Vanilla EKS Quickstart¶

Use this path for a production-shaped EKS install that does not depend on Istio, External Secrets Operator, or cert-manager. The profile uses AWS Load Balancer Controller, IRSA, RDS/Postgres, and Kubernetes Secrets.

Choose the right profile first:

Need	Profile
Laptop-speed demo	`eks-control-plane-sqlite-pilot-values.yaml`
Vanilla EKS production	`eks-vanilla-values.yaml`
Mesh-hardened production	`eks-istio-kyverno-values.yaml`

Prerequisites¶

EKS cluster with AWS Load Balancer Controller installed
ACM certificate ARN for the control-plane hostname
distinct RDS/Postgres credentials for app, maintenance, and migration/admin roles
IRSA role ARN for scanner/API AWS read access and backup access
Helm 3

1. Create The Namespace¶

kubectl create namespace agent-bom

2. Create Secret Env Files¶

Create three database env files locally:

echo 'AGENT_BOM_POSTGRES_URL=postgresql://agent_bom_app:REPLACE_ME@REPLACE_ME_RDS_ENDPOINT:5432/agent_bom' > agent-bom-db.env
echo 'AGENT_BOM_POSTGRES_MAINTENANCE_URL=postgresql://agent_bom_maintenance:REPLACE_ME@REPLACE_ME_RDS_ENDPOINT:5432/agent_bom' > agent-bom-maintenance.env
echo 'ALEMBIC_DATABASE_URL=postgresql://REPLACE_ME_MIGRATION_ADMIN:REPLACE_ME@REPLACE_ME_RDS_ENDPOINT:5432/agent_bom' > agent-bom-admin.env

Create agent-bom-auth.env locally:

AGENT_BOM_API_KEYS=REPLACE_ME_OPENSSL_RAND_HEX_24:admin
AGENT_BOM_CONNECTIONS_KEY=REPLACE_ME_FERNET_KEY
AGENT_BOM_AUDIT_HMAC_KEY=REPLACE_ME_32_BYTES_OR_LONGER
AGENT_BOM_AUDIT_HMAC_KEY_LAST_ROTATED=2026-04-26T00:00:00+00:00
AGENT_BOM_BROWSER_SESSION_SIGNING_KEY=REPLACE_ME_32_BYTES_OR_LONGER
AGENT_BOM_BROWSER_SESSION_SIGNING_KEY_LAST_ROTATED=2026-04-26T00:00:00+00:00
AGENT_BOM_RATE_LIMIT_KEY=REPLACE_ME_32_BYTES_OR_LONGER
AGENT_BOM_RATE_LIMIT_KEY_LAST_ROTATED=2026-04-26T00:00:00+00:00
AGENT_BOM_TRUST_PROXY_AUTH_SECRET=REPLACE_ME_32_BYTES_OR_LONGER
AGENT_BOM_TRUST_PROXY_AUTH_ISSUER=aws-alb

Generate the API-key value with openssl rand -hex 24 and append :admin. Generate AGENT_BOM_CONNECTIONS_KEY with python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"; an arbitrary hex value is not a valid Fernet key. Replace the remaining placeholders with independently generated secret material.

Replace AGENT_BOM_API_KEYS with a complete OIDC, SAML, or trusted-proxy auth configuration when that backend is enabled. SCIM provisioning does not replace an interactive login backend. Keep the env files in your secret-management workflow, not in Git.

Apply the Kubernetes Secrets:

kubectl create secret generic agent-bom-control-plane-db \
  --namespace agent-bom \
  --from-env-file=agent-bom-db.env

kubectl create secret generic agent-bom-control-plane-maintenance \
  --namespace agent-bom \
  --from-env-file=agent-bom-maintenance.env

kubectl create secret generic agent-bom-control-plane-admin \
  --namespace agent-bom \
  --from-env-file=agent-bom-admin.env

kubectl create secret generic agent-bom-control-plane-auth \
  --namespace agent-bom \
  --from-env-file=agent-bom-auth.env

3. Customize The Values File¶

Copy the shipped profile and replace placeholders:

cp deploy/helm/agent-bom/examples/eks-vanilla-values.yaml ./agent-bom-eks-vanilla-values.yaml

Update:

alb.ingress.kubernetes.io/certificate-arn
controlPlane.ingress.hosts[0].host
IRSA role ARNs
backup bucket, region, and KMS key

4. Install¶

helm upgrade --install agent-bom deploy/helm/agent-bom \
  --namespace agent-bom \
  --create-namespace \
  -f ./agent-bom-eks-vanilla-values.yaml

5. Verify¶

kubectl get ingress -n agent-bom
curl -fsS https://agent-bom.internal.example.com/healthz
curl -fsS https://agent-bom.internal.example.com/readyz
helm test agent-bom -n agent-bom

The API uses /healthz (JSON liveness; /health is the same probe) and /readyz for dependency readiness. Gateway and sidecar runtime surfaces also use /healthz.

NetworkPolicy Note¶

The vanilla profile keeps NetworkPolicy enabled for egress controls, but it does not enable restricted ingress by default. With ALB target-type: ip, data traffic reaches pod IPs directly and cannot be selected as an in-cluster controller pod. Enable restricted ingress only after you add environment-specific CIDR or CNI policy controls that match your ALB data path.

Going Further¶

Mesh and policy-controller hardening: deploy/helm/agent-bom/examples/eks-istio-kyverno-values.yaml
Full EKS operator guide: site-docs/deployment/own-infra-eks.md
Postgres ownership: site-docs/deployment/postgres-provisioning.md