Prerequisites
Tools, accounts, permissions, sizing, and cost planning before you deploy.
Work through this checklist before starting a deployment. Everything here is required unless marked optional.
Tools
Install these locally (or in your CI runner) and confirm they are on your PATH.
| Tool | Purpose | Both clouds |
|---|---|---|
kubectl | Talk to the cluster | Yes |
helm v3 | Deploy the chart | Yes |
terraform >= 1.5 | Provision supporting resources | Yes |
docker | Pull and (if mirroring) push images | Yes |
aws CLI + eksctl | AWS only: account access and EKS cluster creation | AWS |
gcloud (+ gke-gcloud-auth-plugin) | GCP only: account access and GKE | GCP |
Accounts and access
- A cloud account (AWS or GCP) with permissions to run Terraform and create the resources described in the Terraform reference.
- A registry you can pull the platform images from (your Marketplace entitlement, or a registry you mirror the images into).
- A domain name you control, with DNS you can edit (Route 53 or Cloud DNS recommended but not required).
- API keys for at least one LLM provider (OpenAI, Anthropic, Google, or access to AWS Bedrock / Vertex AI).
Foundational infrastructure you provide
The Terraform stacks deliberately do not create these. Provision them first.
Kubernetes cluster
- AWS: an EKS cluster (Kubernetes 1.30+), created with
eksctl, with an OIDC provider enabled (required for IRSA) and the AWS Load Balancer Controller installed (required for ALB ingress). - GCP: a GKE cluster (Autopilot is supported), with Workload Identity enabled.
A starting node pool of 2 nodes at roughly 2 vCPU / 8 GB each (for example AWS
t3.large) comfortably runs the default footprint. Scale from there based on load.
PostgreSQL database
PostgreSQL 16 or newer. Any of:
- Amazon RDS for PostgreSQL (in the cluster VPC),
- Google Cloud SQL for PostgreSQL,
- Neon (serverless PostgreSQL).
The application connects using a single PG_BASE_URL secret. The schema is created
and migrated automatically by the migration job; you do not run DDL by hand. Use a
database name of workflows (not system, which is a reserved word); the platform
uses system as a schema inside that database.
Temporal
A Temporal endpoint, either:
- Temporal Cloud (managed), or
- a self-hosted Temporal server (for example, deployed to the same cluster with its own PostgreSQL persistence).
You will supply TEMPORAL_HOST, TEMPORAL_NAMESPACE, and either an API key
(TEMPORAL_API_KEY) or mTLS certificates, depending on your Temporal setup.
Sizing (default footprint)
These are the chart's default requests and limits. Autoscaling is on by default for all three workloads.
| Component | CPU request / limit | Memory request / limit | Replicas (min-max) |
|---|---|---|---|
web | 250m / 500m | 512Mi / 1Gi | 1 - 6 |
server | 500m / 1000m | 1Gi / 2Gi | 2 - 10 |
worker | 100m / 500m | 256Mi / 512Mi | 1 - 8 |
migration (job) | 100m / 500m | 256Mi / 512Mi | one-shot |
Plan cluster capacity for the sum of maximum replicas you intend to allow, plus headroom for the ingress controller and system pods.
Cost planning
Self-hosting costs are dominated by the cluster and its networking, not the application. Rough monthly order-of-magnitude figures (region-dependent):
| Item | AWS | GCP |
|---|---|---|
| Managed control plane | EKS ~$73 | GKE Autopilot: pay per pod, no separate control-plane fee on the free tier |
| Worker compute | EC2 nodes (largest variable cost) | Autopilot pod resources |
| NAT / egress | NAT gateway ~$32 + data | Cloud NAT + egress |
| Load balancer | ALB ~$16-22 | GCE LB (forwarding rules + data) |
| Database | RDS from ~$12 (db.t3.micro) or Neon usage-based | Cloud SQL from ~$10 or Neon usage-based |
| Object storage, KMS, Secrets | Low (a few dollars) | Low (a few dollars) |
To reduce cost in non-production environments, you can scale node groups to zero or tear down the cluster while preserving the stateful and identity resources. See Operations.
Pre-flight checklist
Confirm each item before you begin:
- Cluster is running and your kubectl current-context points at it.
- Terraform can authenticate to your cloud account.
- A PostgreSQL database is reachable from the cluster network.
- A Temporal endpoint and its credentials are ready.
- You have a domain and can create DNS records and a TLS certificate.
- You have at least one LLM provider API key.