Deploy AgentWatch on Your Cluster

1# Clone the manifests
2git clone https://github.com/chinmayNayar/agentwatch.git
3cd agentwatch
4 
5# Create namespace + image pull secret (same as Helm step 2)
6kubectl create namespace agentwatch
7kubectl create secret docker-registry ghcr-credentials \
8  --docker-server=ghcr.io --docker-username=YOUR_USERNAME \
9  --docker-password=YOUR_READ_TOKEN --namespace agentwatch
10 
11# Fill in secrets (copy template, fill values, apply, then delete local copy)
12cp k8s/secrets/agentwatch-secrets.yaml /tmp/aw-secrets.yaml
13# Edit /tmp/aw-secrets.yaml with real values — never commit them
14kubectl apply -f /tmp/aw-secrets.yaml && rm /tmp/aw-secrets.yaml
15 
16# Edit domain (placeholders are RFC 1123: example.com, not CUSTOMER_DOMAIN)
17sed -i '' 's/app.example.com/app.YOUR_DOMAIN/g' k8s/ingress/ingress.yaml
18sed -i '' 's/api.example.com/api.YOUR_DOMAIN/g' k8s/ingress/ingress.yaml
19# Linux: drop the '' after -i
20 
21# Deploy everything
22kubectl apply -k k8s/
23kubectl get pods -n agentwatch -w

1# 1. Create EKS cluster (if you don't have one)
2eksctl create cluster \
3  --name agentwatch-prod \
4  --region us-east-1 \
5  --nodegroup-name standard \
6  --node-type m5.xlarge \
7  --nodes 2 \
8  --nodes-min 2 \
9  --nodes-max 4 \
10  --managed
11 
12# 2. Install EBS CSI driver
13eksctl create addon \
14  --name aws-ebs-csi-driver \
15  --cluster agentwatch-prod \
16  --region us-east-1
17 
18# 3. Install nginx-ingress (AWS NLB mode)
19helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
20helm install ingress-nginx ingress-nginx/ingress-nginx \
21  --namespace ingress-nginx --create-namespace \
22  --set controller.service.annotations."service\.beta\.kubernetes\.io/aws-load-balancer-type"="nlb"
23 
24# 4. Install cert-manager
25kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml
26 
27# 5. Get NLB hostname (use this for DNS CNAME, not A record)
28kubectl get svc -n ingress-nginx ingress-nginx-controller \
29  -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'
30 
31# 6. Deploy AgentWatch (from a clone of this repo)
32helm install agentwatch helm/agentwatch/ \
33  --namespace agentwatch --create-namespace \
34  --set global.domain="agentwatch.company.com" \
35  --set postgres.storageClass="gp3" \
36  --set redis.storageClass="gp3" \
37  --set imagePullSecret="ghcr-credentials" \
38  --set secrets.postgresPassword="$(openssl rand -hex 20)" \
39  --set secrets.agentwatchDevApiKey="$(openssl rand -hex 16)" \
40  --set secrets.internalAuthSecret="$(openssl rand -hex 32)" \
41  --set secrets.connectorEncryptionKey="$(python3 -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')" \
42  --set secrets.nextauthSecret="$(openssl rand -base64 32 | tr -d '\n')"

1# 1. Create GKE cluster
2gcloud container clusters create agentwatch-prod \
3  --region us-central1 \
4  --machine-type n2-standard-4 \
5  --num-nodes 2 \
6  --enable-autoscaling --min-nodes 2 --max-nodes 4 \
7  --workload-pool=$(gcloud config get-value project).svc.id.goog
8 
9# 2. Get credentials
10gcloud container clusters get-credentials agentwatch-prod --region us-central1
11 
12# 3. Install nginx-ingress
13helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
14helm install ingress-nginx ingress-nginx/ingress-nginx \
15  --namespace ingress-nginx --create-namespace
16 
17# 4. Install cert-manager
18kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml
19 
20# 5. Get ingress IP
21kubectl get svc -n ingress-nginx ingress-nginx-controller \
22  -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
23# → Create A records: app.YOUR_DOMAIN → IP, api.YOUR_DOMAIN → IP
24 
25# 6. Deploy AgentWatch
26helm install agentwatch helm/agentwatch/ \
27  --namespace agentwatch --create-namespace \
28  --set global.domain="agentwatch.company.com" \
29  --set postgres.storageClass="pd-ssd" \
30  --set redis.storageClass="pd-ssd" \
31  --set imagePullSecret="ghcr-credentials" \
32  --set secrets.postgresPassword="$(openssl rand -hex 20)" \
33  --set secrets.agentwatchDevApiKey="$(openssl rand -hex 16)" \
34  --set secrets.internalAuthSecret="$(openssl rand -hex 32)" \
35  --set secrets.connectorEncryptionKey="$(python3 -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')" \
36  --set secrets.nextauthSecret="$(openssl rand -base64 32 | tr -d '\n')"

1# 1. Create resource group and AKS cluster
2az group create --name agentwatch-rg --location eastus
3az aks create \
4  --resource-group agentwatch-rg \
5  --name agentwatch-prod \
6  --node-count 2 \
7  --node-vm-size Standard_D4s_v3 \
8  --enable-cluster-autoscaler \
9  --min-count 2 --max-count 4 \
10  --generate-ssh-keys
11 
12# 2. Get credentials
13az aks get-credentials --resource-group agentwatch-rg --name agentwatch-prod
14 
15# 3. Install nginx-ingress
16helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
17helm install ingress-nginx ingress-nginx/ingress-nginx \
18  --namespace ingress-nginx --create-namespace
19 
20# 4. Install cert-manager
21kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml
22 
23# 5. Get ingress IP
24kubectl get svc -n ingress-nginx ingress-nginx-controller \
25  -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
26 
27# 6. Deploy AgentWatch
28helm install agentwatch helm/agentwatch/ \
29  --namespace agentwatch --create-namespace \
30  --set global.domain="agentwatch.company.com" \
31  --set postgres.storageClass="managed-csi-premium" \
32  --set redis.storageClass="managed-csi-premium" \
33  --set imagePullSecret="ghcr-credentials" \
34  --set secrets.postgresPassword="$(openssl rand -hex 20)" \
35  --set secrets.agentwatchDevApiKey="$(openssl rand -hex 16)" \
36  --set secrets.internalAuthSecret="$(openssl rand -hex 32)" \
37  --set secrets.connectorEncryptionKey="$(python3 -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')" \
38  --set secrets.nextauthSecret="$(openssl rand -base64 32 | tr -d '\n')"

1# 1. Install k3s on your server (single-node)
2curl -sfL https://get.k3s.io | sh -s - \
3  --disable traefik \
4  --write-kubeconfig-mode 644
5 
6export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
7 
8# 2. Install local-path-provisioner (storage)
9kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.26/deploy/local-path-storage.yaml
10kubectl patch storageclass local-path \
11  -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
12 
13# 3. Install nginx-ingress
14helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
15helm install ingress-nginx ingress-nginx/ingress-nginx \
16  --namespace ingress-nginx --create-namespace \
17  --set controller.service.type=NodePort \
18  --set controller.service.nodePorts.http=80 \
19  --set controller.service.nodePorts.https=443
20 
21# 4. Install cert-manager
22kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml
23 
24# 5. Point DNS to your server's public IP
25# app.YOUR_DOMAIN → SERVER_IP
26# api.YOUR_DOMAIN → SERVER_IP
27 
28# 6. Deploy AgentWatch
29helm install agentwatch helm/agentwatch/ \
30  --namespace agentwatch --create-namespace \
31  --set global.domain="agentwatch.company.com" \
32  --set imagePullSecret="ghcr-credentials" \
33  --set secrets.postgresPassword="$(openssl rand -hex 20)" \
34  --set secrets.agentwatchDevApiKey="$(openssl rand -hex 16)" \
35  --set secrets.internalAuthSecret="$(openssl rand -hex 32)" \
36  --set secrets.connectorEncryptionKey="$(python3 -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')" \
37  --set secrets.nextauthSecret="$(openssl rand -base64 32 | tr -d '\n')"

1# Confirm ingress + cert
2kubectl get ingress -n agentwatch
3kubectl describe certificate -n agentwatch
4kubectl get clusterissuer letsencrypt-prod

1# GitHub → Actions → "Build Customer Image" → Run workflow
2#   customer_slug: acme-bank
3#   api_url:       https://api.YOUR_DOMAIN
4#   app_url:       https://app.YOUR_DOMAIN
5#
6# Then:
7helm upgrade agentwatch helm/agentwatch/ \
8  --namespace agentwatch \
9  --reuse-values \
10  --set dashboard.imageTag="acme-bank-latest"

1# On a machine WITH internet access:
2 
3docker pull ghcr.io/chinmaynayar/agentwatch-api:latest
4docker pull ghcr.io/chinmaynayar/agentwatch-dashboard:latest
5docker pull timescale/timescaledb:latest-pg15
6docker pull redis:7-alpine
7docker pull postgres:15-alpine          # API init container (pg_isready)
8docker pull curlimages/curl:latest      # dashboard init container
9 
10docker save ghcr.io/chinmaynayar/agentwatch-api:latest | gzip > agentwatch-api.tar.gz
11docker save ghcr.io/chinmaynayar/agentwatch-dashboard:latest | gzip > agentwatch-dashboard.tar.gz
12docker save timescale/timescaledb:latest-pg15 | gzip > timescaledb.tar.gz
13docker save redis:7-alpine | gzip > redis.tar.gz
14docker save postgres:15-alpine | gzip > postgres-init.tar.gz
15docker save curlimages/curl:latest | gzip > curl-init.tar.gz
16 
17# Transfer to the air-gapped node (USB, SCP to bastion, etc.)
18scp *.tar.gz admin@airgapped-node:/tmp/
19 
20# On the air-gapped node:
21docker load < /tmp/agentwatch-api.tar.gz
22docker load < /tmp/agentwatch-dashboard.tar.gz
23docker load < /tmp/timescaledb.tar.gz
24docker load < /tmp/redis.tar.gz
25docker load < /tmp/postgres-init.tar.gz
26docker load < /tmp/curl-init.tar.gz
27 
28# Push to your internal registry
29docker tag ghcr.io/chinmaynayar/agentwatch-api:latest registry.internal/agentwatch-api:latest
30docker push registry.internal/agentwatch-api:latest
31# Repeat for dashboard, timescaledb, redis, postgres:15-alpine, curlimages/curl
32 
33# Deploy pointing at the internal registry
34helm install agentwatch helm/agentwatch/ \
35  --namespace agentwatch --create-namespace \
36  --set global.domain="YOUR_DOMAIN" \
37  --set global.registry="registry.internal" \
38  --set postgres.image="registry.internal/timescaledb:latest-pg15" \
39  --set redis.image="registry.internal/redis:7-alpine" \
40  --set imagePullPolicy="IfNotPresent"

1# 1. All pods must be Running 1/1
2kubectl get pods -n agentwatch
3# NAME                                   READY   STATUS    RESTARTS
4# postgres-0                             1/1     Running   0
5# redis-xxx                              1/1     Running   0
6# agentwatch-api-xxx                     1/1     Running   0
7# agentwatch-api-yyy                     1/1     Running   0
8# agentwatch-dashboard-xxx               1/1     Running   0
9 
10# 2. API health (db AND redis must be true)
11kubectl port-forward svc/api-service 8000:8000 -n agentwatch &
12curl http://localhost:8000/health
13# {"status":"ok","db":true,"redis":true}
14 
15# 3. Create a test run to confirm end-to-end
16API_KEY=$(kubectl get secret agentwatch-secrets -n agentwatch \
17  -o jsonpath='{.data.AGENTWATCH_DEV_API_KEY}' | base64 -d)
18 
19RUN=$(curl -s -X POST http://localhost:8000/runs \
20  -H "x-api-key: $API_KEY" \
21  -H "Content-Type: application/json" \
22  -d '{"agent_name":"install-verify"}')
23echo $RUN | python3 -m json.tool
24# Should show run_id, status: running
25 
26# 4. Open the dashboard
27echo "Console: https://app.YOUR_DOMAIN"

1# Check current release
2helm list -n agentwatch
3 
4# Pull latest chart + images, keep existing values
5git pull
6helm upgrade agentwatch helm/agentwatch/ \
7  --namespace agentwatch \
8  --reuse-values
9 
10# Watch the rollout
11kubectl rollout status deployment/agentwatch-api -n agentwatch
12kubectl rollout status deployment/agentwatch-dashboard -n agentwatch
13 
14# Verify after upgrade
15kubectl port-forward svc/api-service 8000:8000 -n agentwatch &
16curl http://localhost:8000/health

1# Backup Postgres (from any machine with kubectl access)
2kubectl exec -n agentwatch postgres-0 -- \
3  pg_dump -U agentwatch agentwatch_db | gzip > agentwatch-backup-$(date +%Y%m%d).sql.gz
4 
5# Restore (to a fresh install)
6gunzip -c agentwatch-backup-20260912.sql.gz | \
7  kubectl exec -i -n agentwatch postgres-0 -- \
8  psql -U agentwatch agentwatch_db