Skip to main content

04 · Post-install validation

Prove the install is healthy before handing off to app teams.

Pod smoke test​

kubectl get pods -n openbox
# Expect all Running/Ready. Count varies by variant:
#   - Temporal Cloud variant: ~8-10 pods
#   - Self-hosted Temporal variant: ~15-20 pods (adds temporal server ×4, ES ×3, admintools)

Investigate any pod in CrashLoopBackOff, Pending, or ImagePullBackOff:

kubectl describe pod <name> -n openbox
kubectl logs <name> -n openbox --previous

Backend health probe​

kubectl port-forward -n openbox svc/openbox-backend 3000:3000 &

curl -sf http://localhost:3000/health
# Expect: {"status":"ok"}

curl -sf http://localhost:3000/readyz
# Expect: {"ready":true}

Keycloak first login​

Get the bootstrap admin credentials Openbox chart creates on first install:

BOOTSTRAP_USER=$(kubectl get secret -n openbox identity-service-bootstrap \
  -o jsonpath='{.data.username}' | base64 -d)
BOOTSTRAP_PASS=$(kubectl get secret -n openbox identity-service-bootstrap \
  -o jsonpath='{.data.password}' | base64 -d)

echo "Admin user: $BOOTSTRAP_USER"
echo "Password:   $BOOTSTRAP_PASS"

kubectl port-forward -n openbox svc/identity-service 8080:8080 &
# Open http://localhost:8080/admin/master/console/
# Log in with bootstrap creds; realms should include: master, openbox

Rotate the bootstrap password immediately — this account is only for initial setup.

OPA policy check​

kubectl port-forward -n openbox svc/opa-app 8181:8181 &

curl -sf http://localhost:8181/health?bundle=true
# Expect: {} (200 OK)

curl -sf http://localhost:8181/v1/data
# Expect: JSON with your policy bundles from S3

If bundles are empty, verify opa-app env vars point to your S3 bundle bucket and IRSA is attached.

Guardrails end-to-end​

kubectl port-forward -n openbox svc/guardrails-api 8000:8000 &

curl -sS http://localhost:8000/v1/scan \
  -H 'Content-Type: application/json' \
  -d '{"text":"My email is test@example.com"}' | jq .

# Expect: response includes detected PII entities

Ingress + TLS​

# If using ALB Ingress Controller:
kubectl get ingress -n openbox
# Look for ADDRESS column populated with an ALB DNS name

DNS=$(kubectl get ingress openbox -n openbox -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
curl -sfI "https://${DNS}/"
# Expect: HTTP/2 200 (or 302 redirect to login)

Point your CNAME / ALIAS record to ${DNS} when ready to serve real users.

Backup verification​

Run the first backup manually to prove the mechanism works before relying on the schedule:

# RDS: trigger manual snapshot
aws rds create-db-snapshot \
  --db-instance-identifier openbox-prod \
  --db-snapshot-identifier openbox-first-backup-$(date +%Y%m%d)

# Verify snapshot completes:
aws rds describe-db-snapshots \
  --db-snapshot-identifier openbox-first-backup-$(date +%Y%m%d) \
  --query 'DBSnapshots[0].Status'
# Expect: "available" (may take 5-15 min)

Sign-off checklist​

  • All pods Running/Ready
  • Backend /health returns 200
  • Keycloak admin login works, bootstrap password rotated
  • OPA /v1/data returns bundles from S3
  • Guardrails PII detection returns expected entities
  • Ingress serves 200 over TLS via public DNS
  • RDS manual snapshot completed
  • helm history openbox -n openbox shows revision 1 deployed
  • Rollback dry-run: helm rollback openbox 0 --dry-run succeeds

If all check: install is production-ready. Hand off to app teams.

Ongoing operations​

Openbox does not prescribe ops tooling. Choose your own for:

  • Metrics/logs (Prometheus/Grafana, Datadog, ELK, etc.)
  • Alerting rules
  • On-call rota + escalation
  • DR drill cadence

See System requirements — Network for what OpenBox exposes on /metrics.