Deploy AI Command Center on AWS EKS
Prepare the prerequisites, install and validate Staging, then promote the approved release to Production. The scripts deploy into an existing cluster; they do not provision EKS, EFS, the database, or the load balancer controller.
1. Download and connect
Obtain and verify the deployment toolkit. It contains the required scripts and templates plus supporting guidance. Extract it, change into AICC-EKS-Package, and make its scripts executable:
chmod +x scripts/*.sh
Define the environment in this terminal session. Replace the example region and cluster name:
export AWS_REGION="eu-west-1"
CLUSTER="your-eks-cluster"
NAMESPACE="aicc-staging"
RELEASE="aicc"
VALUES="values-staging.yaml"
aws sts get-caller-identity
aws eks update-kubeconfig --region "$AWS_REGION" --name "$CLUSTER"
kubectl config current-context
kubectl get nodes
Confirm the account, cluster, and Ready amd64 nodes before changing anything. Production must use independent values, databases, storage paths, Secrets, and licensing. Supply namespace and release flags consistently; the scripts otherwise default to aicc for both.
2. Configure EFS storage
Edit config/storageclass-efs.yaml and replace <FILE_SYSTEM_ID> with your encrypted EFS file system ID. Configure the EFS CSI driver and its IAM permissions first. Create a mount target in each worker-node Availability Zone and allow TCP 2049 from the nodes.
kubectl apply -f config/storageclass-efs.yaml
kubectl get storageclass efs-aicc -o yaml
Check provisioner efs.csi.aws.com, reclaim policy Retain, and access-point provisioning with UID/GID 10001. The StorageClass is cluster-scoped: verify an existing class rather than overwriting it. Use distinct class names where environments use different EFS file systems.
The application mounts shared storage at /aicc and requires ReadWriteMany. The 5Gi PVC request does not impose an EFS capacity limit. A new volume starts empty; the setup wizard creates the configuration. Do not copy another environment's appsettings.json into it.
3. Mirror release artifacts into ECR
Toolkit 1.0.0 targets AICC platform 8.3.121; AWS deployment validation and the approved Helm chart version remain pending. Obtain the registry project, username/token, exact image release tag, chart version, and license from IntelliBuddies through the agreed delivery process before deployment. Confirm the compatibility information. The ZIP contains scripts and templates, not licensed images or a Helm archive.
Set these to the exact versions confirmed for AICC 8.3.121. Do not infer the chart version from the platform version:
IMAGE_TAG="REPLACE_WITH_APPROVED_IMAGE_TAG"
CHART_VERSION="REPLACE_WITH_APPROVED_CHART_VERSION"
./scripts/aicc-mirror-to-ecr.sh \
--source registry.ib-x.ai/your-project \
--tag "$IMAGE_TAG" --chart-version "$CHART_VERSION" --region "$AWS_REGION" --dry-run
Review the plan, then repeat without --dry-run. The script prompts for registry credentials without echoing the token. For automation, supply HARBOR_USERNAME and HARBOR_TOKEN through an approved secrets mechanism.
| Artifact | Default ECR repository |
|---|---|
| Six application services | aicc/ib-api, aicc/ib-worker, aicc/ib-scheduler, aicc/ib-voice, aicc/ib-ingestion, aicc/ib-frontend |
| Redis | aicc/redis |
| OCI Helm chart | aicc/aicc |
The script creates repositories unless --no-create-repos is specified. Its default prefix is aicc. Retain its final image-registry, Redis-image, and chart-reference output. All six application images use one release tag. A four-part image tag such as 8.3.121.1 maps to chart version 8.3.121-1; these are format examples, not a compatibility statement. Supply --chart-version if IntelliBuddies specifies a different version.
Scan and approve the mirrored images before installing. Do not skip Redis or the chart for a new installation. The mirror host needs the source registry, ECR, Docker Hub for Redis, and GitHub release downloads if it needs to obtain the pinned ORAS binary.
4. Create the namespace and master key
kubectl create namespace "$NAMESPACE"
If it already exists, verify it belongs to this environment. This walkthrough uses a customer-created Secret referenced by global.masterKey.existingSecret. Generate a key only for a new environment; an existing installation must retain its matching key.
umask 077
KEY_DIR=$(mktemp -d)
openssl rand -hex 32 | tr -d '\n' > "$KEY_DIR/master-key"
kubectl -n "$NAMESPACE" create secret generic aicc-master-key \
--from-file=master-key="$KEY_DIR/master-key"
Store this key securely outside the cluster using your approved secrets-management process. After confirming that backup, remove the temporary file:
rm -- "$KEY_DIR/master-key"
rmdir -- "$KEY_DIR"
unset KEY_DIR
Do not print, lose, replace, or routinely rotate the master key. Losing it prevents decryption of saved configuration. Use separate keys per environment and preserve them through upgrades and recovery.
The chart can alternatively generate <release>-aicc-master-key when no existing Secret is configured. Do not mix that alternative with this walkthrough's aicc-master-key reference. Back up the actual key in use. Namespace deletion removes Secrets even where Helm retention applies.
5. Prepare values
cp config/values-eks.yaml "$VALUES"
Replace every active placeholder. Remove the optional global.objectStore and global.serviceAccount blocks if S3 is not used. Keep passwords out of this file.
| Setting | Value |
|---|---|
global.imageRegistry | Registry and prefix printed by the mirror script |
global.masterKey.existingSecret | aicc-master-key from step 4 |
Six aicc-*.image.tag entries | Same approved release tag |
redis.enabled, redis.image | true, and the mirrored ECR Redis image |
sharedVolume.storageClass, accessMode | EFS StorageClass and ReadWriteMany |
dnsResolver | Leave empty for cluster DNS discovery |
ingress.host | This environment's HTTPS hostname |
| Certificate annotation | Issued ACM certificate for that hostname, in the ALB region |
| Ingress scheme | Explicitly choose internal or internet-facing |
| ALB settings | Class alb, target type ip, HTTPS redirect, /index.html health check, idle timeout 3600 seconds |
Service resources | Measured CPU/memory requests and limits for each applicable service |
The script revision supplied here reads tags from the template's one-line service entries. Preserve that format when adding resources or replicas:
# Replace the illustrative resource settings with measured values.
aicc-api: { image: { tag: "YOUR_RELEASE_TAG" }, resources: { requests: { cpu: "YOUR_CPU_REQUEST", memory: "YOUR_MEMORY_REQUEST" }, limits: { cpu: "YOUR_CPU_LIMIT", memory: "YOUR_MEMORY_LIMIT" } } }
Keep ingress routed through the frontend service, which routes the API, chat, and voice paths. Do not add a separate /api ingress rule. If knowledge bases are not used, ingestion can be disabled by adding replicaCount: 0 to the one-line aicc-ingestion entry; otherwise retain it.
Configure all applicable services. The chart does not supply application resource requests and limits by default. Do not convert these service entries into multiline YAML with this script revision.
Optional S3 documents
Configure global.objectStore and the service-account role annotation from the template. The supplied configuration uses IRSA and needs the appropriate bucket/object permissions to list, read, write, and delete documents. Provision the role and trust relationship first. S3 does not replace EFS for configuration, and its content requires separate backup.
Browser voice and TURN
Provide a relay reachable from browsers and the Voice workload. Create its credential Secret without placing the password in values:
umask 077
TURN_DIR=$(mktemp -d)
read -r -s -p "TURN credential: " TURN_CREDENTIAL
printf '\n'
printf '%s' "$TURN_CREDENTIAL" > "$TURN_DIR/credential"
unset TURN_CREDENTIAL
kubectl -n "$NAMESPACE" create secret generic aicc-turn \
--from-file=credential="$TURN_DIR/credential"
rm -- "$TURN_DIR/credential"
rmdir -- "$TURN_DIR"
unset TURN_DIR
Uncomment the complete global.extraEnv block in the template and replace the TURN hostname and username. Configure all three ICE URL entries: STUN, TURN over UDP, and TURN over TCP. Credentials reference aicc-turn. Match the transports and ports to the relay; where TCP is unavailable, use the supported UDP URL for the third entry as described by the package.
This walkthrough uses Helm environment overrides. Verify the effective settings in Voice logs; do not assume administration settings override deployment values. Use a dedicated TURN account and sufficient relay bandwidth. Its credentials are supplied to browsers for media relay.
6. Run preflight
./scripts/aicc-preflight.sh --values "$VALUES" --namespace "$NAMESPACE" \
--chart-version YOUR_CHART_VERSION
Resolve every [FAIL] and review each [WARN]. Checks cover active placeholders, tags, cluster access, architecture, storage class, ingress class, master key, ECR artifacts, and ACM status. Skipped AWS checks are not passed prerequisites. Preflight does not establish application readiness, capacity, or complete compatibility.
Optionally check database TCP reachability:
./scripts/aicc-preflight.sh --values "$VALUES" --namespace "$NAMESPACE" \
--chart-version YOUR_CHART_VERSION --db your-db-host:5432
With --db, preflight creates and removes a diagnostic Pod using the mirrored Redis image. It needs permission to create, attach to, and delete the Pod. This verifies TCP reachability, not credentials or schema permissions.
7. Install and configure DNS
./scripts/aicc-eks.sh install --values "$VALUES" \
--namespace "$NAMESPACE" --release "$RELEASE" \
--chart-version YOUR_CHART_VERSION --dry-run
Review the output, then repeat without --dry-run. The script runs preflight, requests confirmation, authenticates Helm to ECR, and waits for workloads; the default timeout is 15 minutes. Dry-run output may include Secrets: protect it. A rehearsal still performs read checks and registry authentication.
kubectl -n "$NAMESPACE" get ingress "$RELEASE"
Point the hostname to the ALB address using a suitable DNS alias or CNAME. Check the ingress scheme, certificate, and security groups, then test HTTPS from an authorized network.
8. Complete first-run setup
Open the HTTPS hostname and complete the wizard:
- Choose PostgreSQL, the baseline for this guide. The product also supports SQL Server with release-specific configuration guidance.
- Enter a cluster-reachable database endpoint, port, name, and credentials. Never use
localhost. Use lowercase names; the wizard normalizes names to lowercase with underscores. - Use an account permitted to initialize and modify the schema. It can create a missing database when granted the necessary rights; otherwise supply an empty database with the required ownership.
- Create the initial administrator and activate the environment's license.
The wizard writes encrypted configuration to /aicc/data/appsettings.json; services consume it without a routine manual restart. Primary database credentials are not Helm values. Before setup, /api/setup/status may return HTTP 400; use the wizard to establish setup status rather than treating that response alone as failure.
9. Verify and promote
./scripts/aicc-eks.sh status --namespace "$NAMESPACE" --release "$RELEASE"
Complete the verification checklist, take configuration/database backups, and record Staging acceptance. Deploy the same approved artifacts to Production with independent configuration, databases, storage, Secrets, and licensing. Complete Production setup and acceptance before opening it for use.
Use Enterprise Operations for subsequent changes and Troubleshooting for failed checks.