Skip to content

Helm chart
Version oop-platform 2.0.0 (tag v2.0.0-release, 2026-10-23)
Repository oop/deploy/helm
Changes v1.0.0-release...v2.0.0-release

oop-platform is the umbrella Helm chart that deploys the whole of OpenOP, together with the platform services the components depend on: PostgreSQL, Keycloak and NATS.

Not for production

The chart is a reference deployment for kind, meant for development, integration testing and demos.

New in this release

Subchart Chart version Runs Default
oeg 2.0.0 OEG 2.0.0 on
srm 2.0.0 SRM 2.0.0 on
federation-manager 2.0.0 FM 2.0.0 on, needs login
ai2 2.0.0 AI² 2.0.0 and Redis on
portal 2.0.0 Portal 2.0.0 on
keycloak 1.0.0 Keycloak 26.7.3 on, needs login
postgresql 1.0.0 PostgreSQL 18.6 on
nats (upstream) 1.2.10 NATS 2.10.29 on
datalab 0.1.0 Data Lab 0.1.0 off
  • One PostgreSQL with a database and a role per component. Passwords are generated on first install and kept across upgrades, and a NetworkPolicy admits only labelled clients.
  • Keycloak with three realms: oop (Portal users, App Providers and OEG, with the roles app-provider, operator and platform-admin and the API products), federation (FM partners) and dataspace (Data Lab, optional). A first platform-admin user, oop-admin, sets a new password at first login.
  • NATS from the official chart, with JetStream on a 2 Gi file store for FM.
  • Encryption keys for OEG (oegcontroller-keys) and FM (federation-manager-keys), generated on first install and kept on upgrade and helm uninstall.
  • SRM reads one TF-SDK bootstrap, with its credentials mounted from Secrets.
  • Public address. global.publicHost is detected from the first node when it is not set, and scripts/helm-deploy.sh prints the access URLs.

To install, follow Deploy with Helm.

Breaking changes

  • No in-place upgrade from 1.x. MongoDB and the artefact manager are removed and nothing is migrated. Follow Upgrading from 1.x in the README.
  • New values layout. federationManager is now federation-manager, and the new sections are postgresql, keycloak, datalab, databus and nats.
  • SRM deploys nothing until it is configured. Set srm.topology (a complete bootstrap document) and workloads.namespaces.
  • New kind cluster definition. Recreate the kind cluster.
  • Login is on by default. global.auth.enabled=false is accepted only when global.publicHost is localhost or 127.0.0.1.

Upgrade notes

  • Back up the postgres-credentials, keycloak-credentials, oegcontroller-keys and federation-manager-keys Secrets together with the PostgreSQL volume.
  • Choose the PostgreSQL volume size and storage class before the first install; they cannot change in place.
  • Changing global.publicHost later does not update the redirect URLs already stored in realm oop.

Known limitations

  • No ingress. Keycloak (30081), the Portal (30082) and the Data Lab (30083) get NodePorts; the kind environment adds NodePorts for the other services.
  • The Data Lab hub and search APIs are not reachable from outside the cluster.
  • PostgreSQL is single-node and takes no backups.