BigHammer setup scripts

Deployment automation scripts for Azure live in your deployment repository alongside Helm values (for example scripts/ in your organization's chart repo). Use them to prepare PostgreSQL and Key Vault before the platform chart is installed.

Script	Purpose
create-dbs-azure.sh	Create databases, roles, schemas, and grants on PostgreSQL Flexible Server
Platform install script	One-time Key Vault secrets, pre-Helm validation, helm upgrade --install
install-prerequisites-azure.sh	Install ESO, Reloader, RabbitMQ

Never commit real credentials — use install-config-azure.env locally (gitignored).

---

Recommended order

Step	Action	When
0	Provision PostgreSQL instance, databases, users, and platform Key Vault passwords (Terraform, portal, or automation)	Once per environment
1	create-dbs-azure.sh	Schemas and grants inside the application database
2	Platform install script / manual Key Vault upload	Verifies platform prerequisites; creates one-time app secrets
3	Cluster preparation	ESO, edge, RabbitMQ, TLS
4	Helm install	Platform Deployment

Keycloak database — infrastructure only

The Keycloak server pod (bhkeycloak) is not on the application database. Infrastructure provisions:

Resource	Reference name	Chart mapping
Database	keycloak_db_<env>	global.bhkeycloak.env.KC_DB_URL
User	keycloak_db_user	global.bhkeycloak.env.KC_DB_USERNAME
Password	Key Vault bh-kcdbpwd	KC_DB_PASSWORD via global.remoteSecrets.keycloak.dbPassword

create-dbs-azure.sh may create the Keycloak database and user, but Keycloak runtime tables are created by Keycloak itself in public.

If database or user names differ from reference defaults, see Renaming databases or users.

See Key Vault Secrets and Infrastructure — PostgreSQL.

---

Quick start

cd scripts
cp install-config-azure.example.env install-config-azure.env
# Edit install-config-azure.env with your values

./validate-<env>-dependencies.sh    # optional explicit pre-flight
./install-prerequisites-azure.sh     # once per cluster
./install-platform-azure.sh           # DBs, Key Vault, Helm deploy (script name may vary)

A one-shot wrapper (for example install-uat.sh) may chain prerequisites + platform install.

---

Automated install flow

The platform install script orchestrates (resumable — completed steps are skipped on re-run):

Step	Action
1	Validate ACR images exist (optional, from values file tags)
2	Validate Key Vault reachability
3	Create PostgreSQL databases, roles, and schemas (create-dbs-azure.sh)
4	Push or verify Key Vault secrets
5	Pre-Helm validation — all required secrets present
6	Verify External Secrets Operator is running
7	helm upgrade --install for the platform umbrella chart

Set FORCE_RUN=true to re-run all steps from scratch.

---

Script catalog

Script	Purpose
validate-*-dependencies.sh	Pre-flight: Azure login, PostgreSQL, Key Vault, ACR, storage, kubectl, ESO, RabbitMQ
install-uat.sh (or equivalent)	One-shot: validation + prerequisites + platform install
install-prerequisites-azure.sh	Install ESO, Reloader, RabbitMQ (and optionally Redis)
Platform install script	ACR check, KV validation, DB bootstrap, secret sync, Helm deploy
create-dbs-azure.sh	Create databases, application roles, schemas; push DB secrets to Key Vault
create-storage-secrets.sh	Push blob storage account name/key to Key Vault
push-tls-to-keyvault.sh	Bootstrap wildcard TLS cert/key into Key Vault
push-license-to-keyvault.sh	Push catalog license and verifier public key
setup-workload-identity-federation-azure.sh	Create AKS OIDC federated credentials for ESO and app service accounts
enable-aks-blob-csi.sh	Enable Blob CSI driver on the cluster (once per cluster)
copy-tls-from-bighammer.sh	Copy TLS secret from platform namespace to Airflow namespace
setup-databricks-akv-secret-scope.sh	Configure Databricks Key Vault–backed secret scope (optional)

---

Configuration: install-config-azure.env

Copy from install-config-azure.example.env or install-config-azure.placeholder.env.

Required variables

Variable	Description
DB_USER	PostgreSQL admin login
DB_HOST	<server>.postgres.database.azure.com
DB_PORT	5432 (default)
DB_PASSWORD	PostgreSQL admin password
KEY_VAULT_NAME	Azure Key Vault name
KEY_VAULT_RESOURCE_GROUP	Resource group for the vault
HELM_NAMESPACE	Platform namespace (e.g. bh-control-plane)
HELM_RELEASE	Helm release name (e.g. bighammer)

Skip flags

Flag	Effect
SKIP_DATABASES	Skip database creation
SKIP_KEYVAULT	Skip Key Vault secret upload
SKIP_ESO_CHECK	Skip ESO health check
SKIP_HELM	Skip Helm install (print command only)
SKIP_PREREQUISITES	Skip ESO / reloader / RabbitMQ install
SKIP_ACR_CHECK	Skip ACR image validation
RUN_HELM_INSTALL	Set false to stop before Helm
VALIDATE_DATABASES_ONLY	Check DB state and exit

---

Database creation

create-dbs-azure.sh provisions PostgreSQL objects on Azure Flexible Server.

Usage:

export DB_USER="<admin-user>"
export DB_HOST="<server>.postgres.database.azure.com"
export DB_PASSWORD="<password>"
export KEY_VAULT_NAME="<your-keyvault>"
./create-dbs-azure.sh

Prerequisites: psql, PGSSLMODE=require for Azure

Dual-role database users

Role	Key Vault secret	Helm env var	Purpose
bh_dev_user	azure-postgres-master-password	POSTGRES_USER / POSTGRES_PASSWORD	Migrations, Alembic, DDL
bh_app_user	bh-app-user-password	BH_APP_USER / BH_APP_USER_PASSWORD	Runtime API and worker DML

Databases

Database	Purpose
<TARGET_DB> (main app DB)	Hosts application schemas
keycloak_db_<env>	Keycloak persistence (name configurable)

Schemas (in main app database)

• catalog_db
• agent_db
• audit_db
• celery_db
• keycloakapi_db
• llm_observability_db

The script is idempotent — re-runs skip existing databases and grants when AUTO_SKIP_EXISTING_DATABASES and SKIP_GRANT_IF_COMPLETE are enabled (defaults).

---

SQL assets

File	Purpose
sql/grant_application_schemas.sql	Canonical schema grants
sql/create_setup_db.sql	Manual bootstrap template (prefer create-dbs-azure.sh)

---

References

• Platform Deployment
• Key Vault Secrets
• Database bootstrap troubleshooting
• Azure CLI
• PostgreSQL psql

Related

Topic	Link
GCP equivalent	GCP Scripts Reference
Secrets mapping	Key Vault Secrets