Platform GCP Deployment

Deploy the BigHammer umbrella chart (bighammer) on GKE. This page covers values preparation and Helm install — the final step after infrastructure, database bootstrap, secrets, and cluster add-ons are ready.

Before you start

Complete these steps before running helm upgrade:

Step	Action	Doc
0	GKE, Cloud SQL, platform GSM passwords, DNS	Infrastructure
1	Application DB schemas and grants	Scripts Reference — bighammer_db_setup.sql
2	Verify GSM + create one-time secrets	Secret Manager Secrets · Scripts Reference — bh_gsm_onetime_setup.sh
3	ESO, edge, RabbitMQ, TLS	Cluster preparation

Also confirm Prerequisites and mirror entitled artifacts per Release Manifest & Distribution.

End-to-end journey

Step	Action	Doc
0	GKE, Cloud SQL, provision platform GSM passwords (Terraform, console, or automation), DNS	Infrastructure
1	Application DB schemas and grants	Scripts Reference — bighammer_db_setup.sql
2	Verify GSM + create one-time secrets	Secret Manager Secrets · Scripts Reference — bh_gsm_onetime_setup.sh
3	ESO, edge, RabbitMQ, TLS	Cluster preparation
4	Mirror chart, prepare values, Helm install (this page)	—

If pods fail with permission denied for schema, see Database bootstrap troubleshooting.

Mirror chart and prepare values

Pull the chart from your mirrored registry after Release Manifest & Distribution:

helm registry login <region>-docker.pkg.dev \
  --username oauth2accesstoken \
  --password "$(gcloud auth print-access-token)"

helm pull oci://<region>-docker.pkg.dev/<project>/bh-helm-release/bighammer \
  --version <CHART_VERSION>

tar -xzf bighammer-<CHART_VERSION>.tgz
cp bighammer/values.yaml values.yaml
cp bighammer/values-release.yaml values-<env>.yaml   # edit all placeholders
# Bootstrap scripts: bighammer/scripts/bighammer_db_setup.sql, bh_gsm_onetime_setup.sh

Values files

File	Use
values.yaml	Chart defaults, global.remoteSecrets, service toggles
values-release.yaml	Sample customer overlay in the chart (placeholder project, hostnames, IPs — reference and CI only)
values-<env>.yaml	Your per-environment overlay (copy from values-release.yaml)

Do not deploy values-release.yaml as-is

values-release.yaml uses fictional placeholders (customer-sample-gcp-project, sample.example.com, 10.255.0.10). Copy it to values-<env>.yaml in your deploy repo and replace every sample value.

Required global settings

Path	Example (replace with yours)
secretStore.projectId	<your-gcp-project>
secretStore.gcpServiceAccount	external-secrets-operator@<project>.iam.gserviceaccount.com
gcpProject / gcpRegion	<project>, us-central1
image.repository	us-docker.pkg.dev/<project>/bh-docker-public/bh-docker-public/
postgresSSLMode	require or verify-ca (match your Cloud SQL SSL setup)
ingress.*HostName or gateway.routes.*.hostname	Your DNS names
dev.enabled	false for production overlays (bh-gcp-sa-key only when true)

Database and Secret Manager mapping

Application database (dual-role)

global:
  remoteSecrets:
    postgres:
      password: bh-dev-user-password   # POSTGRES_PASSWORD → bh_dev_user
    app:
      userPassword: bh-app-user-password    # BH_APP_USER_PASSWORD → bh_app_user

  bhcatalogapi:
    env:
      POSTGRES_HOST: "10.x.x.x"          # Cloud SQL private IP
      POSTGRES_USER: bh_dev_user
      POSTGRES_DB: <your_app_database>
      BH_APP_USER: bh_app_user
      DB_SCHEMA: catalog_db

Repeat POSTGRES_USER / BH_APP_USER for every service that runs migrations — see Secret Manager Secrets — dual-role.

Keycloak server (separate database)

global:
  bhkeycloak:
    env:
      KC_DB_USERNAME: keycloak_db_user
      KC_DB_URL: jdbc:postgresql://10.x.x.x:5432/<keycloak_db>?ssl=true&sslmode=verify-ca&...
      # KC_DB_PASSWORD from ExternalSecret → bh-kcdbpwd

Full GSM mapping: Secret Manager Secrets.

Confirm cluster add-ons

Before Helm install, verify:

• Cloud SQL reachable from GKE; bighammer_db_setup.sql applied as postgres
• Platform GSM secrets exist (bh-dev-user-password, bh-app-user-password, db-postgres-password, bh-kcdbpwd)
• bh_gsm_onetime_setup.sh completed (one-time app secrets created)
• ESO running; SecretStore can reach GSM
• Edge controller installed (nginx or Gateway stack)
• RabbitMQ broker deployed
• TLS secret available (TLS Options)
• Redis deployed separately if using AI agent cache (Prerequisites — optional services)

Full checklist: Deployment Checklist.

Deploy

helm registry login <region>-docker.pkg.dev \
  --username oauth2accesstoken \
  --password "$(gcloud auth print-access-token)"

# Gateway API mode (recommended)
helm upgrade --install bighammer \
  oci://<region>-docker.pkg.dev/<project>/bh-helm-release/bighammer \
  --version <CHART_VERSION> \
  -f values.yaml \
  -f values-<env>.yaml \
  --set global.gateway.enabled=true \
  --set global.ingress.enabled=false \
  -n bh-control-plane \
  --create-namespace \
  --timeout 10m

# NGINX Ingress mode
helm upgrade --install bighammer \
  oci://<region>-docker.pkg.dev/<project>/bh-helm-release/bighammer \
  --version <CHART_VERSION> \
  -f values.yaml \
  -f values-<env>.yaml \
  --set global.ingress.enabled=true \
  --set global.gateway.enabled=false \
  -n bh-control-plane \
  --create-namespace \
  --timeout 10m

Edge mode can also be set in values-<env>.yaml instead of --set. See:

Mode	Set in values	Doc
Gateway API	global.gateway.enabled: true, global.ingress.enabled: false	Gateway API
NGINX Ingress	global.ingress.enabled: true, global.gateway.enabled: false	NGINX Ingress

Upgrade

When a new chart version is released:

1. Review Helm Chart Release Notes and mirror the new manifest.
2. Update <CHART_VERSION> in your deploy command or values pin.
3. Re-run helm upgrade --install with the same values files.
4. Watch externalsecret status and pod restarts; allow time for Alembic migrations on startup.

Post-deploy verification

kubectl get pods,externalsecret -n bh-control-plane
kubectl get ingress -n bh-control-plane          # nginx mode
kubectl get httproute -n bh-control-plane        # gateway mode

Verify ExternalSecrets are SecretSynced and application pods are Running. Complete Deployment Checklist post-deploy items.

If schema permission errors appear, see Troubleshooting database bootstrap.

What the chart deploys

Type	Components
Web	bhui, bhadminui
APIs	bhcatalogapi, bhauditapi, bhaiagent, bhkeycloakapi, bhtransformationutils
Identity	bhkeycloak
Workers	bhcatalogworker, bhauditworker, bhaiagentworker, bhcelerybeat
Platform	SecretStore, ESO service account, ExternalSecrets

Not included — install separately: ESO, edge (nginx or Gateway), RabbitMQ broker, Redis.

Related

Topic	Link
GSM names and script	Secret Manager Secrets
DB bootstrap SQL	Scripts Reference
Pre-install checklist	Deployment Checklist
Schema / grant errors	Troubleshooting database bootstrap