Getting the Images and Helm Chart

The Enterprise Development Kit Deployment repository uses published images only. The public customer deployment surface is the deployment repository: Compose, Helm, gateway examples, Postman, and provisioning scripts.

The enterprise service images are published as:

• nexus.sphereon.com/edk-docker/enterprise-platform
• nexus.sphereon.com/edk-docker/enterprise-tenant-kms
• nexus.sphereon.com/edk-docker/enterprise-did
• nexus.sphereon.com/edk-docker/enterprise-tenant-as
• nexus.sphereon.com/edk-docker/enterprise-wallet-unit
• nexus.sphereon.com/edk-docker/enterprise-wallet-interaction
• nexus.sphereon.com/edk-docker/enterprise-issuer
• nexus.sphereon.com/edk-docker/enterprise-verifier
• nexus.sphereon.com/edk-docker/admin-console

The eight native service images run as a non-root user, expose REST on port 8080 unless documented otherwise, and read their configuration from mounted YAML and environment variables. The admin-console image is a Next.js server on port 3000 and is routed at /admin-console on the platform host. Database credentials, JWT issuers, license material, and public hostnames are never baked into the images.

note

The default enterprise distribution uses the private Nexus Docker repository nexus.sphereon.com/edk-docker and Helm repository https://nexus.sphereon.com/repository/edk-helm. Your OEM, MSP, or EDK distributor may provide mirrored coordinates and supplies the corresponding credentials through its delivery channel.

Installing with Helm

The edk-enterprise chart is published from https://nexus.sphereon.com/repository/edk-helm and deploys the platform, tenant runtime services, and admin console with hardened defaults: non-root pods, read-only root filesystems, network policies, and a gateway route set that exposes only platform.<base-domain> and <tenant>.<base-domain> as customer endpoints. Workload container hosts, health routes, and gRPC ports stay private to the cluster.

kubectl create namespace edk

kubectl -n edk create secret docker-registry edk-registry-credentials \
  --docker-server=nexus.sphereon.com \
  --docker-username=<username> --docker-password=<token>

kubectl -n edk create secret generic edk-platform-postgres \
  --from-literal=username=<platform-db-user> --from-literal=password=<platform-db-password>

kubectl -n edk create secret generic edk-tenant-postgres \
  --from-literal=username=<tenant-db-user> --from-literal=password=<tenant-db-password>

kubectl -n edk create secret generic edk-runtime-secrets \
  --from-literal=internal-client-secret='<long-random-confidential-client-secret>' \
  --from-literal=keystore-password='<long-random-pkcs12-password>'

helm repo add edk-helm https://nexus.sphereon.com/repository/edk-helm --username <username> --password <token>

helm upgrade --install edk edk-helm/edk-enterprise \
  --namespace edk \
  --set global.imageTag=<enterprise-version> \
  --set 'global.imagePullSecrets[0]=edk-registry-credentials' \
  --set global.platformBaseDomain=<base-domain> \
  --set platform.externalBaseUrl=https://platform.<base-domain> \
  --set platform.bootstrap.issuer=https://platform.<base-domain> \
  --set platform.bootstrap.owner.email=<operator-email> \
  --set database.platform.host=<platform-postgres-host> \
  --set database.platform.name=<platform-db-name> \
  --set database.platform.existingSecret=edk-platform-postgres \
  --set database.tenant.host=<tenant-postgres-host> \
  --set database.tenant.name=<tenant-db-name> \
  --set database.tenant.existingSecret=edk-tenant-postgres \
  --set database.tenant.isolation=schema \
  --set database.tenant.schemaPattern='tenant_{id}' \
  --set serviceIdentity.internalClientExistingSecret=edk-runtime-secrets \
  --set keystore.existingSecret=edk-runtime-secrets

The chart does not deploy PostgreSQL or generate runtime credentials. Point it at a platform database for the platform service and a tenant workload database for tenant-KMS, DID, tenant-AS, wallet-unit, wallet-interaction, issuer, and verifier. The tenant workload database uses one schema per tenant by default. Generate the two runtime Secret values independently with at least 32 random bytes each and keep them out of values files and Git. Example values files in the deployment repository cover external managed Postgres, JWT service authentication, mesh mTLS, and OpenTelemetry export.

The chart rejects an empty runtime Secret reference while rendering. Kubernetes checks the referenced object and keys when containers start: a missing object produces CreateContainerConfigError: secret ... not found, while an empty or incorrect object reports a missing internal-client-secret or keystore-password key.

Once the pods report ready, continue with platform onboarding. After first run completes and the license is active, operators sign in at https://platform.<base-domain>/admin-console.