← Buildbarn

Buildbarn Helm chart

A maintained, Apache-2.0 Helm chart for running Buildbarn remote cache and remote execution for Bazel on Kubernetes. Published as an OCI artifact; source and runbooks on GitHub.

Install (Helm 3.8+)
helm upgrade --install --namespace hermetiq buildbarn \
  oci://ghcr.io/hermetiq/buildbarn \
  --version 0.9.6 \
  --values buildbarn-values.yaml
View on GitHub Chart README →Artifact Hub →

Install

  1. Check prerequisites: Kubernetes 1.32+, Helm 3.8+, a Gateway API, Contour, or Ingress controller, DNS and TLS, an OIDC provider, and a StorageClass for CAS and AC volumes.
  2. Copy the Buildbarn starter values.
  3. Inspect the packaged defaults before editing them.
Inspect chart docs and defaults
helm show readme oci://ghcr.io/hermetiq/buildbarn --version 0.9.6
helm show values oci://ghcr.io/hermetiq/buildbarn --version 0.9.6
  1. Set hosts, identity provider, storage sizing, and routing. kubectl get storageclass, then set storage.persistence.cas.storageClassName and storage.persistence.ac.storageClassName (defaults to GKE's premium-rwo; use gp3 on EKS).
  2. Run the install command above, verify the services, then add worker pools as RbeWorker resources via the bb-worker-operator.

What it deploys

  • Frontend Deployment and gRPC Service — the endpoint Bazel uses for --remote_cache and --remote_executor. Optional KEDA autoscaling and a local read cache.
  • Scheduler with predeclared platform queues, including scale-to-zero worker pools.
  • Storage StatefulSet (CAS and AC), with optional raw block devices, ISCC/FSAC, and NetworkPolicies limiting direct access.
  • Buildbarn Browser behind OIDC SSO, optional bb-portal and Remote Asset API.
  • Routing via Gateway API (HTTPRoute/GRPCRoute), Contour HTTPProxy, or Ingress; optional cert-manager certificates and in-cluster mTLS.
  • Observability: optional VictoriaMetrics scrapes and alert rules, tracing, and the Hermetiq grpc-cache-proxy sidecar for action-cache hit tracking.

Configuration is Jsonnet rendered into ConfigMaps, with per-file overrides when the values surface isn't enough.

Values you will touch first

  • hosts.* — external hostnames for gRPC and Browser.
  • storage.persistence.* — StorageClass and size for CAS/AC.
  • routing, gateway, httpProxy, ingress — choose one exposure model.
  • frontend.* — replicas, read cache, autoscaling, cache-event tracking.
  • scheduler.predeclaredPlatformQueues — platforms your workers serve.
  • security.*, tls — pod/container security context and mTLS.

The full reference is the chart README and helm show values; the chart ships a values.schema.json so invalid values fail at render time.

Limitations

  • Worker pools are not part of this chart; they need the bb-worker-operator.
  • Starter values target GKE. Other clouds need equivalent storage, workload identity, and routing.
  • Frontend reads are open by design; writes are authenticated. Restrict network exposure accordingly.
  • We have not published comparative performance benchmarks for this chart.

FAQ

Is there an official Buildbarn Helm chart?

The upstream Buildbarn project publishes example deployments (bb-deployments) rather than a maintained Helm chart. Hermetiq publishes and maintains an Apache-2.0 Buildbarn chart at oci://ghcr.io/hermetiq/buildbarn, with source in the Hermetiq/hermetiq-k8s repository.

What does the chart deploy?

Buildbarn frontend, scheduler, sharded storage StatefulSet, and Buildbarn Browser, with optional Remote Asset API, bb-portal, KEDA frontend autoscaling, PodDisruptionBudgets, NetworkPolicies, and Gateway API, Contour, or Ingress routing. Workers are not rendered by this chart; they are RbeWorker resources reconciled by the bb-worker-operator chart.

What are the prerequisites?

Kubernetes 1.32 or newer, Helm 3.8 or newer (for OCI), a Gateway API, Contour, or Ingress controller, DNS and TLS for external hosts, an OIDC identity provider, and a StorageClass suitable for CAS and AC volumes. The starter values target GKE; EKS and AKS need equivalent storage, identity, and routing settings.

Can I use it without Hermetiq?

The chart is Apache-2.0 and deploys standard Buildbarn components. The supported install order in the repository installs it alongside the Hermetiq chart and worker operator, and the optional grpc-cache-proxy sidecar sends cache events to Hermetiq. Review the chart README for which values depend on the rest of the stack in your setup.

How do I point Bazel at it?

Set --remote_cache and --remote_executor to the frontend gRPC host you expose, plus the credentials your frontend requires for writes. The repository includes example Bazel integrations.

Where is it listed on Artifact Hub?

The chart is currently listed on Artifact Hub; the listing is moving to a Hermetiq-owned publisher. The OCI reference above is the canonical install source.

Related

Running Buildbarn already?

Hermetiq adds build analytics and an AI build engineer on top of your Buildbarn: queue pressure, action latency phases, cache-miss causes, and cost attribution, with fixes proposed as PRs.

Book a demo See Build Analytics & AI →Log in or create an account →