Deployment

To install OpenLM Platform on a single virtual machine, run one script on a clean RHEL-family operating system. The script handles K3s installation, database provisioning, schema initialization, Kafka topic creation, and OpenLM Platform service deployment automatically.

Before you start, complete everything in Requirements.

What the script does

The installer runs an Ansible playbook that:

1. Verifies prerequisites (operating system family, RAM, CPU).
2. Installs and configures firewalld, opening the Kubernetes API port (6443).
3. Installs K3s as a lightweight Kubernetes environment, with Traefik as the ingress controller.
4. Creates the cluster namespaces, stores your TLS certificate as a Kubernetes secret, and loads the same certificate into an in-cluster trust bundle mounted by every service.
5. Deploys the infrastructure services: Redis, Kafka, MongoDB, and the operational and reporting databases.
6. Initializes the operational database schema, and the reporting schema when the reporting database is the bundled PostgreSQL.
7. Creates the Kafka topics required by OpenLM Platform.
8. Deploys the OpenLM API gateway and the OpenLM Platform services.

Note

Step 6 applies the reporting schema scripts only to the bundled PostgreSQL. If you configured an external SQL Server for reporting, you must create that schema yourself. See Configuration reference.

The install takes 20 to 40 minutes, mostly for the first container image pulls.

Deployment steps

To install OpenLM Platform on the VM, complete the following sections in order.

Download the deployment package

Get the release archive directly from OpenLM: Platform as VM deployment package. The filename follows the pattern platform-as-vm-<date>-<commit>.zip, where <date> is the build date and <commit> the source revision.

Version-specific link

That link points at one specific build, and no "latest" alias exists. Contact OpenLM to confirm you are installing the current release before you deploy, and to obtain the release notes for it. Upgrades work by obtaining a newer bundle and re-running the installer, so keep track of which build you deployed.

Unzip it on your workstation by running this command:

unzip platform-as-vm-*.zip

This produces a platform-as-vm/ directory containing the installer scripts, Helm charts, Ansible playbook, and database schemas.

(Optional) Print the archive's SHA-256 checksum so you can confirm it with OpenLM before installing:

sha256sum platform-as-vm-*.zip

Transfer the deployment package

Copy the unzipped platform-as-vm/ directory to the target VM:

scp -r platform-as-vm/ <user>@<vm-ip>:~/

Place the TLS certificate

SSH into the VM and put your certificate and key at the paths you set in config.yaml. The default locations are:

sudo mkdir -p /etc/openlm/certs
sudo cp tls.crt /etc/openlm/certs/tls.crt
sudo cp tls.key /etc/openlm/certs/tls.key
sudo chmod 600 /etc/openlm/certs/tls.key

You can store the files anywhere. Update the corresponding paths in config.yaml.

Edit the configuration file

Open ~/platform-as-vm/config.yaml and set the three required fields:

openlm_system_domain: "openlm.yourcompany.com"        # Your OpenLM FQDN
tls_cert_path:        "/etc/openlm/certs/tls.crt"    # Path to the TLS certificate
tls_key_path:         "/etc/openlm/certs/tls.key"    # Path to the TLS private key

Every other field has a default that works for a single-VM deployment. See the Configuration reference for advanced patterns such as external SQL Server, external Kafka, or air-gapped installations.

Edit the passwords file

Open ~/platform-as-vm/passwords.yaml and set strong passwords for the three bundled databases:

postgres_password:     "<postgres-password>"
mariadb_root_password: "<mariadb-password>"
mongodb_root_password: "<mongodb-password>"

Replace each placeholder with a strong, different password for that database.

Warning

These passwords are set when the databases are initialized. Changing them in passwords.yaml after the first install doesn't update the running databases. Treat them as one-time-set values and rotate them later with each database's own commands.

Run the installer

From inside the deployment directory, run these commands:

cd ~/platform-as-vm
chmod +x entrypoint.sh
./entrypoint.sh

The script prompts for your sudo password twice:

1. Immediately, when it updates OS packages and installs Python.
2. Again when the Ansible playbook starts, as a separate BECOME password: prompt. This can be several minutes later, after the package, pip, and Helm installs finish.

Stay at the terminal until the playbook is running. After the second prompt it runs end-to-end without further input.

If the installer fails partway through, fix the cause and run ./entrypoint.sh again. You can run the playbook again safely: it re-checks every step and skips the work already done rather than starting over. It does not resume from a saved position, so expect the early steps to be re-evaluated (quickly) on each run.

Verify the deployment

To confirm the deployment succeeded, check the pods and Helm releases, open OpenLM Platform, and sign in.

Check pods

Run this command:

kubectl get pods -A

Each namespace shows:

• kube-system: All pods Running (CoreDNS, Traefik, metrics-server, local-path-provisioner).
• openlm-infrastructure: All pods Running (Redis, Kafka, MongoDB, MariaDB, PostgreSQL).
• openlm: About 100 pods, most Running. A handful might stay in Init or ContainerCreating for a few minutes after the installer exits. This is normal while services pull images and wait for their dependencies.

If pods stay in CrashLoopBackOff after 15 minutes, see Troubleshooting.

Check Helm releases

Run this command:

helm list -A

The command lists 7 releases, each with STATUS: deployed:

Namespace	Releases
openlm-infrastructure	redis, mariadb, mongodb, postgres, kafka
openlm	openlm-gateway, openlm-platform

Fewer releases than this, or any release not in deployed state, means a step failed. See Troubleshooting.

Open OpenLM Platform

Open https://<your-domain>/ in a browser. The OpenLM Platform sign-in page opens.

If you see a browser TLS warning, your certificate is self-signed or from a CA the browser does not trust. That is expected for those cases.

Sign in for the first time

Reaching the sign-in page means the deployment succeeded, but you can't sign in yet. The installer deploys OpenLM Platform without creating any users or roles, and it sets no default administrator password. The OpenLM identity service handles authentication entirely.

To get from the sign-in page to a working OpenLM Platform:

1. Contact OpenLM for the initial administrator credentials for your deployment.
2. Configure the identity service for your organization.
3. Create your own users and roles from the OpenLM Platform administration UI.

To federate against Active Directory, LDAP, or an SSO provider, see OpenLM Identity Service configuration guides.

(Optional) Connect Power BI to the reporting database

To connect Power BI or another BI tool to the reporting database:

Setting	Value
Server	<vm-ip-or-fqdn>:30432
Database	openlm_reporting_db
Username	postgres
Password	The postgres_password you set in passwords.yaml

In Power BI Desktop, select Get Data, then PostgreSQL database, enter the server and database, then provide the credentials.

What's next

To continue, use these pages:

• Operations: Health checks, logs, backups, and upgrades.
• Configuration reference: External SQL Server, external Kafka, and other patterns.
• Troubleshooting: The most common problems and how to fix them.