Delivery package and configuration

Delivery-bundle verification, Secret-reference preparation, and strict validation of rendered Helm values.

Short glossary

Helm release: an installed and independently managed resource set from one chart.
Secret object: a Kubernetes resource referenced for sensitive values; the delivery charts do not own the values themselves.
PersistentVolumeClaim (PVC): a storage request used by a bundled data component.
NetworkPolicy: rules governing permitted network connections for application Pods.
Container Storage Interface (CSI) and Container Network Interface (CNI) capabilities are provided by the customer cluster.

Configurator and non-secret values

Choose Kubernetes and each store's placement in the on-premise configurator, save the configuration, and download the complete archive. The configuration/* files are generated by the panel, bound by checksums, and must not be edited manually.

Confirm contractVersion is massaccess.io/onprem-values/v1alpha1 and deployment.method is kubernetes
Check schema_version=6, target.namespace, application.hostname, and an independent bundled or external mode for PostgreSQL, Kafka, ClickHouse, and Redis
Review endpoints, versions, TLS modes, Secret names, the public hostname, CIDRs, scheduling, and resources
Do not edit configuration/product-config.yaml, configuration/installation-config.yaml, or configuration/deployment-plan.json manually; change settings in the panel and download the package again
Treat release/release-manifest.json and its checksums as the authoritative inventory of the exact downloaded release

Downloaded archive contents

The archive is self-contained for installation and upgrades; the source repository is not required. The work directory is created locally by package commands and is not part of the original archive.

Path	Purpose
README.md, README.ru.md	English and Russian operator guides
EXTERNAL-STORES-GUIDE.ru.md	Contracts, roles, and preparation for external PostgreSQL, Kafka, ClickHouse, and Redis
bin/	Primary and supporting commands for install, upgrade, activation, verification, and diagnostics
checks/	Configuration schemas, namespace baseline, and check contracts
examples/	Synthetic configuration example without customer data
configuration/	Panel-generated product configuration, installation configuration, deployment plan, and unresolved requirements
activation/	License status and, after license creation, the protected activation bootstrap archive
release/	Two chart packages, release manifest and provenance, SBOMs, schemas, and digest-only image values
work/	Not shipped: created locally for reports, generated values, the log, and initial administrator credentials

Purpose of the bundled scripts

Start with install.sh. The other commands serve a separate lifecycle or diagnostic stage and do not replace the complete installation flow.

Command	Purpose	Changes the cluster
./bin/install.sh	Primary installation or safe repeat from the panel configuration; --dry-run shows the plan without changes	By default; no with --dry-run
./bin/init.sh	Verifies the package, creates the working configuration, renders values, and validates them	No
./bin/resource-check.sh	Checks cluster resources, StorageClass, quota, and publication	No
./bin/upgrade.sh	Checks the plan and upgrades the installed version	Only with --apply
./bin/enroll.sh	Re-prepares the proxy-relay activation Secret	Only with --apply
./bin/healthcheck.sh	Checks releases and workloads; exit code 1 means a problem	No
./bin/massaccess-k8s	Low-level utility invoked by the scripts; call it directly only for documented diagnostics or an advanced procedure	Depends on the subcommand; writes require --apply

InformationA normal installation does not require manually repeating internal massaccess-k8s subcommands: install.sh runs them in the verified order and stops on the first FAIL.

Verify the release candidate

Before install, upgrade, or rollback, verify the complete bundle's checksums, chart and image SBOM inventory, SLSA v1 provenance subjects, trusted source/ref/builder policy, and digest-only image overlay.

bash

./bin/massaccess-k8s verify-package
./bin/massaccess-k8s inspect

Authorized bootstrap and Secret references

Charts contain no Secret values. install.sh verifies the supplied activation materials, shows the plan, creates missing application and bundled-store Secrets, and refuses to overwrite an incompatible existing identity. Company infrastructure creates external-store Secrets in advance from the bundled contract.

Check the external-store key contract with external-secret-contract without printing values
Use the customer's approved Vault, External Secrets, sealed-secret, or protected file process for store credentials and TLS material
Run install.sh --dry-run first; application stops when a required key is missing or an existing Secret identity does not match
Limit each Secret mount to the workloads that require it; the application ServiceAccount has no Secret-reader RBAC

bash

./bin/massaccess-k8s external-secret-contract
./bin/install.sh --dry-run

WarningNever place credentials, Secret values, kubeconfig data, customer endpoints, or private material in Git, values files, --set arguments, shell history, logs, screenshots, issue text, or CI artifacts.

Validate schema and rendered inventory

For a separate read-only check, run init.sh: it verifies the package, creates the local working configuration, renders values, and validates the schemas. install.sh performs the required checks during a normal installation.

bash

./bin/init.sh --namespace <namespace>