> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/kubernetes.md).
# Kubernetes
Deploy OpenIAM to Kubernetes — which route to take, what the deployment includes, and what it does and does not protect against.
OpenIAM runs on any conformant Kubernetes cluster. Every component ships as a Helm chart — the application services, the interfaces, the message broker, the cache, the graph and search tiers, the secret store and the reverse proxy — and a deployment is a set of Helm releases in one namespace.
This release covers a **simple deployment**: one OpenIAM deployment, with one instance of each component, in a single zone. See [*Scope and availability*](/installation/scope-and-availability.md) for what that shape protects against.
## Which route
| Your situation | Route |
| ---------------------------------------------------- | --------------------------------------------------------------------------------- |
| Creating a **new AWS environment** | [**EKS with Terraform**](/installation/kubernetes/terraform-eks.md) — recommended |
| Creating a **new Azure environment** | [**AKS with Terraform**](/installation/kubernetes/terraform-aks.md) — recommended |
| You need the provider infrastructure created for you | **Terraform** |
| Deploying into an **existing EKS or AKS cluster** | **Helm** — see below |
| Deploying to a **conformant cluster you run** | **Helm** — see below |
| You manage Helm values and releases directly | **Helm** |
Both routes are supported. They differ in what they take responsibility for: Terraform provisions the network, the cluster and the managed database as well as the OpenIAM releases; Helm deploys OpenIAM, and its bundled database, into a cluster that already exists.
### Terraform
The recommended route for a new environment on AWS or Azure. One `terraform apply` produces the network, the cluster, the managed database and the deployment.
* [**Amazon EKS with Terraform**](/installation/kubernetes/terraform-eks.md)
* [**Azure AKS with Terraform**](/installation/kubernetes/terraform-aks.md)
Read [*Prepare the cluster*](/installation/kubernetes/prepare-the-cluster.md) alongside either page — it sets out what the deployment needs from any cluster, and both Terraform pages assume it.
### Helm on an existing cluster
Use Helm when the cluster is already there, and for a conformant cluster you run yourself.
[**Deploy with Helm**](/installation/kubernetes/deploy-with-helm.md) is the complete procedure, from the deployment machine through to the published entry point, safe re-runs, upgrades and removal.
The cluster preparation is the same either way — capacity, storage classes including one supporting `ReadWriteMany`, node settings and egress. Read [*Prepare the cluster*](/installation/kubernetes/prepare-the-cluster.md) and your provider's page first, then the Helm page.
## What the deployment includes
```mermaid
flowchart TD
U["Users"] --> ENT["Load balancer or ingress — TLS terminates here"]
ENT --> RP["Reverse proxy — the only component exposed"]
RP -->|"8080"| NG["Interface router"]
RP -->|"9080"| ESB["Service bus"]
NG --> UIS["The six interface services"]
UIS --> ESB
ESB --> APPS["The application services"]
APPS --> INFRA["Secret store and its backend, message broker,
cache, graph tier and its storage, search tier"]
APPS --> DB[("Database")]
```
Everything in the diagram runs in one namespace, as a set of Helm releases. **Only the reverse proxy is exposed** — the interface router and everything behind it stay inside the cluster.
**In the cluster:** every OpenIAM component. The charts bring the message broker, the cache, the graph tier and its storage, the search tier, the secret store and its backend, and the reverse proxy, alongside the application services and the six interfaces.
**The database depends on the route.** On the Terraform routes it is the provider's managed service, which Terraform provisions and prepares for you. **On the Helm route in this release it is the bundled in-cluster database**, which the deployment brings up and creates the eight accounts on — suitable for evaluation and non-production work, and with no backup regime of its own. [*Deploy with Helm*](/installation/kubernetes/deploy-with-helm.md) step 4 sets out which arrangement applies, and [*Managed databases*](/installation/rpm/cloud/managed-databases.md) covers the supported engines and the parameters that must be set before the schema migration runs.
## When to choose Kubernetes over RPM
Choose Kubernetes when your organisation already runs one and OpenIAM should live alongside everything else — the same deployment pipeline, the same monitoring, the same upgrade rhythm.
Choose RPM when there is no cluster to deploy into, when the deployment must be self-contained on hosts you control, or when you want a shape that tolerates the loss of a host without an interruption while workloads reschedule. [*RPM, single node*](/installation/rpm/rpm-single-node.md) and [*RPM, three nodes*](/installation/rpm/rpm-ha.md).
## The pages
| Page | What it does |
| ------------------------------------------------------------------------ | ----------------------------------------------------------------- |
| [*Prepare the cluster*](/installation/kubernetes/prepare-the-cluster.md) | What any cluster must provide. Read this whichever route you take |
| [*Deploy with Helm*](/installation/kubernetes/deploy-with-helm.md) | The Helm route into an existing cluster, end to end |
| [*Amazon EKS*](/installation/kubernetes/amazon-eks.md) | Node settings, storage and the entry point on EKS |
| [*Azure AKS*](/installation/kubernetes/azure-aks.md) | The same, on AKS |
| [*EKS with Terraform*](/installation/kubernetes/terraform-eks.md) | The recommended AWS route, end to end |
| [*AKS with Terraform*](/installation/kubernetes/terraform-aks.md) | The recommended Azure route, end to end |
| [*Verify a Kubernetes deployment*](/installation/kubernetes/verify.md) | Confirm it is genuinely running |
| [*Back up and restore*](/installation/kubernetes/back-up-and-restore.md) | The five things to capture, and the restore |
| [*Troubleshoot*](/installation/kubernetes/troubleshoot.md) | Symptom, meaning, action |
| [*Upgrading OpenIAM*](/installation/kubernetes/kubernetes-upgrade.md) | Moving an existing deployment to a newer release |
**Allow half a day to a day** for a first deployment, including preparing the cluster.
## Related
* [*Choose your route*](/installation/choose-your-route.md)
* [*Upgrading OpenIAM*](/installation/kubernetes/kubernetes-upgrade.md) — minor and major upgrades of a running cluster
* [*Scope and availability*](/installation/scope-and-availability.md)
* [*Managed databases*](/installation/rpm/cloud/managed-databases.md)
*Applies to OpenIAM 2026.8.1.*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.openiam.com/installation/kubernetes.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.