Local installation

This guide installs MCS Operator and Console into a local Kind cluster with Helm. The installation is complete when:

1. the Operator Deployment is ready;
2. the Console is reachable; and
3. the bootstrap administrator can sign in.

This workflow does not install or require Argo CD. Creating organizations, Keeper fleets, ClickHouse services, or test tables belongs to Testing.

Prerequisites

• Docker
• kubectl
• Kind
• Helm 3
• Go and Make

Verify the tools before changing the cluster:

docker version
kubectl version --client
kind version
helm version
go version
make --version

Object storage, ClickHouse images, Keeper images, and ClickStack are not required to complete this installation. They are required only by the post-install tests that create and exercise data-plane resources.

1. Create a Kind cluster

The Operator and Console need only a normal local Kind cluster:

kind create cluster --name mcs-local
kubectl cluster-info --context kind-mcs-local
kubectl get nodes

The five-worker Kind topology used for Keeper anti-affinity testing is documented in Testing; it is not an installation prerequisite.

2. Build and load the Operator image

From the repository root:

make docker-build IMG=mcs-operator:dev
kind load docker-image --name mcs-local mcs-operator:dev

The local Helm values use imagePullPolicy: Never, so Kubernetes runs the image already loaded into Kind.

3. Create the administrator bootstrap Secret

The bootstrap email must use the @coreweave.com domain. Read the password without echoing it or placing it in a values file:

export MCS_LOCAL_ADMIN_EMAIL='admin@coreweave.com'
printf 'Admin password: '
IFS= read -r -s MCS_LOCAL_ADMIN_PASSWORD
printf '\n'

kubectl create namespace data-mcs-operator \
  --dry-run=client --output yaml | kubectl apply -f -

kubectl --namespace data-mcs-operator create secret generic mcs-admin-bootstrap \
  --from-literal=email="${MCS_LOCAL_ADMIN_EMAIL}" \
  --from-literal=password="${MCS_LOCAL_ADMIN_PASSWORD}" \
  --dry-run=client --output yaml | kubectl apply -f -

unset MCS_LOCAL_ADMIN_PASSWORD

The bootstrap password is passed to the process only for initial administrator creation. MCS stores the administrator credential in mcs-admin-auth as a salted password hash, not as the original password.

4. Configure Helm

Create values.local.yaml in the repository root:

manager:
  image:
    repository: mcs-operator
    tag: dev
    pullPolicy: Never
  env:
    - name: MCS_ADMIN_EMAIL
      valueFrom:
        secretKeyRef:
          name: mcs-admin-bootstrap
          key: email
    - name: MCS_ADMIN_PASSWORD
      valueFrom:
        secretKeyRef:
          name: mcs-admin-bootstrap
          key: password

console:
  enable: true
  service:
    type: ClusterIP

metrics:
  enable: false

These are the minimum values for an install-and-login check. Do not add object storage configuration merely to make the Operator start. The post-install tests add the object-storage values and Secrets before creating Keeper or ClickHouse resources.

Do not commit values.local.yaml.

5. Install with Helm

Render the chart once before applying it:

helm lint ./dist/chart --values values.local.yaml
helm template mcs-operator ./dist/chart \
  --namespace data-mcs-operator \
  --values values.local.yaml >/dev/null

Install the chart:

helm upgrade --install mcs-operator ./dist/chart \
  --namespace data-mcs-operator \
  --create-namespace \
  --values values.local.yaml

kubectl --namespace data-mcs-operator \
  rollout status deployment/mcs-operator-controller-manager \
  --timeout=300s
kubectl --namespace data-mcs-operator get pods

Pass criteria:

• deployment/mcs-operator-controller-manager completes its rollout;
• the Operator Pod is Running and ready;
• no Pod is in CrashLoopBackOff or ImagePullBackOff.

If the rollout fails, inspect it before continuing:

kubectl --namespace data-mcs-operator \
  describe deployment/mcs-operator-controller-manager
kubectl --namespace data-mcs-operator \
  logs deployment/mcs-operator-controller-manager

6. Open the Console and sign in

Keep this command running in a terminal:

kubectl --namespace data-mcs-operator \
  port-forward service/mcs-operator-console 8090:8090

Open http://127.0.0.1:8090 and sign in with:

• email: the value of MCS_LOCAL_ADMIN_EMAIL;
• password: the password entered in step 3.

The installation is complete when the administrator reaches the authenticated Console. Stop here. Follow Testing when you want to create an organization, Keeper fleet, ClickHouse service, managed table disk, or ElasticQuery reader.

Cleanup

helm uninstall mcs-operator --namespace data-mcs-operator
kind delete cluster --name mcs-local
rm -f values.local.yaml

The chart retains CRDs during a Helm uninstall. For a complete disposable local cleanup, deleting the Kind cluster removes them with the cluster.