FerroDruid Container - Rust-native Apache-Druid-compatible OLAP

FerroDruid container on Amazon EKS via Helm (paid Marketplace product).

A. PREREQUISITES

1. Subscribed AWS account; record the Marketplace product code.
2. Amazon EKS cluster (Kubernetes 1.27+); kubectl + Helm v3.8+ (OCI registry).
3. IAM OIDC provider on the cluster + IRSA role granting the pod SA aws-marketplace:RegisterUsage (the chart cannot create the role). Create once: eksctl create iamserviceaccount --cluster <c> --namespace <ns> --name ferrodruid
   --attach-policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringRegisterUsage --approve
4. StorageClass with ReadWriteOnce dynamic provisioning (EBS CSI recommended). Do NOT use EFS/NFS - SQLite POSIX locking is unsafe there.

B. CONFIGURATION Single-binary topology (SQLite metadata + local-FS deep storage). Basic auth (Argon2id) + RBAC on by default. Listens on TCP 8888; auth-exempt /status/health, /status/live, /metrics. Required Helm values: marketplace.productCode (-> env FERRODRUID_MARKETPLACE_PRODUCT_CODE); marketplace.awsRegion (-> env AWS_REGION/AWS_DEFAULT_REGION); serviceAccount.create=true + annotations."eks.amazonaws.com/role-arn"=<IRSA arn>. Defaults: replicaCount=1 (>1 rejected); image.tag=0.2.2; persistence.size=10Gi (RWO, /var/lib/ferrodruid); auth.enabled=true; metrics.enabled=true. Chart fails to render on metadata.driver!=sqlite, deepStorage.type!=local, replicaCount>1, mode!=single-binary. Full values.yaml: github.com/abyo-software/ferrodruid/blob/main/marketplace/helm/charts/ferrodruid/values.yaml

C. DEPLOY - STEP-BY-STEP

1. kubectl create namespace ferrodruid && kubectl config set-context --current --namespace=ferrodruid
2. aws ecr get-login-password --region us-east-1 | helm registry login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com
3. helm install ferrodruid oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/abyo-software/ferrodruid-helm --version 0.2.3
   --set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/abyo-software/ferrodruid --set image.tag=0.2.2
   --set marketplace.productCode=<code> --set marketplace.awsRegion=<region>
   --set serviceAccount.create=true
   --set serviceAccount.annotations."eks.amazonaws.com/role-arn"=arn:aws:iam::<acct>:role/ferrodruid-register-usage
4. kubectl rollout status deploy/ferrodruid --timeout=180s && kubectl logs deploy/ferrodruid
5. Rotate the first-launch admin password (every authenticated endpoint returns 403 until rotated): kubectl logs deploy/ferrodruid | grep -A4 'FIRST-LAUNCH ADMIN' POST /druid-ext/basic-security/authentication/db/basic/users/admin/credential body {"password":"<new>"}

D. VERIFY kubectl port-forward svc/ferrodruid 8888:8888 curl -fsS http://localhost:8888/status/health  curl -fsS -u admin:$PW -X POST http://localhost:8888/druid/v2/sql  -H 'content-type: application/json' -d '{"query":"SELECT 1"}'

E. MONITOR THE APPLICATION Logs (stdout/stderr): collect with Fluent Bit -> Amazon CloudWatch Logs. Metrics: GET /metrics on 8888; scrape with Amazon Managed Service for Prometheus or a Prometheus ServiceMonitor (metrics.serviceMonitor.enabled=true). Kubernetes probes / ALB health: /status/health (readiness), /status/live (liveness). Suggested CloudWatch alarms: pod CrashLoopBackOff (fail-closed RegisterUsage surfaces here), Service/ALB 5xx rate, PVC >80% utilization.

F. UNINSTALL / STOP BILLING helm uninstall ferrodruid && kubectl delete pvc -l app.kubernetes.io/name=ferrodruid Removing the deployment stops all software charges immediately; you can also unsubscribe in the AWS Marketplace console. All commercial transactions and refunds are handled exclusively through AWS Marketplace.

Alternative path (Fargate via CloudFormation): github.com/abyo-software/ferrodruid/blob/main/marketplace/cloudformation/fargate.yaml Full guide: github.com/abyo-software/ferrodruid/blob/main/docs/marketplace/usage/quick-start.md Limitations: github.com/abyo-software/ferrodruid/blob/main/docs/KNOWN_LIMITATIONS.md