Wexa Fabric

WEXA FABRIC ON AMAZON EKS - INSTALLATION

Fabric installs into your existing EKS cluster with Helm. Do the steps in order: prerequisites, storage, IAM, license, install, DNS, verify.

STEP 1 - PREREQUISITES

Tools:

• Amazon EKS cluster
• kubectl, Helm v3.19+, AWS CLI v2
• IAM permission to create roles and policies
• Your AWS Account ID
• An S3 bucket for Knowledge Base files

Cluster add-ons:

• OIDC provider enabled (IRSA)
• AWS Load Balancer Controller
• Amazon EBS CSI Driver
• A default StorageClass
• About 160 GiB of persistent storage

Nodes:

• 7x m6i.xlarge or larger for general workloads
• 1x c6i.16xlarge or larger, dedicated to CognoDB

STEP 2 - STORAGE

Skip this if you already have a default StorageClass. Otherwise save the following as storageclass.yaml:

apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: gp3 annotations: storageclass.kubernetes.io/is-default-class: "true" provisioner: ebs.csi.aws.com volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true reclaimPolicy: Delete parameters: type: gp3 encrypted: "true"

Apply it:

kubectl apply -f storageclass.yaml

STEP 3 - IAM ROLES (IRSA)

Create 4 IRSA roles, one per service account:

• fabric-license-gate license-manager:CheckoutLicense, CheckInLicense

• fabric-litellm bedrock:InvokeModel, InvokeModelWithResponseStream, Converse, ConverseStream, ListFoundationModels

• fabric-data-service secretsmanager:CreateSecret, DescribeSecret, GetSecretValue, PutSecretValue, UpdateSecret, DeleteSecret S3 read/write limited to your Knowledge Base bucket

• kube-system/aws-load-balancer-controller Standard AWS Load Balancer Controller IAM policy

STEP 4 - LICENSE

Email support@wexa.ai  with your AWS Account ID, company name and number of seats. You will receive a Grant ARN and a License ARN.

Accept the grant:

aws license-manager accept-grant --grant-arn <GRANT_ARN> --region us-east-1

Activate it:

aws license-manager create-grant-version --grant-arn <GRANT_ARN> --status ACTIVE --client-token "$(uuidgen)" --region us-east-1

The grant must be ACTIVE before you install.

STEP 5 - INSTALL

Log in to the registry:

aws ecr get-login-password --region us-east-1 | helm registry login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com

Install. Replace <AWS_ACCOUNT_ID>, <LICENSE_ARN>, <KB_BUCKET_NAME> and fabric.yourcompany.com with your values:

helm install fabric oci://709825985650.dkr.ecr.us-east-1.amazonaws.com/wexa-ai/fabric
--version 1.0.7
--namespace fabric --create-namespace
--set ingress.host=fabric.yourcompany.com
--set license.licenseArn="<LICENSE_ARN>"
--set services.license-gate.serviceAccount.annotations."eks.amazonaws.com/role-arn"="arn:aws:iam::<AWS_ACCOUNT_ID>:role/fabric-license-manager-irsa"
--set services.litellm.serviceAccount.annotations."eks.amazonaws.com/role-arn"="arn:aws:iam::<AWS_ACCOUNT_ID>:role/fabric-bedrock-irsa"
--set services.data-service.serviceAccount.annotations."eks.amazonaws.com/role-arn"="arn:aws:iam::<AWS_ACCOUNT_ID>:role/fabric-data-service-secrets-irsa"
--set aws.s3BucketName="<KB_BUCKET_NAME>"
--timeout 15m

STEP 6 - DNS

Get the ALB hostname:

kubectl -n fabric get ingress fabric

Create a DNS record for your ingress host pointing at that ALB.

STEP 7 - VERIFY

kubectl -n fabric get pods

App pods should be Running. Install Jobs showing Completed is normal.

If a pod stays Pending:

kubectl -n fabric describe pod <POD_NAME>

Usual causes: no default StorageClass, EBS CSI Driver missing, not enough node capacity, CognoDB node misconfigured, or IRSA permissions missing.

SUPPORT

Email support@wexa.ai  with the output of: kubectl -n fabric get pods helm status fabric -n fabric