On-Premise Deployment
On-Premise Deployment
Koku can be deployed on-premise using the cost-onprem-chart Helm chart. This provides a fully self-contained deployment where all data stays inside the operator’s perimeter — no external SaaS dependencies.
Prerequisites
- OpenShift 4.18+ (or compatible Kubernetes with appropriate CRDs)
- S3-compatible object storage (OpenShift Data Foundation, AWS S3, MinIO, or other)
- Kafka / AMQ Streams for message brokering
- Helm 3
Quick Start
The chart can be installed directly from the Helm repository:
helm repo add cost-mgmt https://project-koku.github.io/cost-onprem-chart
helm repo update
helm install cost-mgmt cost-mgmt/cost-managementOr clone the repository for local customization:
git clone https://github.com/project-koku/cost-onprem-chart.git
cd cost-onprem-chart
helm install cost-mgmt ./charts/cost-managementWhat Gets Deployed
The Helm chart deploys the full Koku stack:
| Component | Purpose |
|---|---|
| Koku API | REST API server (Django) |
| Masu / Workers | Data pipeline and Celery workers |
| PostgreSQL | Multi-tenant database |
| Valkey (Redis) | Cache and Celery broker |
| Kafka (AMQ Streams) | Event streaming |
| Envoy Gateway | API gateway and ingress |
| Sources API | Provider source management |
| koku-ui | Web frontend |
Optionally, the chart can also deploy:
- Resource Optimization Service (ROS) with Kruize integration
- Keycloak for JWT-based authentication
Key Configuration
Authentication, storage, and resource sizing are configured through Helm values. See the chart documentation for the full list of configurable parameters.
Important areas to configure:
- S3 storage — endpoint, bucket names, and credentials
- Authentication — JWT/Keycloak configuration for secure API access
- Resource limits — CPU and memory requests/limits for each component
- Network policies — Security boundaries between components
Collecting OpenShift Metrics
To meter OpenShift clusters, install the koku-metrics-operator on each cluster you want to monitor. The operator collects Prometheus metrics and uploads them to the Koku ingress endpoint.