AWS EKS (Helm)

For production deployments on Amazon EKS with automated DNS and TLS provisioning.

Prerequisites

• An EKS cluster (or create one — see below)
• aws CLI, kubectl, and helm installed
• AWS credentials with the required permissions
• A Route 53 hosted zone for your domain

1. Create an EKS cluster (if needed)

eksctl create cluster --name my-cluster --region eu-west-1 --nodes 2 --node-type t3.large

2. Configure values-aws.yaml

imageTag: <build number>

app:
  auth:
    authority: <your OIDC provider authority URL>
    clientId: <your OIDC client ID>
    scopes: openid profile email

  connections:
    gatewayApi:
      url: <RTGS.global Participant API URL>
    signingApi:
      url: <signing module URL>

  ingress:
    host: portal.example.com

letsencrypt:
  enabled: true
  createIssuer: false   # set to true if the signing module did not already install cert-manager

db:
  auth:
    password: <strong password>
  primary:
    persistence:
      storageClass: gp2

app.auth.redirectUri and notifications.connections.participantPortalBaseUrl are automatically derived from app.ingress.host. Override them explicitly if needed.

3. Deploy

Download helm-up-aws.sh

CLUSTER_NAME=my-cluster \
AWS_REGION=eu-west-1 \
./helm-up-aws.sh

The script:

1. Installs nginx-ingress and waits for AWS to assign an NLB hostname
2. Installs CloudNativePG, metrics-server, and cert-manager (if letsencrypt.createIssuer: true)
3. Creates Route 53 alias A records for any configured ingress hosts and waits for DNS propagation
4. Deploys the Helm chart

Once complete, the NLB hostname is printed. If you configured app.ingress.host, the portal is available at https://<your-domain> once the Let's Encrypt certificate is issued.

Teardown

Download helm-down-aws.sh

CLUSTER_NAME=my-cluster \
AWS_REGION=eu-west-1 \
./helm-down-aws.sh

Pass force=true to also remove shared cluster components (nginx-ingress, CloudNativePG, cert-manager). The script will prompt before removing each Route 53 DNS record.

AWS permissions

The deploy identity needs the following in addition to standard EKS access:

Action	Used for
elasticloadbalancing:DescribeLoadBalancers	Resolving the NLB's canonical hosted zone for alias records
route53:ListHostedZonesByName, route53:ListResourceRecordSets	Finding the owning zone and checking existing records
route53:ChangeResourceRecordSets	Creating/updating alias A records
route53:GetChange	Waiting for DNS propagation
iam:*Role*, iam:*OpenIDConnect*, ec2:Describe*	Reconciling the EBS CSI driver IAM role and OIDC provider