Deploy - Simault

Choose your platform

Amazon Web Services

EKS behind an Application Load Balancer, image in ECR, master key backed up in Secrets Manager.

Google Cloud

GKE Autopilot with a Google-managed certificate, image in Artifact Registry, Cloud Armor at the edge.

Microsoft Azure

AKS with the managed NGINX ingress on an internal load balancer, image in Azure Container Registry.

Red Hat OpenShift

Runs under the default restricted security context constraint, built in the cluster, exposed through a Route.

Start with the common guide. It covers the decisions that are the same everywhere, how to verify a deployment, and a production checklist.

The install command

After you have built an image and created three Secrets (admin key, MongoDB connection string, master key):

helm upgrade --install simault charts/simault -n simault --create-namespace \
  --set image.repository=<your-registry>/simault --set image.tag=<tag> \
  --set adminKey.existingSecret=simault-admin \
  --set mongodb.existingSecret=simault-mongodb \
  --set kms.local.existingSecret=simault-master-key

The chart stops with a clear message if a required value is missing. All values are described in the chart README.

What you need to bring

You provide	Notes
A container image	There is no public image. Build it from the `Dockerfile` in the repository and push it to your registry.
MongoDB	A replica set, version 4.2 or later. MongoDB Atlas works on all three clouds. The chart does not install MongoDB.
A master key	A 96-byte key file held in a Secret, or a cloud KMS key.
TLS	Simault serves plain HTTP. Terminate TLS at the Ingress, Route or service mesh.

What the chart sets up

Two or more stateless replicas with rolling updates, a disruption budget and optional autoscaling.
Pods that run as non-root with a read-only filesystem and no added capabilities.
An Ingress, or a Route on OpenShift, and an optional NetworkPolicy so only the ingress layer reaches the pods.
Health checks on the liveness and readiness endpoints.

Before you depend on it

The chart passes lint and renders for every platform, but has not yet been installed on a real cluster.
The commands in the platform guides were written from each provider's documentation and were not executed. Try them in a non-production account first.
Cloud KMS has not been tested against a real KMS. The guides use the local master key by default and mark cloud KMS as experimental.

Run it on your Kubernetes