Deploy a Tentacle

Goal

Deploy a tentacle from local development to a running Kubernetes cluster.

Prerequisites

tntc CLI installed and configured with an MCP endpoint
A tentacle project that passes tntc validate
Docker installed (for image builds)
Secrets configured (.secrets.yaml or .secrets/)

Steps

1. Validate the Tentacle

tntc validate
tntc test
tntc secrets check

Ensure no validation errors, all tests pass, and all secrets are provisioned.

2. Check Cluster Readiness

tntc cluster check

This validates:

MCP server is reachable
Namespace can be created
gVisor RuntimeClass exists (warning if missing)
NetworkPolicy support is available

3. Build the Image

Option A: Full build + push

tntc build --push

Creates a workflow-specific image with the Deno engine embedded and pushes to your configured registry.

Option B: Reuse existing image

tntc deploy --image ghcr.io/yourorg/tentacular-engine:latest

Skips the build step — only updates the ConfigMap with code changes. ~5-10 second deployment.

4. Deploy

tntc deploy

This:

Parses and validates workflow.yaml
Resolves the base image
Generates ConfigMap with workflow.yaml + nodes/*.ts
Generates K8s manifests (Deployment, Service, NetworkPolicy)
Provisions secrets to K8s
Ensures enclave exists (via MCP enclave_provision if needed)
Applies all manifests (via MCP wf_apply)

5. Verify Deployment

# Check deployment status
tntc status my-tentacle --detail

# View logs
tntc logs my-tentacle --tail 20

# Trigger a manual run
tntc run my-tentacle

# Security audit
tntc audit my-tentacle

Verification

tntc status shows healthy deployment with ready replicas
tntc logs shows clean startup with no errors
tntc run returns expected output
tntc audit shows clean RBAC, NetworkPolicy, and PSA

Failure Modes

Failure	Cause	Resolution
`MCP not configured`	Missing endpoint in config	Run `tntc configure` with `--env`
`image pull error`	Wrong registry or tag	Check `--image` flag or `.tentacular/base-image.txt`
`secret not found`	Secrets not provisioned	Run `tntc secrets check` and fix
`NetworkPolicy deny`	Contract missing dependency	Add dependency to `contract.dependencies`
`RuntimeClass not found`	gVisor not installed	Deploy with `--runtime-class ""` or install gVisor
`namespace not ready`	MCP server permissions	Check MCP server RBAC