Most conversations about Kubernetes focus on application workloads — microservices, APIs, batch processing pipelines. The idea that Kubernetes should also be the operational home for your workspace delivery platform tends to generate a moment’s hesitation the first time you hear it.
That hesitation is worth taking seriously. Then set it aside, because the operational model Kubernetes provides maps almost perfectly onto the day-2 management problems that make running workspace infrastructure at scale genuinely hard.
The Problem with Static Desktop Infrastructure
Legacy desktop delivery infrastructure is built around permanence. Virtual machines are provisioned, configured, and then managed indefinitely. Patches are applied in place. Images drift. The gap between what your gold image looked like at provisioning time and what a user’s environment looks like six months later is filled with accumulated state — installed software, configuration changes, browser extensions, downloaded files, and credentials stored in ways that were never sanctioned.
This is not a criticism of the teams managing that infrastructure. It is a structural property of persistent desktop environments. The longer a desktop exists, the more it diverges from its intended state. And divergence creates risk.
At scale, these problems multiply. A fleet of five hundred persistent VMs is five hundred independent state management problems. Rolling out an image update means coordinating reboots, managing user interruption windows, and handling the inevitable edge cases where the update interacts badly with accumulated local state. For security-sensitive environments — government agencies, financial services firms, healthcare organizations — the compliance overhead of auditing that kind of fleet is substantial.
Kasm Workspaces was designed around an ephemeral session model: sessions that are created from a known-good image, run for the duration of a user’s work, and are discarded completely. No accumulated state. No drift. Every session starts from the same baseline.
The operational challenge is managing the platform that delivers those sessions consistently, at scale, across environments. That is where Kubernetes enters the picture.
Why Kubernetes Changes the Game for Platform Operations
Kubernetes was designed to manage complex, distributed platform deployments declaratively. When Kasm’s management and control plane components are deployed via Helm into a Kubernetes cluster, the operational characteristics of the platform change fundamentally.
Declarative configuration. Kubernetes deployments are defined as code — Helm charts, values files, configuration exports stored in version control. The state of your Kasm deployment, including how it is configured and how it is connected to the rest of your infrastructure, is expressed in files that can be reviewed, versioned, and audited. For compliance-driven organizations, the ability to demonstrate that your infrastructure matches a documented, version-controlled specification is operationally significant.
Portability. Kubernetes runs on every major cloud provider and on-premises. An organization that deploys Kasm’s management layer on a self-hosted Kubernetes cluster today can migrate to a managed Kubernetes service later without rearchitecting the workspace platform. The Helm charts work. The configuration works. The operational knowledge transfers. Infrastructure decisions no longer lock the workspace platform in place.
Managed upgrade paths. Helm-managed deployments make upgrading Kasm a controlled, reversible process. Rolling updates reduce disruption. Failed updates can be rolled back without manual intervention. For organizations managing multiple Kasm environments, this matters: keeping deployments current becomes an operational routine, not a project.
What Kasm Workspaces on Kubernetes Looks Like in Practice
Deploying Kasm Workspaces on Kubernetes starts with the official Helm charts, which cover Kasm’s management and control plane components — the parts of the platform responsible for orchestrating sessions, managing users and policies, handling authentication, and exposing the administrative interface. A minimal evaluation install can be up and running in a cluster with a handful of commands. A production deployment is more involved, but the configuration lives in values files that are readable, diffable, and stored in version control.
Importantly, workspace sessions themselves — the secure browsers, virtual desktops, and streamed applications that users connect to — run on dedicated Kasm agent servers, not inside the Kubernetes cluster. The Kubernetes deployment manages Kasm’s control plane. The agent infrastructure that delivers sessions is provisioned and scaled separately, according to the organization’s capacity model. This is a meaningful architectural distinction: Kubernetes provides the operational foundation for managing the platform, while session delivery remains on agent infrastructure designed for that purpose.
The Configuration Import/Export system is a meaningful part of the operational story. The ability to export Kasm platform configuration — workspace types, access policies, image registries, network settings — as a portable, sanitized artifact means your Kasm configuration can live in the same repository as your Helm values files. Promoting a configuration from a staging environment to production becomes a controlled, reviewable process rather than a manual re-configuration exercise. Environment drift between staging and production, one of the most persistent sources of “it worked in staging” failures, becomes manageable.
For organizations connecting workspace sessions to internal services, Kasm supports configurable egress providers. The OpenZiti integration gives administrators the option to route session egress traffic through an existing OpenZiti-based zero-trust network — organizations that already run OpenZiti infrastructure can extend it to cover Kasm session connectivity without additional VPN configuration or broad network access grants. This is a complement to Kubernetes network policy, not a replacement for it: Kubernetes controls platform component communication inside the cluster; OpenZiti governs how workspace sessions reach internal services.
The Operational Case for Platform Teams
Three operational questions tend to drive the adoption of Kubernetes-based Kasm deployments among platform engineering teams.
How do we keep multiple Kasm environments consistent? Organizations running separate Kasm instances for different departments, regions, security classifications, or development stages face a consistency problem. Without a declarative, version-controlled deployment model, environments diverge. Helm-based deployment with shared charts and environment-specific values files makes consistency a structural property of the deployment model rather than a discipline that has to be enforced manually.
How do we manage Kasm upgrades without disrupting operations? Rolling Kasm upgrades through Helm means upgrade operations are predictable, reversible, and integrated with the same change management process the team uses for everything else. There is no separate “Kasm upgrade procedure” that lives outside the standard operational workflow.
How do we demonstrate infrastructure compliance? Regulated organizations need to show that their infrastructure matches a documented, authorized configuration. Helm charts in version control, GitOps deployment pipelines, and exportable Kasm configuration artifacts together provide a clear configuration audit trail — from the Kubernetes deployment specification down to the Kasm platform settings.
Where This Deployment Model Makes the Most Sense
Enterprise deployments with multiple environments. Organizations running Kasm across multiple regions, data centers, or tenancy boundaries benefit most from a deployment model that enforces consistency at scale. Helm-based deployment with config-as-code practices makes managing a distributed Kasm fleet operationally tractable.
Government and classified environments. Agencies handling sensitive or classified data need workspace infrastructure that can demonstrate consistent configuration. Kubernetes-based deployments with Helm chart management and GitOps workflows provide an auditable configuration trail. Air-gapped Kubernetes clusters are supported for environments where the management plane must remain isolated. The zero-trust egress integration means workspace network access can be scoped tightly to authorized services.
Developer and engineering workspaces. Platform teams managing Kasm as developer workspace infrastructure benefit from treating it as a first-class platform service: versioned, monitored, upgraded through a pipeline, and configured alongside the rest of the organization’s infrastructure. Developer workspaces running through Kasm on Kubernetes are fully consistent, fully ephemeral — code and credentials stay inside the session, not on the endpoint — and operationally managed through the same tooling the platform team uses everywhere else.
Getting Started
For teams evaluating a Kubernetes-based Kasm deployment, the documentation at kasmweb.com/docs covers both single-node evaluation configurations and multi-zone production architectures. The Helm charts are the right starting point for understanding the deployment model.
The gap between “interesting technology” and “production infrastructure” closes when the operational model is sound. Kubernetes provides that model for managing Kasm at scale: declarative, portable, GitOps-compatible, and built for the day-2 operations that determine whether platform infrastructure is actually sustainable to run.
About Kasm Workspaces
Kasm Technologies delivers a modern platform for secure, containerized desktop and application access. Kasm Workspaces streams browsers, desktops, and applications directly to users through ephemeral, policy-controlled sessions — eliminating the cost, rigidity, and risk of traditional VDI. Built by a team with deep roots in federal cybersecurity and offensive/defensive operations, Kasm is used by organizations ranging from government agencies to Fortune 500 companies to deliver secure, scalable developer and end-user environments.
Learn more at kasm.com.
