Gateway on Kubernetes

Instructions for installing Keeper Gateway on Kubernetes using Helm

Overview

The Keeper Gateway can be deployed on any Kubernetes cluster using the official Helm chart maintained by Keeper Security. The chart runs the Gateway as a Kubernetes Deployment and supports the full set of Gateway capabilities - remote access (RDP, SSH, VNC), Remote Browser Isolation, secret rotation, and discovery - along with optional persistent storage for session recordings, Horizontal Pod Autoscaling, and disposable demo targets for evaluation.

The Gateway establishes outbound-only connections to Keeper infrastructure. No Ingress, LoadBalancer, or inbound firewall rules are required.

The chart is published to both the Keeper Helm repository and Docker Hub as an OCI artifact:

• Helm repository: https://keeper-security.github.io/helm-charts

• OCI registry: oci://registry-1.docker.io/keeper/keeper-gateway

• ArtifactHub: keeper-security/keeper-gateway

The chart source is available on GitHub.

Prerequisites

• A Kubernetes cluster, version 1.25 or later

• Helm 3

• A Keeper Enterprise account with the Privileged Access Manager add-on

• A Gateway configuration (Base64) from the Keeper Vault - see Create a Gateway below

Create a Gateway

A new Gateway deployment can be created by clicking Create New > Gateway from the Web Vault or Desktop App. When provisioning, choose the Docker method and copy the Base64 Configuration -this is the value the chart needs.

You can also create a Gateway and its configuration from the Keeper Commander CLI:

pam gateway new -n "<Gateway Name>" -a <Application Name or UID> -c b64

Application names and UIDs can be found with secrets-manager app list. Save the Base64 configuration token; you will provide it to the chart in the next step.

For full details on provisioning, see Creating a Keeper Gateway.

When provisioning, you can select Create with example records to generate sample PAM records that match the chart's optional Demo / Playground Services.

Installation

Install the chart from either the Helm repository or the OCI registry. Set gateway.acceptEula=Y and provide the Base64 configuration from the previous step.

Helm Repository

helm repo add keeper https://keeper-security.github.io/helm-charts
helm repo update

helm install keeper-gateway keeper/keeper-gateway \
  --namespace keeper-gateway --create-namespace \
  --set gateway.acceptEula=Y \
  --set gateway.config='<base64-config>'

OCI Registry (Docker Hub)

Passing --set gateway.config places the configuration in your shell history and in helm get values output. For production, store the configuration in a Kubernetes Secret instead - see Providing the Gateway Configuration.

Providing the Gateway Configuration

The Gateway configuration can be supplied three ways. Accepting the EULA (gateway.acceptEula=Y) is required in all cases.

Inline (quick start)

Pass the Base64 configuration directly. Best for evaluation and non-production use.

--set gateway.acceptEula=Y \
--set gateway.config='<base64-config>'

Existing Secret (recommended)

AWS Secrets Manager

Verify

Confirm the pod is running and connected to Keeper:

kubectl get pods -n keeper-gateway
kubectl logs -n keeper-gateway -l app.kubernetes.io/name=keeper-gateway

The Gateway also reports its status as Online in the Keeper Vault under the Gateway.

Logging

Set the log level and format with the logging values. Levels apply to both the Gateway service and guacd unless overridden individually.

--set logging.level=debug \
--set logging.format=json

• Levels: error, warning, info, debug (guacd also supports trace)

• Formats: text, json, logfmt, cef, leef, rfc5424, rfc3164, gelf

Set levels independently with logging.gatewayLevel and logging.guacdLevel. To forward logs to a syslog server, set syslog.enabled=true and the syslog.host / syslog.port / syslog.proto values.

Structured log formats (json, logfmt, cef, etc.) require a recent Gateway image (1.8.0+). If your chart pins an earlier appVersion, override the image: --set image.tag=1.8.0.

For event monitoring and SIEM forwarding, see Alerts and SIEM Integration.

Health Checks

The chart configures Kubernetes startup, liveness, and readiness probes that run the Gateway's built-in keeper-gateway health-check command inside the container. The health-check HTTP server binds to 127.0.0.1 (localhost only) on port 8099.

Health checks are enabled by default. To expose the /health endpoint to an external monitoring tool, set an auth token with healthCheck.authToken (or healthCheck.existingAuthTokenSecret) and adjust the service accordingly.

See Health Checks for the endpoint response format and CLI options.

Updating

Pull the latest chart and upgrade the release:

helm repo update
helm upgrade keeper-gateway keeper/keeper-gateway \
  --namespace keeper-gateway \
  --reuse-values

With the default Recreate strategy, the existing pod is terminated before the new one starts, so active sessions are disconnected during the upgrade. For zero-downtime upgrades, run multiple replicas with the RollingUpdate strategy, see Scaling and High Availability.

If you provided the configuration with gateway.config on the command line, pass it again (or switch to gateway.existingSecret) so it is not lost on upgrade.

Scaling and High Availability

Running more than one replica requires the Gateway to be configured for multi-instance operation in Keeper first. From Keeper Commander, find the Gateway UID with pam gateway list, then set the maximum number of instances:

Multi-instance scaling is currently managed through Keeper Commander only. Support for managing it in the Web Vault and Desktop App is coming soon.

pam gateway set-max-instances -g <GATEWAY_UID> -m <MAX_INSTANCES>

Once multi-instance is enabled, scale the deployment with a fixed replica count or the Horizontal Pod Autoscaler, and switch to the RollingUpdate strategy:

Fixed replicas

--set replicaCount=3 \
--set strategy.type=RollingUpdate

Autoscaling (HPA)

For scaled deployments, set sessionAffinity=ClientIP to keep a client's traffic on the same pod, and consider enabling a Pod Disruption Budget (podDisruptionBudget.enabled=true). All replicas use the same Gateway configuration.

See Scaling and High Availability for how the Gateway pool distributes and fails over sessions.

Session Recordings Storage

Session recordings are encrypted (AES-256-GCM) and streamed to Keeper in real time as the session happens, so recordings are not lost if the pod restarts. The Gateway uses a temporary local directory as a streaming buffer. On nodes with limited disk or for many concurrent sessions, attach a persistent volume for this buffer:

--set recordings.enabled=true \
--set recordings.size=50Gi

The /dev/shm shared-memory volume required for Remote Browser Isolation (Chromium) sessions is enabled by default (sharedMemory.enabled=true, sharedMemory.sizeLimit=2Gi). Increase the size limit for heavy RBI or RDP usage.

KeeperAI Threat Detection (optional)

Use a large language model to monitor privileged sessions and flag suspicious commands in real time. The API key is stored in a Kubernetes Secret.

--set ai.enabled=true \
--set ai.provider=openai \
--set ai.model=gpt-4o-mini \
--set ai.apiKey='<your-api-key>'

Supported providers include OpenAI, Anthropic, Azure OpenAI, Google AI, Vertex AI, AWS Bedrock, and any OpenAI-compatible endpoint (via openai-generic). For cloud-native authentication (AWS Bedrock with IRSA, Vertex AI with Workload Identity), use serviceAccount.annotations with ai.existingSecret or extraEnv instead of ai.apiKey. See KeeperAI for details.

Corporate Proxy / Custom CA Certificates

If your network uses SSL inspection (for example Zscaler), the Gateway needs your organization's CA certificate to establish outbound connections:

--set-file caCertificates.inline=./company-ca.pem

Or reference an existing ConfigMap with caCertificates.existingConfigMap. The Gateway installs these certificates into its trust store at startup.

Security Context

The Gateway requires elevated privileges for two reasons:

1. Startup - the entrypoint runs as root to install CA certificates and Python packages, then drops to the keeper-gw user before starting services.

2. RBI sessions - CEF/Chromium requires Linux namespace isolation (unshare, mount, clone), which needs CAP_SYS_ADMIN and an unconfined seccomp profile.

The chart defaults to capabilities SYS_ADMIN, SYS_CHROOT, SETUID, SETGID; seccompProfile: Unconfined; and appArmorProfile: unconfined.

Do not set runAsNonRoot: true or runAsUser. If your cluster enforces Pod Security Standards, the Gateway namespace may require an exemption.

For hardened deployments, the chart README documents installing a custom AppArmor profile (Debian/Ubuntu nodes) and a custom seccomp profile that allow only the syscalls CEF needs.

Demo / Playground Services (optional)

Deploy sample SSH, RDP, VNC, and MySQL containers alongside the Gateway as disposable targets for evaluation - try remote access, rotation, and discovery without standing up your own infrastructure. Provision the Gateway with Create with example records, then enable the demo services:

--set demo.enabled=true

Individual services can be toggled (for example --set demo.rdp.enabled=false).

Service	Port	Default
demo.mysql	3306	Enabled
demo.sshPassword	2222	Enabled
demo.sshKey	2222	Enabled
demo.vnc	5901	Enabled
demo.rdp	3389	Enabled

All demo passwords are placeholders for local testing only. Replace them with the values from your Keeper Vault wizard output. The demo services are not intended for production.

Network Configuration

The Keeper Gateway establishes outbound-only connections and does not require any inbound firewall rules. The following outbound connections must be allowed:

Destination Endpoint	Ports Needed	More Info
Keeper Cloud keepersecurity.[x] Endpoints: US: .com EU: .eu AU: .com.au JP: .jp CA: .ca US GOV: .us	TLS Port 443	Communicates with Keeper Cloud to access target infrastructure via native protocols (e.g., SSH, RDP)
Keeper Router connect.keepersecurity.[x] Endpoints: US: .com EU: .eu AU: .com.au JP: .jp CA: .ca US GOV: .us	TLS Port 443	Communicates with Keeper Router to establish secure, real-time WebSocket connections
Keeper Stun/Turn Service krelay.keepersecurity.[x] Endpoints: US: .com EU: .eu AU: .com.au JP: .jp CA: .ca US GOV: .us	TCP and UDP opened on Port 3478 Outbound access to TCP and UDP ports 49152 through 65535	Facilitates secure and encrypted WebRTC connections between end-user's vault and target systems via the Gateway

Uninstall

helm uninstall keeper-gateway -n keeper-gateway
kubectl delete namespace keeper-gateway

If recordings storage was enabled, the persistent volume is not removed automatically:

kubectl delete pvc -n keeper-gateway -l app.kubernetes.io/name=keeper-gateway

Configuration Reference

The most common values are below. For the complete list, see the chart's values.yaml or the ArtifactHub listing.

Gateway configuration

Parameter	Description	Default
gateway.acceptEula	Accept the EULA (required, must be Y)	""
gateway.config	Base64-encoded Gateway configuration from Keeper	""
gateway.existingSecret	Use a pre-created Kubernetes Secret instead of gateway.config	""
gateway.existingSecretKey	Key within the existing secret	"gateway-config"
gateway.awsKmsSecretName	Load the configuration from AWS Secrets Manager	""

Image

Parameter	Description	Default
image.repository	Gateway image repository	keeper/gateway
image.tag	Image tag (defaults to the chart appVersion)	""
image.pullPolicy	Image pull policy	IfNotPresent

Scaling & availability

Parameter	Description	Default
replicaCount	Number of Gateway pods	1
strategy.type	Recreate (single instance) or RollingUpdate (multi-instance)	Recreate
autoscaling.enabled	Enable the Horizontal Pod Autoscaler	false
autoscaling.minReplicas / maxReplicas	HPA bounds	1 / 5
sessionAffinity	Set to ClientIP for scaled deployments	""
podDisruptionBudget.enabled	Keep a minimum number of pods running during disruptions	false

Storage, logging, health & AI

Parameter	Description	Default
recordings.enabled / recordings.size	Persistent buffer for session recordings	false / 10Gi
sharedMemory.sizeLimit	/dev/shm size (RBI/Chromium)	2Gi
logging.level / logging.format	Log level and format	info / text
healthCheck.enabled / healthCheck.port	Health-check server (localhost)	true / 8099
ai.enabled / ai.provider / ai.model	KeeperAI threat detection	false
resources.limits	CPU / memory limits (raise for many RBI sessions)	4 / 4Gi