Delivery package and configuration

Download materials and prepare local values

A company administrator opens On-premise in the dashboard, creates a license, selects Kubernetes and clicks Download Kubernetes deployment materials. Extract massaccess-kubernetes-manual-<version>.tar.gz into a protected directory and enter massaccess-kubernetes-manual/. Follow INSTALL.ru.md from that release. Kubernetes requires no portal configuration; your DevOps team creates and maintains the values.

• Start with files/examples/all-external-values.yaml, all-bundled-values.yaml or postgresql-clickhouse-external-values.yaml under charts/massaccess/. Copy an appropriate example to work/app-values.yaml and replace addresses and modes according to values.schema.json.
• For another combination, change the four dataStores.<name>.mode fields. If any store is bundled, also create work/data-values.yaml from charts/massaccess-data/values.yaml; modes and bundled.existingSecret must match in both charts.
• Set deployment.version from values/massaccess-images.json, images.pullSecrets: [massaccess-registry], runtimeSecret.name: massaccess-runtime and meteringSecret.name: massaccess-metering.
• Set actual application.publicHttpUrl, application.publicWebSocketUrl, namespace, resources, exposure and networkPolicy. Merge YAML sections with the same name; do not leave example.test or documentation-installation-id.
• Set application.hardwareId to the SHA-256 of API_SERVER|MA_NAMESPACE without a newline; obtain application.licenseServerUrl from the verified activation manifest. With external tls: false remove tlsMode; PostgreSQL DSNs inside the Secret must specify sslmode=disable.

cp charts/massaccess/files/examples/all-external-values.yaml work/app-values.yaml
# bundled: all-bundled-values.yaml
# mixed: postgresql-clickhouse-external-values.yaml
# Edit work/app-values.yaml for the target cluster.
# If any store is bundled, also prepare work/data-values.yaml:
cp charts/massaccess-data/values.yaml work/data-values.yaml

Downloaded archive contents

Materials include unpacked charts, immutable image overlays and company activation. The operator separately prepares Helm values, backups and cluster settings. The work directory is created locally and is not part of the archive.

Material validation helpers

The operator installs with Helm and kubectl. Each Python helper has a specific purpose and does not run an overall deployment workflow.

Verify the release candidate

Run sha256sum -c SHA256SUMS in the extracted archive root. Every line must report OK. Download the materials again on failure. Checksums do not replace checking the download source; do not assume the entire archive is signed. INSTALL.ru.md is not included in SHA256SUMS, which covers the selected materials.

sha256sum -c SHA256SUMS
umask 077
mkdir -m 700 work

Activation, Secrets and the first administrator

In an existing non-system namespace, first verify activation with bootstrap-secrets.py without --apply. On success, set hardwareId and licenseServerUrl in app values; repeat with --apply during installation. It creates massaccess-runtime, massaccess-metering and massaccess-registry. The operator separately prepares store and webhook transport Secrets: application.webhookTransport references bot config/TLS Secrets for mTLS listener 8443; Receiver/Agent, PKI and shared Redis must be configured before messaging starts.

• Do not print activation/manifest.json or Secret values. The manifest version must match deployment.version.
• External PostgreSQL needs seven DATABASE_URL_* entries for CORE/GATEWAY/WEBHOOK/WORKER/TELEGRAM/MAX/ARCHIVER; Kafka needs producer.username/password, consumer.username/password and admin.username/password; ClickHouse needs archiver.username/password, auditor.username/password and migration.username/password; Redis needs username and password. TLS also requires ca.crt.
• Each bundled store needs separate serverSecret and existingSecret. Get the complete key, TLS, ACL and configuration inventory from INSTALL.ru.md and charts/massaccess/files/<store>/README.md. Do not use empty or example passwords.
• After Core is ready, create the first administrator with core.bootstrap_onprem_admin using hidden password input. Cloud company registration is disabled in on-premise.

MA_HARDWARE_ID="$(printf '%s' "${API_SERVER}|${MA_NAMESPACE}" | sha256sum | cut -d ' ' -f 1)"
printf 'hardwareId: %s\n' "$MA_HARDWARE_ID"
python3 charts/massaccess/files/bootstrap-secrets.py --bundle activation \
  --context "$MA_CONTEXT" --expected-server "$API_SERVER" \
  --namespace "$MA_NAMESPACE" --acknowledge-namespace "$MA_NAMESPACE"
python3 -c 'import json; from pathlib import Path; m=json.loads(Path("activation/manifest.json").read_text()); print("version:",m["version"]); print("licenseServerUrl:",m["license_server_url"])'

Validate schema and rendered inventory

Fetch the current palette from the signed activation manifest origin; stop on failure. Run helm lint --strict and helm template for the application and, with bundled stores, for the data chart. The immutable image overlay is required; pass the palette overlay last for the application only. Review Secret references, images, endpoints, resources and NetworkPolicy locally.

python3 bin/palette-delivery.py --manifest activation/manifest.json --helm work/platform-palette-values.yaml
helm lint charts/massaccess --strict -f work/app-values.yaml -f values/massaccess-images.json -f work/platform-palette-values.yaml
helm template massaccess charts/massaccess -n "$MA_NAMESPACE" -f work/app-values.yaml -f values/massaccess-images.json -f work/platform-palette-values.yaml > work/app-rendered.yaml
# Only when at least one store is bundled:
helm lint charts/massaccess-data --strict -f work/data-values.yaml -f values/massaccess-data-images.json
helm template massaccess-data charts/massaccess-data -n "$MA_NAMESPACE" -f work/data-values.yaml -f values/massaccess-data-images.json > work/data-rendered.yaml