c8 is split into an install-time Helm layer and a runtime operator layer. The charts create the API, custom resource, controllers, worker roles, security policy and scaling objects. PostgreSQL, S3-compatible object storage, image registry, secret management, ingress/Gateway, service-mesh TLS and node provisioning remain infrastructure dependencies.

kubectl create namespace c8

# Examples only: source values from your external secret manager in production.
kubectl -n c8 create secret generic c8-database   --from-literal=DATABASE_URL='postgres://<user>:<password>@<private-host>/<database>'
kubectl -n c8 create secret generic c8-object-store   --from-literal=AWS_ACCESS_KEY_ID='<id>'   --from-literal=AWS_SECRET_ACCESS_KEY='<secret>'
kubectl -n c8 create secret generic c8-auth-tokens   --from-file=tokens.json=./approved-tokens.json
kubectl -n c8 create secret generic c8-tenant-admission   --from-file=policy.json=./approved-tenant-policy.json
kubectl -n c8 create secret tls c8-internal-tls   --cert=./tls.crt --key=./tls.key

Calculate the token and tenant-policy SHA-256 values from the exact mounted bytes. On EKS, AKS and GKE, prefer provider workload identity over long-lived object-store keys when the selected S3-compatible client path supports it.

approved-platform-values.yaml

images:
  api: { repository: registry.example.com/c8/api, digest: sha256:<digest> }
  operator: { repository: registry.example.com/c8/operator, digest: sha256:<digest> }
  distributedOperator: { repository: registry.example.com/c8/distributed-operator, digest: sha256:<digest> }
  distributedWorker: { repository: registry.example.com/c8/distributed-worker, digest: sha256:<digest> }
  referenceWorker: { repository: registry.example.com/c8/reference-worker, digest: sha256:<digest> }
  catalogMigrator: { repository: registry.example.com/c8/catalog-migrator, digest: sha256:<digest> }

dependencies:
  databaseSecret: c8-database
  authTokensSecret: c8-auth-tokens
  objectStoreCredentialsSecret: c8-object-store

artifactStore:
  baseUrl: s3://c8-artifacts/prod

batchScheduling:
  localQueue: ngkg-batch

api:
  replicas: 3
  authTokensFileSha256: <64-lowercase-hex>
  autoscaling:
    enabled: true
    minReplicas: 3
    maxReplicas: 12

approved-workloads-values.yaml

platform:
  kubernetesDistribution: generic # use rke2 only with the checked-in RKE2 profile

images:
  query: { repository: registry.example.com/c8/online, digest: sha256:<digest> }
  fragment: { repository: registry.example.com/c8/online, digest: sha256:<digest> }
  locator: { repository: registry.example.com/c8/online, digest: sha256:<digest> }
  hydration: { repository: registry.example.com/c8/online, digest: sha256:<digest> }
  reasoner: { repository: registry.example.com/c8/reasoner, digest: sha256:<digest> }

tls:
  existingSecret: c8-internal-tls

onlineServing:
  databaseSecret: c8-database
  authTokensSecret: c8-auth-tokens
  authTokensFileSha256: <64-lowercase-hex>
  tenantAdmissionSecret: c8-tenant-admission
  tenantAdmissionPolicySha256: <64-lowercase-hex>
  objectStoreCredentialsSecret: c8-object-store
  artifactStoreBaseUrl: s3://c8-artifacts/prod
  queryTimeoutSeconds: "120"
  maxQueryResultRows: "1000000"
  propertyPathHotVertexDegree: "100000"
  propertyPathMaxHotVertexSplits: "64"

onlineReasoning:
  enabled: true
  sharedWorkspaceClaim: c8-reasoner-work
  sharedTokenSecret: c8-reasoner-token
  adapterSha256: <sha256-of-ngkg-hermit-adapter.jar>

hpcRuntime:
  guaranteedQos: true
  nodeSaturationTargetPercent: 80
  cpuManagerPolicyRequired: static
  topologyManagerPolicyRequired: restricted
  memoryManagerPolicyRequired: Static
  nestedParallelism: false
  localNvme: { requiredForSpill: true }

networking:
  externalApi: gateway-api
  tlsMode: external-service-mesh-required
  defaultDenyNetworkPolicies: true
  dependencyCidrs:
    - 10.40.0.0/24 # private PostgreSQL
    - 10.41.0.0/24 # private S3/MinIO

# Static validation
python3 scripts/validate_helm_values.py   charts/ngkg-workloads/values.yaml   --overlay approved-workloads-values.yaml
helm lint charts/ngkg-crds
helm lint charts/ngkg-platform -f approved-platform-values.yaml
helm lint charts/ngkg-workloads -f approved-workloads-values.yaml

# Render for review
helm template c8-crds charts/ngkg-crds --namespace c8 > rendered-crds.yaml
helm template c8-platform charts/ngkg-platform --namespace c8   -f approved-platform-values.yaml > rendered-platform.yaml
helm template c8-workloads charts/ngkg-workloads --namespace c8   -f approved-workloads-values.yaml > rendered-workloads.yaml

# Install in order
helm upgrade --install c8-crds charts/ngkg-crds   --namespace c8 --create-namespace
helm upgrade --install c8-platform charts/ngkg-platform   --namespace c8 -f approved-platform-values.yaml --wait --rollback-on-failure
helm upgrade --install c8-workloads charts/ngkg-workloads   --namespace c8 -f approved-workloads-values.yaml --wait --rollback-on-failure

For RKE2, insert -f charts/ngkg-workloads/profiles/rke2.yaml before the approved workload overlay. Add profiles/production-workload-autoscaling.yaml only after the custom metrics API is installed and verified.

1. 01Run at least three API and query-coordinator replicas across failure domains.
2. 02Use required anti-affinity so new responsibility replicas create honest node-pool demand.
3. 03Keep PostgreSQL and S3-compatible artifacts highly available and independently backed up.
4. 04Let HPA scale online roles, operators create batch Jobs and Kueue admit batch capacity.
5. 05Let the provider autoscaler add only nodes whose labels, taints and resources match the pending pod.
6. 06Block scale-in until query ownership, spill, frontier and checkpoint work drains safely.
7. 07Use PodDisruptionBudgets and multi-zone topology without weakening completion barriers.
8. 08Prove identical answers during pod replacement, node replacement and replica-count changes.

kubectl get crd ngkgcompilations.ngkg.io
kubectl -n c8 get deploy,sts,pod,job
kubectl -n c8 get serviceaccount,role,rolebinding
kubectl -n c8 get hpa,pdb,networkpolicy
kubectl get nodes -L ngkg.io/workload,topology.kubernetes.io/zone
kubectl -n c8 logs deploy/c8-platform-ngkg-operator --since=10m
kubectl -n c8 logs deploy/c8-platform-ngkg-distributed-operator --since=10m

# Create or ingest through the c8 API, then observe reconciliation
kubectl -n c8 get ngkgcompilations -w
kubectl -n c8 describe ngkgcompilation <name>

A healthy install is not a production qualification. Exercise an actual compilation, HPA scale event, matching node-pool expansion, worker replacement, complete partition barrier and deterministic query result.

# Inspect current releases and render the proposed change
helm -n c8 list
helm -n c8 history c8-platform
helm template c8-platform charts/ngkg-platform -n c8   -f approved-platform-values.yaml > proposed-platform.yaml

# Upgrade workloads after CRD/platform compatibility review
helm upgrade c8-platform charts/ngkg-platform -n c8   -f approved-platform-values.yaml --wait --rollback-on-failure
helm upgrade c8-workloads charts/ngkg-workloads -n c8   -f approved-workloads-values.yaml --wait --rollback-on-failure

# Roll back application charts; CRDs require their own reviewed procedure
helm rollback c8-workloads <revision> -n c8 --wait
helm rollback c8-platform <revision> -n c8 --wait

# Uninstall does not delete PostgreSQL, object artifacts or CRDs automatically
helm uninstall c8-workloads -n c8
helm uninstall c8-platform -n c8
helm uninstall c8-crds -n c8

• Native Cargo format/build/Clippy/workspace tests and Maven HermiT tests.
• Helm lint plus deterministic render, install, upgrade, rollback and uninstall gates.
• Live distributed algebra/property-path transport and adjacency activation with scalar equality.
• Provider-specific EKS, AKS, GKE, K3s and on-prem overlays checked into the repository.
• Multinode chaos, autoscaling, NVMe pressure, backup/restore, rolling upgrade and sustained soak.
• SBOM, licenses, CVE scans, signed images and reproducible offline release evidence.