On-Prem Prerequisites

Below is everything needed before deploying Middleware on premise. The installation guide is shared by the Middleware team during onboarding.

At a glance, you will need:

• From Middleware team — registry username + token, installation guide
• Kubernetes cluster — v1.25+, sized as per the table below, kubeconfig with cluster-admin access
• CLI tools — helm (v3.8+), kubectl, openssl on the machine running the install
• Storage class — a default storage class with dynamic provisioning (~260 GB of volumes are created)
• Object storage — S3 bucket / Blob container with access credentials
• Domain — one domain for Middleware, used by UI and agents (example: mw.your-company.com)
• SSL — certificate and key files for that domain
• Network egress — Middleware registry, public container registries, your object storage, app.middleware.io (emails)
• Credentials — owner email + password, decided before install (datastore passwords are generated by the install kit)

Cluster Sizing#

• Add one 8-core node per additional 100 GB/day beyond the table.
• No burstable instances (t2/t3/B-series) in production.
• Node root disk: 100 GB per node (50 GB is enough for the evaluation tier).
• Optional: a dedicated database node pool — 1 node, 8 core / 32 GB, taint dedicated=database:NoSchedule (ClickHouse tolerates it; set clickhouse.clusters.db1.nodeSelector in the values file to pin ClickHouse there).
• A load balancer is assigned automatically to Middleware's ingress on deploy.

Cloud-Specific Prerequisites#

AWS (EKS)#

• Make sure the EBS storage driver addon is installed.

• Storage class: verify there is one storage class when you create the cluster and ensure it's marked as default.

• Keep all default settings which AWS suggests while creating the cluster for permissions and roles.

• To get kubeconfig, run this in cloudshell:

  bash

  aws eks update-kubeconfig --region {{region_in_which_cluster_deployed}} --name {{your_cluster_name}}
  cat /home/cloudshell-user/.kube/config

• Add users in cluster IAM access entries (Click on cluster > Access tab).

• S3 bucket to store telemetry data, and an IAM user (access key ID + secret) that can access only this bucket. Attach this policy to that user:

  json

  {
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:AbortMultipartUpload", "s3:ListBucketMultipartUploads"],
      "Resource": ["arn:aws:s3:::YOUR_BUCKET", "arn:aws:s3:::YOUR_BUCKET/*"]
    }]
  }

Azure (AKS)#

• A storage account, its key and secret.
• A Blob container to store telemetry data.
• Get kubeconfig from cloudshell of Azure.

Credentials#

⚠️ Passwords are fixed at the first install. Changing them later needs a manual rotation procedure.

• Owner email + password — first UI login. The account is activated during install, so no activation email is sent.
• Datastore passwords (Postgres, Redis, ClickHouse) — generated automatically by the install kit and stored in your values file; keep that file for every upgrade.
• Password rules — minimum 8 characters, letters and digits (not only numbers), always in quotes in YAML.

Checklist#

• [ ] Registry credentials and installation guide received
• [ ] Cluster created as per sizing table, kubeconfig working with cluster-admin
• [ ] helm, kubectl, openssl installed
• [ ] Default storage class present
• [ ] Bucket/container created with access credentials
• [ ] Domain and SSL certificate ready
• [ ] Outbound access approved
• [ ] Owner email and password decided