Cluster preparation
Configure cluster add-ons, secrets, identity, and edge routing on AKS before installing the BigHammer Helm chart (bighammer). This section covers everything the application chart depends on but does not install itself.
Complete Infrastructure provisioning (AKS, PostgreSQL, Key Vault, DNS, ACR) and the Prerequisites checklist first.
Recommended order
| Order | Page | Purpose |
|---|---|---|
| 1 | Workload Identity | Bind KSAs to user-assigned managed identities (ESO + apps) |
| 2 | External Secrets Operator | Install ESO to sync Key Vault → Kubernetes |
| 3 | TLS Options | SSL/TLS certificates for HTTPS at the edge |
| 4 | NGINX Ingress Deployment | Edge routing — single Ingress resource |
| 5 | RabbitMQ broker | Deploy bhrabbitmq (OCI), Bitnami, or use an existing broker |
| 6 | Key Vault Secrets | Key Vault name mapping and chart secret reference |
Run create-dbs-azure.sh and Key Vault bootstrap scripts from Scripts Reference after PostgreSQL is provisioned and before Helm install. Platform Key Vault secrets must exist before the chart syncs ExternalSecrets.
Install Workload Identity and ESO (steps 1–2 above) before the platform chart syncs secrets.
Cluster add-ons (summary)
From Prerequisites — install before the platform chart:
| Add-on | Helm chart |
|---|---|
| External Secrets Operator | external-secrets-0.18.2 |
| Stakater Reloader | reloader-1.1.0 |
| RabbitMQ | bhrabbitmq (OCI) or existing broker |
| Edge | ingress-nginx Helm 4.15.1 (controller v1.15.1) |
What to do next
When TLS, secrets, Workload Identity, and edge routing are in place:
- Platform Deployment —
helm upgradethebighammerchart - Deployment Checklist — final verification
- Troubleshooting — if something fails
For customer artifact access and release pins, see Release Manifest & Distribution.