Overview
The SaaS, multi-tenant controller is built on a zero trust security model that only requires outbound Internet connectivity on TCP port 443 from the managed clusters to the Internet based SaaS controller for centralized management.
However, due to security and operational requirements, some organizations may be unable to allow even outbound connectivity on port 443 to the SaaS Controller. As a result, these organizations may be required to deploy and operate the controller itself in their infrastructure. Here are some examples:
- A defence agency that needs to manage their clusters in GovCloud
- A highly regulated business that needs to operate their clusters in a private network
Architecture¶
The Controller itself is a containerized, microservices based application that is packaged and distributed as a Helm chart. In addition to the controller Helm chart, an installer is also provided to help provision and operate the Kubernetes and storage infrastructure layer for the controller software.
Note
See the Cluster Architecture support article for more details. This content is only available to customers and partners, and requires a login to the support portal.
Air Gapped Environments¶
The self hosted controller can be deployed in "fully air gapped" environments.
All software and dependencies for the "controller" and "upstream Kubernetes clusters" are "pre-packaged" into the installer. Once the controller is installed, new upstream Kubernetes clusters can be provisioned, operated and kept up to date without requiring any software downloads from the Internet.
Management Options¶
Two management options are available for the self hosted controller
Self Managed¶
The customer deploys and operates the controller software on their network. The customer is responsible for installation, ongoing operations, upgrades etc.
See Self Managed Options for available configurations.
Managed¶
With the managed option for the self hosted controller, the customer can offload the operational burden of provisioning and ongoing maintenance of the controller. The controller software will be operated on the customer's infrastructure with remote access provided to our operational/support personnel.
Self Managed Options¶
Users of the self hosted controller can use the following configuration options:
HA Option¶
This option is designed and optimized for production use with a "highly available" (i.e. multi master Kubernetes cluster) deployment configuration with three Kubernetes master nodes and at least one worker node.
Note
Users can always expand the initial deployment anytime by adding worker nodes to the cluster as required.
Single Node Option¶
This option is primarily designed for non-production use (e.g. testing and demos). This allows the entire controller software stack to be provisioned on a single node cluster.
Converged Option¶
This option is designed for environments where "BOTH" the controller and the managed cluster need to be operated in the same instance/VM.
Important
This option will deploy a minimal version of the controller requiring fewer resources.