Choose an installation layout#

The application serves a web UI and API from a Go process. The supplied container and Helm chart package that application for installation. Start with the standard single-instance layout unless your package and operational qualification explicitly cover a distributed layout.

The chart distinguishes standard and HA profiles. HA is not simply replicaCount greater than one: its validation and settings involve PostgreSQL, separated Delivery roles, shared artifacts and the relevant internal identity configuration. Do not infer a tested customer HA deployment from the presence of a profile.

Prepare the environment#

  • Provide the exact image and chart version supplied for your release. Do not substitute an unverified latest tag.
  • Choose the database and durable storage. SQLite requires a persistent database location; local Delivery artifacts also need persistence when used.
  • Provision a stable JWT signing secret and Orkiva encryption key through your secret-management process. Replacing the encryption key without a rotation/recovery plan can make stored credentials unreadable.
  • Configure the public hostname, TLS termination, trusted hosts, origins and proxy addresses to match your actual deployment.
  • Ensure server-side access to the Kubernetes APIs and any Git, image registry, chart repository, database, artifact or inference endpoints you intend to use.

Install from the supplied Helm chart#

Use a reviewed values file tailored to your environment. Run the commands below from the supplied package directory containing charts/orkiva.

helm template orkiva ./charts/orkiva \
  --namespace orkiva-system -f customer-values.yaml

helm upgrade --install orkiva ./charts/orkiva \
  --namespace orkiva-system --create-namespace \
  -f customer-values.yaml

Inspect the rendered workload, volume, Secret references and ingress before installing. After installation, check pod readiness and the serving endpoint. Complete first-run setup only after the intended persistent storage and secrets are attached.

Validate the installation#

  1. Open the HTTPS URL from a client that will use the console. Confirm the expected certificate and hostname.
  2. Complete setup and connect a non-production cluster first.
  3. Test resource listing, one permitted operation, and a denied operation with a restricted account.
  4. Test the logs/terminal WebSocket path if those features are enabled.
  5. Restart the application through your deployment system and confirm that configuration and connected clusters persist.
  6. Perform a backup/restore rehearsal before relying on the installation for production work.