All Kaa services, including AA, are distributed as Helm charts. You can run these charts using Kubernetes.

Installing AA chart on Kubernetes


These steps should be done once for your entire Kaa cluster in Kubernetes.

  1. Install Kubernetes.

  2. Install Helm client.

  3. Create a Kaa license secret (remember to put in your Kaa license key file contents and password):

     export HISTCONTROL=ignorespace # Prevent saving your key password in the shell history; note the leading space in the next line
      cat << EOF > /tmp/kaa-licence.yaml
     apiVersion: v1
       file: < your licence key file contents, base64-encoded >
       password: < your licence key password >
     kind: Secret
       name: license
       type: Opaque
     kubectl create -f /tmp/kaa-licence.yaml
  4. Specify the image pull secret for the official KaaIoT docker registry. To define this secret, use your KaaID credentials:

     export HISTCONTROL=ignorespace  # Prevent saving your credentials in the shell history; note the leading space in the next line
      export KAAID_EMAIL=<your KaaID email, eg.> KAAID_PASSWORD=<your KaaID password>
     kubectl create secret docker-registry kaaid --docker-username=$KAAID_EMAIL --docker-email=$KAAID_EMAIL --docker-password=$KAAID_PASSWORD
  5. Add the KaaIoT Helm repository:

     helm repo add kaa-museum


Once you have completed the preparation steps, everything is ready for deploying AA on your Kubernetes cluster. To deploy the service, run the following command (observe the reference to the previously created license secret):

helm install --set global.license.secretName=license kaa-museum/aa --name kaa-aa

Check that pods are running:

kubectl get pods

Once the service initialization is complete, you should observe the output similar to the below:

NAME                                          READY   STATUS             RESTARTS   AGE
kaa-aa                       1/1     Running            0          2m

Chart Requirements

Repository Name Version
@bitnami-pre-2022 postgresql 10.1.1
@kaa service-chart 0.0.84

Chart Values

Key Type Default Description
affinity object {}  
annotations.deployment object {}  
annotations.pod object {}  
config string "" Content for the service config map, automatically mounted as a config file into the pod.
env object {} Defines the environment variables that Kubernetes passes to the service replica.
extraPodSpecs.automountServiceAccountToken bool false  
fullnameOverride string ""  
global.iamcore.enabled bool false  
global.image.pullSecrets list [] List of image pull secret names. Each must be defined as a record with the name field. Overrides image.pullSecrets.
global.kaaIngress.tls.issuerKind string "Issuer"  
global.kaaIngress.tls.issuerName string "letsencrypt-stage"  
global.kaaIngress.tls.selfSigned bool false  
global.keycloak.backend.existingSecret string "-keycloak-backend"  
global.keycloak.enabled string "" Enables API security using the auth provider. Overrides keycloak.enabled.
global.keycloak.privateUrl string ""  
global.keycloak.publicUrl string ""  
global.license.existingSecret string "" Name of the license secret, which must contain two base64-encoded fields: file (license file contents in PKCS #12) and password. Overrides license.secretName.
global.monitoring.enabled bool false  
global.nats.url string "" NATS URL.
global.postgresql.existingSecret string "" Name of an existing Kubernetes secret containing PostgreSQL admin and user passwords (postgresql-postgres-password and postgresql-password secret keys, respectively).
global.tekton.enabled string "" Enables Tekton integration. When disabled, the service will expect Kaa application configs to be defined in the config map. Overrides tekton.enabled.
global.tekton.url string "" Tekton URL. Overrides tekton.url.
global.tenantManager.baseUrl string "" Tenant manager base URL.
global.tenantManager.enabled string "" Enables multitenancy using the Kaa Tenant Manager. Overrides tenantManager.enabled.
image.pullPolicy string "IfNotPresent" Docker image pull policy.
image.pullSecrets list [] List of image pull secret names. Each must be defined as a record with the name field.
image.repository string "" Docker image repository image URL.
image.tag string "" Docker image tag version to pull and run.
ingress.annotations object {}  
ingress.enabled bool false  
ingress.hosts[0] string "chart-example.local"  
ingress.paths list []  
ingress.tls list []  
metadata.component string "backend"  
metadata.partOf string "kaa"  
nameOverride string ""  
nats.auth.enabled bool false  
nats.enabled bool true  
nats.url string "nats://-nats-client:4222"  
nats.urlOverride string ""  
nodeSelector object {}  
postgresql.enabled bool true  
postgresql.persistence.enabled bool true  
postgresql.postgresqlDatabase string "aa"  
postgresql.postgresqlUsername string "aa"  
postgresql.replication.enabled bool false  
postgresql.service.port int 5432  
postgresql.url string "-"  
postgresql.urlOverride string ""  
probes.enabled bool true Enables liveness, readiness, and startup probes for containers.
probes.liveness.initialDelaySeconds int 15  
probes.liveness.periodSeconds int 3  
probes.readiness.initialDelaySeconds int 5  
probes.readiness.periodSeconds int 1  
replicaCount int 1 The number of service instance replicas to run.
resources.limits.cpu int 1  
resources.limits.memory string "512Mi"  
resources.requests.cpu string "100m"  
resources.requests.memory string "128Mi"  
runbookUrl string ""  
securityContext object {}  
service.externalIPs list []  
service.loadBalancerIP string ""  
service.port int 80  
service.type string "ClusterIP"  
terminationMessagePolicy string "FallbackToLogsOnError" Kubernetes termination message policy.
tolerations list []  
updateStrategy.type string "RollingUpdate" Deployment update strategy.
waitContainers.curl.image string ""  
waitContainers.curl.tag string "0.0.3"  
waitContainers.enabled bool true Wait for dependency services.
waitContainers.timeout int 300 Wait timeout for dependency services in seconds.

The keys with no description are standard Kubernetes values. Refer to the official Kubernetes documentation for more information on these.

Environment variables

The table below summarizes the variables supported by the AA Docker image and provides default values along with descriptions.

Variable name Default value Description
INSTANCE_NAME aa Service instance name.
APP_CONFIG_PATH "/srv/aa/service-config.yml" Path to the service configuration YAML file inside container. In case of running in Kubernetes, consider using K8s Volumes for externalization.
NATS_URLS "nats://nats:4222" NATS connection URLs. May include connection credentials, e.g. "nats://derek:pass@localhost:4222".
NATS_USERNAME   Username for connecting to NATS message broker.
NATS_PASSWORD   Password for connecting to NATS message broker.
SERVICE_DEBUG false Enables debug level logging.
KAA_LICENSE_CERT_PATH "/run/license/license.p12" Path to the Kaa platform license certificate file in PKCS #12 format.
KAA_LICENSE_CERT_PASSWORD   License certificate password. Required.
KAA_POSTGRESQL_HOST "aa-postgresql" PostgreSQL connection host for storing the binary data blobs metadata.
KAA_POSTGRESQL_PORT 5432 PostgreSQL connection port.
KAA_POSTGRESQL_USERNAME "aa" PostgreSQL connection username.
KAA_POSTGRESQL_PASSWORD "aa" PostgreSQL connection password.
KAA_POSTGRESQL_DATABASE "aa" PostgreSQL connection database.
KAA_POSTGRESQL_SSL_MODE "disable" PostgreSQL connection SSL mode ("disable", "require", "verify-ca", "verify-full").
KAA_POSTGRESQL_MAX_OPEN_CONNECTIONS 100 Maximum number of open connections to PostgreSQL.
KAA_TEKTON_ENABLED false Enables Tekton integration.
KAA_TEKTON_URL "http://tekton" URL of the Tekton service.
KAA_SECURITY_ENABLED false Enables authentication and authorization on REST API endpoints (inbound and outbound API calls).
KAA_SECURITY_ISSUER_PUBLIC_URL   OAuth 2.0 issuer public URL for the system tenant (“kaa”).
KAA_SECURITY_ISSUER_PRIVATE_URL   OAuth 2.0 issuer private URL for the system tenant (“kaa”).
KAA_SECURITY_CLIENT_ID   Client ID for making requests in the system tenant scope.
KAA_SECURITY_CLIENT_SECRET   Client secret for making requests in the system tenant scope.
KAA_SECURITY_MULTITENANCY_ENABLED false Enables multitenancy via integration with the Kaa Tenant Manager. Only effective when is set to true.
KAA_SECURITY_MULTITENANCY_TENANT_MANAGER_URL "http://tenant-manager" URL of the Kaa Tenant Manager that provides security configurations for tenants.
KAA_SECURITY_IAMCORE_ENABLED false Enables iamcore integration.
KAA_SECURITY_IAMCORE_APPLICATION "kaa" iamcore application.
KAA_LICENSE_CERT_PATH "/run/license/license.p12" Path to the Kaa platform license certificate file in PKCS #12 format.
KAA_LICENSE_CERT_PASSWORD   License certificate password. Required.

Some of the listed above settings can also be controlled via the configuration options. When set, environment variables take precedence over corresponding configuration file settings.