sub-millisecond latency Centralized management Manage, test, and deploy policies from a single control plane

How to deploy Cerbos with Helm

1. Add the Cerbos Helm repository, Run helm repo add cerbos https://download.cerbos.dev/helm-charts to register the chart source.
2. Install the chart, Run helm install cerbos cerbos/cerbos to deploy the Cerbos PDP into your Kubernetes cluster.
3. Configure via Helm values, Set your policy source, replica count, resource limits, and observability settings in a values file or with --set flags.
4. Connect your application, Use a Cerbos SDK to send authorization checks from your services to the deployed PDP.

FAQ

How do I install Cerbos with Helm?

Add the Cerbos Helm chart repository, then install the chart into your cluster. The chart supports configuring policy sources, resource limits, replicas, and observability settings through standard Helm values.

Does Cerbos require any external dependencies?

No. Cerbos is fully stateless and requires no external database or message queue. Policies can be loaded from the filesystem, a Git repository, or Cerbos Hub, no additional infrastructure needed.

Can I run Cerbos as a sidecar with Helm?

The Helm chart deploys Cerbos as a standalone service by default. For sidecar deployments, add the Cerbos container directly to your application pod spec rather than using the chart.