Standalone oz-echo Helm Chart

This chart deploys Echo plus its own dedicated MongoDB, independently of the rest of the Oz API stack. Use it if you're running Echo on Kubernetes on its own.

Chart: oz-echo, version 0.3.8, app version (Echo image) 1.0.3.

This chart was last released some time ago and pins an older Echo image than the bundled oz-k8s chart does. Confirm current support status with Oz Forensics before adopting it for a new production deployment.

Shared concepts (authentication, endpoints, configuration reference) can be found on the parent page.

Prerequisites

• A Kubernetes cluster with:

  • ingress-nginx controller + cert-manager with a working ClusterIssuer (default assumes Let's Encrypt production).

  • metrics-server / kube-metrics (required for autoscaling, on by default).

  • Prometheus, if you want metrics scraping (optional, on by default – disable if you don't have Prometheus Operator CRDs installed).

  • A StorageClass for Mongo's persistent volume.

• Helm 3.

• openssl, to generate Echo's signing key.

• The chart itself – obtain the chart source or a ChartMuseum URL from Oz Forensics; this repo has no public distribution URL documented in-chart.

Must-override values

Value	Purpose
ozDockerHubCreds	Base64 .dockerconfigjson for pulling the private image (see below for how to generate)
UserParams.URLs.echoURL	Public hostname for the Ingress
Params.echo.tokenKey	JWT signing secret — generate with openssl rand -base64 129 | tr -d '\n'
pvc.mongo.storageClassName	Must match a StorageClass that exists in your cluster (default efs-sc almost certainly won't)
Params.mongo.security.Password	Embedded MongoDB root password – change the default
Params.global.Ingress.clusterIssuer.clusterIssuerIssuerName	Only if you're not using a ClusterIssuer literally named letsencrypt-production
At least one of UserParams.Passwords, UserParams.StaticTokens, or UserParams.JWT.public	Without one of these, nothing can authenticate to Echo

Also review Params.echo.resources / Params.mongo.resources against your cluster's actual capacity – the defaults (Echo: 2–6 CPU / 2–6Gi; Mongo: 2–8 CPU / 8–16Gi) assume a reasonably sized node.

Generating ozDockerHubCreds

kubectl create secret docker-registry tmp-reg-cred \
  --docker-server=https://index.docker.io/v1/ \
  --docker-username=<username-from-Oz> \
  --docker-password=<token-from-Oz> \
  --dry-run=client -o jsonpath='{.data.\.dockerconfigjson}'

Paste the output as the value of ozDockerHubCreds in your values file.

Example of values.yaml

values.yaml

ozDockerHubCreds: "<base64 dockerconfigjson from above>"

UserParams:
  URLs:
    echoURL: echo.yourcompany.example.com
  Passwords:
    - username: [e-mail]
      password: "<change-me>"

pvc:
  mongo:
    storageClassName: <your-storage-class>

Params:
  echo:
    tokenKey: "<output of: openssl rand -base64 129 | tr -d '\n'>"
  mongo:
    security:
      Password: "<change-me>"

Install

helm repo add oz-forensics <chartmuseum-url-from-Oz>
helm repo update
helm install echo oz-forensics/oz-echo --version 0.3.8 \
  --namespace echo --create-namespace \
  -f my-values.yaml

If you received the chart as a local checkout or tarball instead:

helm install echo ./oz-api-echo-chart -f my-values.yaml

Verify

kubectl -n echo get pods
kubectl -n echo port-forward svc/oz-echo-app 8010:8010
curl http://localhost:8010/healthz

Known limitation

Resource names in this chart are derived from the chart name, not the Helm release name – only a single release of this chart is supported per namespace. Install additional instances into separate namespaces.