Features

Production Deployment With External Stores

Deploy the Eden gateway as one container or an HA workload while keeping PostgreSQL, ClickHouse, ingress, and monitoring in customer-managed services.

Choose A Profile

Profile	Eden workload	Embedded state	Use when
`single`	One `Deployment` replica	Process-local ShardMap	One gateway process is sufficient or the platform owns restart and failover.
`ha` with `active_active`	Multi-replica `StatefulSet`	mTLS-authenticated ShardKV replication	Multiple Eden replicas serve traffic concurrently.
`ha` with `active_passive`	One release per role	Process-local cache with PostgreSQL fallback and invalidation	Operators control primary, read-replica, and standby promotion.

The chart installs only Eden. It does not install PostgreSQL, ClickHouse, Redis, an ingress controller, or a monitoring stack. Redis and Valkey are not internal runtime dependencies; configure one only when it is an application data endpoint that Eden should manage.

Point Eden At Customer Services

Copy helm/charts/eden/examples/production-single-values.yaml or helm/charts/eden/examples/production-ha-values.yaml, then set non-secret service endpoints as environment values:

yaml

deploymentMode: single

env:
  POSTGRES_HOST: postgres.customer.example
  POSTGRES_PORT: "5432"
  CLICKHOUSE_URL: https://clickhouse.customer.example:8443

Pre-create Kubernetes Secrets for PostgreSQL credentials, ClickHouse credentials, the organization bootstrap token, the JWT secret, and the organization encryption key. The chart references existing Secrets and does not render their values into the release manifest.

Render the selected profile before installation:

bash

helm template eden ./helm/charts/eden \
  --values helm/charts/eden/examples/production-single-values.yaml \
  >/dev/null \
  && echo "chart render: ok"

Expected output:

text

chart render: ok

Replace every example address, placeholder identifier, zero image digest, and storage class before deploying. Pin the production image by digest.

Persistence And Failure Behavior

Each replica owns separate bounded local outboxes for telemetry and request audit delivery. Put them on encrypted persistent storage and never share an outbox volume between processes. Eden fails readiness instead of evicting unacknowledged records when durable admission is unavailable.

Back up and test restore procedures for customer-managed PostgreSQL and ClickHouse independently. Monitor /health and /ready; active-active deployments should also monitor /health/cache-sync.

On SIGTERM, Eden stops HTTP admission, signals running interlays, and waits for listener tasks until the configured bounded shutdown deadline. Keep the Kubernetes termination grace period longer than EDEN_INTERLAY_SHUTDOWN_TIMEOUT_MS.

Production Checklist

Keep the plaintext Eden service private and terminate TLS at a

customer-managed ingress or load balancer.

Spread HA replicas across failure domains.
Give every replica a process-exclusive outbox volume.
Roll the workload after externally managed Secrets change.
Test database loss, outbox replay, RBAC revocation, cache resynchronization,

and graceful termination.

Run scripts/check-eden-chart.sh in CI to validate rendered manifests.

Choose A Profile

Point Eden At Customer Services

Persistence And Failure Behavior

Production Checklist

Related Docs