Skip to main content

Prerequisites checklist

Run these checks before helm install. Each command should print the expected output; any failure blocks install.

One-shot verification script​

#!/usr/bin/env bash
set -e

echo "== Kubernetes version =="
kubectl version --output=json | jq -r '.serverVersion.gitVersion'
# Expect: v1.27.x or later

echo "== Nodes ready =="
NODES=$(kubectl get nodes --no-headers | grep -c ' Ready ')
echo "$NODES nodes Ready"
# Expect: >= 8 for prod, >= 3 for dev

echo "== metrics-server =="
kubectl get deployment metrics-server -n kube-system \
  -o jsonpath='{.status.readyReplicas}' | grep -q 1 && echo "OK" || echo "MISSING"

echo "== StorageClass (default) =="
kubectl get storageclass \
  -o jsonpath='{.items[?(@.metadata.annotations.storageclass\.kubernetes\.io/is-default-class=="true")].metadata.name}'
# Expect: at least one name printed

echo "== IngressClass =="
kubectl get ingressclass --no-headers | awk '{print $1}'
# Expect: at least one line (nginx/alb/istio/traefik)

echo "== helm CLI =="
helm version --short
# Expect: v3.12.x or later

echo "== kubectl CLI =="
kubectl version --client --output=json | jq -r '.clientVersion.gitVersion'
# Expect: v1.27.x or later

echo "== Namespace 'openbox' (create if missing) =="
kubectl get namespace openbox >/dev/null 2>&1 || kubectl create namespace openbox

echo "== Optional CRDs =="
kubectl get crd rollouts.argoproj.io >/dev/null 2>&1 \
  && echo "Argo Rollouts: present" \
  || echo "Argo Rollouts: MISSING (set openbox-guardrails-service.rollout.enabled=false)"

kubectl get crd externalsecrets.external-secrets.io >/dev/null 2>&1 \
  && echo "External Secrets: present" \
  || echo "External Secrets: missing (use plain K8s Secrets)"

kubectl get crd clusterissuers.cert-manager.io >/dev/null 2>&1 \
  && echo "cert-manager: present" \
  || echo "cert-manager: missing (TLS certs are manual)"

echo "== Cluster egress (image pull test) =="
kubectl run tmp-pull-test --image=alpine:3.19 --rm -it --restart=Never -- \
  wget -qO- https://google.com >/dev/null && echo "OK" || echo "EGRESS BLOCKED"

echo "All checks complete. Fix any missing items before proceeding to helm install."

Save as preflight.sh, chmod +x preflight.sh, run before install.

Manual checklist (if script not applicable)​

  • Kubernetes API server reachable (kubectl cluster-info)
  • Server version ≥ 1.27
  • ≥ 3 worker nodes Ready (production: ≥ 8)
  • metrics-server running in kube-system
  • Default StorageClass present
  • At least one IngressClass installed
  • helm ≥ 3.12 on your workstation
  • kubectl ≥ 1.27 on your workstation
  • Namespace openbox created (or you have create-namespace RBAC)
  • Argo Rollouts CRD installed (OR you set rollout.enabled: false in values)
  • Cluster can pull images from ghcr.io/openbox-ai/* (adjust if using private registry)

Common blockers​

"metrics-server not found"

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

"no StorageClass has default annotation" — mark one as default:

kubectl patch storageclass <your-class-name> \
  -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

"cluster can't pull ghcr.io images" — check egress firewall, or mirror images to your registry and override image.repository in values.

Next​

Helm install →