On-premise install

Kimo can run entirely inside your network. The on-premise build is the same software as the cloud, packaged as container images and a Helm chart. It is the default deployment for Kimo Defense Intelligence and is available on Enterprise plans for the other products.

Requirements

Install with Helm

1. 1
   Add the chart repository

   Your license key unlocks the private registry.

   bash

   helm registry login registry.getkimo.com -u $KIMO_LICENSE_IDhelm pull oci://registry.getkimo.com/charts/kimo --version 4.8.2

2. 2
   Write your values file

   Point Kimo at your metadata database, object storage and identity provider.

3. 3
   Install

   The install takes 5–10 minutes. All pods should be Ready before you log in.

   bash

   helm install kimo oci://registry.getkimo.com/charts/kimo \  --version 4.8.2 -n kimo --create-namespace -f values.yamlkubectl -n kimo get pods

1license:2  key: kl_ent_…3global:4  host: kimo.internal.example5metadata:6  url: postgres://[email protected]:5432/kimo7storage:8  s3:9    endpoint: https://minio.internal:900010    bucket: kimo-cache11auth:12  oidc:13    issuer: https://keycloak.internal/realms/ops14ask:15  provider: self-hosted16  endpoint: http://llm.internal:808017telemetry:18  enabled: false

Air-gapped installation

For networks with no internet access, download the offline bundle (images, chart, connector packs and a signed manifest) on a connected machine, verify it, and carry it across on approved media. The bundle is about 9 GB.

1cosign verify-blob --key kimo-release.pub \2  --signature kimo-4.8.2-offline.tar.sig kimo-4.8.2-offline.tar3tar -xf kimo-4.8.2-offline.tar4./kimo-offline load --registry registry.internal:50005./kimo-offline install -f values.yaml

Upgrades

Releases follow semantic versioning. Minor versions ship monthly and are safe to apply in place; database migrations run automatically in a pre-upgrade job. Major versions are announced 90 days ahead in the changelog with a migration guide.

Backups and disaster recovery

• Back up the metadata PostgreSQL database daily; it holds models, dashboards, users and alerts.
• The object-storage cache can be rebuilt from sources, but backing it up shortens recovery.
• Export models to Git for an independent copy of your semantic layer.
• Test restores quarterly: kimo admin restore --dry-run validates a backup without applying it.

Monitoring

The chart exposes Prometheus metrics on every service and ships ready-made Grafana dashboards. Logs are structured JSON on stdout, so they flow into whatever collector you already run. The four signals worth alerting on are listed below; together they catch nearly every incident we have seen in customer installs.