The same stack as docker-compose.yml, on a cluster. Compose stays the way to run it on one machine. The chart is in smo/deploy/helm/smo (its own README lists every value).

helm install smo smo/deploy/helm/smo -n smo --create-namespace

Use a namespace of its own: the Services are named as in Compose (sme, dme, postgres, ...), because that is what the modules and the GUI address each other by, so there is one release per namespace. Images are ghcr.io/rsys-bshankar/ai-ran-ref/smo-<module>:<appVersion>.

Reach it:

kubectl -n smo port-forward svc/gui 3000:8080              # the operator GUI
kubectl -n smo port-forward svc/r1-termination 8080:8000   # the gateway rApps call: GET /bootstrap

or set ingress.enabled with ingress.gui.host and ingress.r1.host.

Kubernetes keeps the bundled database's volume when you uninstall. To reinstall from nothing, delete it too: kubectl -n smo delete pvc pgdata-postgres-0.

The chart makes the Secret smo-secrets (database password and enrollment secret) and keeps the values across upgrades. To bring your own, create a Secret with the keys db-password and enrollment-secret and set secrets.existingSecret. Each pod is given only what it needs; an rApp pod never gets the enrollment secret.

A Job runs the migration on install, and as a pre-upgrade hook on upgrade, so it finishes once before any pod of the new version starts and a failed migration aborts the upgrade with the old pods still serving (kubectl -n smo logs job/migrate-<revision>). Every module that uses the database waits for the schema in an init container and never serves on an older one.

helm upgrade smo smo/deploy/helm/smo -n smo

With --set rappCredentials.delivery=kubernetes (off by default) rApp Management writes each instance's credentials to a Secret rapp-<instanceId>-credentials in the namespace, so the workload can take them with envFrom. It replaces the Secret when the credentials are rotated and deletes it when the instance is terminated; nobody sees the secret. This gives rApp Management (only) a service account that can create, update and delete Secrets in the namespace and read none.

netconf-lab and edge-tls (use the Ingress with a TLS secret). Replicas above one, PodDisruptionBudget, autoscaling and NetworkPolicy are in the chart but off by default; see Known Limitations.