One command installs the Poet, our datastore, and the Kubernetes Muse, our collector, in one pod. Your browser reads the Poet over a direct, encrypted WebRTC connection: no data passes through our servers; we only handle sign-in.

1. Name your cluster. Sign in at https://infinitehaiku.com as an organisation admin, open Access › Clusters, pick A Kubernetes cluster and enter a name such as prod-eu-1. You get the cluster’s token and the command with your organisation, your cluster and the token filled in.
2. Paste it in a shell where kubectl and helm reach the cluster. It saves the token to a file only you can read, installs the chart, waits for the pod and removes the file.
3. Watch it connect. The cluster turns Connected as soon as the Poet starts; the wait is pulling two images and binding the volume. The Muse reads the cluster at once, then every 5 seconds, so your nodes, namespaces and pods follow right after, for everyone in your organisation.

The command looks like this:

 umask 077; printf '%s' '<token>' > "$HOME/ih-token-prod-eu-1"
helm install infinite-haiku \
  oci://ghcr.io/infinitehaiku/charts/infinite-haiku --version <version> \
  -n infinite-haiku --create-namespace \
  --set-string organisation=<your organisation id> \
  --set-string poetClusterId=prod-eu-1 \
  --set-string clusterName=prod-eu-1 \
  --set-file shibuyaToken="$HOME/ih-token-prod-eu-1"
kubectl -n infinite-haiku rollout status statefulset/ih-poet --timeout=300s \
  && rm "$HOME/ih-token-prod-eu-1"

<version> is the newest published chart; Kabuki’s command fills it in. Without --version Helm installs the newest chart too.

The defaults fit a standard node. Add a flag only if you need it:

The ids are passed with --set-string, so an id made of digits stays text. No Helm in the cluster, or a policy review first? Install with plain YAML. Flux, a mirror, a pull secret and more: install examples.

OpenTelemetry

With --set intake.expose=true, applications in the cluster send traces, metrics and logs to the Poet with any OTLP/HTTP exporter. Only namespaces you label may reach it, on that one port, and every request needs the Poet’s intake token:

kubectl label namespace shop infinitehaiku.com/send-telemetry=true
kubectl -n infinite-haiku get secret ih-client -o jsonpath='{.data.intake-token}' | base64 -d   # the intake token

OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
OTEL_EXPORTER_OTLP_ENDPOINT=http://ih-poet-intake.infinite-haiku:4318
OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer%20<intake token>"

Keep the token in a Secret of the sending namespace. An OpenTelemetry Collector works the same way, with its otlphttp exporter.

Send to an existing Poet

A cluster that needs no datastore of its own runs only the Kubernetes Muse and sends to a Poet you already have: no volume, no token of ours. In Access › Clusters, name the cluster and pick Send to an existing Poet; the screen fills in this command:

helm install infinite-haiku-muse \
  oci://ghcr.io/infinitehaiku/charts/infinite-haiku-muse --version <version> \
  -n infinite-haiku --create-namespace \
  --set-string organisation=<your organisation id> \
  --set-string clusterName=edge-1 \
  --set-string poetUrl=https://poet.example.com:4443 \
  --set-file intakeToken="$HOME/ih-intake-token"

• The Poet’s address is HTTPS: a Linux Poet’s intake on 4443 (HTTPS intake), or a Kubernetes Poet with intake.expose=true behind your own TLS ingress (label the ingress controller’s namespace as above). Another port than 443 or 4443: add --set poetPort=<port>. A private certificate: add --set-file poetCa=<its CA file> (kept in the Muse’s Secret); without it the Poet’s certificate must be publicly trusted.
• The intake token is the Poet’s: on a Kubernetes Poet, the kubectl get secret line above (run against the Poet’s cluster); on a Linux Poet, its intake token file.
• What gets installed: one Deployment ih-k8s-muse, the same read-only ClusterRole, a Secret with the token (and the CA, when given). Egress only: your API server, DNS and the Poet.

Remove it with helm uninstall infinite-haiku-muse -n infinite-haiku.

Update

Your settings and the token stay; your data stays on its volume:

helm upgrade infinite-haiku oci://ghcr.io/infinitehaiku/charts/infinite-haiku \
  -n infinite-haiku --reuse-values
kubectl -n infinite-haiku rollout status statefulset/ih-poet --timeout=300s

Without --version Helm upgrades to the newest chart; add --version <version> to pick one (the newest is the one Kabuki’s Access › Clusters command shows). A Muse-only install upgrades the same way: helm upgrade infinite-haiku-muse oci://ghcr.io/infinitehaiku/charts/infinite-haiku-muse -n infinite-haiku --reuse-values.

If you installed under another release name or namespace, helm list -A | grep infinite-haiku shows them; use them in place of infinite-haiku and -n infinite-haiku above.

Kabuki marks a Poet that runs an older version on Updates and on the Poet’s own page. An older Poet is updated; Kabuki does not keep older versions of itself to open it.

Uninstall

helm uninstall infinite-haiku -n infinite-haiku && kubectl delete namespace infinite-haiku

Your data was only in your own volume, so that is all it takes to leave. During the pilot there is nothing to cancel; later, uninstalling and cancelling stay separate (leaving).

Then revoke the cluster’s token (poet <cluster>) in Access › Tokens. Your data lived only in the deleted volume.

What you need

• Kubernetes 1.25 or later (linux/amd64 or linux/arm64), Helm 3, and the right to create a namespace and one read-only ClusterRole.
• The connections below, all opened from inside the cluster; no Service is exposed to the outside.

What gets installed

No Ingress or LoadBalancer. Every container runs non-root with a read-only filesystem and no capabilities (the restricted Pod Security Standard); we never get access to your cluster.

Troubleshooting

To change a setting later, see upgrading. Need help? Send us the output of kubectl -n infinite-haiku describe pod ih-poet-0 and the pod’s logs; they contain no secret.

The images are for authorised pilots only. The terms are in /LICENSE inside each image, the third-party licences in /THIRD-PARTY-NOTICES.