KAIZEN setup

important

Assumption: The users who will perform the deployment should understand databases and Kubernetes.

In this article, you will deploy the KAIZEN platform to your project environment.

To reduce any possible errors, follow these instructions from beginning to end and avoid changing the sequence.

You can use a TOPPAN Ecquaria product Ecquaria Docking Services (EDS) for the deployment, or another tool based on your project requirements. The instructions below will focus on scenarios for using EDS.

Prerequisites

Before getting started, be sure to fulfil the following preconditions.

Set up Redis

note

It is recommended to use version 7 for Redis.

Ensure that a Redis instance is running.

It can be Amazon ElastiCache or a local Redis installation, based on your project requirements.

Get the KAIZEN release

Get a copy of the KAIZEN release files in the version you want to deploy.

note

Contact your TOPPAN Ecquaria representative to obtain any relevant files.

Configure the project and environment in EDS

If you are using EDS, be sure to perform the following:

1. Create your project.

2. Create an environment for your project.

   1. Ensure that the correct project is selected.

   2. Enable the Only View Objects Created from This Environment option.

   3. Upload the JSON file containing Kubernetes configuration. Click the Test Connection button.

      If the test is successful, the Default Namespace option will appear below.

   4. If available, select kaizen as the default namespace to be used.

      Otherwise, create a new namespace to replace the default.

3. Perform a sanity test on the Kubernetes cluster. For example (non-exhaustive), verify the following:

   • All pods in the kube-system namespace are running.

   • Pods hosted in different nodes communicate with each other.

   • You are able to pull images from your repositories.

Configure database

1. Create a database within Postgres, MySQL, or SQLServer.

2. In the database, expand Schemas to ensure the following are created:

   

   Schemas include:

   • ai• common• console• dbeditor• gateway• iam• job• oidc• report• theme• uirenderer• workflow

note

The public schema shown in the above screenshot was created by default in Postgres.

Install KAIZEN using EDS

Import snapshot

1. Log into EDS. Navigate to Resources > Environments.

   

2. Search for the environment to be used for the deployment on the right.

3. On the same row of the environment, click the menu and select Import Snapshot.

   

4. Click Upload File to browse for and upload the snapshot file in JSON format (KAIZEN_KAIZEN-YYYYMMDD.json) provided in the release.

   • Based on your project requirements, select YAML Files (Mandatory) and Jobs (Optional).
   • Set the namespace for all manifests by selecting Override Namespace in YAML-Files and entering the value.
   

5. Click Import. The import process starts.

6. Upon the completion of the import, navigate to Resources > YAML Files to view the uploaded artifacts shown in the App list.

important

For the deployment not using EDS, you need to deploy the YAML file manually via another tool based on your project requirements. The provided KAIZEN YAML files must use the same stack name as listed in the following section.

Deployment YAML manifests

To view or edit the manifests, open Resources > YAML Files. Select your project and search for each manifest by name.

#	Name	Description
1	kaizen-be-cm-config	This stack is used to deploy the application properties held by ConfigMap for KAIZEN BE (backend) services.
2	kaizen-fe-cm-config	This stack is used to deploy the config.json properties overridden by ConfigMap for KAIZEN FE (frontend) services.
3	kaizen-be-theme-config	This stack is used to deploy the ConfigMap for overriding theme related configuration. No need to deploy if not required.
4	kaizen-be-app-secret	This stack is used to deploy the Kubernetes secrets e.g., jdbc datasource connection password for KAIZEN BE services.
5	kaizen-be-keystore-secret	This stack is used to deploy Kubernetes secrets e.g., keystore for KAIZEN BE services to accept TLS connections.
6	kaizen-be-truststore-secret	This stack is used to deploy Kubernetes secrets e.g., truststore for KAIZEN BE services to perform TLS connections.
7	kaizen-be-jwt-cert-secret	This stack is used to deploy Kubernetes secrets e.g., JWT signer certificate for KAIZEN BE services to issue and verify JWT tokens.
8	kaizen-setup	This stack is used to deploy the setup UI and the setup service for configuring KAIZEN. It can be shut off after the initial setup. Warning: If you need to shut it down, be sure to comment out the /setup/ path in kaizen-fe-app-gateway deployment. Otherwise, it may cause kaizen-fe-app-gateway to fail from starting in the next restart.
9	kaizen-be-core & kaizen-be-core-service	This stack is used to deploy KAIZEN core BE services.
10	kaizen-be-admin & kaizen-be-admin-service	This stack is used to deploy KAIZEN Admin BE services. No need to deploy if not required.
11	kaizen-be-studio & kaizen-be-studio-service	This stack is used to deploy KAIZEN Designer BE services. No need to deploy if not required.
12	FE container	Starting with version 5.1.0, KAIZEN has streamlined its frontend deployment by combining multiple FE container images into a single container. Choose one of the following options: kaizen-fe-admin & kaizen-fe-admin-service (New in version 5.1.0). This stack is used to deploy KAIZEN Admin Frontend services, containing only admin-related services. Typically used for development purposes. Or kaizen-fe-studio & kaizen-fe-studio-service (New in version 5.1.0). This stack is used to deploy KAIZEN Designer Frontend services, containing both designer-related and admin-related services. Typically used for production or live environment.
13	kaizen-ai (New in version 5.1.0)	This stack is used to deploy KAIZEN AI services. Not required if your project is not using AI.
14	kaizen-uirenderer (New in version 5.3.0)	This stack is used to deploy KAIZEN UI Renderer services. Not required if your project is not using the UI Renderer services.
15	kaizen-fe-app-gateway	This stack is used to deploy KAIZEN FE App Gateway service. This is the last manifest to bring up. Otherwise, the links and images in the system will not work properly. The nodePort value for your project is configurable to access KAIZEN.
16	kaizen-migration-volume	This stack is used to set up the volume to hold the KAIZEN migration deployment files for any future version upgrade. Not required for initial setup, but it is recommended to deploy this first to iron out any future connectivity or access issues when you need to perform KAIZEN upgrade.
17	kaizen-fe-oidc & kaizen-be-oidc	This stack is used to deploy KAIZEN OIDC services.

Perform modifications

Be sure to update the datasource settings, modify BE and FE application configurations, apply labels to nodes, and configure nginx service.

Datasource

important

Apply the instructions in this section only to the following manifest list.

Manifest list:

• kaizen-setup
• kaizen-be-studio
• kaizen-be-admin
• kaizen-be-core

Instructions:

1. In EDS, navigate to Resources > YAML Files.

2. For each manifest listed above, ensure that all JDBC strings are valid, especially the database type, host, and port.

   • An example of a valid JDBC string for MySQL database:

     jdbc:mysql://{IP_Address}:{Port}/console?serverTimezone=Asia/Singapore&useUnicode=true&characterEncoding=utf8&characterSetResults=utf8&useSSL=false&allowMultiQueries=true&stringtype=unspecified&allowPublicKeyRetrieval=true

3. After each modification, click the Save button.

4. For database password, update kaizen-be-app-secret to fit your use case.

   You need to update two sets of database password, for example:

   1. db.user.gateway.vault used for KAIZEN service to access the database for daily operations.

   2. db.admin.user.gateway.vault used for KAIZEN setup service to access the database for creating tables or views, with the necessary database DDL access rights.

BE application configurations

important

Apply the instructions in this section only to the following manifest list.

note

For details on a complete list of Spring Boot properties, refer to the Spring Boot documentation.

Manifest list:

• kaizen-be-cm-config

Instructions:

1. Redis cache configuration

   Property Name	Default Value	Description
   spring.data.redis.host	kaizen-redis-service.kaizen.svc.cluster.local	Hostname of the Redis cache service KAIZEN should connect with
   spring.data.redis.password	-	Password to connect with Redis cache service if required
   spring.data.redis.port	6379	Port number of the Redis cache service KAIZEN should connect with
   spring.data.redis.ssl.enabled	Default follows server.ssl.enabled	Flag to determine whether KAIZEN should connect with Redis cache service via TLS connection. Accept true or false value
   spring.redis.ssl.key-store	Default follows server.ssl.key-store-password	File path of the keystore to be used for SSL connection to connect with Redis cache
   spring.redis.ssl.key-store-password	Default follows server.ssl.key-store-password	Password of the keystore to be used for SSL connection to connect with Redis cache
   spring.redis.ssl.trust-store	Default follows server.ssl.trust-store	File path of the truststore to be used for SSL connection to connect with Redis cache
   spring.redis.ssl.trust-store-password	Default follows server.ssl.trust-store-password	Password of the truststore to used for SSL connection to connect with Redis cache

2. JWT configuration

   Property Name	Default Value	Description
   com.ecquaria.lowcode.iam.access.jwt.issuer	ecq-jwt-issuer	Issuer claim value to be set for KAIZEN to issue JWT token
   com.ecquaria.lowcode.iam.access.jwt.trusted.issuers	ecq-jwt-issuer	Issuer claim value of the JWT token for KAIZEN to validate
   com.ecquaria.lowcode.iam.access.jwt.refresh-token-expiration-sec-admin	1800	JWT refresh token validity in terms of seconds when issued
   com.ecquaria.lowcode.iam.access.jwt.session-token-expiration-sec-admin	900	JWT access token validity in terms of seconds when issued
   com.ecquaria.lowcode.iam.access.jwt.signer.key.location	/certs/jwt/signer-private-key-rsa.pem	File path of the JWT signer key location
   com.ecquaria.lowcode.iam.access.jwt.trusted.cert.location	/certs/jwt/signer-public-key-rsa.pem	File path of the JWT trusted cert for validating the integrity of the JWT token
   security.token.cookie.prefix	kaizen-cookie	Cookie name prefix for JWT tokens

3. Configuration for the transit of password encryption

   Property Name	Default Value	Description
   com.ecquaria.lowcode.iam.access.password.enc.key.location	/certs/jwt/signer-private-key-rsa.pem	Path to the key to be used for encryption and decryption of password in transit

4. CSRF configuration

   Property Name	Default Value	Description
   tecq.lowcode.gateway.csrf.enabled	true	Flag to control whether KAIZEN enables CSRF checking
   security.token.cookie.csrf.prefix	kaizen-cookie-csrf	cookie prefix for CSRF Token
   security.token.cookie.csrfkey.prefix	kaizen-cookie-csrf_key	cookie prefix key for CSRF token

5. KAIZEN service TLS configuration

   Property Name	Default Value	Description
   server.ssl.enabled	true	Flag to configure whether KAIZEN services should run as TLS services. Accept true or false value
   server.ssl.key-alias	KAIZEN	Key alias used to run KAIZEN services as TLS services
   server.ssl.key-store-type	PKCS12	Keystore type used. Accept PKCS12 or JKS value
   server.ssl.key-store	file:/certs/keystore/kaizen-keystore.p12	File path to the keystore used for TLS connections
   server.ssl.key-store-password	-	Password of the keystore
   server.ssl.trust-store-type	PKCS12	Truststore type used. Accept PKCS12 or JKS value
   server.ssl.trust-store	file:/certs/truststore/kaizen-truststore.p12	File path to the truststore used for TLS connections
   server.ssl.trust-store-password	-	Password of the truststore

6. KAIZEN service mesh configuration

   Property Name	Default Value	Description
   use.mesh.name	true	Flag to configure whether KAIZEN should use its own service mesh setup. If using Istio Service Mesh, this should be set to false. Accept true or false value
   service.names.mesh	{"setup":{"host":"setup.kaizen.svc.cluster.local","port":8089,"contextPath":""}, "gateway":{"host":"gateway.kaizen.svc.cluster.local","port":8081,"contextPath":""}, "iam":{"host":"iam.kaizen.svc.cluster.local","port":8082,"contextPath":""}, "common":{"host":"common.kaizen.svc.cluster.local","port":8084,"contextPath":""}, "job":{"host":"job.kaizen.svc.cluster.local","port":8085,"contextPath":""}, "workflow":{"host":"workflow.kaizen.svc.cluster.local","port":8087,"contextPath":""}, "console":{"host":"console.kaizen.svc.cluster.local","port":8083,"contextPath":""}, "pagescan":{"host":"pagescan.kaizen.svc.cluster.local","port":8086,"contextPath":""}, "theme":{"host":"theme.kaizen.svc.cluster.local","port":8090,"contextPath":""}, "dbeditor":{"host":"dbeditor.kaizen.svc.cluster.local","port":8091,"contextPath":""}, "report":{"host":"report.kaizen.svc.cluster.local","port":8088,"contextPath":""}, "ai":{"host":"ai.kaizen.svc.cluster.local","port":7860,"contextPath":""}}	KAIZEN Service Mesh configuration in JSON format. Each JSON item is one service configuration in the format of <service name> : {host:<service hostname>, port: <service port number>} e.g. "setup":{"host":"setup.kaizen.svc.cluster.local","port":8089}
   service.public.white.path.additional.list	'[{"path":"/xxx/api/v1/xxx/services","method":"GET"}, … }]'	A list of additional endpoints to be whitelisted for security checks

FE application configurations

important

Apply the instructions in this section only to the following manifest list.

note

For details on a complete list of Spring Boot properties, refer to the Spring Boot documentation.

Manifest list:

• kaizen-fe-cm-config

Instructions:

1. KAIZEN FE application configuration

   The following configurations are deployed in JSON format in the config.json file.

   Property Name	Default Value	Description
   CSRF_TOKEN_PREFIX	kaizen-cookie-csrf	CSRF Token cookie name to be used by FE application
   DYNAMIC_USER_DOMAIN_CODES	-	Custom user domain code to be accepted by KAIZEN

Apply labels to the nodes

1. In EDS, navigate to Resources > Nodes.

2. On every node usable for KAIZEN deployment, add this label:

   • kaizen: 'Y'

3. Upon completion, click Save.

Configure nginx service

1. In EDS, navigate to Resources > YAML Files.

2. Search for the job with the name kaizen-fe-app-gateway.

3. In the context menu on the right, click Edit.

4. In the editor, search for the Kubernetes service named kaizen-fe-app-gateway-service.

5. Modify the NodePort value as required.

6. Upon completion, click Save.

Start the KAIZEN application

important

Apply the instructions in this section to the following manifest list.

Manifest list:

• kaizen-be-cm-config
• kaizen-fe-cm-config
• kaizen-be-app-secret
• kaizen-be-npm-secret
• kaizen-be-keystore-secret
• kaizen-be-truststore-secret
• kaizen-be-jwt-cert-secret
• kaizen-infra
• kaizen-setup
• kaizen-be-core
• kaizen-be-core-service
• kaizen-be-studio
• kaizen-be-studio-service
• kaizen-fe-studio or kaizen-fe-admin
• kaizen-fe-studio-service or kaizen-fe-admin-service
• kaizen-ai - [Optional] only required when it has been deployed
• kaizen-uirenderer - [Optional] only required when it has been deployed
• kaizen-fe-app-gateway

Instructions:

1. In EDS, navigate to Resources > YAML Files.

2. For each manifest in the same order as listed above, in the context menu on the right, click Apply.

   Wait until each deployment is running, then move on to the next.

Perform the initial setup

1. Navigate to the KAIZEN setup page.

   If you have a load balancer for the cluster workers, use that address. Otherwise, directly use the address of any worker.

   

2. Click Continue Setup of KAIZEN.

   

3. In this screen, KAIZEN will detect and display the KAIZEN services that were deployed. Please verify that all required services are deployed.

4. Configure the setup parameters as required.

   • You may add project custom user domains as required by clicking Add. The left column is the user domain code and the right column is the display name of the user domain.

     note

     You can skip this step if you are not sure of the custom user domains to be created. You can still create user domains after setting up KAIZEN by logging in as kaizenadmin of the KAIZEN Default user domain and create new user domains.

     

   • Select the backend services that you want to set up, according to your project requirements. To set up KAIZEN Designer services such as DB editor and theme services, you need to check console service first.

   • Select the case sensitivity of KAIZEN login user ID.

     

   • Select the password hashing function and its strength.

     caution

     This cannot be changed after setup. The following screenshots are showing the default values.

     • Bcrypt:
     
     • Scrypt:
     
     • HASH:
     

   • Enter the default password of the admin users. You can refer to the default password in the provided deployment stack kaizen-be-app-secret. Look for the system.user.admin.vault property.

     note

     • You can choose not to use the default value by updating the default password stack before the actual deployment and enter the new default password here.
     • It is recommended to use the provided default password here and change the password to your preference after KAIZEN initial setup is completed.
     

5. Click Confirm & Begin KAIZEN Setup (as shown in Step 2) to start.

6. Wait until the initial setup shows completed.

   

7. Restart the following manifests in the same order as listed:

   1. kaizen-be-core
   2. kaizen-be-admin
   3. kaizen-be-studio

Log into KAIZEN

To log into the KAIZEN application you have deployed, perform the following:

1. Navigate to the KAIZEN landing page.

2. Select the KAIZEN Default user domain, enter the username kaizenadmin, and type the password.

   If the login is successful, the setup of KAIZEN is complete.

Last updated on 21 Sep 2026