Skip to content

Deploy to EKS

Status: Current | Last reviewed: 2026-06-12

Deploys to Amazon EKS for customer AWS environments.

Cluster

Aspect Value
Namespace trueserve
Helm release trueserve
Values file values-aws.yaml

One-time setup

  1. Create the EKS cluster with two node pools:
  2. default for app services (general-purpose).
  3. media for telephony pods, with kernel tuning for rtpengine. See media-pool-tuning.md.
  4. Provision the cloud services you'll use:
  5. RDS PostgreSQL with pgvector extension.
  6. ElastiCache for Redis (cluster mode optional).
  7. S3 bucket for object storage.
  8. Amazon MQ for RabbitMQ (or run RabbitMQ in-cluster).
  9. Global Accelerator with TCP listeners for SIP and UDP listeners for RTP.
  10. Create the trueserve-master-key secret with MASTER_ENCRYPTION_KEY.
  11. Install:
  12. AWS Load Balancer Controller for ingress.
  13. external-secrets-operator pointing at SSM or Secrets Manager.
  14. cert-manager with ACM Private CA or Let's Encrypt.

Deploy

helm upgrade --install trueserve charts/trueserve-stack \
  -f charts/trueserve-stack/values-aws.yaml \
  --namespace trueserve --create-namespace

values-aws.yaml highlights

postgres:
  enabled: false  # RDS
pgbouncer:
  enabled: true   # in-cluster, points at RDS
redis:
  enabled: false  # ElastiCache
minio:
  enabled: false  # S3
rabbitmq:
  enabled: false  # Amazon MQ

global:
  s3:
    endpoint: https://s3.us-east-1.amazonaws.com
    bucket: trueserve-customer-prod

conversation-api S3 swap

All services ride the shared object-storage seam (object-storage.md) configured by STORAGE_BUCKET_* + STORAGE_REGION; on EKS the credentials come from IRSA (leave STORAGE_ACCESS_KEY unset). Archive sinks can reference tenant integrations for destination credentials; the worker still reads hot recordings from the recordings bucket unless source_bucket is set on the sink.

Global Accelerator

Use GA for SIP/RTP if you need single-anycast IPs across regions. GA performs DNAT (PUBLIC_IP → LAN_IP) before delivery, which means rtpengine must run dual-interface. See rtpengine.md.

Observability

Wire otel-collector to CloudWatch, Managed Prometheus, or a third-party APM. The chart ships an AWS exporter ready to enable.

See also