> ## Documentation Index
> Fetch the complete documentation index at: https://docs.open-cluster.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Helm

> Deploy the control plane on Kubernetes with existing Secrets, probes, and optional Relay TLS.

<Warning>
  The chart at `deploy/helm/opencluster` is not a complete OpenCluster installation. It
  deploys the control plane only. You must supply PostgreSQL, a frontend, same-origin
  routing, ingress, and TLS termination.
</Warning>

## Prerequisites

You need Kubernetes, Helm 3, a reachable PostgreSQL database, outbound HTTPS access to
the selected model provider, and two Secrets:

* `opencluster-database` with key `postgres-dsn`;
* `opencluster-credentials` with keys `operator-token`, `sealing-key`, and `model-key`.

The shipped chart names these Secret keys `operator-token` and `sealing-key`; they supply
the administrator bootstrap token and 32-byte credential-encryption key respectively.
The bootstrap token must be at least 32 characters and the encryption key exactly 32 bytes.
Do not put their values in Helm values or command history.

## Install

Create a values file with the public URL, released image, model provider, and model:

```yaml theme={null}
image:
  repository: IMAGE_REPOSITORY
  tag: VERSION
  pullPolicy: IfNotPresent
operator:
  publicURL: https://opencluster.example.com
model:
  provider: anthropic
  name: MODEL_ID
database:
  existingSecret: opencluster-database
credentials:
  existingSecret: opencluster-credentials
```

Install from a checkout of the matching release:

```bash theme={null}
helm upgrade --install opencluster ./deploy/helm/opencluster \
  --namespace opencluster --create-namespace --values values.yaml
kubectl --namespace opencluster rollout status deployment/opencluster-opencluster
```

## Verify

The rollout proves only that the control-plane component is ready. The installation is
usable only after the external frontend and ingress route `/api/v1`, `/webhooks/v1`,
`/healthz`, and `/readyz` to the HTTP Service on the configured public origin. Verify both
probes through that route:

```bash theme={null}
curl --fail https://YOUR-OPENCLUSTER/healthz
curl --fail https://YOUR-OPENCLUSTER/readyz
```

Both commands must succeed before the deployment accepts user traffic.

## Optional Relay listener

Set `relay.enabled=true`, provide at least one `relay.spkiPins` value, and name a TLS
Secret in `relay.tls.existingSecret`. The Secret must contain the configured certificate
and private-key keys. Expose the Relay port only to customer Relays; they initiate the
connection and pin the control-plane public key.

## Resources and upgrades

The chart intentionally ships no generic CPU or memory requests. Set requests and limits
from measured Investigation concurrency and provider workloads before production. OSS
v0.1 does not publish a qualified in-place upgrade path. Do not infer compatibility from
image or chart tags; see [Feature availability](/feature-availability).

## Common failure and recovery

If the rollout stalls, inspect
`kubectl --namespace opencluster describe deployment/opencluster-opencluster` and the
control-plane Pod logs. Correct missing Secret keys, database reachability, or model
provider configuration, then rerun the Helm command. A ready Pod does not compensate for
missing frontend, ingress, or same-origin routing.

## Next step

After the external frontend, ingress, and TLS routing are verified, create the first User
and Organization and continue with the [Quickstart](/getting-started/quickstart).