Access Manager via Helm

Helm chart installation and version compatibility reference for deploying Access Manager on Kubernetes, including Auth, Identity, and supporting parts.

Access Manager handles authentication, authorization, and identity management across all Lerian products. It includes an Auth service for token management and an Identity service for user and role administration.

What the chart installs

---

The chart installs three Deployments, each with its own Service and ConfigMap:

• Auth: issues and validates tokens.
• Identity: administers users, roles, and permissions.
• Caradhras, the identity backend, under the caradhras values block: holds the users, roles, and permissions that Auth and Identity act on. The chart also runs its schema migration Job, and an optional web UI Deployment. See What is Caradhras.

Auth and Identity each get a Secret. The chart adds an Ingress, a HorizontalPodAutoscaler, and a PodDisruptionBudget per service when you enable each of them.

The chart bundles PostgreSQL and Valkey and enables both by default. Disable either one to use an externally managed service instead.

Prerequisites

---

• Standalone: you can install it independently of Midaz.
• Helm 3.8 or later for OCI registry support. Use a currently supported Kubernetes minor release in production. The chart enables HorizontalPodAutoscaler and PodDisruptionBudget resources, so the cluster must serve autoscaling/v2 and policy/v1.

Values you must set

---

The chart refuses to render without these keys:

Key	Purpose
auth.secrets.AUTHORIZER_CLIENT_SECRET	The Auth service’s credential for Caradhras.
identity.secrets.AUTHORIZER_CLIENT_SECRET	The Identity service’s credential for Caradhras.

Leave the database password empty while the bundled PostgreSQL is enabled. The subchart generates it into its own Secret, and the services read it from there. Set auth.secrets.DB_PASSWORD only when you point the chart at an external database that has no existing Secret of its own.

OCI registry

---

oci://registry-1.docker.io/lerianstudio/plugin-access-manager

Installation

---

Read the current chart version and the application version it deploys before you install:

helm show chart oci://registry-1.docker.io/lerianstudio/plugin-access-manager

helm install access-manager oci://registry-1.docker.io/lerianstudio/plugin-access-manager --version <version> -n access-manager --create-namespace -f my-values.yaml

Override auth.image.tag or identity.image.tag only when your release process requires a different image.

Upgrade and uninstall

---

helm upgrade access-manager oci://registry-1.docker.io/lerianstudio/plugin-access-manager \
  --version <new-version> -n access-manager -f my-values.yaml

helm uninstall access-manager -n access-manager

Uninstalling removes the Kubernetes resources. Check the storage settings of the bundled PostgreSQL and Valkey subcharts before you uninstall, and back up the data you want to keep.

Resources

---

• Access Manager documentation
• Helm chart repository