Skip to main content

Prerequisites (AWS Marketplace)

Check every item before you run helm install. Each one maps to a failure in Troubleshooting if it is missing.

Cluster​

  • Amazon EKS, Kubernetes 1.27 or later, with kubectl pointed at it
  • Nodes can pull from the AWS Marketplace registry (709825985650.dkr.ecr.us-east-1.amazonaws.com) — your Marketplace subscription grants this
  • An ingress controller (NGINX, Traefik, or Istio). The chart creates Ingress resources but does not install a controller. With Istio, the gateway must already exist.
  • A default StorageClass, or a class you will name explicitly at install time. Without one, the PostgreSQL, Redis and Keycloak volumes stay Pending and the install never converges.
kubectl version
kubectl get ingressclass
kubectl get storageclass        # one should be marked (default)
No default StorageClass?

Many EKS clusters ship several classes and mark none as default. You can pass one explicitly — see Install → Storage class. A volume's class cannot change after it is created, so decide before the first install.

Tools​

  • Helm 3.14 or later (--reset-then-reuse-values, used for upgrades, needs it)
  • AWS CLI authenticated to an account with the Marketplace subscription

From your subscription​

  • License bundle — license.jwt and report-signing.key
  • Tenant ID — issued with the license, entered exactly as issued

Your organization​

  • First administrator's email, on your company domain. The install creates the organization from it: the organization ID is the domain part, lowercased. Public providers (gmail.com, outlook.com and similar) are rejected.
  • A DNS domain you control for five hostnames: openbox-eks, openbox-api, openbox-core, identity, opa
  • TLS — either at your load balancer / ingress controller, or a certificate secret in the namespace

reCAPTCHA​

Sign-in and organization registration verify a Google reCAPTCHA token. If you do not have your own Google reCAPTCHA keys, plan to install with global.recaptcha.disabled=true, or nobody can sign in.

Optional​

  • One GPU node (g5.xlarge or larger, amd64) for LlamaFirewall prompt inspection. Without it, install with --set llamafirewall.enabled=false; otherwise its pod stays Pending (harmless for everything else).

Governance policies (S3)​

  • An S3 bucket and two IAM roles for governance policies — needed before anyone can save a policy or behavior rule. Not needed to install: you can add them later with helm upgrade (the backend and OPA restart and pick them up).

    • A private, encrypted S3 bucket in your account (it also stores audit/evidence exports)
    • An OPA reader role and a backend writer role, both trusting your cluster's OIDC provider (IRSA)
    • Exact permissions and values: Install → Governance policies

    Without them the platform installs and runs, but saving a policy or behavior rule fails and OPA has no policy, so every agent action is allowed.

IAM service account​

The AWS launch page includes an eksctl create iamserviceaccount step with Marketplace metering policies. OpenBox does not use it — the chart does not read serviceAccount.name. You can skip that step.

Last updated on