The chart at deploy/helm/opencluster is not a complete OpenCluster installation. It
deploys the control plane only. You must supply PostgreSQL, a frontend, same-origin
routing, ingress, and TLS termination.
Prerequisites
You need Kubernetes, Helm 3, a reachable PostgreSQL database, outbound HTTPS access to
the selected model provider, and two Secrets:
opencluster-database with key postgres-dsn;opencluster-credentials with keys operator-token, sealing-key, and model-key.
The shipped chart names these Secret keys operator-token and sealing-key; they supply
the administrator bootstrap token and 32-byte credential-encryption key respectively.
The bootstrap token must be at least 32 characters and the encryption key exactly 32 bytes.
Do not put their values in Helm values or command history.
Install
Create a values file with the public URL, released image, model provider, and model:
Install from a checkout of the matching release:
Verify
The rollout proves only that the control-plane component is ready. The installation is
usable only after the external frontend and ingress route /api/v1, /webhooks/v1,
/healthz, and /readyz to the HTTP Service on the configured public origin. Verify both
probes through that route:
Both commands must succeed before the deployment accepts user traffic.
Optional Relay listener
Set relay.enabled=true, provide at least one relay.spkiPins value, and name a TLS
Secret in relay.tls.existingSecret. The Secret must contain the configured certificate
and private-key keys. Expose the Relay port only to customer Relays; they initiate the
connection and pin the control-plane public key.
Resources and upgrades
The chart intentionally ships no generic CPU or memory requests. Set requests and limits
from measured Investigation concurrency and provider workloads before production. OSS
v0.1 does not publish a qualified in-place upgrade path. Do not infer compatibility from
image or chart tags; see Feature availability.
Common failure and recovery
If the rollout stalls, inspect
kubectl --namespace opencluster describe deployment/opencluster-opencluster and the
control-plane Pod logs. Correct missing Secret keys, database reachability, or model
provider configuration, then rerun the Helm command. A ready Pod does not compensate for
missing frontend, ingress, or same-origin routing.
Next step
After the external frontend, ingress, and TLS routing are verified, create the first User
and Organization and continue with the Quickstart.
