Helm, Kubernetes and EKS

import { Aside } from ‘@astrojs/starlight/components’;

The open-agentix chart (0.2.1, app version 0.1.0) is designed to install a complete stack with one command (bundled PostgreSQL and optional Valkey, generated credentials, demo and air-gapped modes). The chart lives in open-agentix/open-agentix-helm. Value names may still change before 1.0; the chart’s values.yaml is authoritative.

The chart renders and lints in CI. By default it pulls `ghcr.io/open-agentix/open-agentix-api`, `-worker` and `-ui`, and the API image is **not published yet**. Until a release publishes the images, an install with default values cannot start; override `image.*` with images you built yourself. The automated install test runs once the API image is published.

What the chart deploys

• api (control node), worker and ui deployments;
• PostgreSQL as an optional bundled dependency, or an external database;
• a migrations Job as a Helm hook;
• NetworkPolicies with default deny and explicit egress;
• PodSecurity restricted (non-root, read-only root file system, no privilege escalation);
• HorizontalPodAutoscaler, PodDisruptionBudget and a ServiceMonitor for the Prometheus Operator;
• ingress for nginx or the AWS Load Balancer Controller (ALB).

Install

From a checkout of the chart repository:

git clone https://github.com/open-agentix/open-agentix-helm.git
cd open-agentix-helm
helm install oax ./charts/open-agentix -n openagentix --create-namespace

Credentials are generated by the chart, or referenced from existing Secrets (existingSecret values); see docs/install.md in the chart repository. Publishing the chart as a Helm repository and as an OCI artifact is on the roadmap.

Values (illustrative)

database:
  external: true
  existingSecret: openagentix-secrets

auth:
  oidc:
    issuer: https://login.example.com/realms/main
    clientId: openagentix
    existingSecret: openagentix-oidc

ingress:
  className: alb            # or nginx
  host: agents.example.com

networkPolicy:
  enabled: true             # default deny
  egress:
    - to: bedrock-vpc-endpoint
      cidr: 10.0.12.0/24
      ports: [443]

serviceAccount:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/openagentix-bedrock

EKS and Bedrock

1. Create an IAM role for IRSA that trusts your cluster’s OIDC provider and the chart’s service account, with bedrock:InvokeModel on the allowed models.
2. Annotate the service account with the role ARN (see above).
3. Create a Bedrock VPC interface endpoint or set a proxy, and allow it in the network policy.
4. Configure the Bedrock provider without any static keys.

The kubernetes-job runner is planned for 0.2: one Job per step in a dedicated namespace (openagentix-runs in the chart) with its own run service account, IRSA annotation and NetworkPolicy. A building block exists on main but is not yet wired into the platform.