Skip to main content

03 · Helm install

Install the OpenBox umbrella chart onto the EKS cluster Terraform just created.

1. Add repos + fetch chart deps​

helm repo add bitnami https://charts.bitnami.com/bitnami

git clone https://github.com/OpenBox-AI/openbox-manifest-k8s-cluster.git
cd openbox-manifest-k8s-cluster

helm dependency update charts/openbox

2. Prepare values-prod.yaml​

Wire Terraform outputs into the chart. Full reference at Helm chart → values reference.

# values-prod.yaml
global:
  environment: prod

openbox-backend:
  serviceAccount:
    # From terraform output backend_irsa_role_arn
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::<ACCOUNT>:role/openbox-backend-irsa
  env:
    KMS_KEY_ARN: <terraform output kms_key_arn>
    OPA_BUNDLE_BUCKET: <terraform output s3_opa_bundles_bucket>

openbox-core:
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::<ACCOUNT>:role/openbox-core-irsa
  env:
    KMS_KEY_ARN: <terraform output kms_key_arn>

# Use managed Postgres from Terraform (skip in-cluster Bitnami)
postgresql:
  enabled: false          # skip Bitnami sub-chart

openbox-backend:
  db:
    host: <terraform output rds_endpoint>
    port: 5432
    name: openbox
    userSecretRef: openbox-backend-db-credentials  # you create via ESO or manually

identity-service:
  db:
    host: <terraform output rds_endpoint>
    port: 5432
    name: keycloak
    userSecretRef: keycloak-db-credentials

# Use managed Redis from Terraform (skip in-cluster StatefulSet)
openbox-core:
  redis:
    external:
      host: <terraform output elasticache_endpoint>
      port: 6379

# Temporal — choose one variant
temporal:
  # OPTION A: Temporal Cloud (recommended for prod, lower ops burden)
  mode: cloud
  cloud:
    namespace: <your-temporal-cloud-namespace>
    address: <ns>.<acct>.tmprl.cloud:7233
    tlsSecretRef: temporal-cloud-tls

  # OPTION B: Self-hosted (uncomment to use)
  # mode: self-hosted
  # server:
  #   replicas: 4

# Ingress — choose per your gateway
ingress:
  className: alb          # if using AWS ALB Ingress Controller
  # className: istio      # if using Istio Gateway (chart default)
  # className: nginx      # if using NGINX Ingress
  host: openbox.your-domain.com
  tls:
    enabled: true
    # If using cert-manager:
    certManager:
      clusterIssuer: letsencrypt-prod

3. Install​

kubectl create namespace openbox

# Create DB credential secrets first (adapt to your ESO / Vault / etc.)
kubectl create secret generic openbox-backend-db-credentials \
  --from-literal=username=openbox \
  --from-literal=password="$(aws secretsmanager get-secret-value \
    --secret-id openbox/rds-master --query SecretString --output text | jq -r .password)" \
  -n openbox

kubectl create secret generic keycloak-db-credentials \
  --from-literal=username=keycloak \
  --from-literal=password="$(aws secretsmanager get-secret-value \
    --secret-id openbox/rds-master --query SecretString --output text | jq -r .password)" \
  -n openbox

# Install
helm upgrade --install openbox charts/openbox \
  -n openbox \
  -f values-prod.yaml \
  --atomic --wait --timeout 15m

--atomic auto-rolls back on failure. --wait blocks until all pods are Ready or timeout hits.

4. Verify pods​

kubectl get pods -n openbox
# Expect 8-15 pods, all Running / Ready

If pods are stuck, jump to Troubleshooting →.

Next​

04 · Post-install validation →