Reference
Install with Helm
Install eode into a Kubernetes cluster you already run, using the same chart the stack uses.
cluster-admin on an existing EKS cluster
The one-click stack installs this chart for you. If you'd rather run your own cluster, install the chart yourself.
You provide
| Needs | Why |
|---|---|
| Kubernetes 1.33 or later | |
| The Secrets Store CSI driver and its AWS provider, with secret sync on | Secrets come from your store (Secrets) |
| Envoy Gateway 1.9 or later | The edge: TLS, cookie session persistence, hour-long requests |
| cert-manager with Gateway API support, unless you bring certificates | Certificates |
| An EFS file system and access point | Users' models, shared by the app and every engine |
An engine node group labelled and tainted workload=eo:NoSchedule | Engines are placed only there |
| A CNI that enforces NetworkPolicy | Engine isolation |
EKS Pod Identity for service accounts eode-app, eode-mcp, eode-migrate | Reading secrets |
PostgreSQL 16 with the vector extension, and Redis with TLS |
Install
aws ecr get-login-password --region us-east-1 | helm registry login --username AWS --password-stdin REGISTRY
helm upgrade --install eode oci://REGISTRY/eode/charts/eode --version RELEASE \
-n eode --create-namespace -f values.yamlA minimal values.yaml:
cloud: { provider: aws, region: AWS_REGION, secretsPrefix: "eode/" }
app: { host: APP_HOST }
mcp: { host: MCP_HOST, signInDomain: SIGNIN_DOMAIN }
signIn: { clientId: SIGNIN_CLIENT_ID }
storage: { models: { efs: { fileSystemId: EFS_ID, accessPointId: EFS_ACCESS_POINT_ID } } }
network: { vpcCidrs: [VPC_CIDR] }
tls: { mode: LetsEncrypt, acmeEmail: YOU@EXAMPLE.COM }
database: { bootstrap: true }To upgrade, run the same command with the new RELEASE. The chart runs the database migration before anything restarts, and stops the upgrade if it fails.
Values
| Value | Default | What it does |
|---|---|---|
app.host | required | The web app's hostname |
app.replicas, app.turnsPerReplica | 2, 4 | Copies of the web app, and RIA conversations each runs at once |
mcp.enabled, mcp.host | true, required if enabled | The MCP endpoint |
mcp.signInDomain | required if enabled | Where MCP sign-in tokens come from |
mcp.allowedClients | any | Only accept tokens issued to these client applications |
signIn.clientId, signIn.adminRole | required, admin | Your sign-in connection |
llm.baseUrl | api.anthropic.com | An Anthropic-compatible endpoint |
engines.memoryClasses | 12Gi,24Gi,48Gi,112Gi | Engine sizes, smallest first |
engines.idleMinutes | 30 | Idle engines are removed after this |
storage.models.size | 100Gi | |
telemetry.mode, telemetry.otlpEndpoint | off | otlp sends to your own collector |
dataConnections.denyCidrs | empty | Internal ranges a data connection may never reach |
network.policies | true | Apply eode's network policies |
network.vpcCidrs, network.serviceCidr | Your internal ranges | |
gateway.className, gateway.serviceAnnotations | eg | The Gateway class, and load balancer annotations (for example, internal-only) |
tls.mode | LetsEncrypt | LetsEncrypt, ClusterIssuer, AcmCertificate or Secret |
database.bootstrap | false | Create the app login and turn on vector before migrating |
probe.enabled | false | One real conversation turn a day against your install |