Kubernetes installation and verification

Safe data and application release installation, repeat execution, application-level checks, and external access.

Short glossary
  • Helm release: an installed and independently managed resource set from one chart.
  • Secret object: a Kubernetes resource referenced for sensitive values; the delivery charts do not own the values themselves.
  • PersistentVolumeClaim (PVC): a storage request used by a bundled data component.
  • NetworkPolicy: rules governing permitted network connections for application Pods.
  • Container Storage Interface (CSI) and Container Network Interface (CNI) capabilities are provided by the customer cluster.

Install Helm releases

Run commands from the materials root after validating values, activation and Secrets. MA_CONTEXT, MA_NAMESPACE and API_SERVER are set on the requirements page. Commands change the selected cluster and namespace.

  1. Check Kubernetes, permissions and namespace. Create the namespace only if missing; do not use system namespaces. Existing massaccess/massaccess-data releases will be changed by upgrade --install.
  2. Check SHA256SUMS, prepare local values and store Secrets, and run the activation plan. For bundled stores run storage preflight: --run creates and removes probe PVCs/Pods; with Retain inspect remaining PVs. After PASS set the digest and verified: true in storagePreflight; set enforcementVerified only after checking the actual CNI.
  3. Fetch a fresh palette and run lint/template. Apply activation with --apply, then install massaccess-data only with bundled stores and wait for readiness.
  4. Install massaccess, run helm test and inspect Pods, Jobs and PVCs. Stop and inspect events on failure; do not delete disks or recreate identity.
  5. Create the first administrator with the command below: expect PASS admin.bootstrap action=created; repeating with the same data preserves the account (action=preserved). Store the password securely.
bash
python3 charts/massaccess/files/bootstrap-secrets.py --bundle activation \
  --context "$MA_CONTEXT" --expected-server "$API_SERVER" \
  --namespace "$MA_NAMESPACE" --acknowledge-namespace "$MA_NAMESPACE" --apply
# Only when at least one store is bundled:
helm --kube-context "$MA_CONTEXT" upgrade --install massaccess-data charts/massaccess-data -n "$MA_NAMESPACE" \
  -f work/data-values.yaml -f values/massaccess-data-images.json --rollback-on-failure --wait --timeout 15m
# Application, after data services are ready:
helm --kube-context "$MA_CONTEXT" upgrade --install massaccess charts/massaccess -n "$MA_NAMESPACE" \
  -f work/app-values.yaml -f values/massaccess-images.json -f work/platform-palette-values.yaml --rollback-on-failure --wait --timeout 15m
helm --kube-context "$MA_CONTEXT" status massaccess -n "$MA_NAMESPACE"
helm --kube-context "$MA_CONTEXT" test massaccess -n "$MA_NAMESPACE" --logs
kubectl --context "$MA_CONTEXT" -n "$MA_NAMESPACE" get deployment,statefulset,pod,service,job,pvc

Activation, Secrets and the first administrator

bash
MA_ADMIN_EMAIL='<адрес-администратора>'
MA_COMPANY_NAME='<название-компании>'
export MA_ADMIN_EMAIL MA_COMPANY_NAME
python3 - <<'PYCODE'
import getpass, json, os, subprocess
password = getpass.getpass('Пароль первого администратора: ')
if not password:
    raise SystemExit('Пароль не может быть пустым')
payload = json.dumps({
    'email': os.environ['MA_ADMIN_EMAIL'],
    'password': password,
    'company_name': os.environ['MA_COMPANY_NAME'],
})
subprocess.run([
    'kubectl', '--context', os.environ['MA_CONTEXT'],
    '-n', os.environ['MA_NAMESPACE'],
    'exec', '-i', 'deploy/core', '-c', 'core', '--',
    'python', '-m', 'core.bootstrap_onprem_admin',
], input=payload, text=True, check=True)
PYCODE

Post-install verification

STATUS: deployed and a successful Helm test are required. Then check Pod readiness, migration Jobs, Secret names, first administrator login, license heartbeat and application smoke operations. Pod readiness alone does not prove message delivery.

  • Check Ready Pods, completed Jobs, Bound PVCs, restart counts and absence of OOMKilled.
  • Check dashboard login, API/WebSocket and data reads/writes; verify message delivery through its final status, beyond HTTP 202.
  • Keep the version, image digests, local values and verification results in a protected location.

Installation-host publication and external access

Your team configures public HTTP/WebSocket URLs, DNS, Ingress/Gateway and TLS in local values and infrastructure. Use frontend port-forward for a local check; it does not verify external routing.

  • Run port-forward in a separate terminal with the same MA_CONTEXT and MA_NAMESPACE; open http://127.0.0.1:3001/web/login.
  • Separately check UI, API and WebSocket through the actual external URL, including certificates and network policies.
bash
kubectl --context "$MA_CONTEXT" -n "$MA_NAMESPACE" port-forward --address 127.0.0.1 svc/frontend 3001:3000