Kubernetes and Helm

Kubernetes and Helm

Overview

ADEPT provides a Helm chart for production Kubernetes deployments across AWS EKS, Azure AKS, and GCP GKE. Infrastructure provisioning is managed through provider-specific IaC tools, while the Helm chart abstracts application-layer configuration.

Helm Chart Structure

The chart is located at infra/helm/agentic-framework/:

agentic-framework/
├── Chart.yaml              # Chart metadata
├── values.yaml             # Default values
├── values-aws.yaml         # AWS EKS overrides
├── values-azure.yaml       # Azure AKS overrides
├── values-gcp.yaml         # GCP GKE overrides
├── values-local-k8s.yaml   # Local K8s (kind/minikube)
└── templates/              # Deployments, services, ingress, RBAC, secrets, PVCs

AWS EKS Deployment (CDK)

cd infra/aws/cdk
pip install -r requirements.txt
cdk deploy --all

Provisioned resources: EKS cluster with managed node groups, RDS PostgreSQL (Multi-AZ), ElastiCache Redis, ECR container registry, ALB Ingress Controller, IAM roles for service accounts (IRSA).

Deploy the Helm chart:

helm install adept infra/helm/agentic-framework/ \
  -f infra/helm/agentic-framework/values-aws.yaml \
  --namespace adept --create-namespace

Azure AKS Deployment (Pulumi)

cd infra/azure/pulumi
pulumi up

Provisioned resources: AKS cluster with system and user node pools, Azure Database for PostgreSQL Flexible Server, Azure Cache for Redis, Azure Container Registry (ACR), Azure Application Gateway Ingress, Managed Identity for workload federation.

GCP GKE Deployment (Terraform)

cd infra/gcp/terraform
terraform init && terraform apply

Provisioned resources: GKE Autopilot or Standard cluster, Cloud SQL for PostgreSQL, Memorystore for Redis, Artifact Registry, GKE Ingress with Cloud Load Balancing, Workload Identity for pod-level IAM.

Configuration

Secrets Management

Secrets are mounted as files at /run/secrets/ inside containers. The framework's SecretsManager reads from this path with environment variable fallback:

# values.yaml (excerpt)
secrets:
  kcAdminCliSecret: ""       # Keycloak admin-cli client secret
  postgresPassword: ""       # Database password
  redisPassword: ""          # Cache password
  llmApiKey: ""              # LLM provider API key

External Secrets: For production, use the External Secrets Operator to sync from AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager into Kubernetes Secrets.

Container Images

ADEPT builds internalized images from public bases for supply-chain security. Push to your registry and override in your values file:

global:
  imageRegistry: "your-registry.example.com/adept"
  imageTag: "v1.0.20260529"