diff --git a/charts/warpstream-agent/.helmignore b/charts/warpstream-agent/.helmignore
new file mode 100644
index 0000000..f0c1319
--- /dev/null
+++ b/charts/warpstream-agent/.helmignore
@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
diff --git a/charts/warpstream-agent/Chart.yaml b/charts/warpstream-agent/Chart.yaml
new file mode 100644
index 0000000..c2c1a13
--- /dev/null
+++ b/charts/warpstream-agent/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+name: warpstream-agent
+description: WarpStream Agent for Kubernetes.
+type: application
+version: 0.1.0
+appVersion: v507
+icon: https://avatars.githubusercontent.com/u/132156278
+home: https://docs.warpstream.com/warpstream/
+sources:
+  - https://github.com/warpstreamlabs/charts/warpstream-agent
diff --git a/charts/warpstream-agent/LICENSE b/charts/warpstream-agent/LICENSE
new file mode 100644
index 0000000..46c7ea9
--- /dev/null
+++ b/charts/warpstream-agent/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 WarpStream Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/charts/warpstream-agent/README.md b/charts/warpstream-agent/README.md
new file mode 100644
index 0000000..717cd84
--- /dev/null
+++ b/charts/warpstream-agent/README.md
@@ -0,0 +1,72 @@
+# WarpStream Agent Helm chart
+
+The official Helm chart for the [Warpstream agent for Kubernetes][agent-k8s].
+
+[agent-k8s]: ===CHART_DOC_URL===
+
+## Getting started
+
+### Prerequisites
+
+This chart requires Helm v3.6 or later.
+
+### Install the latest stable release
+
+```shell
+helm repo add warpstream https://warpstreamlabs.github.io/charts
+helm repo update
+helm upgrade --install warpstream-agent warpstream/warpstream-agent \
+    --set config.bucketURL="mem://mem_bucket" \
+    --set config.apiKey="$YOUR_API_KEY" \
+    --set config.virtualClusterID="$YOUR_VIRTUAL_CLUSTER_ID"
+```
+
+### Upgrade an existing release
+
+```shell
+helm repo update
+helm upgrade  warpstream-agent warpstream/warpstream-agent --reuse-values
+```
+
+### Customize
+
+See [`values.yaml`](./values.yaml).
+
+### Install from source
+
+``` shell
+git clone https://github.com/warpstreamlabs/charts
+cd charts/warpstream-agent
+helm upgrade --install warpstream-agent . \
+    --set config.bucketURL="mem://mem_bucket" \
+    --set config.apiKey="$YOUR_API_KEY" \
+    --set config.virtualClusterID="$YOUR_VIRTUAL_CLUSTER_ID"
+```
+
+## Development
+
+### Testing locally
+
+Bootstrap a Kubernetes cluster locally, for example with [kind][].
+
+```shell
+helm upgrade --install warpstream-agent . --set config.playground=true
+helm test warpstream-agent
+kubectl logs warpstream-agent-diagnose-connection
+```
+
+Or manually diagnose connection with
+```shell
+kubectl port-forward svc/warpstream-agent 9092 &
+docker run --net=host public.ecr.aws/warpstream-labs/warpstream_agent_linux_amd64 \
+    kcmd -bootstrap-host localhost -type diagnose-connection
+```
+
+[kind]: https://kind.sigs.k8s.io/
+
+### Publishing a new release
+
+1. When applicable: Update `appVersion` in [`Chart.yaml`](./Chart.yaml) with the latest [release][].
+1. When changing any Helm chart resources: Update `version` in [`Chart.yaml`](./Chart.yaml).
+
+[release]: https://docs.warpstream.com/warpstream/reference/install-the-warpstream-agent
diff --git a/charts/warpstream-agent/templates/NOTES.txt b/charts/warpstream-agent/templates/NOTES.txt
new file mode 100644
index 0000000..44448bd
--- /dev/null
+++ b/charts/warpstream-agent/templates/NOTES.txt
@@ -0,0 +1,3 @@
+Thank you for installing {{ .Chart.Name }}.
+
+Your release is named {{ .Release.Name }}.
diff --git a/charts/warpstream-agent/templates/_helpers.tpl b/charts/warpstream-agent/templates/_helpers.tpl
new file mode 100644
index 0000000..849116c
--- /dev/null
+++ b/charts/warpstream-agent/templates/_helpers.tpl
@@ -0,0 +1,73 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "warpstream-agent.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "warpstream-agent.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "warpstream-agent.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "warpstream-agent.labels" -}}
+helm.sh/chart: {{ include "warpstream-agent.chart" . }}
+{{ include "warpstream-agent.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "warpstream-agent.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "warpstream-agent.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Secret Name
+*/}}
+{{- define "warpstream-agent.secretName" -}}
+{{- if .Values.config.secretName }}
+{{- .Values.config.secretName }}
+{{- else }}
+{{- printf "%s-apikey" (include "warpstream-agent.fullname" .) -}}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "warpstream-agent.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "warpstream-agent.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
diff --git a/charts/warpstream-agent/templates/deployment.yaml b/charts/warpstream-agent/templates/deployment.yaml
new file mode 100644
index 0000000..7f4bbc8
--- /dev/null
+++ b/charts/warpstream-agent/templates/deployment.yaml
@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "warpstream-agent.fullname" . }}
+  labels:
+    {{- include "warpstream-agent.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      {{- include "warpstream-agent.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "warpstream-agent.selectorLabels" . | nindent 8 }}
+    spec:
+      automountServiceAccountToken: false
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "warpstream-agent.serviceAccountName" . }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName | quote }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            {{- if .Values.config.playground }}
+            - playground
+            {{- else }}
+            - --token-file=/etc/agentk/secrets/token
+            - --kas-address={{ .Values.config.kasAddress }}
+            {{- end }}
+            {{- range .Values.extraArgs }}
+            - {{ . }}
+            {{- end }}
+          readinessProbe:
+            exec:
+              command:
+                - /bin/true
+            initialDelaySeconds: 10
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          env:
+          {{- if .Values.extraEnv }}
+            {{- toYaml .Values.extraEnv | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: kafka
+              containerPort: 9092
+              protocol: TCP
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+      {{- with .Values.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.hostAliases  }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/charts/warpstream-agent/templates/secret.yaml b/charts/warpstream-agent/templates/secret.yaml
new file mode 100644
index 0000000..0c7a4d1
--- /dev/null
+++ b/charts/warpstream-agent/templates/secret.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.config.apiKey -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "warpstream-agent.secretName" . }}
+  labels:
+    {{- include "warpstream-agent.labels" . | nindent 4 }}
+data:
+  apikey: {{  required "A valid config.apiKey is required" .Values.config.apiKey |  b64enc }}
+type: Opaque
+{{- end }}
diff --git a/charts/warpstream-agent/templates/service.yaml b/charts/warpstream-agent/templates/service.yaml
new file mode 100644
index 0000000..dfebf45
--- /dev/null
+++ b/charts/warpstream-agent/templates/service.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "warpstream-agent.fullname" . }}
+  labels:
+    {{- include "warpstream-agent.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: kafka
+      protocol: TCP
+      name: kafka
+    - port: {{ .Values.service.httpPort }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "warpstream-agent.selectorLabels" . | nindent 4 }}
diff --git a/charts/warpstream-agent/templates/serviceaccount.yaml b/charts/warpstream-agent/templates/serviceaccount.yaml
new file mode 100644
index 0000000..daa3a9e
--- /dev/null
+++ b/charts/warpstream-agent/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "warpstream-agent.serviceAccountName" . }}
+  labels:
+    {{- include "warpstream-agent.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/warpstream-agent/templates/tests/test-connection.yaml b/charts/warpstream-agent/templates/tests/test-connection.yaml
new file mode 100644
index 0000000..bb1b17f
--- /dev/null
+++ b/charts/warpstream-agent/templates/tests/test-connection.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "warpstream-agent.fullname" . }}-diagnose-connection"
+  labels:
+    {{- include "warpstream-agent.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: diagnose
+      image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
+      command: ['/warpstream']
+      args:
+        - kcmd
+        - -bootstrap-host
+        - '{{ include "warpstream-agent.fullname" . }}'
+        - -type
+        - diagnose-connection
+  restartPolicy: Never
diff --git a/charts/warpstream-agent/values.yaml b/charts/warpstream-agent/values.yaml
new file mode 100644
index 0000000..d21db0e
--- /dev/null
+++ b/charts/warpstream-agent/values.yaml
@@ -0,0 +1,73 @@
+image:
+  repository: "public.ecr.aws/warpstream-labs/warpstream_agent_linux_amd64"
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+replicas: 1
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  # name: ""
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # runAsNonRoot: true
+
+service:
+  type: ClusterIP
+  port: 9092
+  httpPort: 8080
+
+config:
+  playground: false
+  # bucketURL: "mem://mem_bucket"
+  # apiKey: "YOUR_API_KEY"
+  # virtualClusterID: "YOUR_VIRTUAL_CLUSTER_ID"
+
+extraEnv: []
+# Add additional environment settings to the pod. Can be useful in proxy
+# environments
+
+extraArgs: []
+# Add additional args settings to the pod.
+
+resources: {}
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+priorityClassName: ""
+
+## list of hosts and IPs that will be injected into the pod's hosts file
+hostAliases: []
+  # - ip: "127.0.0.1"
+  #   hostnames:
+  #   - "foo.local"
+  #   - "bar.local"
+
+# Labels to be added to each agent pod
+podLabels: {}
+
+# Optional initContainers definition
+initContainers: []