On-Prem Deployment Installation

Complete the Prerequisites checklist first, then follow these steps in order. See also Specifications.

1. Prepare the Workspace#

1mkdir -p mw-helm/auth mw-helm/haproxy
2cd mw-helm

Final structure:

1mw-helm/
2├── auth/
3│   ├── auth_sign.pem
4│   └── auth_sign_public.pem
5├── haproxy/
6│   ├── mw.crt
7│   └── mw.crt.key
8└── values-override.yaml

2. Generate Authentication Keys#

These RSA keys sign and verify user sessions:

1openssl genrsa -out auth/auth_sign.pem 2048
2openssl rsa -in auth/auth_sign.pem -pubout -out auth/auth_sign_public.pem

3. Place the SSL Certificate#

Copy the certificate and key for your domain into haproxy/:

1cp /path/to/your-cert.crt haproxy/mw.crt
2cp /path/to/your-cert.key haproxy/mw.crt.key

4. Create the Values File#

Download the sample matching your storage backend, save it as values-override.yaml, and replace every YOUR_* placeholder:

• values-aws.sample.yaml — AWS S3 storage
• values-azure.sample.yaml — Azure Blob storage
• values-baremetal.sample.yaml — Bare metal with in-cluster MinIO

The completed file contains credentials — store it securely and do not commit it to version control.

5. Log In to the Helm Registry#

1helm registry login ghcr.io

Use the registry username and token provided by the Middleware team.

6. Install#

Confirm you are connected to the right cluster first:

1kubectl config current-context
2kubectl get nodes

Then run from inside mw-helm/:

1helm install mw oci://ghcr.io/middleware-labs/helm-charts/mw-infra/middleware \
2  --namespace mw \
3  --create-namespace \
4  -f values-override.yaml \
5  --set-file secrets.appConfiguration.authKeys.privateKey=./auth/auth_sign.pem \
6  --set-file secrets.appConfiguration.authKeys.publicKey=./auth/auth_sign_public.pem \
7  --set-file haproxy.ssl.certificate=./haproxy/mw.crt \
8  --set-file haproxy.ssl.privateKey=./haproxy/mw.crt.key

Add --version <chart-version> with the version shared during onboarding to pin the chart.

Installation takes several minutes — database migrations and account registration run as post-install jobs.

7. Point Your Domain at the Load Balancer#

1kubectl get svc -n mw | grep LoadBalancer

Create a DNS record for your domain pointing to the EXTERNAL-IP (A record) or hostname (CNAME) shown.

8. Verify the Installation#

1# All pods Running or Completed
2kubectl get pods -n mw
3
4# Account registration succeeded — the log ends with an activation link
5kubectl logs job/mw-register-account -n mw | tail -5

Open the activation link (or https://YOUR_APP_HOST) in a browser and log in with your owner credentials.

Next Steps#

• Install Middleware agents on the hosts and clusters you want to monitor, pointed at your Middleware domain.
• Confirm data appears in the UI, then invite your team members.

Troubleshooting#

• Pods stuck in ImagePullBackOff — registry credentials are missing or wrong. Verify the registry username and token in values-override.yaml.
• Install fails with a validation error — a required value is empty or invalid. Compare values-override.yaml against the sample and check that all YOUR_* placeholders are replaced.
• UI not reachable — check the DNS record points to the load balancer (kubectl get svc -n mw) and the SSL certificate files match your domain.
• Install jobs fail — check the job logs (kubectl logs job/<job-name> -n mw). A retry with helm upgrade (same command as install) resolves most first-boot issues. If it persists, contact support.
• No data in the UI — verify the agent is configured with your Middleware domain and the agent network can reach it on port 443.

Upgrading#

Re-run the install command with upgrade and the new chart version. Database migrations re-run automatically on every upgrade; account registration does not.

• After changing any secret values, restart workloads: kubectl rollout restart deployment,statefulset -n mw.
• To renew the SSL certificate, replace the files in haproxy/ and re-run the upgrade command — plan this before the certificate expires.

Uninstalling#

1helm uninstall mw -n mw
2kubectl delete namespace mw

If the namespace stays in Terminating, contact support for the cleanup procedure.