Plan a Deployment

Mon, 01 Jan 0001 00:00:00 +0000

Layer5 Cloud starts with unsafe placeholder values for every secret and with localhost for every URL. Settle the decisions below first, so the install is a single helm install with a complete values file.

Decisions to make 🔗

Decision	What to settle	Where it is configured
Database	A PostgreSQL server that hosts three databases: `meshery`, `kratos`, and `hydra`.	`env.db`, `env.kratosdb`, `env.hydradb`, and the subchart `dsn` values
Hostname and TLS	One public hostname, a certificate for it, and the scheme (`https`).	`ingress.*`, `env.serverbaseurl`, `env.serverHost`, `env.proto`
Secrets	Replace every placeholder before first start. See Secrets to generate.	`env.`, `kratos.`, `hydra.*`
Identity providers	The Google and GitHub OAuth applications that act as the default sign-in providers. See Identity Services.	`env.providerOrg*`
Mail	A relay on a public address that offers STARTTLS (or implicit TLS on 465), and how identity mail leaves. See Mail.	`smtp.*`, Kratos courier values
First administrator	The Provider Admin account and the provider organization. See Provider initialization.	`env.initConfig`
Network paths	What must be reachable between components and from users. See Networking.	Ingress, network policy, egress rules
Observability	Where logs and traces go. See Monitoring.	`env.loglevel`, `env.otelConfig`

Database 🔗

Layer5 Cloud creates and migrates its own schema. The server applies migrations every time it starts, and exits if a migration fails, so give the database user the rights to create tables and the uuid-ossp extension in the public schema of the meshery database. Kratos and Hydra run their own migrations when the chart’s automigration setting is on, which is the default.

Self-Hosted Deployments

Mon, 01 Jan 0001 00:00:00 +0000

A self-hosted deployment runs the same Layer5 Cloud that Layer5 operates, on infrastructure you control. Your users sign in against your identity services, your organizations and designs live in your database, and Meshery Servers in your network connect to your deployment as their remote provider. Your data stays in your database.

Self-hosting is part of the Enterprise plan.

Identity & Access Management
Capability	What it does	Free	Team Designer	Team Operator	Enterprise
Cloud as an IDP	Own and control the user accounts of your enterprise members with Cloud your identity provider (IdP).	Not included	Not included	Not included	Included

Support and Deployment
Capability	What it does	Free	Team Designer	Team Operator	Enterprise
Managed Service Provider	White Label: Customize the appearance and branding of your engineering platform powered by Cloud. Multi-tenancy: Hierarchical organizations, teams, users and customizable permissioning.	Not included	Not included	Not included	Included
Self-hosted Deployment	Self-hosted Cloud for on-prem appliances or self-managed cloud tenants. Keep your designs internal to your workplace. Get remote support when you need it.	Not included	Not included	Not included	Included

What you deploy 🔗

One Helm chart, layer5-cloud, installs the identity-aware application and its two identity services. You supply the database, the ingress, and the TLS certificate.

Self-Hosted on Layer5 Documentation

Plan a Deployment

Decisions to make 🔗

Database 🔗

Self-Hosted Deployments

What you deploy 🔗