Deployment steps

us-east-1

1. Unpackage the archive file

1. Before you download the required scripts and packaging, install the ORAS command line interface (CLI).
2. Sign in to the private container registry using your provided credentials:

   $ oras login uccmpprivatecloud.azurecr.io
   Username: 
      Token:

3. To list the available releases, run this command:

   oras repo tags uccmpprivatecloud.azurecr.io/releases/aws-configuration

4. To pull a specific release, run the following command, which pulls the release package:

   oras pull uccmpprivatecloud.azurecr.io/releases/aws-configuration:2025.13.100

5. Check that the following package is in your file system:

   unity-private-cloud-aws-2025.13.100.tar.gz

6. To create the following directory, run this command:

   mkdir asset-solutions-private-cloud

7. Run this command:

   tar -xvzf unity-private-cloud-aws-*.tar.gz -C asset-solutions-private-cloud

   This directory contains all scripts and configurattion:

   ./asset-solutions-private-cloud

   .

2. Set up a Terraform backend

1. To set up the Terraform backend, run this command:

   $ ./aws/.scripts/setup-terraform-backend.sh

   When prompted, enter an AWS region—for example,

   us-east-1

   —and then press Enter. This script provisions a backend in your AWS account that uses both S3 and DynamoDB to restore state and state locks respectively.
2. Make a note of the backend output:

   Use the following bucket name and region for the Terraform backend configuration (store this in 'aws/terraform/backends/us-east-1.tfvars').
   
   bucket         = "terraform-state-asset-solutions-633a7c"
   dynamodb_table = "terraform-state-lock-633a7c"
   key            = "infra.tfstate"
   region         = "us-east-1"

3. Create the backend file at the location that is specified in the output.
4. Copy the variables from this output to the new backend file.

3. Provision resources with Terraform

3.1 Set the Terraform variables

variables.tf

1. Set the following required variables. The recommended practice is to customize these variables for your own environment, in this directory:

   aws/terraform/tfvars/us-east-1.tfvars

   Set these variables:

   region = "us-east-1"
   vpc_id = "vpc-<YOUR_VPC_ID>"
   
   private_subnet_ids = [
     "subnet-<YOUR_SUBNET_ID_1>",
     "subnet-<YOUR_SUBNET_ID_2>",
   ]
   
   asset_solutions_domain = "example.com"
   
   keycloak_mini_usf_clientsecret = "<YOUR_KEYCLOAK_CLIENT_SECRET>" # This should be unique
   
   uvcs_url             = "https://plasticscm.example.com:7179"
   uvcs_authorization   = "Bearer <YOUR_UVCS_AUTHORIZATION_TOKEN>"
   uvcs_repository_guid = "<YOUR_REPOSITORY_GUID>"
   
   allowed_ingress_cidrs = [
     "0.0.0.0/0",  
   ]

2. Customize the following command to your preferred region, and then run it:

   $ cd aws/terraform
   $ make init-us-east-1
   $ make apply-us-east-1
   
   Outputs:
   
   aws_secretsmanager_secret_config_name = "asset-solutions/configuration"
   enable_cluster_autoscaler = true
   enable_external_secrets = true
   enable_istio = false
   enable_metrics_server = true
   environment_name = "dev"
   TARGET_DIR is empty. Defaulting to ../argocd/us-east-1:
   
   Merging helm values files...
   Copying generated Helm charts and values to target directory: ../argocd/us-east-1
   
   ✅ Successfully generated Helm charts and values.
   
   Cleaning up temporary files...

3. To view a list of all resources that have been created with Terraform, run this command:

   terraform state list

4. Install the Helm charts

helm

1. Run this command:

   cd aws/terraform
   make helm-upgrade-us-east-1

   This command installs all the necessary Helm charts on the Kubernetes cluster. The Helm charts are generated from the Terraform output and are stored by default in this directory:

   aws/argocd/us-east-1

   .
2. To check the status of the deployments, run this command:

   kubectl get pods --all-namespaces --watch

3. Ensure that all pods eventually move to the Running state.
4. If a pod isn't running, describe it and check its logs to find the issue.

5. Configure the DNS and certificates

1. Register a fully qualified domain name (FQDN) for the frontend, for example,

   example.com

   . By default, the deployment of Traefik creates a Classic Load Balancer in AWS and uses the certificate that is defined in the traefik_certificate_secret_name Terraform variable.
2. If you want to use AWS Certificate Manager to manage certificates, then, to reference an existing certificate, add this Terraform variable:

   traefik_service_annotations = {
     "service.beta.kubernetes.io/aws-load-balancer-ssl-cert" : "arn:aws:acm:us-east-1:555555555555:certificate/16fc5d31-55ad-41b8-86c4-d43bce6bd95a"
   }

Next steps