Cloud Ops overview

Owner: Cloud Ops

This guide deploys Arbium into a customer-owned cloud account and exposes one customer-reachable HTTPS endpoint. The application layer is the same on every supported cloud; only the managed Kubernetes, PostgreSQL, secret store, ingress, and workload-identity wiring differ.

Installation flow

1. Prepare access and common prerequisites.
2. Choose and provision a cloud: AWS, Google Cloud, or Azure.
3. Configure and install the shared Helm chart, using the preset and provider overlay from Step 2.
4. Verify the deployment with common health checks and the checks for your cloud.
5. Hand the endpoint to IT.

The flow forks only for Step 2 and then converges again:

                         ┌─ AWS: EKS + Aurora + Secrets Manager + ALB ─┐
Common prerequisites ────┼─ GCP: GKE + Cloud SQL + Secret Manager + LB ┼── Shared Helm ── Verify ── IT handoff
                         └─ Azure: AKS + PostgreSQL + Key Vault + nginx ┘

Supported cloud foundations

	AWS	Google Cloud	Azure
Kubernetes	Amazon EKS	Google Kubernetes Engine	Azure Kubernetes Service
PostgreSQL	Aurora PostgreSQL	Cloud SQL for PostgreSQL	PostgreSQL Flexible Server
Secret store	AWS Secrets Manager	Google Secret Manager	Azure Key Vault
Workload identity	IRSA	GKE Workload Identity	AKS Workload Identity
Ingress and TLS	AWS Load Balancer Controller + ACM	GCE Ingress + Google-managed certificate	ingress-nginx + cert-manager
Default embedder	CPU or optional GPU pool	CPU or optional GPU pool	CPU; optional GPU pool can be added
Helm preset	values-aws.yaml	values-gcp.yaml	values-azure.yaml

Do not mix provider overlays. The common application values file is portable, but the provider preset and provider values file must match the foundation that Terraform created.

Parallel IT work

IT can start Entra app registration while Cloud Ops provisions the foundation. Before Helm configuration, Cloud Ops needs the customer’s Entra tenant ID and Arbium Agent client ID. If the fleet console is enabled, Cloud Ops also needs the Arbium Admin application values and the SCIM group IDs.

Start with 1. Prerequisites & access.