Quickstart

The shortest path from an empty namespace to a serving deployment. It assumes you have already worked through Prerequisites: a cluster with ingress-nginx and cert-manager, a DNS record pointing at it, and pull access to the images.

1. Mint an activation code

In the Hub console, open the deployment you are installing and mint an activation code for it. The code is single use and expires in 15 minutes, so do this immediately before the next step.

2. Install

helm install my-mvno oci://ghcr.io/solvegio/charts/platform --version <version> \
  --namespace my-mvno --create-namespace \
  --set platform.kind=mvno \
  --set platform.host=esim.acme.com \
  --set activation.code=<code-from-the-hub-console>

That is the whole install. Swap mvno for mvne to install an MVNE. Nothing else about the command changes: the API image and the web image both derive from platform.kind.

Everything not on that command line either defaults or generates itself: the JWT secret, the encryption keypair, the Postgres and Redis passwords, the connection strings, and the bundled Postgres, Redis and Kafka. Generated values are persisted across helm upgrade, so an upgrade never rotates a credential a running deployment depends on.

Add --set imagePullSecret=ghcr-pull if the images are private to you.

3. Watch it come up

kubectl -n my-mvno get pods -w

The API and the license agent start at the same time. The API sits in Init:0/2 while its wait-for-lease initContainer blocks, and it stays there until the agent has enrolled and written the lease. That is the expected shape, not a deadlock. Watch the agent do its work:

kubectl -n my-mvno logs deploy/my-mvno-platform-license-agent -f

Once the lease lands, wait-for-lease releases and the API rolls out.

kubectl -n my-mvno rollout status deploy/my-mvno-platform-api --timeout=180s

4. Confirm it is licensed

The agent writes the signed lease into the platform Secret as PARENT_LEASE_TOKEN. A non-empty value means the deployment enrolled successfully and holds a live license:

kubectl -n my-mvno get secret my-mvno-platform-env \
  -o jsonpath='{.data.PARENT_LEASE_TOKEN}' | base64 -d | head -c 20; echo

Empty output means the agent has not enrolled. Its logs will say why, and Licensing failures covers the common causes (an expired code, a code already redeemed by another install, no egress to the Hub).

Then hit the API:

curl -sf https://esim.acme.com/health

An unlicensed deployment never reaches this point, because the API would still be blocked in wait-for-lease. A 200 here means the chain worked end to end: code redeemed, lease minted, lease written, API serving.

5. Turn on the web tier

The install above brings up the API, auth, the data services and the license agent. The web tier is off by default. To serve the storefront (or the MVNE console), enable it and give it a hostname:

helm upgrade my-mvno oci://ghcr.io/solvegio/charts/platform --version <version> \
  --reuse-values \
  --set app.enabled=true \
  --set ingress.hosts.app=shop.acme.com

The app Ingress only renders when the workload is enabled and a host is set. Without a host, the app runs but stays reachable inside the cluster only.

Next

Walk through Verify your install to check the pieces this page did not: the auth realm, the email pipeline, and the heartbeat reaching the Hub.