Limitations vs prod
Local PoC intentionally trades production-grade features for laptop-friendliness. Know these gaps before demoing to customers or shipping data.
Capability delta
| Capability | Local PoC | Production (CDK / Helm chart / Marketplace) |
|---|---|---|
| High availability | ❌ single pod per service | ✅ HPA min 2+, PodDisruptionBudget |
| Persistent storage | ⚠️ emptyDir / ephemeral PVC — data lost on restart | ✅ EBS gp3 with backup + PITR |
| TLS on ingress | ❌ HTTP only | ✅ ACM cert / cert-manager auto-provisioned |
| External DNS | ❌ /etc/hosts hack | ✅ Route 53 / real DNS |
| GPU workloads (vllm) | ❌ disabled by default (no laptop GPU) | ✅ 1× A10G for LlamaFirewall deep detection |
Multi-container openbox-core pod | ✅ all 5 containers run | ✅ same |
| Guardrails: PII / NSFW / toxicity | ✅ CPU classifiers work | ✅ same |
| Guardrails: LlamaFirewall (deep detection) | ❌ disabled without GPU | ✅ enabled |
| Temporal | ⚠️ dev-server (single pod, ephemeral) | ✅ Temporal Cloud OR 4-pod self-hosted + ES |
| Keycloak HA | ❌ 1 replica | ✅ 3 replicas |
| PostgreSQL | ⚠️ single Bitnami pod, no backup | ✅ managed RDS/Aurora with PITR |
| Redis | ⚠️ single pod, no persistence | ✅ ElastiCache with replicas |
| OPA bundles | ⚠️ local file / example bundle | ✅ S3-hosted, versioned |
| Envelope encryption (KMS) | ❌ static local key | ✅ AWS KMS CMK with rotation |
| Autoscaling (HPA) | ⚠️ configured but 1 → 1 | ✅ 1 → 8 or 2 → 10 per service |
| Argo Rollouts (canary) | ❌ disabled | ✅ canary strategy on guardrails-service |
| Observability | ❌ chart exposes /metrics but no scraper | ✅ customer's Prom/Datadog/etc. |
| Multi-tenancy | ⚠️ single Keycloak realm | ✅ realm-per-tenant possible |
| RBAC | ⚠️ default admin creds | ✅ SSO federation |
| Compliance controls | ❌ none | ✅ customer's SOC2/GDPR program |
Do NOT use local PoC for
- Any production traffic
- Real customer data (PII, PHI, PCI)
- Compliance evidence collection
- Load testing (single-pod bottleneck)
- Security penetration testing (missing prod controls)
Do use local PoC for
- ✅ Feature demos to internal stakeholders
- ✅ Developer eval / integration testing
- ✅ Sales demos with synthetic data
- ✅ CI smoke tests (
scripts/kind-smoke.sh) - ✅ Docs verification (chart lint + template)
Data loss
Every laptop restart / minikube stop may lose in-cluster PostgreSQL data. Minikube preserves PVCs across restarts by default, but restarting Docker Desktop or reclaiming disk may wipe them.
To preserve data across restarts on Minikube:
minikube stop # pauses, keeps state
# NOT: minikube delete # wipes everything
On kind, cluster delete = data delete. There's no persistent option; use hostPath if you must (out of scope of this doc).
Upgrading from PoC to prod
Do not migrate data from local PoC to prod. Local PoC has default passwords and no encryption at rest. Re-create the Keycloak realm, users, and OPA bundles fresh on the prod install.
If you need to preserve config (not data) between environments, use Helm values files version-controlled in Git. Same chart, different values.
Next
Move to a real scenario when ready:
- CDK into your AWS account → — OpenBox deploys the full stack into your account
- Helm chart → — install onto a cluster you already run
- AWS Marketplace → — subscribe and install onto your EKS cluster