oz-echo as a Part of api-decomposed (oz-k8s)

oz-k8s is the full Oz API stack as a single Helm chart – API, BIO, Echo, Web UI, nginx, MongoDB, and so on, deployed together. Echo is always deployed; there is no toggle to disable it and no separate install step. If you're installing this chart for the API at all, you already get Echo.

Chart: oz-k8s, version 0.20.32, app version 6.6.3. Echo image pinned at ozforensics/echo:1.0.4.

This guide only covers the Echo-specific configuration. For the full install (prerequisites, core values, storage, ingress, database setup), follow api-decomposed's own readme.md (and readme-s3.md if using S3 storage) – this document assumes you're doing that install and just need to know what's configurable about the Echo piece.

Shared concepts (authentication, endpoints, configuration reference) can be found on the parent page.

Prerequisites (stack-wide, not Echo-specific)

• Kubernetes 1.23+, Helm 3+.

• ingress-nginx + cert-manager, or Kong 2.12+.

• kube-metrics-server.

• Prometheus.

• External PostgreSQL with the pgcrypto extension.

• An RWX storage class, or S3 (see readme-s3.md).

Install

helm repo add oz <chartmuseum-url-from-Oz>
helm repo update
helm install my-release oz/oz-k8s --version 0.20.32 -f my-values.yaml

Minimum required overrides are stack-wide (UserParams.URLs.apiURL, UserParams.JWT.public/private, UserParams.DB.*, UserParams.Creds.apiAdminLogin/apiAdminPass, UserParams.BIO.licenseKey/clientToken, Params.mongo.security.Password, storage class names) – see the chart's own readme for the full list. None of these are Echo-specific; Echo rides along automatically once the stack is up.

Echo-specific configuration (Params.echo.*)

Key	Default	Purpose
tokenKey	""	JWT signing secret – generate with openssl rand -base64 129 | tr -d '\n'. Not listed in the chart's own "Required Passwords" table despite defaulting empty – set it explicitly.
StaticTokens	[]	{username, token} pre-shared bearer tokens
Passwords	[]	{username, password} login accounts
ServiceUsers	[]	Usernames (from the two lists above) granted GET access to session data
publicKeys	{}	Map of filename → PEM public key, for JWS-signed request validation
extraEnvVarsSecret	""	Point at a pre-created Secret instead of letting the chart generate one – must contain a base64 MONGODB_URL key
resources	limits 6 CPU / 6Gi, requests 2 CPU / 2Gi	Sizing
scaling	HPA on by default, min 2 / max 5 replicas, 75% CPU target	Autoscaling
image.tag	"1.0.4"	Override to pin a different Echo build

How Echo is reached

Echo has no separate hostname or ingress entry. It's reachable at <apiURL>/api/event_sessions, routed through the same Ingress (or Kong HTTPRoute, if using Kong) as the rest of the API.

Verify

kubectl get pods -l app=echo
curl https://<apiURL>/api/event_sessions -H "Authorization: Bearer <token>"

Version note

Echo's own repository has moved past 1.0.4 (adding cursor-based pagination and an optional conversion-funnel logging feature) but this chart still pins 1.0.4 as of version 0.20.32. If you need features from a newer Echo release, override Params.echo.image.tag – check with Oz Forensics first for compatibility.