Kubernetes Deployment Guide

Kubernetes Deployment Guide

Prerequisites

• Kubernetes cluster configured (k8s-dev or k8s-prod) via OVH Managed K8s (BHS5)
• secuops CLI installed and configured
• helm CLI v3+
• DNS access for configuring ingress domains

Namespaces

SecuSiem uses 3 Kubernetes namespaces:

secusiem-system       # Main services + PostgreSQL + Redis
secusiem-loki         # Grafana Loki cluster
secusiem-monitoring   # Grafana OSS

Creation:

secuops kubectl -- apply -f infrastructure/k8s-manifests/00-namespaces.yaml

Step 1: Configure Secrets

Edit infrastructure/k8s-manifests/02-secrets-dev.yaml and replace CHANGE_ME values:

• OVH S3: access_key_id, secret_access_key (OVH console)
• Stripe: secret_key, webhook_secret (Stripe dashboard)
• Anthropic: api_key (Anthropic console)
• Authentik: token, url (Authentik admin)
• Grafana: admin_password
• PostgreSQL: Change default passwords

secuops kubectl -- apply -f infrastructure/k8s-manifests/02-secrets-dev.yaml

Step 2: Deploy Infrastructure

PostgreSQL 16

secuops kubectl -- apply -f infrastructure/k8s-manifests/03-postgresql.yaml

StatefulSet with 100Gi csi-cinder-high-speed storage.

Redis 7.2

secuops kubectl -- apply -f infrastructure/k8s-manifests/04-redis.yaml

Deployment with 1Gi max memory, LRU eviction policy.

Grafana Loki 3.0+

secuops helm-install loki grafana/loki -n secusiem-loki \
  --create-namespace \
  -f infrastructure/helm-values/loki-values-dev.yaml

Loki dev configuration:

• Mode: SingleBinary (1 replica)
• Multi-tenancy: auth_enabled: true
• Storage: Filesystem (no S3 needed for dev)
• Schema: TSDB v13 with 24h index periods
• Resources: 200m-1000m CPU, 512Mi-1Gi memory
• Persistence: 10Gi on csi-cinder-high-speed

Grafana OSS

secuops helm-install grafana grafana/grafana -n secusiem-monitoring \
  --create-namespace \
  -f infrastructure/helm-values/grafana-values-dev.yaml

Grafana dev configuration:

• Pre-configured Loki datasource pointing to loki-gateway.secusiem-loki.svc.cluster.local
• 5Gi persistent storage
• 100m-500m CPU, 256Mi-512Mi memory
• Security context: non-root (uid 472)

Step 3: Deploy Microservices

secuops kubectl -- apply -f infrastructure/k8s-manifests/05-secusiem-microservices.yaml

This deploys the 5 services:

• tenant-manager (port 8000)
• ingestion-api (port 8000)
• claude-analyzer (port 8000)
• billing-service (port 8000)
• report-generator (port 8000)

Step 4: Verification

# Check all pods
secuops kubectl -- get pods -n secusiem-system
secuops kubectl -- get pods -n secusiem-loki
secuops kubectl -- get pods -n secusiem-monitoring

# Health checks
curl http://tenant-manager.secusiem-system:8000/health
curl http://ingestion-api.secusiem-system:8000/health
curl http://claude-analyzer.secusiem-system:8000/health

Docker Images

Images are hosted on the OVH Harbor registry:

qq9o8vqe.c1.bhs5.container-registry.ovh.net/secuops/
  tenant-manager:latest
  ingestion-api:latest
  claude-analyzer:latest
  billing-service:latest
  report-generator:latest

Resources per Service

Expected Pod Count

Manifest Files