Prerequisites

Required tooling for all deployment targets.

Tool	Minimum version
kubectl	1.27+
Helm	3.12+
cert-manager	1.13+ (TLS management)
PostgreSQL	16 (external or StatefulSet)
Redis	7 (external or StatefulSet)

Helm Install (all targets)

The same command works across AKS, EKS, GKE, and on-premises. Provide a target-specific values override file for cloud-specific settings (Key Vault, KMS, Vault).

bash

Universal install command

1helm upgrade --install aegissovereign helm/sovereign-gateway \
2  --namespace aegissovereign \
3  --create-namespace \
4  --values helm/sovereign-gateway/values.yaml \
5  --values helm/sovereign-gateway/values-production.yaml \
6  --set global.platformHost=sovereign.yourcompany.com \
7  --set ingress.tls.certManager.acmeEmail=ops@yourcompany.com \
8  --wait --timeout 10m
9
10# The pre-upgrade hook automatically runs:
11#   alembic upgrade head
12# before any application pod rolls.

Secret Key Providers

The encryption key for at-rest data can be sourced from different backends depending on your cloud.

Provider	Env var	Recommended for
`env`	`SECRET_ENCRYPTION_KEY`	Dev / CI
`azure_keyvault`	`AZURE_KEYVAULT_URL`, `AZURE_SECRET_NAME`	AKS
`aws_kms`	`KMS_KEY_ID`	EKS
`vault`	`VAULT_ADDR`, `VAULT_TOKEN`, `VAULT_SECRET_PATH`	On-Prem

SIEM Integration

Audit events are forwarded to your SIEM in real-time. Supported targets: Splunk HEC, Datadog, AWS CloudWatch, GCP Cloud Logging, GCP Security Command Center, GCP Pub/Sub.

bash

Splunk HEC (example)

1# Set via Helm values or environment variables
2SIEM_SPLUNK_HEC_URL=https://splunk.internal:8088/services/collector
3SIEM_SPLUNK_HEC_TOKEN=your-hec-token
4
5# Test connectivity after deploy:
6curl -X POST https://sovereign.yourcompany.com/api/v1/audit/siem/test \
7  -H "Authorization: Bearer $PAT"

Bare Metal / On-Premises

On-premises deployments require MetalLB (or equivalent) for LoadBalancer services and a Vault instance for secret key storage.

bash

On-prem values override

1# values-onprem.yaml
2provider: onprem
3secretKeyProvider: vault
4vaultAddr: https://vault.internal:8200
5vaultSecretPath: secret/data/sovereign/encryption-key
6
7networking:
8  type: metallb
9  externalIP: 10.0.1.100
10
11storage:
12  class: local-path
13  size: 100Gi

Celery Workers (AI Governance Agents)

The AI Governance Agents execute as Celery tasks. The Helm chart deploys a celery-worker Deployment and a celery-beat Deployment automatically. Set agent notification variables in your values override file to enable Slack, JIRA, and PagerDuty routing from the IncidentResponseAgent.

yaml

values-production.yaml — agent section

1celeryWorker:
2  enabled: true
3  replicas: 2
4  resources:
5    requests: { cpu: "250m", memory: "512Mi" }
6    limits:   { cpu: "1",    memory: "1Gi" }
7
8celeryBeat:
9  enabled: true   # weekly governance report + drift scans
10
11agentConfig:
12  apiKey: ""                    # set via --set or external secret
13  llmModel: "gpt-4o-mini"
14  slackWebhookUrl: ""           # optional
15  jiraUrl: ""                   # optional
16  jiraEmail: ""
17  jiraApiToken: ""
18  jiraProjectKey: "GOV"
19  pagerdutyRoutingKey: ""       # optional — critical incidents only

Post-Deploy Verification

After deployment, verify the platform is healthy, migrations ran successfully, and Celery workers are processing tasks.

bash

Health check + worker status

1# Liveness + readiness
2curl https://sovereign.yourcompany.com/api/v1/health/live
3curl https://sovereign.yourcompany.com/api/v1/health/ready
4# → { "status": "ready", "checks": { "postgres": "ok", "redis": "ok" } }
5
6# Check all pods (API, worker, beat)
7kubectl get pods -n aegissovereign
8
9# Verify migrations ran (pre-upgrade hook)
10kubectl logs -n aegissovereign -l app.kubernetes.io/name=sovereign-gateway --previous | grep alembic
11
12# Verify Celery worker is online
13kubectl logs -n aegissovereign -l app.kubernetes.io/component=celery-worker | grep "celery@"
14# → celery@pod-xyz ready.