Skip to content

Installation

Install the platform from the published Helm chart at oci://eccr.ecmwf.int/sites-oss/ecmwf-sites. Create a values file with the environment-specific settings. Keep private values and credentials out of shared files.

Set the chart version to the release you have approved:

CHART_VERSION="2.7.1" # Replace with the release you have approved.

Log in to the ECMWF container registry (ECCR) first if your account needs authentication:

helm registry login eccr.ecmwf.int

Prepare values

Create a private values file for your environment or manage values in your configuration system. Set at least:

  • the Helm release namespace (-n <namespace>)
  • images.tag and any registry overrides
  • sitesConfig for OpenID Connect (OIDC), platform access, application defaults, and enabled integrations
  • routing.host, TLS, and the selected routing mode (ingress or gateway)
  • routing.hubHost, a separate host name for the Hub. Set it for every production installation (Separate Hub host)
  • storage.data and site storage settings
  • networkPolicy namespace settings

See configuration and routing and networking.

Prepare Secrets

Create the required Secrets in the release namespace. By default, the workloads refer to oidc-secrets and sites-secrets. Use the names in your chart values if you change them. Configure only the keys needed by enabled features.

For example, create the Secrets from protected files managed outside the repository:

kubectl -n sites-stage create secret generic oidc-secrets \
  --from-env-file=/secure/path/oidc.env
kubectl -n sites-stage create secret generic sites-secrets \
  --from-env-file=/secure/path/sites.env

The files must contain KEY=value pairs. Protect them from source control and restrict access. oidc.env needs OIDC_CLIENT_ID and OIDC_CLIENT_SECRET. sites.env needs SESSION_SECRET_KEY and HUB_MASTER_TOKEN. SESSION_SECRET_KEY is required and must contain 32 bytes or more (openssl rand -base64 48). HUB_MASTER_TOKEN is the platform administration token that the Hub API uses; it is optional at install and the Hub logs a warning when it is empty, because the Hub API then rejects every bearer master token. Generate one from the Hub settings page after the install, or set it here for automation. Add the secret keys for the integrations you enable, such as LDAP_PASSWORD, JIRA_API_TOKEN, or SPLUNK_API_PASSWORD. Add CACHE_REDIS_PASSWORD to make Redis require a password.

The standard platform images use the sites-oss project in ECCR. Confirm whether your cluster needs a registry pull Secret. For any image repository that requires authentication, create a kubernetes.io/dockerconfigjson Secret in the release namespace and set serviceAccount.imagePullSecretName to its name.

The chart does not create these Secrets by default. Avoid passing credentials on a command line, where shell history or process inspection can expose them.

Prepare routing TLS

When routing.tls.enabled is true, routing.tls.secretName is a reference used by the selected routing resource. It does not create a TLS Secret.

  • In Ingress mode, provide the Secret in the release namespace.
  • If the chart creates the Gateway with its default HTTPS listener, provide the Secret in the release namespace.
  • If you use an existing Gateway, configure the certificate on that Gateway. The chart does not use routing.tls.secretName in this mode.

Use cert-manager or another approved certificate process to create and renew the Secret. The process can create the Secret after the chart is installed; wait for the certificate to become ready before testing public HTTPS traffic. See routing and networking.

Validate the chart

Use the same chart version and values file for validation and installation:

helm template sites oci://eccr.ecmwf.int/sites-oss/ecmwf-sites \
  --version "${CHART_VERSION}" \
  -f /secure/path/values.yaml \
  -n sites-stage

The rendered output contains ConfigMaps and resource configuration. Review it for incorrect hosts, namespaces, image tags, routing, or accidental credentials before applying it.

Install

helm upgrade --install sites oci://eccr.ecmwf.int/sites-oss/ecmwf-sites \
  --version "${CHART_VERSION}" \
  -f /secure/path/values.yaml \
  -n sites-stage --create-namespace

--create-namespace creates the namespace for the release. The chart does not create the namespace resource. The chart installs the Site Custom Resource Definition (CRD) when Helm first installs the chart. Helm does not update CRDs on a chart upgrade; apply CRD changes separately. See upgrades and rollback.

Verify installation

kubectl -n sites-stage get deployments,pods,services,cronjobs,pvc
kubectl -n sites-stage rollout status deployment/sites-hub
kubectl -n sites-stage rollout status deployment/sites-operator

Confirm the Hub is reachable at /hub/, OIDC login completes, and a test site can be created and served. Confirm a backup job has a working persistent volume and that monitoring can reach the required endpoints.

Uninstall

Review the data and recovery plan before uninstalling:

helm uninstall sites -n sites-stage

Helm does not delete CRDs stored in the chart's crds/ directory. Uninstall does not mean that website content or external storage has been removed. Check remaining persistent volume claims (PVCs), persistent volume (PV) reclaim policies, Site resources, Secrets, and backups before removing them. Delete data only through the approved storage and retention process.