Skip to content

Deploy on Kubernetes

The AWC Helm chart contains the Kubernetes deployment manifests for AWC. It provides control and worker Deployments, a privileged awcd DaemonSet, hostPath storage, RBAC, a NetworkPolicy, PodDisruptionBudgets, health probes, secret integration, and controlled node-drain behavior.

Components

Resource Purpose Default
awcd DaemonSet privileged per-node mount/cache daemon; hostPath basefs/cache/upper volumes and /dev/fuse; health probes on /healthz, /readyz enabled
awc-worker Deployment stateless background worker draining the PostgreSQL job queue; env from Secrets enabled, replicas=2
awc-control Deployment and Service REST API and mTLS internal gRPC API enabled
Secrets database-url and object-store keys; placeholder unless *.existingSecret is set created
ConfigMap awcd.toml and awcd.env created
RBAC awcd ClusterRole (read-only Node and Pod) and binding created
NetworkPolicy default-deny ingress per pod; DNS and dependency egress created
PodDisruptionBudgets protect worker (and control when enabled) during voluntary disruption created

Usage

# Validate without a cluster:
helm lint deploy/helm/awc
helm template deploy/helm/awc

# Render with the control plane enabled:
helm template deploy/helm/awc --set control.enabled=true

# Install (provide real secrets out-of-band):
kubectl create secret generic awc-database \
  --from-literal=database-url='postgres://awc:REAL@postgres:5432/awc'
kubectl create secret generic awc-objectstore \
  --from-literal=endpoint=https://objects.example --from-literal=bucket=awc-cas \
  --from-literal=access-key-id=AKID --from-literal=secret-access-key=SECRET
helm install awc deploy/helm/awc \
  --set database.existingSecret=awc-database \
  --set objectStore.existingSecret=awc-objectstore

Storage

awcd mounts hostPath volumes under awcd.hostPathRoot (default /var/lib/awc): basefs, cache, workspaces, and binds, plus /run/awcd and /dev/fuse. The in-container paths match the mounted awcd config. Use a node-local disk sized for your workload. The chart does not provision that disk. Ensure the hostPath root is on a suitably sized local volume before you schedule agents.

Probes and drain

  • awcd exposes /healthz (liveness) and /readyz (readiness) on its loopback health port. The DaemonSet probes them. On SIGTERM, awcd reconciles sessions and preserves uppers. terminationGracePeriodSeconds: 60 bounds it.
  • Controlled node drain: cordon the node to stop new agent pods, then drain. The awcd pod receives SIGTERM and reconciles. Worker and control pods are protected by their PDBs, so a drain respects minAvailable. See Drain and restart a host.

Secrets

No real secret is templated. The chart creates placeholder Secrets only when no existingSecret is named. Replace those with provisioned Secrets in any real deployment. See Rotate credentials.

Current scope

  • Build images with packaging/build-release.sh. Release binaries include the S3 transports and awcd's real FUSE base filesystem. See Build and package.
  • Provision the internal TLS and credential Secrets documented in values.yaml before installation. The chart never generates production credentials.
  • PostgreSQL is external (managed or operator-provided). The chart consumes DATABASE_URL from a Secret. For a local cluster, reuse the PostgreSQL from Run locally.
  • AWC has no published OCI image yet. Set image.registry, image.repository, and image.tag to images you build with the packaging scripts.