AWS EKS Deployment Guide | Golem Technologies

Overview

Install into a prepared buyer-owned Amazon EKS landing zone

The Bounded Agentic AI Workflow Engine is customer-hosted execution infrastructure. The Marketplace package installs the API control plane, model-training orchestration, mandatory artifact qualification, governed inference services and AWS Marketplace metering into the buyer’s Amazon EKS environment.

Deployment boundary. The Helm package does not provision an AWS account, VPC, Amazon EKS cluster, Amazon RDS instance, Amazon S3 bucket, IAM role, DNS zone or certificate. Those resources must already exist under buyer control.

Customer-hosted architecture

Private by default, operated in the buyer account

AWS Marketplace releaseAuthorized images, Helm chart, manifest and buyer utilities

Platform operatorAWS CLI, kubectl, Helm, jq and Python

→

Amazon EKSAPI control plane, GPU fine-tuning and governed inference

IRSA service accountScoped access to S3, operational AWS services and Marketplace metering

→

Amazon RDS for PostgreSQLApplication and workflow state over TLS

Encrypted Amazon S3Policy-bound model artifacts and retained operational evidence

CloudWatch and VPC Flow LogsBuyer-managed observability and network records

Scope and landing-zone assumptions

What this guide installs—and what it does not

Installed by the package

Namespaced Kubernetes workloads, services, policies, database migration, model job orchestration and the metering workload.

OUT

Prepared by the buyer

Amazon EKS, node groups, add-ons, RDS, S3, IAM, networking, encryption, certificates, DNS and external connectivity.

The current package expects Linux on AMD64. System workloads use nodes labelled tacr.golem.tech/node-pool=system. GPU workloads use nodes labelled tacr.golem.tech/node-pool=gpu and tainted nvidia.com/gpu=present:NoSchedule. For this release, the supported reference Region is Europe (Stockholm), eu-north-1, using compatible G6e capacity with NVIDIA L40S.

Prerequisites

Prepare the AWS landing zone

AWS Marketplace subscription and extracted buyer package
Supported reference Region for this release: Europe (Stockholm), eu-north-1
Amazon EKS with private networking appropriate to the buyer policy
System and GPU managed node groups using the package scheduling labels
Cluster add-ons at the versions declared in release-manifest.json
Amazon RDS for PostgreSQL reachable over TLS
Encrypted Amazon S3 bucket for model artifacts
IRSA role with least-privilege S3 and Marketplace metering permissions
CloudWatch logging and VPC Flow Logs configured by the buyer
Access to the selected base-model repository, including any required licence acceptance and permitted outbound HTTPS connectivity

Marketplace subscription and package

Use only the buyer-authorized release

Subscribe through AWS Marketplace and download or extract the package provided through the subscribed buyer flow. Do not substitute development charts or registry locations. The release manifest is the source of truth for the chart archive, image references and metering settings.

Expected buyer files. release-manifest.json, SHA256SUMS, values.aws.yaml.tpl, render_values.py, and the chart named by the release manifest.

Package checksum verification

Confirm the operational files before use

Run the following block from a trusted operator workstation. It checks only the buyer-facing files used by this guide.

Terminal — package integrity

set -euo pipefail

for tool in aws kubectl helm jq python3 curl; do
  command -v "$tool" >/dev/null 2>&1 || {
    echo "Missing required tool: $tool" >&2
    exit 1
  }
done

read -r -p "Path to the extracted Marketplace package: " PACKAGE_ROOT
PACKAGE_ROOT="$(cd "$PACKAGE_ROOT" && pwd)"

export PACKAGE_ROOT
export RELEASE_MANIFEST="$PACKAGE_ROOT/release-manifest.json"
export VALUES_TEMPLATE="$PACKAGE_ROOT/values.aws.yaml.tpl"
export RENDER_VALUES="$PACKAGE_ROOT/render_values.py"
export CHART_FILE="$(jq -er '.chart' "$RELEASE_MANIFEST")"
export TACR_HELM_CHART="$PACKAGE_ROOT/$CHART_FILE"

for file in \
  SHA256SUMS \
  release-manifest.json \
  values.aws.yaml.tpl \
  render_values.py \
  "$CHART_FILE"; do
  test -f "$PACKAGE_ROOT/$file"
done

verify_checksum_line() {
  if command -v sha256sum >/dev/null 2>&1; then
    sha256sum --check -
  elif command -v shasum >/dev/null 2>&1; then
    shasum -a 256 --check -
  else
    echo "Install sha256sum or shasum before continuing." >&2
    return 1
  fi
}

for file in \
  release-manifest.json \
  values.aws.yaml.tpl \
  render_values.py \
  "$CHART_FILE"; do
  checksum_line="$(grep -F "  ./$file" "$PACKAGE_ROOT/SHA256SUMS" || true)"
  test -n "$checksum_line" || {
    echo "Checksum entry missing for $file" >&2
    exit 1
  }
  (cd "$PACKAGE_ROOT" && printf '%s\n' "$checksum_line" | verify_checksum_line)
done

AWS identity and cluster access

Connect to the intended buyer cluster

Use the same shell for the remaining blocks so the exported values remain available. Confirm the active AWS identity, cluster endpoint posture and GPU scheduling contract before installation.

Terminal — AWS and Amazon EKS context

set -euo pipefail

read -r -p "AWS CLI profile: " AWS_PROFILE
export AWS_REGION="eu-north-1"
export AWS_DEFAULT_REGION="$AWS_REGION"
read -r -p "Amazon EKS cluster name: " EKS_CLUSTER_NAME

export AWS_PROFILE AWS_REGION AWS_DEFAULT_REGION EKS_CLUSTER_NAME
export K8S_NAMESPACE="tacr-system"
export HELM_RELEASE="tacr"
export SERVICE_ACCOUNT_NAME="tacr-workload"

aws sts get-caller-identity \
  --profile "$AWS_PROFILE" \
  --output table

aws eks describe-cluster \
  --profile "$AWS_PROFILE" \
  --region "$AWS_REGION" \
  --name "$EKS_CLUSTER_NAME" \
  --query 'cluster.{name:name,status:status,version:version,privateEndpoint:endpointAccessConfig.privateAccess,publicEndpoint:endpointAccessConfig.publicAccess}' \
  --output table

aws eks update-kubeconfig \
  --profile "$AWS_PROFILE" \
  --region "$AWS_REGION" \
  --name "$EKS_CLUSTER_NAME"

export MARKETPLACE_CLUSTER_IDENTIFIER="$(aws eks describe-cluster \
  --profile "$AWS_PROFILE" \
  --region "$AWS_REGION" \
  --name "$EKS_CLUSTER_NAME" \
  --query 'cluster.arn' \
  --output text)"

kubectl cluster-info
kubectl get nodes -L tacr.golem.tech/node-pool

gpu_nodes="$(mktemp)"
kubectl get nodes \
  -l tacr.golem.tech/node-pool=gpu \
  -o json > "$gpu_nodes"

jq -e '.items | length > 0' "$gpu_nodes" >/dev/null
jq -e 'all(.items[]; any(.spec.taints[]?; .key == "nvidia.com/gpu" and .value == "present" and .effect == "NoSchedule"))' "$gpu_nodes" >/dev/null
jq -e 'all(.items[]; ((.status.allocatable["nvidia.com/gpu"] // "0") | tonumber) >= 1)' "$gpu_nodes" >/dev/null
rm -f "$gpu_nodes"

IRSA service account

Bind the runtime to a buyer-owned IAM role

The Marketplace chart consumes an existing Kubernetes service account. The associated IAM role should grant only the S3, operational and Marketplace metering permissions required by the deployment.

Terminal — namespace and workload identity

set -euo pipefail

read -r -p "IRSA workload role ARN: " WORKLOAD_ROLE_ARN
export WORKLOAD_ROLE_ARN

kubectl create namespace "$K8S_NAMESPACE" \
  --dry-run=client -o yaml | kubectl apply -f -

kubectl -n "$K8S_NAMESPACE" create serviceaccount "$SERVICE_ACCOUNT_NAME" \
  --dry-run=client -o yaml | kubectl apply -f -

kubectl -n "$K8S_NAMESPACE" annotate serviceaccount "$SERVICE_ACCOUNT_NAME" \
  eks.amazonaws.com/role-arn="$WORKLOAD_ROLE_ARN" \
  --overwrite

kubectl -n "$K8S_NAMESPACE" get serviceaccount "$SERVICE_ACCOUNT_NAME" \
  -o jsonpath='{.metadata.annotations.eks\.amazonaws\.com/role-arn}{"\n"}'

Kubernetes Secrets

Create sensitive values outside Helm

Secret values are entered without terminal echo, streamed directly to the Kubernetes API and immediately removed from the shell environment. They do not appear in Helm values, generated manifests or command-line arguments.

Terminal — secret creation

set -euo pipefail
set +x

read -rsp "PostgreSQL password: " TACR_POSTGRES_PASSWORD; echo
printf %s "$TACR_POSTGRES_PASSWORD" | kubectl -n "$K8S_NAMESPACE" create secret generic tacr-postgres \
  --from-file=password=/dev/stdin \
  --dry-run=client -o yaml | kubectl apply -f -
unset TACR_POSTGRES_PASSWORD

read -rsp "TACR API key: " TACR_API_KEY; echo
printf %s "$TACR_API_KEY" | kubectl -n "$K8S_NAMESPACE" create secret generic tacr-api-auth \
  --from-file=apiKey=/dev/stdin \
  --dry-run=client -o yaml | kubectl apply -f -
unset TACR_API_KEY

read -rsp "Model repository token: " MODEL_REPOSITORY_TOKEN; echo
printf %s "$MODEL_REPOSITORY_TOKEN" | kubectl -n "$K8S_NAMESPACE" create secret generic tacr-hf-token \
  --from-file=token=/dev/stdin \
  --dry-run=client -o yaml | kubectl apply -f -
unset MODEL_REPOSITORY_TOKEN

kubectl -n "$K8S_NAMESPACE" get secret \
  tacr-postgres tacr-api-auth tacr-hf-token \
  -o name

Rendering Marketplace Helm values

Combine the release manifest with buyer-owned infrastructure

The rendering utility reads image and metering information from the authorized release package. The operator supplies only buyer-owned infrastructure values. External ingress remains disabled.

Terminal — render private-by-default values

set -euo pipefail

read -r -p "Amazon RDS endpoint: " RDS_ENDPOINT
read -r -p "PostgreSQL database: " RDS_DATABASE
read -r -p "PostgreSQL user: " RDS_USERNAME
read -r -p "Encrypted Amazon S3 artifact bucket: " ARTIFACT_BUCKET
read -r -p "Buyer VPC CIDR: " VPC_CIDR
read -r -p "EKS service CIDR: " CLUSTER_SERVICE_CIDR

API_IMAGE="$(jq -er '.images.api' "$RELEASE_MANIFEST")"
TRAINING_IMAGE="$(jq -er '.images.training' "$RELEASE_MANIFEST")"
INFERENCE_IMAGE="$(jq -er '.images.inference' "$RELEASE_MANIFEST")"

export ECR_API_REPOSITORY="${API_IMAGE%:*}"
export ECR_TRAINING_REPOSITORY="${TRAINING_IMAGE%:*}"
export ECR_INFERENCE_REPOSITORY="${INFERENCE_IMAGE%:*}"
export IMAGE_TAG="${API_IMAGE##*:}"

test "${TRAINING_IMAGE##*:}" = "$IMAGE_TAG"
test "${INFERENCE_IMAGE##*:}" = "$IMAGE_TAG"

export RDS_ENDPOINT RDS_DATABASE RDS_USERNAME
export ARTIFACT_BUCKET VPC_CIDR CLUSTER_SERVICE_CIDR
export MARKETPLACE_METERING_ENABLED="true"
export MARKETPLACE_PRODUCT_CODE="$(jq -er '.marketplaceMetering.productCode' "$RELEASE_MANIFEST")"
export MARKETPLACE_USAGE_DIMENSION="$(jq -er '.marketplaceMetering.usageDimension' "$RELEASE_MANIFEST")"
export HUGGINGFACE_TOKEN_SECRET_NAME="tacr-hf-token"
export HUGGINGFACE_TOKEN_SECRET_KEY="token"
export HUGGINGFACE_TOKEN_REQUIRED="true"
export INGRESS_ENABLED="false"
export API_HOST="disabled.invalid"
export ACM_CERTIFICATE_ARN=""
umask 077
export VALUES_FILE="$PWD/values.aws.rendered.yaml"

python3 "$RENDER_VALUES" "$VALUES_TEMPLATE" "$VALUES_FILE"
test -s "$VALUES_FILE"
chmod 600 "$VALUES_FILE"

Buyer-facing preflight

Inspect the authorized package without creating workloads

Confirm that the release manifest references the supplied chart, contains the required image and metering fields, and that the chart archive exposes the expected Helm structure. These checks are local, read-only and do not create Kubernetes workloads.

Terminal — package contract inspection

set -euo pipefail

jq -e --arg chart "$CHART_FILE" '
  .chart == $chart and
  (.images.api | type == "string" and length > 0) and
  (.images.training | type == "string" and length > 0) and
  (.images.inference | type == "string" and length > 0) and
  (.marketplaceMetering.enabled == true) and
  (.marketplaceMetering.productCode | type == "string" and length > 0) and
  (.marketplaceMetering.usageDimension | type == "string" and length > 0)
' "$RELEASE_MANIFEST" >/dev/null

helm show chart "$TACR_HELM_CHART" \
  | sed -n -e '/^name:/p' -e '/^version:/p' -e '/^appVersion:/p'

tar -tzf "$TACR_HELM_CHART" \
  | grep -E '^tacr-platform/(Chart.yaml|values.yaml|templates/)' \
  | sed -n '1,40p'

Helm lint and manifest inspection

Inspect scheduling, identity and image references

Render the chart locally and review the operational fields without printing secret values or the full manifest to the page.

Terminal — lint and inspect

set -euo pipefail

helm lint "$TACR_HELM_CHART" \
  -f "$VALUES_FILE"

RENDERED_MANIFEST="$(mktemp)"
cleanup_rendered_manifest() {
  rm -f "$RENDERED_MANIFEST"
}
trap cleanup_rendered_manifest EXIT

helm template "$HELM_RELEASE" "$TACR_HELM_CHART" \
  --namespace "$K8S_NAMESPACE" \
  -f "$VALUES_FILE" \
  --include-crds > "$RENDERED_MANIFEST"

grep -E '(^|[[:space:]])(serviceAccountName:|tacr\.golem\.tech/node-pool:|nvidia\.com/gpu:|type: ClusterIP)' \
  "$RENDERED_MANIFEST" | sed -n '1,100p'

cleanup_rendered_manifest
trap - EXIT

Atomic Helm installation

Install the Marketplace release

An atomic operation waits for readiness and automatically removes a failed revision. Buyer-owned infrastructure remains outside the Helm release.

Terminal — install or reconcile

set -euo pipefail

helm upgrade --install "$HELM_RELEASE" "$TACR_HELM_CHART" \
  --namespace "$K8S_NAMESPACE" \
  --create-namespace \
  -f "$VALUES_FILE" \
  --atomic \
  --timeout 20m \
  --history-max 10

Health and readiness verification

Verify the internal service on port 8080

The default service is a private Kubernetes ClusterIP. Use a local port-forward to check /healthz and /readyz. The command also confirms that the Marketplace metering CronJob exists without printing metering identifiers.

Terminal — runtime health

set -euo pipefail

export API_DEPLOYMENT="${HELM_RELEASE}-tacr-platform-api"
export API_SERVICE="${HELM_RELEASE}-tacr-platform-api"
export METERING_CRONJOB="${HELM_RELEASE}-tacr-platform-marketplace-metering"
export LOCAL_PORT="18080"

kubectl -n "$K8S_NAMESPACE" rollout status \
  deployment/"$API_DEPLOYMENT" \
  --timeout=10m

kubectl -n "$K8S_NAMESPACE" get deploy,pods,jobs,svc -o wide
kubectl -n "$K8S_NAMESPACE" get cronjob "$METERING_CRONJOB" \
  -o custom-columns='NAME:.metadata.name,SCHEDULE:.spec.schedule,SUSPEND:.spec.suspend'

kubectl -n "$K8S_NAMESPACE" port-forward \
  service/"$API_SERVICE" \
  "$LOCAL_PORT:8080" > "${TMPDIR:-/tmp}/tacr-port-forward.log" 2>&1 &
PORT_FORWARD_PID=$!
trap 'kill "$PORT_FORWARD_PID" 2>/dev/null || true' EXIT

for attempt in $(seq 1 30); do
  if curl -fsS "http://127.0.0.1:$LOCAL_PORT/healthz" >/dev/null; then
    break
  fi
  sleep 2
done

curl -fsS "http://127.0.0.1:$LOCAL_PORT/healthz"
curl -fsS "http://127.0.0.1:$LOCAL_PORT/readyz"

Governed model lifecycle

From workflow topology to policy-bound inference

The approved customer workflow topology is incorporated into model adaptation, producing a policy-bound model artifact with a structurally bounded workflow action space. The artifact must complete mandatory qualification before it can be deployed for governed inference.

Policy and topology

Create or register the customer policy, then compile its states and admissible transitions into executable workflow topology.

Policy-constrained model adaptation

Launch the managed GPU adaptation job. The resulting artifact is specific to the approved workflow and remains inside the buyer environment.

Mandatory qualification

Only a qualified policy-bound model artifact may progress to an inference deployment.

Governed inference

Invoke the deployed model inside the buyer environment. Governance is embedded in model adaptation, not added after generation.

API use. Request and response bodies can evolve with the Marketplace release. Use the API contract and examples shipped with the subscribed package rather than copying unstated payloads from external documentation.

Optional HTTPS ingress

Enable buyer-controlled external access only when required

The package supports an optional AWS Load Balancer Controller ingress using a buyer-owned host name and ACM certificate. Review authentication, security groups, WAF, DNS and allowed network ranges before enabling it.

Terminal — explicitly enable HTTPS ingress

set -euo pipefail

read -r -p "Public API host name: " API_HOST
read -r -p "ACM certificate ARN: " ACM_CERTIFICATE_ARN

export API_HOST ACM_CERTIFICATE_ARN
export INGRESS_ENABLED="true"

python3 "$RENDER_VALUES" "$VALUES_TEMPLATE" "$VALUES_FILE"

helm upgrade "$HELM_RELEASE" "$TACR_HELM_CHART" \
  --namespace "$K8S_NAMESPACE" \
  -f "$VALUES_FILE" \
  --atomic \
  --timeout 20m

kubectl -n "$K8S_NAMESPACE" get ingress -o wide

Operations

Inspect, update, roll back or remove the release

Inspect the current release

Review Helm history and Kubernetes state before changing the deployment.

Terminal — release status

set -euo pipefail

helm -n "$K8S_NAMESPACE" status "$HELM_RELEASE"
helm -n "$K8S_NAMESPACE" history "$HELM_RELEASE"
kubectl -n "$K8S_NAMESPACE" get deploy,pods,jobs,svc,ingress -o wide

Upgrade to another authorized package

Verify the new package and render its values before running this block. The operation remains atomic.

Terminal — controlled upgrade

set -euo pipefail

read -r -p "Path to the new Marketplace chart archive: " NEW_CHART
read -r -p "Path to the new rendered values file: " NEW_VALUES

test -f "$NEW_CHART"
test -f "$NEW_VALUES"

helm upgrade "$HELM_RELEASE" "$NEW_CHART" \
  --namespace "$K8S_NAMESPACE" \
  -f "$NEW_VALUES" \
  --atomic \
  --timeout 20m \
  --history-max 10

Restore a previous Helm revision

Select an existing revision explicitly and wait for the API deployment to become ready.

Terminal — rollback

set -euo pipefail

helm -n "$K8S_NAMESPACE" history "$HELM_RELEASE"
read -r -p "Revision to restore: " REVISION

helm -n "$K8S_NAMESPACE" rollback "$HELM_RELEASE" "$REVISION" \
  --wait \
  --timeout 20m

kubectl -n "$K8S_NAMESPACE" rollout status \
  deployment/"${HELM_RELEASE}-tacr-platform-api" \
  --timeout=10m

Remove the namespaced application

This removes the Helm-managed application. Amazon RDS, Amazon S3, IAM, KMS, DNS and certificates remain buyer-owned.

Terminal — confirmed uninstall

set -euo pipefail

read -r -p "Type UNINSTALL to remove the namespaced application release: " CONFIRM
if [ "$CONFIRM" != "UNINSTALL" ]; then
  echo "Uninstall cancelled."
  exit 1
fi

helm -n "$K8S_NAMESPACE" uninstall "$HELM_RELEASE"
kubectl -n "$K8S_NAMESPACE" get all

Security boundary

Controls retained by the buyer

Control	Buyer responsibility	Runtime behavior
Identity	IAM roles, IRSA trust, Kubernetes RBAC and least-privilege policies	No static AWS credentials are required in the chart
Encryption	AWS KMS configuration for S3, RDS and Secrets Manager; Kubernetes secret encryption when required	Data stores and credentials remain inside the buyer account
Networking	VPC, EKS endpoint access, security groups, DNS, certificates and ingress	ClusterIP and private access are the default path
Data	Policies, workflow state, training inputs, model artifacts and retained operational records	RDS and S3 are supplied and governed by the buyer

Troubleshooting and support

Escalate with sanitized operational context

For product deployment issues, provide the Marketplace release identifier, chart name, AWS Region, Amazon EKS version, failing command, sanitized Kubernetes events and UTC timestamps. Remove account numbers, ARNs, private endpoints, tokens, passwords, request data and customer information before sharing logs.

For entitlement, subscription or AWS service issues, use the appropriate AWS Marketplace or AWS Support channel. For application, training, qualification, inference or package behavior, contact Golem Technologies.

Request technical support

Bounded Agentic AI Workflow Engine for Amazon EKS

Install into a prepared buyer-owned Amazon EKS landing zone

Private by default, operated in the buyer account

What this guide installs—and what it does not

Installed by the package

Prepared by the buyer

Prepare the AWS landing zone

Use only the buyer-authorized release

Confirm the operational files before use

Connect to the intended buyer cluster

Bind the runtime to a buyer-owned IAM role

Create sensitive values outside Helm

Combine the release manifest with buyer-owned infrastructure

Inspect the authorized package without creating workloads

Inspect scheduling, identity and image references

Install the Marketplace release

Verify the internal service on port 8080

From workflow topology to policy-bound inference

Policy and topology

Policy-constrained model adaptation

Mandatory qualification

Governed inference

Enable buyer-controlled external access only when required

Inspect, update, roll back or remove the release

Inspect the current release

Upgrade to another authorized package

Restore a previous Helm revision

Remove the namespaced application

Controls retained by the buyer

Escalate with sanitized operational context