Kubernetes

On Kubernetes the config is split between ConfigMaps (the two config.yaml files) and the PVC at /data (pipelines, steps, agents and skills, plus the database, artifacts and logs). Both services hot-reload, so changing pipelines, steps, agents and skills never needs a pod restart.

Where things live

	VectorStep (`deploy/vectorstep`)	Gateway (`deploy/vectorstep-gateway`)
Config	ConfigMap `vectorstep-config`	ConfigMap `vectorstep-gateway-config`
Secrets (`${VAR}` values, tokens)	Secret `vectorstep-secrets`	Secret `vectorstep-gateway-secrets`
Authored files	`/data/pipelines`, `/data/steps`	`/data/agents`, `/data/skills`

Port-forward to reach either service from your machine:

kubectl -n vectorstep port-forward deploy/vectorstep 8000:8000
kubectl -n vectorstep port-forward deploy/vectorstep-gateway 18780:18780

Change one thing, by hand

The quickest way to try a change — fine for a test cluster:

# 1. put the file on the volume
POD=$(kubectl -n vectorstep get pod -l app=vectorstep -o name | head -1)
kubectl -n vectorstep cp my-pipeline.yaml "${POD#pod/}":/data/pipelines/my-pipeline.yaml -c vectorstep

# 2. reload (the admin token is in the pod's environment)
kubectl -n vectorstep exec "$POD" -c vectorstep -- python -c "
import os, urllib.request as u
print(u.urlopen(u.Request('http://localhost:8000/reload', method='POST',
      headers={'Authorization': 'Bearer ' + os.environ['VECTORSTEP_ADMIN_TOKEN']})).read().decode())"

Agents and skills are the same with deploy/vectorstep-gateway, /data/agents or /data/skills, port 18780, and the Gateway’s admin token (VECTORSTEP_GATEWAY_ADMIN_TOKEN).

Change `config.yaml` or a secret

Edit the ConfigMap (or Secret) and restart the Deployment — these settings are read at startup:

kubectl -n vectorstep edit configmap vectorstep-config          # or vectorstep-gateway-config
kubectl -n vectorstep rollout restart deployment/vectorstep    # or deployment/vectorstep-gateway

pricing:, replay: and security policies on the service are picked up by a reload once the ConfigMap has synced into the pod (usually under a minute), no restart needed. See what reloads and what doesn’t.

Shell-step scripts

Scripts for executor: shell steps are a read-only ConfigMap mounted at /etc/vectorstep/scripts — not part of /data, and not changed by a reload. Mount the volume with defaultMode: 0555 (without it the service rejects every script as not executable), pin each script’s sha256 in config.yaml, and restart after any change. The full steps, including a helper script for the pins and the restart, are in Changing config on Kubernetes → Shell-step scripts.

Ship changes from CI

For a team, put the files in git and have CI deliver them. There are three supported routes, each with copy-and-tweak templates:

A — API push: CI calls the write API. Checked before it goes live; live in seconds.
B — copy files: CI copies into the pod and reloads, with automatic rollback.
C — GitOps ConfigMaps: everything declared in git, applied by a pipeline (C1) or reconciled by Argo CD / Flux (C2).

Changing config on Kubernetes compares them and walks through each.