Cluster Prerequisites

These components are installed once per cluster, regardless of how many Institutional Vault instances (namespaces) you run. If the cluster already has cert-manager or an ingress controller managed by your platform team, confirm the versions meet the minimums below and skip those steps.

Minimum versions

Step 1: Install cert-manager

cert-manager issues and renews TLS certificates for all Institutional Vault ingresses. It must be installed before mpc-cluster-prereqs because the chart creates cert-manager ClusterIssuer resources.

helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --version v1.14.5 \
  --set crds.enabled=true

Verify all pods are running:

kubectl get pods -n cert-manager

All three pods (cert-manager, cert-manager-cainjector, cert-manager-webhook) should show Running.

Step 2: Install an ingress controller

An ingress controller provisions the load balancer and routes external traffic into the cluster. The mpc chart uses standard Kubernetes Ingress resources, so any controller that implements networking.k8s.io/v1 Ingress will work - set ingress.className in your instance values to match whichever controller you install.

📘

Note:

The community-maintained kubernetes/ingress-nginx project entered security-only maintenance in April 2024 (no new features). It remains widely deployed and functional, but for new clusters the options below are preferable.

Cloud-native options (recommended)

Each cloud offers a natively managed ingress controller that eliminates the need to operate your own:

When using a cloud-native controller, also pass its ingressClassName to mpc-cluster-prereqs:

--set clusterIssuer.ingressClassName=<className>

F5 NGINX Ingress Controller (cloud-agnostic, actively maintained)

For a single cloud-agnostic option across all three platforms, the F5-maintained NGINX Ingress Controller is the actively developed successor to kubernetes/ingress-nginx:

helm repo add nginx-stable https://helm.nginx.com/stable
helm repo update

helm install nginx-ingress nginx-stable/nginx-ingress \
  --namespace nginx-ingress --create-namespace \
  --version 1.3.2 \
  --set controller.ingressClass.name=nginx \
  --set controller.ingressClass.create=true

The load balancer type provisioned differs by cloud:

After install, get the external IP or hostname assigned to the ingress controller:

kubectl get service nginx-ingress-nginx-ingress -n nginx-ingress

The EXTERNAL-IP value is needed when creating DNS records in Step 3.

📘

Note:

The CNCF Gateway API (HTTPRoute / GRPCRoute) is the long-term standard and is GA as of Kubernetes 1.28. The mpc chart currently uses Ingress resources; Gateway API support will require chart changes in a future version.

Step 3: Configure DNS

Every Institutional Vault instance requires DNS A records pointing to the ingress controller's external IP. You can manage these manually or use external-dns to automate them.

Option A: Manual DNS records

Create A records in your DNS provider for each instance host before running helm install. cert-manager's ACME HTTP-01 challenge requires the records to resolve before it can issue a certificate.

Option B: external-dns (recommended)

external-dns watches Kubernetes Ingress resources and automatically creates the corresponding DNS records.

helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/
helm repo update

helm install external-dns external-dns/external-dns \
  --namespace external-dns --create-namespace \
  --version 1.14.4 \
  --set provider=<PROVIDER>

Replace <PROVIDER> with your DNS provider:

Step 4: Install mpc-cluster-prereqs

The mpc-cluster-prereqs chart creates the letsencrypt-prod and letsencrypt-staging ClusterIssuer resources that every Institutional Vault instance's ingress references. Install it once after cert-manager is ready.

Public DNS (Let's Encrypt ACME HTTP-01)

Use this when the cluster's ingress load balancer is publicly reachable:

helm install mpc-cluster-prereqs oci://iv.sepior.net/charts/mpc-cluster-prereqs \
  --version <chart-version> \
  --namespace cert-manager \
  --set [email protected]

Public DNS via DNS-01 (AWS Route53)

Use DNS-01 when the ingress LB is internal (not publicly reachable for ACME HTTP-01 challenge validation):

helm install mpc-cluster-prereqs oci://iv.sepior.net/charts/mpc-cluster-prereqs \
  --version <chart-version> \
  --namespace cert-manager \
  --set [email protected] \
  --set clusterIssuer.solver=dns01 \
  --set clusterIssuer.dns01.provider=route53 \
  --set clusterIssuer.dns01.region=us-east-1 \
  --set clusterIssuer.dns01.hostedZoneID=<HOSTED_ZONE_ID>

cert-manager's ServiceAccount must be annotated with an IAM role that has route53:ChangeResourceRecordSets on the hosted zone.

Public DNS via DNS-01 (GCP Cloud DNS)

helm install mpc-cluster-prereqs oci://iv.sepior.net/charts/mpc-cluster-prereqs \
  --version <chart-version> \
  --namespace cert-manager \
  --set [email protected] \
  --set clusterIssuer.solver=dns01 \
  --set clusterIssuer.dns01.provider=clouddns \
  --set clusterIssuer.dns01.clouddns.project=<GCP_PROJECT>

cert-manager's ServiceAccount must be annotated with a GSA that has roles/dns.admin on the project, via GKE Workload Identity.

Private DNS (self-signed CA)

Use this for clusters with no public internet access:

helm install mpc-cluster-prereqs oci://iv.sepior.net/charts/mpc-cluster-prereqs \
  --version <chart-version> \
  --namespace cert-manager \
  --set clusterIssuer.privateDns=true

Verify the ClusterIssuers are ready:

kubectl get clusterissuer

Both letsencrypt-prod and letsencrypt-staging should show READY: True.

Next steps

With cluster prerequisites in place, proceed to the cloud-specific installation guide for your platform:

• Azure AKS
• AWS EKS
• GCP GKE