EKS
The RTGS.global Signing Module can be deployed to Amazon EKS using the Helm chart and the provided deploy scripts.
Prerequisites
The following cluster prerequisites are installed automatically by helm-up-eks.sh if not already present:
| Prerequisite | Purpose |
|---|---|
| ingress-nginx | Provisions an AWS load balancer via the nginx ingress controller |
| metrics-server | Required for horizontal pod autoscaling (usually pre-installed on EKS) |
| CloudNativePG | PostgreSQL operator that backs the wallet store |
| cert-manager | Issues automatic Let's Encrypt TLS certificates for ingress hosts |
You will also need:
- Let's Encrypt account email (
ACME_EMAIL) — used to create theletsencrypt-prodClusterIssuer. A valid email address is required by Let's Encrypt for certificate issuance and renewal notices.
Configure values
Copy the provided values-savy-eks.yaml and fill in all <placeholder> values. The deploy script refuses to run against a file that still contains them.
Key fields:
| Field | Description |
|---|---|
admin.apiKey | Shared key between the signing service and the Aries admin API |
wallet.seed | From the onboarding email — derives your DID/Verkey on the Indicio ledger |
wallet.key | Wallet encryption key; generate a new GUID for a fresh installation |
environment.rtgsGlobalId | From the onboarding email, e.g. RTGS:B:GB00000000 |
environment.rtgsInvitation | Base-64 encoded invitation from the onboarding email |
environment.jurisdiction | Jurisdiction code from the onboarding email, e.g. euwsbx |
hosts.signing_service | Public hostname for the signing service |
hosts.didcomm_agent | Public hostname for the DIDComm agent |
hosts.svix | Public hostname for the Svix webhook server |
postgresql.auth.password | PostgreSQL password |
svix.jwtSecret | Svix JWT signing secret |
svix.endpoints | One or more uid/url pairs to receive webhook event deliveries |
Deploy
ACME_EMAIL=you@example.com VALUES=./values-savy-eks.<cluster>.yaml ./helm-up-eks.sh
DNS alias records are registered automatically in Route 53 if a hosted zone is found for the ingress hostnames. To target a specific zone:
ACME_EMAIL=you@example.com VALUES=./values-savy-eks.<cluster>.yaml ROUTE53_ZONE_ID=Z1234567890ABC ./helm-up-eks.sh
Additional options:
| Variable | Default | Description |
|---|---|---|
RELEASE | rtgs-signing | Helm release name |
NAMESPACE | rtgs-signing | Target namespace |
CONTEXT | current context | kubectl context (must be a cloud/EKS context) |
CHART_VERSION | latest | Specific chart version to deploy |
Uninstall
The Aries DIDComm Agent receives encrypted callbacks from other agents on the network and must be accessible to the internet. Protect it from DDoS and similar risks by fronting it with a reverse proxy such as Nginx.