Infrastructure Requirements
What to provision before you install the Align Helm chart. Nothing here is tied to one cloud.
Quick Checklist
- Kubernetes cluster (1.25+)
- PostgreSQL database (15+) with pgvector extension
- Redis-compatible service (6+), required above one gateway pod
- Ingress controller with TLS
- DNS records for app and API domains
- Container registry access (pull Align images)
- (Optional) GPU node for local LLM inference
Kubernetes Cluster
The chart targets a standard Kubernetes cluster, version 1.25 or newer. That floor is the one we state, not one we have tested.
| Platform | What we can say |
|---|---|
| AWS EKS | Align cloud runs on it |
| k3s | The one-VM pilot installs it. |
| GKE, AKS, on-premises | No recorded install |
Compute Requirements
We have no measured sizing. The only numbers we have are the pilot installer's preflight floors for one machine:
| CPU | Memory | Free disk |
|---|---|---|
| 4 | 7.5 GB | 40 GB |
These are floors, not a recommendation. Treat them as the smallest machine worth trying. A timed install on a clean VM has not been run.
Pod Resource Summary
| Service | Requests (CPU/Mem) | Limits (CPU/Mem) | Replicas |
|---|---|---|---|
| Gateway | 100m / 256Mi | 500m / 512Mi | 1 |
| Brain | 200m / 512Mi | 1000m / 1Gi | 2 |
| UI | 50m / 128Mi | 200m / 256Mi | 2 |
| Connectors (each) | 50m / 128Mi | 200m / 256Mi | 1 |
| Migrations (job) | 50m / 64Mi | 500m / 256Mi | 1 (runs once) |
PostgreSQL Database
Required: PostgreSQL 15+ with the pgvector extension.
For a trial, the chart can run Postgres 16 for you (postgresql.enabled). It is one pod with no backup and no failover. See the install guide.
pgvector is used for semantic search across decisions (embedding similarity). Most managed PostgreSQL services include pgvector:
| Provider | Service | pgvector Support |
|---|---|---|
| AWS | RDS PostgreSQL, Aurora PostgreSQL | Built-in (enable extension) |
| GCP | Cloud SQL for PostgreSQL | Built-in |
| Azure | Azure Database for PostgreSQL Flexible Server | Built-in |
| Self-hosted | PostgreSQL + pgvector | Install via apt/yum or build from source |
Sizing
These are starting points, not measurements.
| Tier | Instance Size | RAM | Storage | Max Connections | Notes |
|---|---|---|---|---|---|
| Minimal | 1 vCPU / 2 GB | 2 GB | 20 GB | ~100 | Single-replica gateway |
| Standard | 2 vCPU / 4 GB | 4 GB | 50 GB | ~150 | Concurrent Discover scans with 3-5 connectors |
| Production | 4 vCPU / 8 GB | 8 GB | 100 GB+ | ~300 | High concurrency, multiple tenants |
Important: Discover scans use parallel workers that consume database connections. See Connection Pooling for tuning guidance. For standard deployments, PgBouncer (included as an optional Helm sidecar) handles connection multiplexing at no extra cost.
Setup
- Create a database named
align(or your preferred name) - Enable the pgvector extension:
CREATE EXTENSION IF NOT EXISTS vector; - Create a Kubernetes secret with connection details:
kubectl create secret generic align-database \
--namespace align \
--from-literal=url="postgresql://user:password@host:5432/align" \
--from-literal=host="your-db-host" \
--from-literal=port="5432" \
--from-literal=username="align" \
--from-literal=password="your-password"
Align runs migrations automatically on install/upgrade.
Redis
Required above one gateway pod. The chart refuses to render without it, unless you set gateway.allowUnsharedSessionStore=true and accept per-pod session revocation. With one pod it is optional, but job state does not survive a restart. Any Redis 6+ compatible service works.
Redis provides:
- Job state - Track progress of Discover scans and bulk operations
- Pub/Sub - Real-time progress streaming (SSE) across gateway pods
| Provider | Service | Notes |
|---|---|---|
| AWS | ElastiCache Redis | Single-node is fine pre-production |
| GCP | Memorystore for Redis | Basic tier sufficient |
| Azure | Azure Cache for Redis | Basic C0 for small teams |
| Self-hosted | Redis, Dragonfly, KeyDB | Any Redis-compatible server |
Sizing
| Tier | Size | Memory | Notes |
|---|---|---|---|
| Minimal | Smallest available | 0.5 GB | Sufficient for job state + pub/sub |
| Standard | Small | 1-3 GB | Handles concurrent scans across connectors |
| Production | Medium + replica | 3+ GB | Multi-AZ for high availability |
Redis usage is lightweight - Align stores job state (small JSON blobs) and uses pub/sub for SSE streaming. A single small node handles most workloads.
Configuration
Provide the Redis URL via secret or direct value:
gateway:
redis:
url: "redis://your-redis:6379"
# Or via Kubernetes secret:
secretName: "align-redis"
secretKey: "url"
Message Queue
Discover scans and bulk operations run on a queue. The gateway picks the backend itself: SQS if you set the queue URLs, otherwise Redis if you configured one. With neither, the gateway in production refuses to start, because the in-memory queue loses work on a pod restart.
| Backend | Survives a pod restart | Configuration |
|---|---|---|
| Redis | Yes | gateway.redis.*. Nothing else |
| AWS SQS | Yes | gateway.sqs.* queue URLs and AWS access |
| In-memory | No | gateway.queue.provider: memory, as a deliberate choice |
See Requirements for the selection rules and delivery guarantees.
Ingress and TLS
Align needs two public endpoints:
| Domain | Service | Purpose |
|---|---|---|
app.yourdomain.com | UI | Web application |
api.yourdomain.com | Gateway | API server, OAuth callbacks, webhooks |
mcp.yourdomain.com (optional) | MCP Connector | AI assistant integration |
Ingress Controller
Any Kubernetes ingress controller works:
| Controller | Notes |
|---|---|
| nginx-ingress | Most common, well-documented |
| Traefik | Built into k3s, lightweight |
| AWS ALB | Native AWS integration |
| GCP Ingress | Native GCP integration |
| Azure Application Gateway | Native Azure integration |
| Istio Gateway | Service mesh environments |
TLS Certificates
Align requires TLS for all endpoints (OAuth callbacks mandate HTTPS). Options:
- cert-manager (recommended) - Automatic Let's Encrypt certificates
- Cloud-managed - ACM (AWS), Google-managed certs, Azure App Gateway
- Manual - Bring your own certificates as Kubernetes TLS secrets
DNS
Create DNS records pointing to your ingress controller's external IP or load balancer:
| Record | Type | Target |
|---|---|---|
app.yourdomain.com | A/CNAME | Ingress LB |
api.yourdomain.com | A/CNAME | Ingress LB |
mcp.yourdomain.com (optional) | A/CNAME | Ingress LB |
Container Registry Access
Align images live in a private AWS ECR registry. We grant pull access to your 12-digit AWS account ID. If you have no AWS account, ask for the offline bundle. These pages write the registry host as $ALIGN_REGISTRY.
Options:
- Pull directly from
$ALIGN_REGISTRY(simplest) - Mirror to your registry (recommended for production and restricted networks)
See Installation - Mirror to Your Registry for mirroring instructions.
GPU Node (Optional)
For local LLM inference instead of cloud API calls. This removes per-token costs for the language model.
When to Add GPU
- You want the language model to run in your cluster. Search still calls OpenAI for embeddings. See Embeddings
- You're running high-volume Discover scans (GPU pays for itself vs API costs)
- You want flat-rate inference costs instead of per-token billing
Hardware Requirements
| GPU | VRAM | Fits Models | Approx. Cost | Notes |
|---|---|---|---|---|
| NVIDIA T4 | 16 GB | Llama 8B, Mistral 7B | ~$380/mo (cloud) | Best value, sufficient for most deployments |
| NVIDIA A10G | 24 GB | Llama 13B, Mixtral 8x7B | ~$660/mo (cloud) | Higher throughput |
| NVIDIA L4 | 24 GB | Same as A10G | ~$500/mo (cloud) | Newer, more efficient |
| NVIDIA A100 | 40-80 GB | Llama 70B | ~$7,000/mo (cloud) | Large models only |
A single NVIDIA T4 running Llama 3.1 8B handles most workloads. You can start without GPU and add it later with no downtime.
Node Setup
GPU nodes need:
- NVIDIA drivers installed (GPU-optimized OS images simplify this)
- NVIDIA container toolkit (for GPU access from containers)
- Node label:
node-type: gpu - Taint:
nvidia.com/gpu=true:NoSchedule(prevents non-GPU pods from scheduling)
Cloud providers offer GPU-ready node images:
- AWS:
al2023-nvidiaAMI family - GCP: Container-Optimized OS with GPU, or Ubuntu with NVIDIA drivers
- Azure: NC-series VMs with NVIDIA drivers pre-installed
- On-premises: Install NVIDIA drivers + container toolkit manually
See LLM Configuration - GPU Inference for Helm configuration after provisioning GPU nodes.
Network Requirements
Outbound Access
Align services need outbound HTTPS access to:
| Destination | Purpose | Required? |
|---|---|---|
| Connector APIs (Slack, GitHub, Jira, Teams, etc.) | Fetch data from connected platforms | Yes (per enabled connector) |
| Cloud LLM APIs (OpenAI, Anthropic) | AI inference (if using cloud providers) | Only if using cloud LLM |
$ALIGN_REGISTRY (issued at onboarding) | Pull container images (if not mirrored) | Only if pulling directly |
| HuggingFace Hub | Download model weights (GPU inference) | Only on first GPU pod start |
| Docker Hub | Bundled Postgres (pgvector/pgvector:pg16), bundled Redis (redis:7-alpine), telemetry jobs (postgres:15-alpine) | Only if you use those |
Mirroring images and pre-downloading model weights removes those pulls. Search still makes one outbound embeddings call. See Network Configuration for proxy and firewall details.
Internal Connectivity
All Align services communicate within the cluster:
UI (3000) ─────► Gateway (8080) ─────► Brain (8090)
│ │
├── Connectors (808x) ├── vLLM (8001, optional)
├── PostgreSQL (5432)
└── Redis (6379)
No special network policies are required by default. Enable networkPolicies.enabled: true in Helm values for restricted environments.
Example: Minimal Infrastructure
The smallest setup we describe is the one-VM pilot: k3s on one VM, with bundled Postgres 16 and Redis (one pod each; the pilot installer adds a nightly dump to a path on the VM, and no failover), Traefik for TLS, and a cloud LLM API. We have not measured what it needs beyond the preflight floors above.
Example: Production Infrastructure
A production-grade deployment for an enterprise team:
| Component | Choice | Approximate Cost |
|---|---|---|
| Kubernetes | Managed (EKS/GKE/AKS), 3 nodes | $200-400/mo |
| PostgreSQL | Managed, 4 GB RAM, multi-AZ | $100-200/mo |
| Redis | Managed, small instance | $30-60/mo |
| GPU Node | NVIDIA T4 (optional) | $380/mo |
| TLS | cert-manager + Let's Encrypt | Free |
| LLM | Local GPU (scans) + Cloud API (synthesis) | ~$50/mo API |
Total: ~$380-700/mo without GPU, ~$760-1080/mo with GPU
Next Steps
Once your infrastructure is provisioned:
- Install Align - Helm chart deployment
- Configure secrets - Database credentials, API keys
- Set up OAuth apps - Connector authentication
- Configure LLM - AI provider setup