Deploy on EKS

Overview

Deploy the Access Broker as a Kubernetes Deployment on an existing AWS EKS cluster. The image is pushed to ECR and the broker reads its tenant and token from a Kubernetes ConfigMap. Use this when you already run workloads on EKS and want the broker alongside them.

What you’ll accomplish:

Build and push the broker image to ECR
Deploy the broker to your EKS cluster
Confirm it registers with your Britive tenant

Before You Begin

A Britive tenant with administrator access
Tenant subdomain (the part before .britive-app.com) and a broker pool token — from System Administration → Broker Pools
AWS CLI, docker, and kubectl configured for your EKS cluster
The britive-broker-2.0.0.jar file placed in the eks-deployment/ directory

The broker token lives in the ConfigMap in this example. For production, move it to a Kubernetes Secret or external secret store and reference it via envFrom.

Deploy

Clone the onboarding repo

git clone https://github.com/britive/onboarding.git
cd "onboarding/Access Broker/eks-deployment"
cp /path/to/britive-broker-2.0.0.jar .

Set deploy variables

Edit deploy.sh and set your token and region:

deploy.sh

BRITIVE_TOKEN="<broker-pool-token>"
AWS_REGION="us-east-1"

Set the ConfigMap values

Edit deployment.yaml and set the tenant subdomain and token in the ConfigMap:

deployment.yaml

data:
  broker-config.yml: |
    config:
      bootstrap:
        tenant_subdomain: mycompany
        authentication_token: "<broker-pool-token>"

Run the deploy script

chmod +x deploy.sh
./deploy.sh

The script builds the image, pushes it to ECR, and applies the Deployment to your cluster.

Verify

Check the pod is running

kubectl get pods -l app=britive-broker
# Expected: STATUS = Running

Tail the logs

kubectl logs -l app=britive-broker --follow

Confirm registration

In the Britive console, go to System Administration → Broker Pools → your pool. The broker shows as Connected.

Troubleshoot

Symptom	Cause	Fix
`ImagePullBackOff`	Node role can’t pull from ECR	Attach `AmazonEC2ContainerRegistryReadOnly` to the node group role
Pod `CrashLoopBackOff`	Bad tenant/token in ConfigMap	Fix `deployment.yaml`, re-apply with `kubectl apply -f deployment.yaml`, then `kubectl rollout restart deploy/britive-broker`
Broker not “Connected”	Egress blocked	Allow outbound HTTPS (443) to `*.britive-app.com` from the cluster

Next Steps

Last updated on June 7, 2026

Deploy on ECS Fargate Deploy on AKS