# Moving to Kubernetes

> Goal: the same contract, in a cluster, in one command - with nothing installed beforehand.

Guide - Since version 0.1.0 - Flexway v1.6.3 - https://flexway.io/en/docs/operations-kubernetes/

> Operations guide: configure, deploy and observe the gateway. What the capability does, product side: [product guide](https://flexway.io/en/docs/product-overview/); calling it: [developer guide](https://flexway.io/en/docs/developer-overview/).

**Goal**: the same contract, in a cluster, in one command - with nothing installed beforehand.

**Command** (short path: a contract, an upstream URL)

```bash
helm install orders oci://ghcr.io/flexwiz/charts/flexway --version <version> \
  --set-file openapi=examples/rest-minimal/openapi.yaml \
  --set upstream=http://orders.internal:8080
```

Full path: the whole `flexway.yaml` as `config`, the files it names as `contracts`.

```yaml
# values.yaml
config:
  version: 1
  contracts: { openapi: ./orders.yaml }
  upstreams:
    default: { url: "http://orders.internal:8080" }
contracts:
  orders.yaml: |
    openapi: 3.1.0
    ...
secretMounts:
  - name: llm-keys          # read as file:/etc/flexway-secrets/llm-keys/<key>
```

```bash
helm install orders oci://ghcr.io/flexwiz/charts/flexway --version <version> -f values.yaml
```

**Check**

```bash
kubectl port-forward svc/orders-flexway 8080:8080 &
curl -i http://localhost:8080/orders          # relayed to the upstream
curl -i http://localhost:8080/nope            # 404: closed by default
kubectl port-forward svc/orders-flexway-admin 9090:9090 &
curl -s http://localhost:9090/readyz          # {"status":"ready","operations":3}
```

> **`/readyz` green** means: contract loaded, routes, chains, expressions and **validation schemas
> compiled** for every mode - no compilation waits for the first request (`1.6.0`). It does not
> say that an upstream connection is open (the first request to an upstream opens it: DNS, TCP, TLS)
> nor that an OIDC issuer's keys are read yet (discovery runs in the background).

> **Without a contract, the install fails** in the terminal, with the command to type - never a pod
> that does not start.

> The contract and the configuration are one `ConfigMap` mounted as a directory: a `helm upgrade`
> with a changed contract is served **without a restart** ([Changing the configuration without a restart](https://flexway.io/en/docs/operations-live-config/)). Secrets are `Secret`s the chart
> does not create. The admin port has a `Service` of its own, `ClusterIP`: never expose it. The core
> requires nothing Kubernetes-specific: the same file runs on a VM.

cluster, ready in 5 s. While the image is private, add `imagePullSecrets`.*