#Kubernetes and Helm

The sdlc-platform Helm chart at deploy/helm deploys every platform service into one Kubernetes namespace. This page covers the chart layout, the values to set before a first install, the install command, and the post-install verification.

#Prerequisites

#Chart layout

Each service group lives in its own directory under deploy/helm/templates/.

#Step 1: Values you must set

The chart ships with development defaults. Override these keys for every environment.

#Step 2: Secrets

When vault.enabled: false, the chart generates stable Kubernetes Secrets on first install using Helm's lookup function. These secrets auto-generate if left empty:

• PostgreSQL password (<release>-postgresql)
• AI gateway virtual key (<release>-ai-gateway-vk; preserves the sk-bf- prefix)
• Platform secrets (<release>-secrets): INTERNAL_API_KEY, MARKETPLACE_ADMIN_TOKEN, MARKETPLACE_RELOAD_SECRET

To supply your own, set secrets.existingSecret (and the corresponding existingSecret / secretKey triads for the AI gateway admin credential and encryption key).

When vault.enabled: true, the chart injects secrets at runtime from KV-v2 paths under secret/data/sdlc-platform/{db,api-keys,redis,s3,internal,email}.

#Step 3: Install

helm dependency update deploy/helm

helm upgrade --install sdlc-platform deploy/helm \
  -n sdlc-platform --create-namespace \
  -f deploy/helm/values.yaml \
  -f deploy/helm/values-production.yaml \
  --set global.imageTag=<tag>

If a previous install is present and the Vault injector owns the webhook caBundle, pass --force-conflicts to let Helm win the field manager conflict.

#Step 4: Post-install hook Jobs

Helm runs these Jobs automatically after install or upgrade:

The Vault bootstrap and provision Jobs (vault-bootstrap, vault-provision) run as ArgoCD sync-wave resources rather than Helm hooks. On a plain Helm install without ArgoCD, run them manually after the chart is up if Vault is enabled in production mode.

The logto-provisioner runs after the seed Job and creates the OIDC applications, JWT customizer, webhook, default admin account, and sign-in experience settings.

#AWS / EKS via Terraform

The Terraform stack in deploy/terraform provisions EKS, ECR, S3, EFS, and the webhook relay, then outputs a values file that wires everything together:

# 1. Apply infrastructure
cd deploy/terraform
terraform init -backend-config=backend.hcl
terraform apply -var-file=envs/cov-eval.tfvars

# 2. Push images
$(terraform output -raw ecr_login_command)
REGISTRY=$(terraform output -raw ecr_image_registry_prefix)

# 3. Deploy the chart
terraform output -raw helm_values_snippet > /tmp/aws-values.yaml
helm upgrade --install sdlc-platform deploy/helm \
  -n sdlc-platform --create-namespace \
  -f /tmp/aws-values.yaml \
  --set global.imageTag=$TAG

The helm_values_snippet output sets global.applicationImageRegistry, externalS3.* (with seaweedfs.enabled: false), IRSA annotations, the relay queue URL, gp3 for block PVCs, and efs-sc for RWX PVCs.

#Verify

kubectl -n sdlc-platform get pods
kubectl -n sdlc-platform get jobs

All Deployments should reach Available; hook Jobs should show Succeeded. Then open the application URL and sign in with the default admin credentials from logto.provisioner.defaultAdminEmail and logto.provisioner.defaultAdminPassword (defaults: admin@sdlc.local / ChangeMe123!).

#Next steps

• Configuration and upgrades
• AI providers and models
• Settings overview