Quick start: EU OpenBao, Port and beacon

Use chart 1.0.359, operator v0.13.209, wrapper/init v0.2.207 and Linux host Port v0.4.133. Use released CLI v0.19.176 with this matched set. Hosted enrollment is unavailable; use your own relay.

The proven path is Linux host Port + customer relay + US cluster + EU store. Install in cloudtaser-system; see the complete procedure for measured results, application resources, exact tested kernels and unsupported features. Chart 1.0.359 passed no-resources delivery with operator policies off; enforcing policies/outages were tested on 1.0.358. Skip 1.0.357 and 1.0.358. The operator adds 64Mi to a manifest memory limit, covering the 42 MB tmpfs. The OOM case was manifest 1Mi → effective 65Mi; size the effective budget well above 69 MB plus app headroom. Use one wrapped container and set cloudtaser.io/containers (default first container). S3 proxy/Volume Shield are unsupported; DB proxy is unproven. GKE COS 6.12.105+ passed delivery; stock Ubuntu 24.04 GCE booted unsupported 7.0.0-1014-gcp. Check node uname -r. Host Port broker CA rotation has no supported runbook yet. Pod tokens can outlive a deleted Pod until TTL, up to 15 minutes.

Use the complete procedure, in order:

1. Arrange the release, node/site inputs, TLS and self-hosted relay tenant.
2. Generate/review/run the EU OpenBao bootstrap and signed Port installer.
3. Complete private source/relay tenant issuance.
4. Approve and activate exact cluster/workload authority.
5. Admit a finite Port process; keep its management parent attached.
6. Install the production cluster profile and privately introduce the operator.
7. Verify app delivery, explicit rotation, outage recovery and uninstall.

The quickstart explains the boundaries. Do not substitute an empty target install, a flag-only Port daemon, or direct mode for this flow.