Install Axual Governance

This guide shows you how to write the Axual Governance values file, choose which governance components to enable, install the chart, confirm Self-Service is reachable, and uninstall it again.

Type

How-to guide

Goal

Get the governance layer running and Self-Service reachable through the API Gateway.

Audience

Platform Operator with Helm access to the target namespace and credentials for the Axual registry.

When to use

Stage 4 of The installation order, after the streaming layer or against an existing Kafka cluster.

The Axual Governance charts install the control plane, the components that manage and expose the platform rather than carry data:

Contents

The sections below cover each task in this guide:

Prerequisites

Confirm the following before you begin.

Access and permissions required

You need the following access and permissions:

  • Credentials for the Axual chart registry, registry.axual.io. Contact Axual support if you have none.

  • Permission to install Helm releases and create workloads in the target namespace.

Tools and versions required

You need the following tools:

  • helm >= 3.12, with OCI registry support.

  • kubectl >= 1.28, configured for the target cluster.

Resources that must exist before starting

The following must already exist:

The examples below install into a namespace called axual, which is the convention the quick-setup guides use for the governance layer, with the streaming layer in kafka. Substitute your own namespace throughout. The two layers can share one namespace if you prefer, because Platform Manager reaches Kafka over its service address either way.

This chart deploys Vault as platform-manager-vault, but Vault still needs initialising and an AppRole afterwards. That is stage 6 work, covered in How to Set Up Vault for Governance.

Create a Helm values file

Create the values.yaml that configures your installation. Start with the pull Secret, so the chart can fetch the component images.

global:
  # -- Globally override the list of ImagePullSecrets provided.
  imagePullSecrets:
    - name: axualdockercred
The name must match the Secret created in Preparations. A mismatch here fails at image pull, which surfaces as pods stuck in ImagePullBackOff rather than as a values error.

Enable the components

Each component is enabled independently. The two MySQL entries back Platform Manager and Keycloak respectively, and both are needed unless you point those components at an external database.

values.yaml
global:

  platform-manager-mysql:
    enabled: true

  keycloak-mysql:
    enabled: true

  keycloak:
    enabled: true

  platform-manager:
    enabled: true

  platform-manager-vault:
    enabled: true

  topic-browse:
    enabled: true

  api-gateway:
    enabled: true

  platform-ui:
    enabled: true

  metrics-exposer:
    enabled: true
Metrics Exposer needs a Prometheus stack to read from, so leave it disabled until one exists. See How to Enable Insights and Metrics.

Install Axual Governance

Log in to the registry, then install the chart with your values.

Replace every <VALUE> placeholder with your own value before running a command.

  1. Log in to the Axual registry that holds the charts.

    helm registry login registry.axual.io --username <YOUR_USERNAME>

  2. Install Axual Governance with your values.yaml.

    helm install governance oci://registry.axual.io/axual-charts/axual-governance \
  --version <GOVERNANCE_CHART_VERSION> -f ./values.yaml -n axual

Verify the installation

Confirm the release succeeded and every enabled component came up, then confirm Self-Service answers through the gateway. A healthy pod set with an unreachable gateway is an ingress problem, and separating the two checks tells you which you have.

helm status governance -n axual
kubectl get pods -n axual

Every pod should read Running, except the initialisation pods, which correctly finish as Completed. Keycloak and the two databases take longest.

Then open Self-Service in a browser at https://platform.<DOMAIN>; and confirm the login page loads. Logging in needs the Keycloak realm, which is stage 6 work: see How to Create the Local Realm in Keycloak.

If a pod does not start, How to Inspect Kubernetes Workloads covers reading its events and logs. If the pods are healthy but nothing is reachable, Deployment Troubleshooting covers an ingress that cannot be reached and a blank Self-Service page.

Uninstall Axual Governance

Uninstalling removes the release, not the data.

helm uninstall governance -n axual
The PersistentVolumeClaims backing the two databases and Vault survive the uninstall by design. Deleting them destroys the platform’s configuration and every secret Vault holds, so remove them only when that is what you intend.

Configure Governance components

Each component’s own reference page lists the values it accepts: