Getting Started
Go from sign-up to a shared organization and your first design in Layer5 Cloud.
Layer5 Cloud Documentation
What Layer5 Cloud does for Kanvas and Meshery, what it leaves to Meshery Server, and where to start.
Layer5 Cloud is the identity, tenancy, and collaboration service behind Kanvas and Meshery. It signs users in, organizes them into organizations, teams, and workspaces, decides what each of them may do, and stores the designs they create and share. Layer5 Cloud runs as a hosted service and as a self-hosted deployment.
Understanding the Layer5 Ecosystem 🔗
Layer5 Cloud is the identity provider and remote provider for Kanvas and Meshery. It owns accounts, organizations, teams, workspaces, roles, and the catalog, and it stores every design and design version. It is available as a hosted service or self-hosted.
Kanvas is a visual designer and operator for Kubernetes and multi-cloud infrastructure. It runs as an extension inside Meshery and uses Layer5 Cloud to store, share, and publish designs.What Layer5 Cloud does 🔗
Sign-in and identity. Users create an account with an email address and password, with GitHub, or with Google. An organization that configures its own identity providers, including a generic OIDC provider, offers those instead. A signed-in user can link a GitHub or Google account to an existing profile, so either method signs in to the same profile. Email sign-ups verify their address before password sign-in works.
Tenancy. Organizations own teams and workspaces. A team belongs to the organization it is created in, a workspace can hold any number of teams, and a team can belong to several workspaces. At first sign-in, every new user receives a default organization, team, and workspace: they hold the Organization Admin role on the organization, the Team Admin role on the team, and own the workspace, so they can start working immediately.
Authorization. Roles, keys, and keychains decide what each user may do. A key is a single permission, a keychain groups keys, and a role carries keychains. Users hold roles within an organization, so the same person can have different permissions in different organizations. Built-in roles cover the provider, organization, team, and workspace levels, and organization admins invite users and assign their roles. See Identity and Security.
Design storage and sharing for Kanvas. Layer5 Cloud persists every Kanvas design and every version of it, records who each design is shared with, and keeps the event log. A design belongs to at most one workspace at a time. Real-time collaboration in Kanvas starts with a signaling service that Layer5 Cloud hosts; after participants connect, edits synchronize directly between their browsers.
The catalog. The catalog publishes reusable designs. Anyone can browse it. A signed-in user with the right permission can clone a published or public design into their own workspace, download it, or open it in Kanvas on the Meshery Playground.
Remote provider for Meshery Server. Meshery Server connects to Layer5 Cloud as its remote provider. Users sign in to Meshery through Layer5 Cloud, Meshery Server registers itself as a connection owned by the signed-in user, and Layer5 Cloud returns a capabilities document that tells Meshery which features to enable for that user. Every new user holds the Kanvas role, which enables the Kanvas extension when their Meshery Server connects.
Academy. Academy delivers learning paths, challenges, and certifications, and gives content creators the tools to build and publish their own.
What Layer5 Cloud does not do 🔗
- It does not deploy to or manage your clusters. Meshery Server, running in your environment, talks to your Kubernetes clusters through Meshery Operator and MeshSync, and performs every dry-run, deploy, and undeploy.
- It does not run Kanvas. Kanvas is an extension that runs inside Meshery. Kanvas sends its requests to Meshery Server, which forwards design, catalog, and sharing requests to Layer5 Cloud. Real-time collaboration signaling is the only direct path from the browser to Layer5 Cloud.
How Layer5 Cloud works explains these boundaries in depth, and How Kanvas Works with Meshery and Layer5 Cloud covers them from the Kanvas side.
Choose your path 🔗
| Section | Go here to |
|---|---|
| Getting Started | Create an account and learn what Layer5 Cloud sets up for you at first sign-in. |
| Tutorials | Work through end-to-end examples that build a working mental model. |
| How-to Guides | Complete a specific task: manage organizations and workspaces, connect integrations, or self-host. |
| Concepts | Understand organizations, teams, workspaces, roles, the catalog, and how they relate. |
| Reference | Look up default permissions by role and the API. |
| Academy | Take learning paths and certifications, or create and publish your own content. |
To design infrastructure with what Layer5 Cloud stores, go to the Kanvas documentation.
What each plan includes 🔗
The following matrix shows which Layer5 Cloud capabilities each subscription plan includes. For default permissions by role, see the Reference section.
| Capability | What it does | Free | Team Designer | Team Operator | Enterprise |
|---|---|---|---|---|---|
| Built-in Roles | Predefined user roles: Organization Admin, Team Admin, Workspace Admin | Included | Included | Included | Included |
| Identity through OAuth | Use third-party identity providers, Google and GitHub, to manage the identities of your organization’s members. | Included | Included | Included | Included |
| Teams | Establish new team for organizing groups of users and resource access. Single organization, multiple teams. | Not included | Included | Included | Included |
| Custom Roles | Assign User Roles, Assign Keychains to Roles | Not included | Not included | Included | Included |
| User-defined Roles | Customizable roles for specific permission assignments | Not included | Not included | Not included | Included |
| Cloud as an IDP | Own and control the user accounts of your enterprise members with Cloud your identity provider (IdP). | Not included | Not included | Not included | Included |
| Organizations | Participate as a member of multiple organizations each with their own accounting and billing structure. Multiple organizations, multiple teams. | Not included | Not included | Not included | Included |
| Organizations | Establish new organization for organizing teams, users, and resource access. | Not included | Not included | Not included | Included |
| Direct Add or Invite User to Organization | Directly create a new user account within an organization. Send a request for a user to join an organization. | Not included | Not included | Not included | Not included |
| Capability | What it does | Free | Team Designer | Team Operator | Enterprise |
|---|---|---|---|---|---|
| My Workspace | My Workspace is your always available, primary space for storing designs, views, and models that you own. | Included | Included | Included | Included |
| GitOps Snapshots | Visual insights in your pull requests in GitHub. Verify your workload designs and Kubernetes cluster configurations prior to accepting and merging pull requests. | Not included | Included | Not included | Included |
| Manage Workspace Team and Environment Access | Assign designs, views, users, and environments to shared workspaces. | Not included | Included | Included | Included |
| Shared Workspaces | Shared Workspaces are collaborative spaces that you can use to store and collaborate on files within and between teams. Easily share files with customizable permissions (edit, comment, view). Create up to 10 shared workspaces per organization. | Not included | Included | Included | Included |
| GitOps Integrations | Initiate deployment with creation of pull request, ArgoEvents, Flux sync, or webhook. | Not included | Not included | Not included | Included |
| Capability | What it does | Free | Team Designer | Team Operator | Enterprise |
|---|---|---|---|---|---|
| Public Catalog: 400 Cloud Native Patterns | A library of pre-built design patterns and operational templates for common deployment scenarios, simplifying the configuration process and ensuring best practices. | Included | Included | Included | Included |
| Organization Private Catalog | Privately publish and share reusable design patterns and operational templates within your organization. | Not included | Not included | Not included | Included |
| Share Design | Share design with anyone within your organization, and make your design easily accessible to all relevant team members. | Included | Included | Not included | Included |
| Clone Design | Clone any published design to customise it according to your use cases | Included | Included | Not included | Included |
| Publish Design | Publish a design | Not included | Not included | Not included | Not included |
| View Designs | View all public and published designs of other team members and private of signed-in user | Not included | Not included | Not included | Not included |
| View Filters | View all public and published filters of other team members and private of signed-in user | Not included | Not included | Included | Included |
| Approve Catalog Request | Change management for the curation of content published in the catalog. | Not included | Not included | Not included | Included |
| Single and multiple approvers | Not included | Not included | Not included | Not included | |
| Import Filter | Import a publish WASM filter | Not included | Not included | Not included | Not included |
| Capability | What it does | Free | Team Designer | Team Operator | Enterprise |
|---|---|---|---|---|---|
| Event Audit Trail | Detailed accounting of user activity. Historical record or each action taken. | Not included | Not included | Not included | Included |
| Customizable Permissions: Keys, Keychains and Roles | Highly flexible permissioning. Organize keys into custom keychains and assign to existing or custom roles that you define. | Not included | Not included | Not included | Included |
| User Session and API Token Oversight | Expiring and non-expiring API tokens. Visibility into active and expired user sessions. | Not included | Not included | Not included | Included |
| Capability | What it does | Free | Team Designer | Team Operator | Enterprise |
|---|---|---|---|---|---|
| Community Support | Get help with most of your questions and issues in our Community Forum. | Included | Included | Included | Included |
| Standard Support | Support can help you troubleshoot issues you run into. Get support via email. | Not included | Included | Included | Included |
| Managed Service Provider | White Label: Customize the appearance and branding of your engineering platform powered by Cloud. Multi-tenancy: Hierarchical organizations, teams, users and customizable permissioning. | Not included | Not included | Not included | Included |
| Premium Support | With Premium, get a 2-hour SLA and 24/7 web and phone support. | Not included | Not included | Not included | Included |
| Self-hosted Deployment | Self-hosted Cloud for on-prem appliances or self-managed cloud tenants. Keep your designs internal to your workplace. Get remote support when you need it. | Not included | Not included | Not included | Included |
| Capability | What it does | Free | Team Designer | Team Operator | Enterprise |
|---|---|---|---|---|---|
| Academy Theoretical Learning | A comprehensive learning management system for creators and instructors on how to build, manage, and extend educational content like learning paths, challenges, and certifications. | Not included | Not included | Not included | Included |
| Academy Practical Learning | An inclusive, collaborative, hands-on learning environment for students. | Not included | Not included | Not included | Included |
Tutorials
Guided, end-to-end lessons that build a working result in Layer5 Cloud and teach the model behind it.
How-to Guides
Task guides for Layer5 Cloud, grouped by what you want to accomplish.
Concepts
How users, organizations, teams, workspaces, environments, designs, the catalog, and roles relate to each other in Layer5 Cloud.
Reference
Exact facts about Layer5 Cloud - plan availability, roles and permissions, support, and the REST API.
Academy
What the Layer5 Academy is, how its three content types relate, how content moves from an author’s repository to a learner’s certificate, and which roles can do what.