Install services

Complete Deployment preparation first. You do not need the source code: the chart and the application image are published, and these steps use them directly. Replace every example domain, address and credential before running a command.

1. Choose the version

   Pick the release to install and check that its chart is reachable from your machine:

   helm show chart oci://ghcr.io/open-rum/charts/openrum --version 0.1.2

   The chart’s default image is the matching ghcr.io/open-rum/openrum:0.1.2, built for AMD64 and ARM64 nodes. One image contains all five services, the migration tool, the Console and the Browser SDK, so there is nothing to build or push. Always pin --version, and use the same version in every later command.

   Using your own image

   Build your own image only for an internal mirror, an air-gapped cluster or modified source. From the repository root, use a unique tag for every deployment and record its Git commit:

   docker login registry.example.com
   docker build --platform linux/amd64 \
     -t registry.example.com/openrum:alpha-deploy-001 .
   docker push registry.example.com/openrum:alpha-deploy-001

   Use linux/arm64 for ARM64 nodes. Then add the image block shown in the next steps to your values file, configure imagePullSecrets for a private registry, and install from deploy/helm/openrum in that checkout if you also changed the chart.

   Success: helm show chart prints version: 0.1.2 and appVersion: "0.1.2".

2. Create the runtime Secret and the HTTPS certificate

   Generate the token for first-time initialization and save it in your team’s password manager:

   openssl rand -hex 32

   Put the three values in a private file and replace every placeholder:

   runtime.env

   POSTGRES_DSN=postgres://openrum:REPLACE_PASSWORD@postgres.example:5432/openrum?sslmode=require
   CLICKHOUSE_DSN=clickhouse://openrum:REPLACE_PASSWORD@clickhouse.example:9000/openrum
   BOOTSTRAP_TOKEN=REPLACE_WITH_GENERATED_TOKEN

   URL-encode special characters in connection credentials. Match the ClickHouse port and TLS parameters to the database configuration. Create the Secret from the file, then delete the file, because it contains real credentials and must never be committed:

   chmod 600 runtime.env
   kubectl -n openrum create secret generic openrum-runtime --from-env-file=runtime.env
   kubectl -n openrum get secret openrum-runtime
   rm runtime.env

   The chart only references the Secret by name, so a secret manager such as External Secrets or Sealed Secrets can create openrum-runtime instead. Then import the domain certificate into the same Namespace, or use the Secret produced by your certificate controller:

   kubectl -n openrum create secret tls openrum-tls \
     --cert=/path/to/certificate-chain.pem --key=/path/to/private-key.pem

   Success: Both openrum-runtime and openrum-tls exist. Keep the bootstrap token available for the first administrator setup.

3. Write deployment values

   Create values.production.yaml:

   values.production.yaml

   config:
     appEnv: production
     publicBaseURL: https://rum.example.com
     existingSecret: openrum-runtime
     kafkaBrokers: kafka-0:9092,kafka-1:9092,kafka-2:9092
     kafkaEventTopic: rum-events-v1
     kafkaRetentionDuration: 168h
     # Replace with the actual Ingress proxy range you operate.
     ingestTrustedProxies: "10.42.0.0/16"
   
   # The chart runs its own Redis by default. To use yours instead:
   # redis:
   #   mode: external
   #   external:
   #     address: redis.example:6379
   
   ingress:
     enabled: true
     className: nginx
     host: rum.example.com
     tls:
       - hosts: [rum.example.com]
         secretName: openrum-tls
   
   # Only if you use your own image or a mirror:
   # image:
   #   repository: registry.example.com/openrum
   #   tag: alpha-deploy-001

   • publicBaseURL and host: the domain browsers actually visit; production requires HTTPS.
   • Kafka address, and Redis address if you use your own: endpoints reachable from Pods, not your development machine’s localhost. The bundled Redis is a single instance; see Redis: bundled or external.
   • ingestTrustedProxies: only proxy ranges you operate, allowing rate limits to identify the real caller IP.
   • className: your installed Ingress controller.
   • image: leave it out to use the published image that matches the chart version.

   Leave object-storage fields empty initially. See Helm values for more options.

   Success: Every placeholder is replaced, DNS points to the Ingress, and the Secret names match the previous step.

4. Install and verify

   Render the chart first. A mistake in the values file fails here, before anything reaches the cluster:

   helm template openrum oci://ghcr.io/open-rum/charts/openrum \
     --version 0.1.2 --namespace openrum \
     --values values.production.yaml > /dev/null

   Then install, run the chart’s tests and look at what came up:

   helm upgrade --install openrum oci://ghcr.io/open-rum/charts/openrum \
     --version 0.1.2 --namespace openrum \
     --values values.production.yaml \
     --wait --timeout 15m
   helm test openrum --namespace openrum
   kubectl -n openrum get pods,deploy,ingress

   Installation runs database migrations before starting applications. For deployment or health-test failures:

   kubectl -n openrum get jobs
   kubectl -n openrum logs -l app.kubernetes.io/component=migration --tail=100
   kubectl -n openrum logs deploy/openrum-api --tail=100
   kubectl -n openrum describe pods

   Success: Installation and Helm tests pass, all five Deployments are available, and https://rum.example.com opens without certificate errors. Service health still needs an end-to-end event check.

Next: First use and maintenanceCreate an administrator, connect a real Project and arrange ongoing maintenance.