Instead of letting the installer create and manage a cluster for you (on Hyper-V or vSphere with Talos Linux), you can deploy VAM into a Kubernetes cluster you already run — on-prem or in the cloud. The installer then skips all VM / OS provisioning and only deploys VAM's platform components and services as Helm packages into your cluster.

This page covers the prerequisites for that cluster and how the install proceeds. For the summary requirements table see Prerequisites → Bring your own Kubernetes cluster.

Who this is for. A Kubernetes / platform administrator who owns an existing cluster and wants VAM deployed onto it. If you want the installer to build the cluster for you, use the Hyper-V or VMware / vSphere paths instead.

What the Installer Deploys into Your Cluster

VAM is not a single container — it is a platform. When you point the installer at your cluster, it deploys (as packages) the components VAM depends on, alongside the VAM services themselves:

Layer

Component(s)

Role

Ingress / gateway

Traefik (Gateway API)

Terminates HTTPS and routes to the internal services.

Certificates

cert-manager + trust-manager + an issuer (self-signed / Let's Encrypt / AD CS)

Issues and renews the gateway certificate; distributes the CA bundle.

Object storage

MinIO / AIStor (operator + object store)

The authoritative media store (S3 API).

Block storage

DirectPV and/or local-path-provisioner

Local NVMe/SSD provisioning for the stateful workloads.

Databases / index

SurrealDB, OpenSearch

Cache / index over the object store.

Messaging

RabbitMQ

Event bus between services.

Identity

Keycloak (bundled) or your external OIDC

Sign-in for users and services.

Container registry

Harbor

In-cluster OCI registry / pull-through cache (where an internal one is used).

Observability

kube-prometheus-stack (Prometheus, Grafana, Alertmanager), Loki + Promtail, OpenTelemetry Collector

Metrics, logs, traces and dashboards.

GPU (optional)

NVIDIA device plugin, AMD GPU operator

Exposes host GPUs to workloads that need them (for example, AI features).

VAM services

VAM core, Configuration Service, Deployment Console, MCP server, Workflow Bridge

The application itself.

You can let the installer deploy all of these, or — if your cluster already provides some of them (for example your own ingress controller or an existing StorageClass) — configure VAM to use what you have. Discuss the split with your Vizrt representative for a production design.

Component versions are pinned per VAM release. Each package declares the exact upstream chart / app versions it ships, so an installation is reproducible. As of the current release these include Traefik v3.7.6, cert-manager v1.21.1, trust-manager v0.24.0, the AD CS issuer 2.1.4, Keycloak 26.3.3, RabbitMQ 4.3.4, OpenSearch 3.7.0 and SurrealDB 3.2.0. The authoritative, always-current versions for your installation are shown per package in the Configuration Service → Packages view after install.

Cluster Prerequisites

Area

Requirement

Kubernetes version

A currently-supported version — confirm the minimum with your Vizrt representative.

Access

An admin kubeconfig; the installer deploys into its current context. kubectl reachable.

Isolation

The cluster, or at least dedicated namespaces, not shared with unrelated workloads.

Capacity

Enough total CPU / RAM / disk for the worker sizing.

Storage

Block devices for DirectPV, or an existing default StorageClass (see below).

Ingress / exposure

A LoadBalancer service, or NodePort ingress, reachable by your clients.

DNS

An A record for the public hostname (for example, vam.example.com) pointing at the ingress.

TLS

A certificate strategy (self-signed, Let's Encrypt, provided cert, or AD CS — see below).

Identity

Bundled Keycloak, or an external OIDC provider configured per Identity provider setup.

Storage — DirectPV or a StorageClass

VAM's object store (MinIO / AIStor) needs fast local block storage.

  • DirectPV (recommended for local NVMe/SSD). Installed via the kubectl krew plugin, DirectPV discovers and formats raw drives and exposes a directpv-min-io storage class. The high-level flow is kubectl directpv install → kubectl directpv discover → review the generated drives.yaml → kubectl directpv init drives.yaml. See the DirectPV documentation.
  • Existing StorageClass. If your cluster already provides suitable persistent block storage, VAM can use it instead. Provision capacity sized to your media volume.

For storage spread across multiple nodes, use the MinIO Erasure Code Calculator to size the layout — your Vizrt representative can help.

Certificates — cert-manager Issuers

The gateway serves HTTPS using a certificate issued by cert-manager. Choose the issuer that fits your environment (this is the same choice as the installer's TLS certificate step):

  • Self-signed: evaluation only.

  • Let's Encrypt: if the hostname is publicly resolvable.

  • Provided certificate: a PEM certificate + key you already hold.

  • Enterprise CA / AD Certificate Services (AD CS). For on-prem Microsoft environments, VAM uses an ADCS issuer with cert-manager. You provide:

    • the ADCS server URL,
    • the CA bundle (root/intermediate chain),
    • the certificate template name to request against and
    • the credentials (username + password) of an account permitted to enroll certificates from that template.

    trust-manager then distributes the CA bundle so in-cluster clients (such as MinIO) trust the issued certificate.

Identity — Entra ID / OIDC

Sign-in works exactly as for a provisioned cluster. Use the bundled Keycloak for the simplest path, or configure an external provider — Microsoft Entra ID, Okta, Auth0, or your own Keycloak. The full provider setup (app registration, app roles such as vam / vam-admin / readwrite / consoleAdmin, API permissions, redirect URIs, client secret and enforcing v2 tokens) is in Identity provider setup.

Running the Install

  1. Set your kubectl context to the target cluster — the installer deploys into the current context.
  2. Prepare storage, DNS, certificate inputs and (if external) the OIDC details ahead of time.
  3. Launch vamctl.exe and follow Running the installer through the prerequisite and source steps.
  4. At Kubernetes → Select, choose Use an existing Kubernetes cluster and point the installer at your kubeconfig.
  5. The installer skips cluster provisioning and goes straight to Deployment configuration — set the public hostname, TLS option, identity provider and license, then deploy.
  6. Finish with the sanity check as in the main walkthrough.

The same deploy-to-existing-cluster path can be scripted non-interactively with appsettings.json and command-line overrides (DeploymentMode=Skip). Contact your Vizrt representative for the unattended-deployment reference.

Next Steps