Requirements and sizing
Supported platforms#
| Topology | Minimum versions |
|---|---|
| Kubernetes (Helm) | Kubernetes 1.25+, Helm 3.8+ (OCI support) |
| Docker Compose | Docker Engine 24.0+, Docker Compose plugin v2.20+ (docker compose version) |
The single-host bundle targets Linux x86_64 with kernel 4.x or newer;
it is tested on Ubuntu 22.04 LTS and RHEL 9. Legacy Compose v1
(docker-compose with a hyphen) is not supported — the Compose files use
v2 features.
Single-host sizing (Compose bundle)#
| Resource | Minimum |
|---|---|
| RAM | 4 GB free |
| Disk (install) | ~2 GB total — images, PostgreSQL data volume, Redis, and room to grow |
Disk under /var/lib/docker |
5 GB free |
| Ports | 8080 free on the host for the web UI (configurable via ABRQ_FRONTEND_PORT) |
Kubernetes resource defaults#
The Helm chart ships these requests and limits per component (all overridable in values):
| Component | Replicas | Requests (CPU / memory) | Limits (CPU / memory) |
|---|---|---|---|
| API | 2 | 100m / 256Mi | 1000m / 1Gi |
| Worker | 2 | 100m / 256Mi | 1000m / 1Gi |
| Beat | 1 (fixed) | 50m / 64Mi | 200m / 256Mi |
| Frontend | 1 | 50m / 64Mi | 100m / 128Mi |
| Migrator (init container / hook Job) | — | — | 500m / 512Mi |
| PostgreSQL (bundled subchart) | 1 | — | 500m / 1Gi |
| Redis (bundled subchart, standalone) | 1 | — | 200m / 256Mi |
Optional horizontal autoscaling is built in but disabled by default: an API
HPA (min 2, max 10) and a worker HPA (min 2, max 20), both targeting 70%
CPU and 80% memory. PodDisruptionBudgets with minAvailable: 1 are enabled
by default for the API and workers.
Storage#
| Volume | Default size | Access mode | Purpose |
|---|---|---|---|
| PostgreSQL data | 20Gi | RWO | Framework database and datastore |
| Redis data | 4Gi | RWO | Broker durability (AOF) |
| Beat schedule | 1Gi | RWO | Persistent scheduler state at /var/abrq-dip |
| Backups (optional, off by default) | 5Gi | RWX | Shared encrypted auto-backup volume, mounted by API and workers |
When the backups volume is disabled, automatic backups still run but are
recorded as ephemeral (ok_ephemeral) — they do not survive pod
replacement. Enable the volume (or point at an existing RWX claim) for
durable backups.
Network and egress#
Abrq DIP requires no outbound internet access. Air-gapped installs are a first-class topology: the release bundle carries every container image, and the Helm chart vendors its database subcharts, so nothing is pulled at deploy time. The only network connections the platform opens are the ones you configure — your source and destination systems, and optional notification, OTLP, or SSO endpoints.
SSRF protection is on by default (ABRQ_SSRF_PROTECTION, default
true): outbound connections to loopback, link-local, private-range, and
reserved addresses are refused, so a user who can edit a connector or
webhook target cannot point the platform at internal infrastructure.
Deployments whose legitimate sources live on private addresses exempt them
explicitly, host by host, via ABRQ_EGRESS_ALLOWED_INTERNAL_HOSTS.
Ports to plan for:
| Port | What | Exposure |
|---|---|---|
| 8080 (Compose) or your ingress | Web UI and API | The only user-facing entry point |
| 8000 | API | Cluster/network-internal |
| 5432 | PostgreSQL | Internal only |
| 6379 | Redis | Internal only |
See Deployment for topology-specific instructions.