Skip to main content

Limitations vs prod

Local PoC (S8) intentionally trades production-grade features for laptop-friendliness. Know these gaps before demoing to customers or shipping data.

Capability delta​

CapabilityLocal PoCProd (S1/S2/S3)
High availability❌ single pod per service✅ HPA min 2+, PodDisruptionBudget
Persistent storage⚠️ emptyDir / ephemeral PVC — data lost on restart✅ EBS gp3 with backup + PITR
TLS on ingress❌ HTTP only✅ ACM cert / cert-manager auto-provisioned
External DNS❌ /etc/hosts hack✅ Route 53 / real DNS
GPU workloads (vllm)❌ disabled by default (no laptop GPU)✅ 1× A10G for LlamaFirewall deep detection
Multi-container openbox-core pod✅ all 5 containers run✅ same
Guardrails: PII / NSFW / toxicity✅ CPU classifiers work✅ same
Guardrails: LlamaFirewall (deep detection)❌ disabled without GPU✅ enabled
Temporal⚠️ dev-server (single pod, ephemeral)✅ Temporal Cloud OR 4-pod self-hosted + ES
Keycloak HA❌ 1 replica✅ 3 replicas
PostgreSQL⚠️ single Bitnami pod, no backup✅ managed RDS/Aurora with PITR
Redis⚠️ single pod, no persistence✅ ElastiCache with replicas
OPA bundles⚠️ local file / example bundle✅ S3-hosted, versioned
Envelope encryption (KMS)❌ static local key✅ AWS KMS CMK with rotation
Autoscaling (HPA)⚠️ configured but 1 → 1✅ 1 → 8 or 2 → 10 per service
Argo Rollouts (canary)❌ disabled✅ canary strategy on guardrails-service
Observability❌ chart exposes /metrics but no scraper✅ customer's Prom/Datadog/etc.
Multi-tenancy⚠️ single Keycloak realm✅ realm-per-tenant possible
RBAC⚠️ default admin creds✅ SSO federation
Compliance controls❌ none✅ customer's SOC2/GDPR program

Do NOT use local PoC for​

  • Any production traffic
  • Real customer data (PII, PHI, PCI)
  • Compliance evidence collection
  • Load testing (single-pod bottleneck)
  • Security penetration testing (missing prod controls)

Do use local PoC for​

  • ✅ Feature demos to internal stakeholders
  • ✅ Developer eval / integration testing
  • ✅ Sales demos with synthetic data
  • ✅ CI smoke tests (scripts/kind-smoke.sh)
  • ✅ Docs verification (chart lint + template)

Data loss​

Every laptop restart / minikube stop may lose in-cluster PostgreSQL data. Minikube preserves PVCs across restarts by default, but restarting Docker Desktop or reclaiming disk may wipe them.

To preserve data across restarts on Minikube:

minikube stop            # pauses, keeps state
# NOT: minikube delete   # wipes everything

On kind, cluster delete = data delete. There's no persistent option; use hostPath if you must (out of scope of this doc).

Upgrading from PoC to prod​

Do not migrate data from local PoC to prod. Local PoC has default passwords and no encryption at rest. Re-create the Keycloak realm, users, and OPA bundles fresh on the prod install.

If you need to preserve config (not data) between environments, use Helm values files version-controlled in Git. Same chart, different values.

Next​

Move to a real scenario when ready: