Cluster preparation
Configure cluster add-ons, secrets, identity, and edge routing on GKE before installing the BigHammer Helm chart (bighammer). This section covers everything the application chart depends on but does not install itself.
Complete Infrastructure provisioning (GKE, Cloud SQL, Secret Manager, DNS, Artifact Registry) and the Prerequisites checklist first.
Recommended order
| Order | Page | Purpose |
|---|---|---|
| 1 | Workload Identity | Bind KSAs to GCP service accounts (ESO + apps) |
| 2 | External Secrets Operator | Install ESO to sync Secret Manager → Kubernetes |
| 3 | TLS Options | SSL/TLS certificates for HTTPS at the edge |
| 4a | NGINX Ingress Deployment | Legacy edge — single Ingress resource |
| 4b | Gateway API Deployment | Recommended edge — Envoy Gateway + Gateway API |
| 4b-i | bh-gateway | Platform Gateway / EnvoyProxy (Gateway API path) |
| 5 | RabbitMQ broker | Deploy bhrabbitmq (OCI), Bitnami, or use an existing broker |
| 6 | Secret Manager Secrets | GSM name mapping and global.remoteSecrets reference |
Pick one edge mode in step 4 — nginx or Gateway API. Gateway API is recommended for new deployments. Deploy RabbitMQ after edge setup (step 5) when using Gateway API management UI — see RabbitMQ broker.
Run bighammer_db_setup.sql and bh_gsm_onetime_setup.sh from Scripts Reference after Cloud SQL is provisioned and before Helm install. Platform GSM passwords must already exist in Secret Manager; the script verifies them and creates one-time application secrets.
Install Workload Identity and ESO (steps 1–2 above) before the platform chart syncs secrets. The Secret Manager Secrets page is a mapping reference — not a step to defer until after RabbitMQ.
Cluster add-ons (summary)
From Prerequisites — install before the platform chart:
| Add-on | Helm chart |
|---|---|
| External Secrets Operator | external-secrets-0.18.2 |
| Stakater Reloader | reloader-1.1.0 |
| RabbitMQ | bhrabbitmq (OCI) or existing broker |
| cert-manager | cert-manager-v1.19.2 (TLS Option A only) |
| Edge | ingress-nginx Helm 4.15.1 or Envoy Gateway + bh-gateway |
What to do next
When TLS, secrets, Workload Identity, and edge routing are in place:
- Platform Deployment —
helm upgradethebighammerchart - Deployment Checklist — final verification
- Troubleshooting — if something fails
For customer artifact access and release pins, see Release Manifest & Distribution.