CRAFT Deployment Overview

Deploy CRAFT on any Kubernetes cluster using Helm charts and ArgoCD GitOps. Supports GKE, EKS, AKS, and on-premises environments.

Deployment Overview

Run CRAFT on any Kubernetes cluster. The platform uses Helm charts for application packaging and ArgoCD for GitOps-based continuous deployment across four environments: dev, staging, demo, and production.

CRAFT deploys on your infrastructure. The platform runs on any CNCF-conformant Kubernetes cluster — GKE, EKS, AKS, or self-managed — without cloud-specific dependencies. You choose where to run; the same Helm chart deploys across all environments, while provisioning steps vary by environment.

Supported Environments

Google Kubernetes Engine

Deploy on GKE Autopilot or Standard clusters. Terraform modules automate cluster, VPC, IAM, and Secret Manager provisioning.

Amazon EKS

Deploy on Amazon EKS with Helm charts. Terraform modules for automated provisioning are planned.

Azure AKS

Deploy on Azure AKS with Helm charts. Terraform modules for automated provisioning are planned.

On-Premises

Deploy on any CNCF-conformant cluster (v1.28+). No cloud-specific services required — use self-hosted PostgreSQL, Redis, and MinIO.

Helm Chart

The em-runtime Helm chart packages all platform services and their dependencies:

Included Components

Component	Type	Purpose
Governance	Deployment	Identity, authorization, secrets management (port 8001)
Assets	Deployment	Artifacts, data connections, files, models (port 8002)
Utils	Deployment	Data catalog, search, scheduling, context packs, memories (port 8003)
PostgreSQL	StatefulSet / External	Primary data store for all services
Redis	StatefulSet / External	Caching, messaging, event streaming
Keycloak	StatefulSet / External	Multi-realm JWT authentication
OpenFGA	Deployment / External	Relationship-based access control
Infisical	Deployment / External	Secrets management, one of two supported backends. See Secrets Management.

Deployment Modes

In-Cluster (Default)

All dependencies (PostgreSQL, Redis, Keycloak, OpenFGA) are deployed as part of the Helm release within the Kubernetes cluster.

Best for:

• Development and testing environments
• Standalone deployments
• Quick setup with minimal external dependencies

External Databases

PostgreSQL and Redis run outside the Kubernetes cluster (managed services or Docker). The Helm chart connects to them via configuration values.

Best for:

• Production environments with managed database services
• Existing infrastructure reuse
• Separation of stateful and stateless workloads

Solution Integration

Solutions declare em-runtime as a Helm subchart dependency in their Chart.yaml. This ensures:

• Platform services are co-deployed with the solution
• Consistent Keycloak, OpenFGA, and database configuration
• Single helm install deploys the complete stack
• Version-pinned dependencies for reproducible deployments

Service Startup Order

The Helm chart respects the required startup order via init containers and readiness probes:

PostgreSQL -> Redis -> Keycloak -> OpenFGA -> [Infisical] -> Governance -> Assets/Utils -> Solutions

Governance must complete its bootstrap process (initializing Keycloak realms and OpenFGA schema) before Assets, Utils, or any solution can start. If Governance is down, downstream services return 403 on all permission-checked endpoints.

Observability Stack

The deployment includes a full observability stack via the Grafana LGTM bundle:

Component	Purpose
OpenTelemetry	OTLP-based traces, metrics, and logs from all services
Loki	Log aggregation and querying
Grafana	Dashboards and visualization
Tempo	Distributed tracing
Mimir	Metrics storage and querying

Next Steps

Helm Configuration

Customize the Helm chart values for your environment.

Observability

Set up OpenTelemetry and the Grafana LGTM stack.

Networking

Gateway API, cert-manager, and DNS configuration.

Secrets Management

Configure ESO + GCP Secret Manager or Infisical.