[{"data":1,"prerenderedAt":1045},["ShallowReactive",2],{"navigation_docs":3,"-getting-started-prerequisites":136,"-getting-started-prerequisites-surround":1040},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":18,"body":138,"description":1034,"extension":1035,"links":1036,"meta":1037,"navigation":509,"path":19,"seo":1038,"stem":20,"__hash__":1039},"docs\u002F1.getting-started\u002F3.prerequisites.md",{"type":139,"value":140,"toc":1021},"minimark",[141,145,154,159,166,169,230,236,240,251,342,353,358,367,374,400,417,424,442,446,696,699,703,725,729,740,750,758,761,793,796,800,803,822,833,837,863,866,930,937,941,950,967,971,978,981,1003,1012,1017],[142,143,18],"h1",{"id":144},"prerequisites",[146,147,148,149,153],"p",{},"Everything here you set up once per cluster, before the first ",[150,151,152],"code",{},"helm install",". Reuse it for every deployment you put on that cluster afterwards. The activation code is the one exception: you mint that fresh, right before each install.",[155,156,158],"h2",{"id":157},"a-kubernetes-cluster","A Kubernetes cluster",[146,160,161,162,165],{},"Any conformant Kubernetes works. k3s on a single VPS, ",[150,163,164],{},"kind"," on your laptop, GKE, EKS, whatever you already run. The chart makes no cloud-specific assumptions: no Gateway API, no Workload Identity, no cloud secret manager.",[146,167,168],{},"A single-node k3s box is enough to get a deployment serving:",[170,171,176],"pre",{"className":172,"code":173,"language":174,"meta":175,"style":175},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -sfL https:\u002F\u002Fget.k3s.io | sh -s - --disable traefik\nexport KUBECONFIG=\u002Fetc\u002Francher\u002Fk3s\u002Fk3s.yaml\n","bash","",[150,177,178,213],{"__ignoreMap":175},[179,180,183,187,191,194,198,201,204,207,210],"span",{"class":181,"line":182},"line",1,[179,184,186],{"class":185},"sBMFI","curl",[179,188,190],{"class":189},"sfazB"," -sfL",[179,192,193],{"class":189}," https:\u002F\u002Fget.k3s.io",[179,195,197],{"class":196},"sMK4o"," |",[179,199,200],{"class":185}," sh",[179,202,203],{"class":189}," -s",[179,205,206],{"class":189}," -",[179,208,209],{"class":189}," --disable",[179,211,212],{"class":189}," traefik\n",[179,214,216,220,224,227],{"class":181,"line":215},2,[179,217,219],{"class":218},"spNyl","export",[179,221,223],{"class":222},"sTEyZ"," KUBECONFIG",[179,225,226],{"class":196},"=",[179,228,229],{"class":222},"\u002Fetc\u002Francher\u002Fk3s\u002Fk3s.yaml\n",[146,231,232,235],{},[150,233,234],{},"--disable traefik"," matters, because the chart's Ingress objects are nginx.",[155,237,239],{"id":238},"the-four-operators","The four operators",[146,241,242,243,246,247,250],{},"The chart renders custom resources for four things and expects an operator already running in the cluster to act on them: ",[150,244,245],{},"ingress-nginx"," for the Ingress objects, ",[150,248,249],{},"cert-manager"," for the certificates, CloudNativePG for Postgres, and Strimzi for Kafka. None of these ship with the chart. Install them once, before you install the chart itself.",[252,253,254,270],"table",{},[255,256,257],"thead",{},[258,259,260,264,267],"tr",{},[261,262,263],"th",{},"Operator",[261,265,266],{},"What it runs",[261,268,269],{},"Needed unless",[271,272,273,288,298,319],"tbody",{},[258,274,275,278,281],{},[276,277,245],"td",{},[276,279,280],{},"Routes traffic to the platform",[276,282,283,284,287],{},"you front it with your own gateway (",[150,285,286],{},"ingress.enabled=false",")",[258,289,290,292,295],{},[276,291,249],{},[276,293,294],{},"Issues the TLS certificate for your domain",[276,296,297],{},"same",[258,299,300,303,314],{},[276,301,302],{},"CloudNativePG",[276,304,305,306,309,310,313],{},"The Postgres ",[150,307,308],{},"Cluster"," (",[150,311,312],{},"postgres.mode: operator",", the default)",[276,315,316],{},[150,317,318],{},"postgres.mode=external",[258,320,321,324,337],{},[276,322,323],{},"Strimzi",[276,325,326,327,330,331,309,334,313],{},"The Kafka ",[150,328,329],{},"KafkaNodePool"," + ",[150,332,333],{},"Kafka",[150,335,336],{},"kafka.mode: operator",[276,338,339],{},[150,340,341],{},"kafka.mode=external",[146,343,344,345,348,349,352],{},"Redis is not on this list. It runs as a bundled StatefulSet either way (",[150,346,347],{},"redis.mode: bundled",", the default) or against a managed instance (",[150,350,351],{},"redis.mode: external","); there is no Redis operator involved.",[354,355,357],"h3",{"id":356},"the-one-command-path","The one-command path",[170,359,361],{"className":172,"code":360,"language":174,"meta":175,"style":175},".\u002Fdeploy\u002Fscripts\u002Finstall-prereqs.sh\n",[150,362,363],{"__ignoreMap":175},[179,364,365],{"class":181,"line":182},[179,366,360],{"class":185},[146,368,369,370,373],{},"It is a thin wrapper around plain ",[150,371,372],{},"helm upgrade --install"," calls, echoed before each one runs, so read it before pointing it at your own cluster. Skip a piece you already run:",[170,375,377],{"className":172,"code":376,"language":174,"meta":175,"style":175},".\u002Fdeploy\u002Fscripts\u002Finstall-prereqs.sh --skip-ingress --skip-cert-manager\n.\u002Fdeploy\u002Fscripts\u002Finstall-prereqs.sh --skip-cnpg --skip-strimzi\n",[150,378,379,390],{"__ignoreMap":175},[179,380,381,384,387],{"class":181,"line":182},[179,382,383],{"class":185},".\u002Fdeploy\u002Fscripts\u002Finstall-prereqs.sh",[179,385,386],{"class":189}," --skip-ingress",[179,388,389],{"class":189}," --skip-cert-manager\n",[179,391,392,394,397],{"class":181,"line":215},[179,393,383],{"class":185},[179,395,396],{"class":189}," --skip-cnpg",[179,398,399],{"class":189}," --skip-strimzi\n",[146,401,402,403,406,407,410,411,413,414,416],{},"If you set ",[150,404,405],{},"postgres.mode: external"," or ",[150,408,409],{},"kafka.mode: external",", skip the matching operator entirely: the chart never renders a ",[150,412,308],{}," or a ",[150,415,333],{}," object in external mode, so there is nothing for CNPG or Strimzi to act on.",[146,418,419,420,423],{},"Strimzi's operator image is large and pulls from ",[150,421,422],{},"quay.io",". The script waits up to 15 minutes per install by default; on a slow link raise it:",[170,425,427],{"className":172,"code":426,"language":174,"meta":175,"style":175},"WAIT_TIMEOUT=25m .\u002Fdeploy\u002Fscripts\u002Finstall-prereqs.sh\n",[150,428,429],{"__ignoreMap":175},[179,430,431,434,436,439],{"class":181,"line":182},[179,432,433],{"class":222},"WAIT_TIMEOUT",[179,435,226],{"class":196},[179,437,438],{"class":189},"25m",[179,440,441],{"class":185}," .\u002Fdeploy\u002Fscripts\u002Finstall-prereqs.sh\n",[354,443,445],{"id":444},"the-raw-commands-if-you-would-rather-not-run-a-script-against-your-cluster","The raw commands, if you would rather not run a script against your cluster",[170,447,449],{"className":172,"code":448,"language":174,"meta":175,"style":175},"# ingress-nginx\nhelm repo add ingress-nginx https:\u002F\u002Fkubernetes.github.io\u002Fingress-nginx\nhelm upgrade --install ingress-nginx ingress-nginx\u002Fingress-nginx \\\n  -n ingress-nginx --create-namespace\n\n# cert-manager (see the Autopilot callout below before you skip the leaderElection flag)\nhelm repo add jetstack https:\u002F\u002Fcharts.jetstack.io\nhelm upgrade --install cert-manager jetstack\u002Fcert-manager \\\n  -n cert-manager --create-namespace \\\n  --set crds.enabled=true \\\n  --set global.leaderElection.namespace=cert-manager\n\n# CloudNativePG (runs Postgres)\nhelm repo add cnpg https:\u002F\u002Fcloudnative-pg.github.io\u002Fcharts\nhelm upgrade --install cnpg cnpg\u002Fcloudnative-pg \\\n  -n cnpg-system --create-namespace\n\n# Strimzi (runs Kafka, cluster-wide)\nhelm repo add strimzi https:\u002F\u002Fstrimzi.io\u002Fcharts\u002F\nhelm upgrade --install strimzi strimzi\u002Fstrimzi-kafka-operator \\\n  -n strimzi-system --create-namespace --set watchAnyNamespace=true\n",[150,450,451,457,474,493,504,511,517,532,549,561,575,583,588,594,609,625,635,640,646,661,677],{"__ignoreMap":175},[179,452,453],{"class":181,"line":182},[179,454,456],{"class":455},"sHwdD","# ingress-nginx\n",[179,458,459,462,465,468,471],{"class":181,"line":215},[179,460,461],{"class":185},"helm",[179,463,464],{"class":189}," repo",[179,466,467],{"class":189}," add",[179,469,470],{"class":189}," ingress-nginx",[179,472,473],{"class":189}," https:\u002F\u002Fkubernetes.github.io\u002Fingress-nginx\n",[179,475,477,479,482,485,487,490],{"class":181,"line":476},3,[179,478,461],{"class":185},[179,480,481],{"class":189}," upgrade",[179,483,484],{"class":189}," --install",[179,486,470],{"class":189},[179,488,489],{"class":189}," ingress-nginx\u002Fingress-nginx",[179,491,492],{"class":222}," \\\n",[179,494,496,499,501],{"class":181,"line":495},4,[179,497,498],{"class":189},"  -n",[179,500,470],{"class":189},[179,502,503],{"class":189}," --create-namespace\n",[179,505,507],{"class":181,"line":506},5,[179,508,510],{"emptyLinePlaceholder":509},true,"\n",[179,512,514],{"class":181,"line":513},6,[179,515,516],{"class":455},"# cert-manager (see the Autopilot callout below before you skip the leaderElection flag)\n",[179,518,520,522,524,526,529],{"class":181,"line":519},7,[179,521,461],{"class":185},[179,523,464],{"class":189},[179,525,467],{"class":189},[179,527,528],{"class":189}," jetstack",[179,530,531],{"class":189}," https:\u002F\u002Fcharts.jetstack.io\n",[179,533,535,537,539,541,544,547],{"class":181,"line":534},8,[179,536,461],{"class":185},[179,538,481],{"class":189},[179,540,484],{"class":189},[179,542,543],{"class":189}," cert-manager",[179,545,546],{"class":189}," jetstack\u002Fcert-manager",[179,548,492],{"class":222},[179,550,552,554,556,559],{"class":181,"line":551},9,[179,553,498],{"class":189},[179,555,543],{"class":189},[179,557,558],{"class":189}," --create-namespace",[179,560,492],{"class":222},[179,562,564,567,570,573],{"class":181,"line":563},10,[179,565,566],{"class":189},"  --set",[179,568,569],{"class":189}," crds.enabled=",[179,571,572],{"class":196},"true",[179,574,492],{"class":222},[179,576,578,580],{"class":181,"line":577},11,[179,579,566],{"class":189},[179,581,582],{"class":189}," global.leaderElection.namespace=cert-manager\n",[179,584,586],{"class":181,"line":585},12,[179,587,510],{"emptyLinePlaceholder":509},[179,589,591],{"class":181,"line":590},13,[179,592,593],{"class":455},"# CloudNativePG (runs Postgres)\n",[179,595,597,599,601,603,606],{"class":181,"line":596},14,[179,598,461],{"class":185},[179,600,464],{"class":189},[179,602,467],{"class":189},[179,604,605],{"class":189}," cnpg",[179,607,608],{"class":189}," https:\u002F\u002Fcloudnative-pg.github.io\u002Fcharts\n",[179,610,612,614,616,618,620,623],{"class":181,"line":611},15,[179,613,461],{"class":185},[179,615,481],{"class":189},[179,617,484],{"class":189},[179,619,605],{"class":189},[179,621,622],{"class":189}," cnpg\u002Fcloudnative-pg",[179,624,492],{"class":222},[179,626,628,630,633],{"class":181,"line":627},16,[179,629,498],{"class":189},[179,631,632],{"class":189}," cnpg-system",[179,634,503],{"class":189},[179,636,638],{"class":181,"line":637},17,[179,639,510],{"emptyLinePlaceholder":509},[179,641,643],{"class":181,"line":642},18,[179,644,645],{"class":455},"# Strimzi (runs Kafka, cluster-wide)\n",[179,647,649,651,653,655,658],{"class":181,"line":648},19,[179,650,461],{"class":185},[179,652,464],{"class":189},[179,654,467],{"class":189},[179,656,657],{"class":189}," strimzi",[179,659,660],{"class":189}," https:\u002F\u002Fstrimzi.io\u002Fcharts\u002F\n",[179,662,664,666,668,670,672,675],{"class":181,"line":663},20,[179,665,461],{"class":185},[179,667,481],{"class":189},[179,669,484],{"class":189},[179,671,657],{"class":189},[179,673,674],{"class":189}," strimzi\u002Fstrimzi-kafka-operator",[179,676,492],{"class":222},[179,678,680,682,685,687,690,693],{"class":181,"line":679},21,[179,681,498],{"class":189},[179,683,684],{"class":189}," strimzi-system",[179,686,558],{"class":189},[179,688,689],{"class":189}," --set",[179,691,692],{"class":189}," watchAnyNamespace=",[179,694,695],{"class":196},"true\n",[146,697,698],{},"Already running CNPG or Strimzi on this cluster for something else? Keep yours. The chart only needs the CRDs registered and does not care who installed the operator.",[354,700,702],{"id":701},"the-chart-checks-for-you","The chart checks for you",[146,704,705,706,406,709,712,713,715,716,406,718,720,721,724],{},"If you try to install with ",[150,707,708],{},"postgres.mode=operator",[150,710,711],{},"kafka.mode=operator"," and the matching CRDs are not registered, ",[150,714,152],{}," fails immediately with a message naming the missing operator and the install command, instead of silently rendering a ",[150,717,308],{},[150,719,333],{}," object nobody reconciles. That is intentional: ",[722,723,116],"a",{"href":117}," has the full message and what to do with it.",[155,726,728],{"id":727},"cert-manager-on-gke-autopilot","cert-manager on GKE Autopilot",[146,730,731,732,735,736,739],{},"If your cluster is a GKE Autopilot cluster, do not skip ",[150,733,734],{},"--set global.leaderElection.namespace=cert-manager",". ",[150,737,738],{},"install-prereqs.sh"," sets it unconditionally, for this reason.",[146,741,742,743,746,747,749],{},"cert-manager defaults leader election to the ",[150,744,745],{},"kube-system"," namespace. Autopilot's Warden admission controller blocks anything writing to ",[150,748,745],{},", so cainjector never wins the leader election, never becomes leader, and never injects the CA bundle into any webhook. Every certificate you try to create afterwards fails with:",[170,751,756],{"className":752,"code":754,"language":755},[753],"language-text","x509: certificate signed by unknown authority\n","text",[150,757,754],{"__ignoreMap":175},[146,759,760],{},"That error points at TLS, not at leader election, so it is easy to lose an afternoon chasing the wrong cause. If you see it on a GKE Autopilot cluster, check cainjector's logs for a leader-election denial before you touch DNS or the ClusterIssuer:",[170,762,764],{"className":172,"code":763,"language":174,"meta":175,"style":175},"kubectl -n cert-manager logs deploy\u002Fcert-manager-cainjector | grep -i leader\n",[150,765,766],{"__ignoreMap":175},[179,767,768,771,774,776,779,782,784,787,790],{"class":181,"line":182},[179,769,770],{"class":185},"kubectl",[179,772,773],{"class":189}," -n",[179,775,543],{"class":189},[179,777,778],{"class":189}," logs",[179,780,781],{"class":189}," deploy\u002Fcert-manager-cainjector",[179,783,197],{"class":196},[179,785,786],{"class":185}," grep",[179,788,789],{"class":189}," -i",[179,791,792],{"class":189}," leader\n",[146,794,795],{},"The fix is the one flag above. It is harmless on every other cluster, which is why the install script always sets it.",[155,797,799],{"id":798},"a-dns-name-you-control","A DNS name you control",[146,801,802],{},"You need a hostname pointing at your cluster's ingress IP before you install, not after. cert-manager cannot issue a certificate for a name that does not resolve, so a missing record shows up as an Ingress stuck without TLS.",[146,804,805,806,809,810,813,814,817,818,821],{},"Point either a wildcard ",[150,807,808],{},"*.yourdomain.com"," A record, or individual A records for the hosts you plan to use (",[150,811,812],{},"platform.host",", and ",[150,815,816],{},"ingress.hosts.app"," \u002F ",[150,819,820],{},"ingress.hosts.realtime"," if you split them), at the ingress controller's external IP.",[146,823,824,825,828,829,832],{},"The chart does not create DNS records. ",[150,826,827],{},"ingress.externalDNS"," is ",[150,830,831],{},"false"," by default, meaning you manage the record yourself. Turn it on only if you already run external-dns.",[155,834,836],{"id":835},"pull-access-to-the-images","Pull access to the images",[146,838,839,840,843,844,843,847,843,850,843,853,843,856,813,859,862],{},"Every first-party image ships from GHCR: ",[150,841,842],{},"ghcr.io\u002Fsolvegio\u002Fmvne-api",", ",[150,845,846],{},"mvno-api",[150,848,849],{},"mvne",[150,851,852],{},"mvno",[150,854,855],{},"ess",[150,857,858],{},"realtime",[150,860,861],{},"license-agent",". If those packages are public for you, there is nothing to do.",[146,864,865],{},"If they are private, create a pull secret in the namespace you are installing into and name it at install:",[170,867,869],{"className":172,"code":868,"language":174,"meta":175,"style":175},"kubectl create secret docker-registry ghcr-pull \\\n  --docker-server=ghcr.io --docker-username=\u003Cuser> --docker-password=\u003Cpat> \\\n  -n my-mvno\n# then add: --set imagePullSecret=ghcr-pull\n",[150,870,871,889,918,925],{"__ignoreMap":175},[179,872,873,875,878,881,884,887],{"class":181,"line":182},[179,874,770],{"class":185},[179,876,877],{"class":189}," create",[179,879,880],{"class":189}," secret",[179,882,883],{"class":189}," docker-registry",[179,885,886],{"class":189}," ghcr-pull",[179,888,492],{"class":222},[179,890,891,894,897,900,903,906,909,911,914,916],{"class":181,"line":215},[179,892,893],{"class":189},"  --docker-server=ghcr.io",[179,895,896],{"class":189}," --docker-username=",[179,898,899],{"class":196},"\u003C",[179,901,902],{"class":189},"user",[179,904,905],{"class":196},">",[179,907,908],{"class":189}," --docker-password=",[179,910,899],{"class":196},[179,912,913],{"class":189},"pat",[179,915,905],{"class":196},[179,917,492],{"class":222},[179,919,920,922],{"class":181,"line":476},[179,921,498],{"class":189},[179,923,924],{"class":189}," my-mvno\n",[179,926,927],{"class":181,"line":495},[179,928,929],{"class":455},"# then add: --set imagePullSecret=ghcr-pull\n",[146,931,932,933,936],{},"Mirroring the images into your own registry, for restricted egress or an airgapped cluster, is covered in ",[722,934,935],{"href":62},"Registry and airgap",".",[155,938,940],{"id":939},"transactional-email-or-turning-it-off","Transactional email, or turning it off",[146,942,943,946,947,949],{},[150,944,945],{},"ess.enabled"," defaults to ",[150,948,572],{},", and Kafka is wired by default. That combination means a bare install with no Resend key used to fail late, as a crashlooping pod. It now fails at render, with a clear message, before anything gets scheduled. Decide which side of this you want before you install:",[951,952,953,961],"ul",{},[954,955,956,957,960],"li",{},"Set ",[150,958,959],{},"--set auth.resendAPIKey=\u003Cyour Resend key>"," to send transactional email through Resend.",[954,962,956,963,966],{},[150,964,965],{},"--set ess.enabled=false"," to install without transactional email at all.",[155,968,970],{"id":969},"an-activation-code","An activation code",[146,972,973,974,977],{},"The one licensing value. You mint it in the Hub console for the specific deployment you are about to install, and you pass it as ",[150,975,976],{},"activation.code",". The license agent redeems it once, on first enrollment, and gets back a signed lease.",[146,979,980],{},"Two properties of the code matter for how you plan the install:",[951,982,983,997],{},[954,984,985,989,990,993,994,996],{},[986,987,988],"strong",{},"It is single use."," The agent consumes it on the first successful enrollment. Re-running ",[150,991,992],{},"helm upgrade"," with the same value in ",[150,995,976],{}," is a no-op, not a second activation, so it is safe to leave it in your values.",[954,998,999,1002],{},[986,1000,1001],{},"It is short lived."," The default TTL is 15 minutes from the moment you mint it.",[146,1004,1005,1006,1008,1009,1011],{},"Mint the code when you are ready to run ",[150,1007,152],{},", not the day before. A code that has expired is not an error you can work around at install time; you go back to the console and mint another one. ",[722,1010,36],{"href":37}," covers the flow, including activating an MVNO against your own MVNE instead of the public Hub.",[146,1013,1014,1015,936],{},"With all of this in place, go to the ",[722,1016,22],{"href":23},[1018,1019,1020],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}",{"title":175,"searchDepth":182,"depth":215,"links":1022},[1023,1024,1029,1030,1031,1032,1033],{"id":157,"depth":215,"text":158},{"id":238,"depth":215,"text":239,"children":1025},[1026,1027,1028],{"id":356,"depth":476,"text":357},{"id":444,"depth":476,"text":445},{"id":701,"depth":476,"text":702},{"id":727,"depth":215,"text":728},{"id":798,"depth":215,"text":799},{"id":835,"depth":215,"text":836},{"id":939,"depth":215,"text":940},{"id":969,"depth":215,"text":970},"The cluster, the four operators, DNS, image pull access, and an activation code you need before you run helm install.","md",null,{},{"title":18,"description":1034},"3zLQ3XFOUyvuX9nmnt0xWX2JuCktwSfY-3ZLRr_Vg-I",[1041,1043],{"title":14,"path":15,"stem":16,"description":1042,"children":-1},"What a single helm install of the platform chart brings up in your namespace, and what each piece does.",{"title":22,"path":23,"stem":24,"description":1044,"children":-1},"Install the chart, watch it enroll against the Hub, and confirm the deployment is licensed and serving.",1783967741116]