This example demonstrates how to run the entire Cosmo platform on Kubernetes with our official Helm chart. For demonstration purposes, we will use Minikube.
- A running Kubernetes cluster, with PV provisioner support + ingress controller
- Minikube
- Requires enabling
minikube addons enable ingress
- Requires enabling
- Minikube
- Helm 3.2.0+ installed locally
- Kubectl installed locally
helm install cosmo oci://ghcr.io/wundergraph/cosmo/helm-charts/cosmo --version 0.13.0Check Releases for the latest release of the Cosmo Chart.
The following steps depend on your operating system:
Minikube will automatically expose the ingress controller on your local machine. You can get the IP with minikube ip.
Now, add the following entries to your /etc/hosts file and replace the IP with the IP you get from the previous step.
192.168.49.2 studio.wundergraph.local
192.168.49.2 controlplane.wundergraph.local
192.168.49.2 router.wundergraph.local
192.168.49.2 keycloak.wundergraph.local
192.168.49.2 otelcollector.wundergraph.local
192.168.49.2 graphqlmetrics.wundergraph.local
192.168.49.2 cdn.wundergraph.local
Minikube needs to set up a tunnel to expose the ingress controller in your local machine. Add the following
entries to /etc/hosts:
127.0.0.1 studio.wundergraph.local
127.0.0.1 controlplane.wundergraph.local
127.0.0.1 router.wundergraph.local
127.0.0.1 keycloak.wundergraph.local
127.0.0.1 otelcollector.wundergraph.local
127.0.0.1 graphqlmetrics.wundergraph.local
127.0.0.1 cdn.wundergraph.local
Then start minikube tunnel and leave it running. It might ask for your root password in order to open
the tunnel on privileged ports.
The following command will create a federated graph consisting of multiple subgraphs and deploy the router to the minikube cluster.
./create_demo.shFinally 🚀, navigate to the Studio Playground and query the router.
Login with the default credentials:
Username: foo@wundergraph.com
Password: wunder@123
NOTE: With recent browsers enforcing secure contexts, Keycloak may not set its session cookie when TLS is disabled (SameSite=None cookies require the Secure attribute).
As a local‑dev workaround in Chrome, add http://keycloak.wundergraph.local,http://studio.wundergraph.local to chrome://flags/#unsafely-treat-insecure-origin-as-secure so these origins are treated as secure contexts over HTTP.
Use this only for local development and remove the flag after testing. Prefer enabling TLS locally (e.g., self‑signed cert via mkcert and an Ingress TLS secret).
After you are done, you can clean up the demo by running:
helm uninstall cosmoCaution
Volumes might not be automatically removed, so you may need to manually remove them with kubectl delete pvc -l app.kubernetes.io/instance=cosmo