Topic outline

• Preparing Your Kubernetes Deployment of InterSystems IRIS Using IKO

  Preparing Your Kubernetes Deployment of InterSystems IRIS Using IKO

  Content Type
  Job Aid

  Duration
  varies

  Level
  Intermediate

  Prepare your Kubernetes environment for a production-grade deployment of InterSystems IRIS® data platform using the InterSystems Kubernetes Operator (IKO). This job aid provides infrastructure and DevOps teams with a practical, IKO-focused checklist of considerations to ensure scalable, secure, and cloud-native deployments of InterSystems IRIS on Kubernetes.
• Pre-Deployment Planning

  Pre-Deployment Planning
  • 1. Familiarize yourself with Kubernetes and InterSystems Kubernetes Operator (IKO) concepts.
       Ensure your team understands core Kubernetes constructs—Pods, Services, StatefulSets, PersistentVolumes, ConfigMaps—and how these are automated via the InterSystems Kubernetes Operator (IKO).
       
       Deployment success depends on your ability to navigate cluster behavior, resource management, and stateful workloads. To ensure you have the necessary background, try these resources:

       • Achieving High Availability with InterSystems IRIS and Kubernetes (exercise, 45m):
         Get an introductory experience to running InterSystems IRIS containers on Kubernetes.
       • InterSystems Kubernetes Operator documentation:
         Learn how IKO helps streamline Kubernetes tasks.
    
    
    2. Inventory your InterSystems IRIS components.
       1. Consider the specific InterSystems IRIS features and components you intend to use (such as interoperability, analytics, or the web gateway) and their infrastructure dependencies. Include any external databases, authentication services, or messaging systems with which InterSystems IRIS will integrate.
       2. Document how these map to IKO’s topology, configSource, and serviceTemplate fields.
    
    
    3. Externalize secrets, including license keys.
       Never embed passwords, license keys, or environment settings into your container image. Use the licenseKeySecret field in your IKO custom resource definition (CRD) to provide your InterSystems IRIS license securely via Kubernetes Secrets.
       
       Example:
       

       licenseKeySecret: iris-license-secret

       
       Not all InterSystems IRIS licenses automatically include containerization compatibility. Contact your InterSystems account team to confirm compatibility with Kubernetes deployments and obtain appropriate license keys if needed.
  • Pre-Deployment Planning Complete

• Containerization Setup

  Containerization Setup
  • 1. Use official InterSystems IRIS images.
       Use InterSystems IRIS container images provided via the InterSystems Container Registry. These images are tested and optimized for Kubernetes use. Reference these images in your CRD using the image field.
       Example:
       

       compute:
         image: containers.intersystems.com/intersystems/iris:latest-em
       

    
    
    2. Customize using configSource.
       If your deployment requires custom logic or configurations, extend the official image by customizing configSource. Within the configSource field, you can inject custom configurations (for example, CPF merge files or CSP merge settings). Avoid Dockerfile customizations where possible, and keep configurations version controlled.
       
       Example:
       Begin code.

       configSource:
           name: my-iriscluster-config
       
       

       End code.
  • Containerization Setup Complete

• Storage Configuration

  Storage Configuration
  • 1. Customize persistent volume claims (PVCs) using IKO fields.
       InterSystems IRIS requires persistent volumes for databases, journal files, and WIJ. By default, IKO deploys volumes for four categories of data:
       
       • storageDB for durable %SYS data
       • storageWIJ for the WIJ directory
       • storageJournal1 for the primary journal directory
       • storageJournal2 for the alternate journal directory
       When defining your storage, consider your needs for journaling, backups, and growth strategies.
       
    2. Select an appropriate storage class.
       Ensure your storage classes align with I/O and durability needs. Journal files should use high-speed storage. Confirm container storage interface (CSI) driver support for snapshots if planning volume-based backups.
       
       Example:
       Begin code.

       storageJournal1:
         storageClassName: fast-ssd
       

       End code.
    
    
    3. Plan for backup and mirroring.
       Enable mirroring via IKO’s topology.data.mirroring configuration and confirm volumes support replication. Backup tools should be tested against Kubernetes CSI volumes.
       
       Example:
       Begin code.

       topology:
         data:
           mirrored: true
       

       End code.
  • Storage Configuration Complete

• Networking Setup

  Networking Setup
  • 1. Expose InterSystems IRIS services via Kubernetes.
       Ensure all clients, administrators, and connected systems have access to the InterSystems IRIS instance. Consult your network administrators and adjust firewall and cloud network rules as necessary to ensure the ports your applications use are accessible.
       
    2. Enable TLS for encrypted connections.
       Secure communication with TLS, using Kubernetes Secrets or a certificate manager (such as cert-manager) to store certificates and inject them into your InterSystems IRIS configuration. Ensure that HTTPS is enabled in the web gateway.
       
       Example:
       

       tls:
         webgateway:
           secret:
             secretName: iris-tls-secret
       

  • Networking Setup Complete

• Security and Access Control

  Security and Access Control
  • 1. Store Secrets securely.
       Use Kubernetes Secrets to store InterSystems IRIS credentials, license keys, and TLS certificates. Avoid plaintext storage or inclusion in Git repositories. Ensure Secret access is tightly scoped using role-based access control (RBAC).
       
       Example:
       Begin code:

       webgateway:
         loginSecret:
           name: iris-login
       

       End code
    
    
    2. Apply RBAC for access management.
       Define Kubernetes Roles and RoleBindings to control who can view, modify, and deploy InterSystems IRIS resources. Limit InterSystems IRIS namespace access to trusted team members, and avoid granting cluster-admin privileges unnecessarily.
    
    
    3. Secure the runtime and network.
       Use PodSecurityPolicies (if supported) or Pod Security Admission to enforce least-privilege container execution. Limit container privileges, apply network policies to isolate InterSystems IRIS pods, and use a container scanning tool to detect vulnerabilities.
  • Security and Access Control Complete

• Deployment and Scaling

  Deployment and Scaling
  • 1. Configure pod resources.
       Define resources.requests and resources.limits in your deployment specification. InterSystems IRIS requires substantial memory and CPU resources for production workloads. Under-provisioning may lead to crashes or degraded performance. Confirm with your InterSystems account team what system requirements exist for your products.
       

       Make sure your resource requests and limits place InterSystems IRIS pods in the Guaranteed Quality of Service (QoS) class, rather than Burstable, to avoid eviction under node pressure. Read more about QoS classes in Kubernetes.

       Example:

       Begin code:

       podTemplate:
         spec:
           resources:
             # Guaranteed QoS: requests must equal limits
             requests:
               cpu: 4
               memory: 16Gi
             limits:
               cpu: 4
               memory: 16Gi
       

       End code.
    
    
    2. Use probes to ensure availability.
       Familiarize yourself with the default readiness and liveness probes included with IKO. A pod's readiness probe is used to tell you when the services in deployed containers are fully started and ready for operartion.
    
    
    3. Enable autoscaling via IKO.
       Use Horizontal Pod Autoscaling (HPA) if your workload is dynamic. IKO supports hpa in topology.compute for compatible versions.
       

       Example:

       Begin code:

       topology:
         compute:
           hpa:
             spec:
               minReplicas: 2
               maxReplicas: 4
               scaleTargetRef:
                 kind: StatefulSet
                 name: acme-compute
                 apiVersion: apps/v1
       

       End code
  • Deployment and Scaling Complete

• Observability and Monitoring

  Observability and Monitoring
  • 1. Connect InterSystems IRIS to an OpenTelemetry Collector.
       Enable InterSystems IRIS to emit OpenTelemetry logging and metric signals and set the endpoint for the OpenTelemetry Collector.
       The OpenTelemetry Collector can then be configured to export signals to monitoring and telemetry infrastructure, such as Fluentd for log analysis, Prometheus for metric monitoring and alerting, and Jaeger for trace analysis.
       
    
    
    2. Monitor pod and storage health.
       Track metrics for pod restarts, PVC usage, and node health. Alerts should trigger for unusual restart patterns, high disk usage, or storage latency spikes that could lead to data loss or service degradation.
  • Observability and Monitoring Complete

• Validation and Testing

  Validation and Testing
  • 1. Test InterSystems IRIS functionality in the cluster.
       Run SQL queries, REST requests, and Management Portal logins to confirm that InterSystems IRIS is operating as expected. Monitor logs for errors during normal operations.
    
    
    2. Simulate failover scenarios.
       If using mirroring, test failover between primary and backup nodes. Manually restart pods, kill nodes, or trigger volume detachment to ensure your high-availability setup responds correctly.
    
    
    3. Validate data durability.
       Simulate pod or node failures to confirm that persistent volumes retain data. Perform backup and restore tests to validate your disaster recovery process.
  • Validation and Testing Complete

• What's Next?

  What's Next?

  This checklist is a starting point for planning and validating your Kubernetes-based deployment of InterSystems IRIS using the InterSystems Kubernetes Operator (IKO). Though it is not exhaustive, it provides the foundational topics your DevOps team should address before and during production rollout.

  For more detailed guidance, use the following resources:

  • IKO documentation
  • Kubernetes documentation

  
  

  • Share Your Feedback!