> ## Documentation Index
> Fetch the complete documentation index at: https://langchain-5e9cc07a-preview-opensw-1774360645-bf2eec8.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable LangSmith Deployment

> Enable agent deployment on a self-hosted LangSmith instance by adding the control plane and data plane components.

This guide shows you how to enable **LangSmith Deployment** on your [self-hosted LangSmith instance](/langsmith/kubernetes). This adds a [control plane](/langsmith/control-plane) and [data plane](/langsmith/data-plane) that let you deploy, scale, and manage agents and applications directly through the LangSmith UI.

After completing this guide, you'll have access to LangSmith [Observability](/langsmith/observability), [Evaluation](/langsmith/evaluation), and [Deployment](/langsmith/deployment).

<Info>**Important**<br /> Enabling LangSmith Deployment requires an [Enterprise](https://langchain.com/pricing) plan. </Info>

<Note>
  **This setup page is for enabling [LangSmith Deployment](/langsmith/deployment) on an existing LangSmith instance.**

  Review the [self-hosted options](/langsmith/self-hosted) to understand:

  * [LangSmith (observability)](/langsmith/self-hosted#langsmith): What you should install first.
  * [LangSmith Deployment](/langsmith/self-hosted#enable-langsmith-deployment): What this guide enables.
  * [Standalone Server](/langsmith/self-hosted#standalone-server): Lightweight alternative without the UI.
</Note>

## Overview

This guide builds on top of the [Kubernetes installation guide](/langsmith/kubernetes). **You must complete that guide first** before continuing. This page covers the additional setup steps required to enable LangSmith Deployment:

* Installing the LangGraph operator
* Configuring your ingress
* Connecting to the control plane

## Prerequisites

1. You are using Kubernetes.
2. You have an instance of [self-hosted LangSmith](/langsmith/kubernetes) running.
3. `KEDA` is installed on your cluster.

```bash theme={null}
  helm repo add kedacore https://kedacore.github.io/charts
  helm install keda kedacore/keda --namespace keda --create-namespace
```

<Info>
  `KEDA` is used to automatically scale the deployment system based on queue size.
</Info>

4. Ingress Configuration
   1. You must set up an ingress, gateway, or use Istio for your LangSmith instance. All agents will be deployed as Kubernetes services behind this ingress. Use this guide to [set up an ingress](/langsmith/self-host-ingress) for your instance. To enable LangSmith Deployment, you will need to provide a `hostname` in your `values.yaml`
5. You must have slack space in your cluster for multiple deployments. `Cluster-Autoscaler` is recommended to automatically provision new nodes.
6. A valid Dynamic PV provisioner or PVs available on your cluster. You can verify this by running:

```bash theme={null}
  kubectl get storageclass
```

7. Egress to `https://beacon.langchain.com` from your network. This is required for license verification and usage reporting if not running in air-gapped mode. See the [Egress documentation](/langsmith/self-host-egress) for more details.

## Setup

1. As part of configuring your self-hosted LangSmith instance, you enable the `deployment` option. This will provision a few key resources.
   1. `listener`: This is a service that listens to the [control plane](/langsmith/control-plane) for changes to your deployments and creates/updates downstream CRDs.
   2. `LangGraphPlatform CRD`: A CRD for LangSmith Deployment. This contains the spec for managing an instance of a LangSmith deployment.
   3. `operator`: This operator handles changes to your LangSmith CRDs.
   4. `host-backend`: This is the [control plane](/langsmith/control-plane).

<Note>
  As of v0.12.0, the `langgraphPlatform` option is deprecated. Use `config.deployment` for any version after v0.12.0.
</Note>

2. Two additional images will be used by the chart. Use the images that are specified in the latest release.

```bash theme={null}
  hostBackendImage:
    repository: "docker.io/langchain/hosted-langserve-backend"
    pullPolicy: IfNotPresent
  operatorImage:
    repository: "docker.io/langchain/langgraph-operator"
    pullPolicy: IfNotPresent
```

3. In your config file for langsmith (usually `langsmith_config.yaml`), enable the `deployment` option. Note that you must also have a valid ingress setup:

```bash theme={null}
  config:
    deployment:
      enabled: true
    # As of v0.12.0, this section is deprecated. Use config.deployment for any version after v0.12.0.
    langgraphPlatform:
      enabled: true
      langgraphPlatformLicenseKey: "YOUR_LANGGRAPH_PLATFORM_LICENSE_KEY"
```

4. In your `values.yaml` file, configure the `hostBackendImage` and `operatorImage` options (if you need to mirror images). If you are using a private container registry that requires authentication, you must also configure `imagePullSecrets`, refer to [Configure authentication for private registries](#optional-configure-authentication-for-private-registries).

5. You can also configure base templates for your agents by overriding the [base templates in values.yaml](https://github.com/langchain-ai/helm/blob/main/charts/langsmith/values.yaml#L898).

   Your self-hosted infrastructure is now ready to create deployments.

## (Optional) Configure additional data planes

In addition to the existing data plane already created in the above steps, you can create more data planes that reside in different Kubernetes clusters or the same cluster in a different namespace.

### Prerequisites

1. Read through the cluster organization guide in the [hybrid deployment documentation](/langsmith/hybrid#listeners) to understand how to best organize this for your use case.
2. Verify the prerequisites mentioned in the [hybrid](/langsmith/deploy-hybrid#prerequisites) section are met for the new cluster. Note that in step 5 of [Prerequisites](/langsmith/deploy-hybrid#prerequisites), you need to enable egress to your [self-hosted LangSmith instance](/langsmith/self-host-usage#configuring-the-application-you-want-to-use-with-langsmith) instead of [https://api.host.langchain.com](https://api.host.langchain.com) and [https://api.smith.langchain.com](https://api.smith.langchain.com).
3. Run the following commands against your LangSmith Postgres instance to enable this feature. This is the [Postgres instance](/langsmith/kubernetes#validate-your-deployment%3A) that comes with your self-hosted LangSmith setup.

```
update organizations set config = config || '{"enable_lgp_listeners_page": true}' where id = '<org id here>';
update tenants set config = config || '{"langgraph_remote_reconciler_enabled": true}' where id = '<workspace id here>';
```

Note down the workspace ID you choose as you will need this for future steps.

### Deploying to a different cluster

1. Follow steps 2-6 in the [hybrid setup guide](/langsmith/deploy-hybrid#setup). The `config.langsmithWorkspaceId` value should be set to the workspace ID you noted in the prerequisites.
2. To deploy more than one data plane to the cluster, follow the rules for [configuring additional data planes in the same cluster](/langsmith/deploy-hybrid#configuring-additional-data-planes-in-the-same-cluster).

### Deploying to a different namespace in the same cluster

1. You will need to make some modifications to the `langsmith_config.yaml` file you created in step 3 of the [above setup instructions](/langsmith/deploy-self-hosted-full-platform#setup):
   * Set the `operator.watchNamespaces` field to the current namespace your self-hosted LangSmith instance is running in. This is to prevent clashes with the operator that will be added as part of the new data plane.
   * It is required to use the [Gateway API](/langsmith/self-host-ingress#option-2%3A-gateway-api) or an [Istio Gateway](/langsmith/self-host-ingress#option-3%3A-istio-gateway). Please adjust your `langsmith_config.yaml` file accordingly.
2. Run a `helm upgrade` to update your self hosted LangSmith instance with the new config.
3. Follow steps 2-6 in the [hybrid setup guide](/langsmith/deploy-hybrid#setup). The `config.langsmithWorkspaceId` value should be set to the workspace ID you noted in the prerequisites. Remember that `config.watchNamespaces` should be set to different namespaces than the one used by the existing data plane!
4. Optionally configure access for the control plane to read Agent Server deployments logs from the other namespaces. For more details, see the [instructions](#optional-configure-access-for-reading-agent-server-deployments-logs-from-other-namespaces).

## (Optional) Configure authentication for private registries

If your [Agent Server deployments](/langsmith/agent-server) will use images from private container registries (e.g., AWS ECR, Azure ACR, GCP Artifact Registry, private Docker registry), configure image pull secrets. This is a one-time infrastructure configuration that allows all deployments to automatically authenticate with your private registry.

**Step 1: Create a Kubernetes image pull secret**

```bash theme={null}
kubectl create secret docker-registry langsmith-registry-secret \
    --docker-server=myregistry.com \
    --docker-username=your-username \
    --docker-password=your-password \
    --docker-email=your-email@example.com \
    -n langsmith
```

Replace the values with your registry credentials:

* `myregistry.com`: Your registry URL
* `your-username`: Your registry username
* `your-password`: Your registry password or access token
* `langsmith`: The Kubernetes namespace where LangSmith is installed

**Step 2: Configure the deployment template in your `values.yaml`**

To enable agent server deployments to use the private registry secret, you must add `imagePullSecrets` to the operator's deployment template:

```yaml {21-22} theme={null}
operator:
  templates:
    deployment: |
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: ${name}
        namespace: ${namespace}
      spec:
        replicas: ${replicas}
        revisionHistoryLimit: 10
        selector:
          matchLabels:
            app: ${name}
        template:
          metadata:
            labels:
              app: ${name}
          spec:
            enableServiceLinks: false
            imagePullSecrets:
            - name: langsmith-registry-secret
            containers:
            - name: api-server
              image: ${image}
              ports:
              - name: api-server
                containerPort: 8000
                protocol: TCP
              livenessProbe:
                httpGet:
                  path: /ok
                  port: 8000
                periodSeconds: 15
                timeoutSeconds: 5
                failureThreshold: 6
              readinessProbe:
                httpGet:
                  path: /ok
                  port: 8000
                periodSeconds: 15
                timeoutSeconds: 5
                failureThreshold: 6
```

**Step 3: Apply during Helm installation/upgrade**

When you deploy or upgrade your LangSmith instance using Helm, this configuration will be applied. All user deployments created through the LangSmith UI will automatically inherit these registry credentials.

For registry-specific authentication methods (AWS ECR, Azure ACR, GCP Artifact Registry, etc.), refer to the [Kubernetes documentation on pulling images from private registries](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).

## (Optional) Configure access for reading Agent Server deployments logs from other namespaces

<Info>**Important**<br /> Retrieving server logs is not supported for self-hosted deployments where the control plane (`host-backend`) and data plane (`listener`) are deployed in different Kubernetes clusters. </Info>

For self-hosted deployments where the control plane (`host-backend`) and data plane (`listener`) are deployed in the same Kubernetes cluster, ensure that the control plane Kubernetes deployment (`host-backend`) has permission to `get`/`list`/`watch` Kubernetes `deployments`/`pods`/`replicasets`/`logs` from the Kubernetes namespace where the Agent Server deployment exists. There are different ways to achieve this, so implement the solution that works best for your use case.

Example implementation:

1. Create a `Role` with the required permissions in the Kubernetes namespace where the Agent Server is deployed. Replace `<data_plane_namespace>` in the following command:
   ```
   kubectl apply -n <data_plane_namespace> -f - <<EOF
   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
   name: read-agent-server-logs-role
   rules:
   - apiGroups: [""]
       resources: ["pods"]
       verbs: ["get","list","watch"]
   - apiGroups: [""]
       resources: ["pods/log"]
       verbs: ["get","watch"]
   - apiGroups: ["apps"]
       resources: ["deployments"]
       verbs: ["get","list","watch"]
   - apiGroups: ["apps"]
       resources: ["replicasets"]
       verbs: ["get","list","watch"]
   EOF
   ```
2. Get the control plane `ServiceAccount`. Replace `<control_plane_namespace>`:
   ```
   kubectl get serviceaccounts -n <control_plane_namespace> | grep host-backend
   ```
3. Bind that `Role` to the control plane `ServiceAccount`. Replace `<data_plane_namespace>`, `<control_plane_namespace>`, and `<control_plane_service_account>` in the following command:
   ```
   kubectl apply -n <data_plane_namespace> -f - <<EOF
   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
   name: read-agent-server-logs-role-binding
   subjects:
   - kind: ServiceAccount
       name: <control_plane_service_account>
       namespace: <control_plane_namespace>
   roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: read-agent-server-logs-role
   EOF
   ```

In this example, the `Role` and `RoleBinding` are defined in the same Kubernetes namespace as the Agent Server deployment. You can assign any name to the `Role` and `RoleBinding` and customize them as needed.

## Next steps

Once your infrastructure is set up, you're ready to deploy applications. See the deployment guides in the [Deployment tab](/langsmith/deployment) for instructions on building and deploying your applications.

***

<div className="source-links">
  <Callout icon="edit">
    [Edit this page on GitHub](https://github.com/langchain-ai/docs/edit/main/src/langsmith/deploy-self-hosted-full-platform.mdx) or [file an issue](https://github.com/langchain-ai/docs/issues/new/choose).
  </Callout>

  <Callout icon="terminal-2">
    [Connect these docs](/use-these-docs) to Claude, VSCode, and more via MCP for real-time answers.
  </Callout>
</div>