Skip to main content

Deploying on Amazon EKS

This page explains how to create the Helm values file and install AI Cockpit: Smart Engineering on Amazon EKS.

Create your values file​

Start from the published chart defaults:

helm show values oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/compass-uol/ai-cockpit/smart-engineering-chart/aic-modernization \
  --version 0.1.12 > values.yaml

The following example shows a common EKS configuration:

serviceAccount:
  create: false
  name: aic-modernization

runtime:
  commonEnv:
    AWS_REGION: "us-east-1"
    AWS_WORKLOAD_IDENTITY_MODE: "irsa"
    AUTH_MODE: "disabled"
    AUTH_DISABLED: "true"
    ALLOWED_ORIGINS: "https://smart-eng.example.com,https://api.smart-eng.example.com"
    ROOT_PATH: ""
    S3_UPLOAD_SERVER_SIDE_ENCRYPTION: "AES256"

s3:
  sourceBucket: "smart-eng-source"
  outputBucket: "smart-eng-output"
  workspaceBucket: "smart-eng-workspace"

bedrock:
  modelId: "amazon.nova-pro-v1:0"
  modelIdSmall: "amazon.nova-lite-v1:0"

marketplace:
  organizationId: "1"
  organizationName: "Marketplace"

gateway:
  enabled: true
  env:
    AUTH_DISABLED: "true"
    BEDROCK_CATALOG_ENABLED: "true"
    CORS_ALLOW_ORIGINS: "https://smart-eng.example.com"

ingress:
  enabled: true
  className: nginx
  frontendHost: smart-eng.example.com
  apiHost: api.smart-eng.example.com
  gatewayHost: gateway.smart-eng.example.com
  tls:
    - hosts:
        - smart-eng.example.com
        - api.smart-eng.example.com
        - gateway.smart-eng.example.com
      secretName: smart-eng-tls

S3_UPLOAD_SERVER_SIDE_ENCRYPTION depends on how the buyer configures bucket encryption.

  • Use AES256 for the default S3-managed encryption path
  • Use aws:kms only when the target buckets are configured for KMS encryption and the runtime IAM role has the required KMS permissions

Install the product​

Use the Marketplace parameters together with your values file:

helm upgrade --install aic-modernization \
  oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/compass-uol/ai-cockpit/smart-engineering-chart/aic-modernization \
  --version 0.1.12 \
  --namespace aic-modernization \
  --create-namespace \
  -f values.yaml \
  --set serviceAccount.name=${AWSMP_SERVICE_ACCOUNT}

If ${AWSMP_SERVICE_ACCOUNT} does not already exist in the namespace, create the service account first and then provide its name explicitly in the install command or in values.yaml.

What happens during installation​

The installation creates:

  • frontend deployment and service
  • API deployment and service
  • worker deployment
  • migration job
  • PostgreSQL stateful set and service
  • Valkey stateful set and service
  • optional gateway deployment and service
  • ingress resources when enabled

The migration job runs automatically after install and upgrade.

Verify the deployment​

After the install completes, check the resources:

kubectl get pods -n aic-modernization
kubectl get svc -n aic-modernization
kubectl get ingress -n aic-modernization

The deployment is ready when:

  • the API pod is healthy
  • the worker pod is healthy
  • PostgreSQL and Valkey are running
  • the migration job has completed

Validate the runtime endpoints​

You can validate the API with port forwarding:

kubectl port-forward svc/aic-modernization-api -n aic-modernization 3000:3000
curl http://localhost:3000/health
curl http://localhost:3000/config/runtime

If the gateway is enabled:

kubectl port-forward svc/aic-modernization-gateway -n aic-modernization 8080:8080
curl http://localhost:8080/health

The API health response includes the current license status, which is useful during the first Marketplace validation.