Skip to main content
Running the Komodor Agentic Operation Platform (KAOP) yourself means you own its upgrades, its secrets, and its database. This page covers the routine parts, and the two irreversible ones — the encryption key, and moving off the bundled database.

​
Upgrading

The chart version is the product version, so the chart you install names exactly what you get. Migrations apply as the new control plane starts. Read the release notes before a minor upgrade. The one class of change worth checking for is a database requirement — the extensions the platform needs are the difference between a managed Postgres working and not working.

​
The secret you must never regenerate

Internal secrets are generated at install time and then left alone: the chart looks for an existing value before creating one, so an upgrade does not mint new ones.
AGENTOPS_ENCRYPTION_KEY protects every stored credential. If it is regenerated or lost, every integration credential and provider key in the database becomes unreadable — not rotated, not recoverable. Back it up the way you back up a root key, and never let a redeploy generate a new one.
Everything else is rotatable in the ordinary way. If you supply secrets as existingSecret, rotation is a change to your secret followed by a restart, and nothing in the chart has to know.

​
Moving off the bundled database

The bundled Postgres is a single pod with no replication and no backup. Treat it as an evaluation step, not a first version of production. Moving is a database migration, not a values change:
1

Stand up your own Postgres

With the extensions the release notes require, and your own backup and restore in place.
2

Quiet the platform

Scale the control plane to zero so nothing writes while you copy.
3

Dump and restore

A conventional pg_dump and restore into the new instance.
4

Repoint and bring it back

Set postgresql.enabled: false, point externalDatabase.existingSecret at your connection string, and upgrade the release.
Doing this while the platform is running loses whatever was written after the dump — runs, evidence, audit records. The scale-to-zero step is the whole safety of the procedure.

​
Sizing and the components with state

Runs, evidence, transcripts and audit records all live in Postgres. If you back up one thing, that is it.

​
When something is wrong

Collect a support bundle before opening a ticket. It gathers the component state, versions, and recent logs from the namespace:
Include the release version, whether the database is bundled or your own, and what changed most recently. Self-hosted problems are usually environmental — a storage class, an ingress annotation, an identity provider’s claim mapping — and the bundle answers those faster than a description does.

​
Next steps

Install

The sequence, and the database decision.

Secrets & credential handling

What the encryption key protects, and how credentials reach a run.

Troubleshooting

Failure modes that are not specific to self-hosting.

Support

How to reach the Komodor team.