[{"data":1,"prerenderedAt":626},["ShallowReactive",2],{"navigation_docs":3,"-getting-started-quickstart":136,"-getting-started-quickstart-surround":621},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":22,"body":138,"description":614,"extension":615,"links":616,"meta":617,"navigation":618,"path":23,"seo":619,"stem":24,"__hash__":620},"docs\u002F1.getting-started\u002F4.quickstart.md",{"type":139,"value":140,"toc":605},"minimark",[141,145,153,158,166,183,189,193,196,200,294,308,315,322,326,350,361,383,389,414,418,425,492,498,501,517,527,531,534,588,591,595,601],[142,143,22],"h1",{"id":144},"quickstart",[146,147,148,149,152],"p",{},"The shortest path from an empty namespace to a serving deployment. It assumes you have already worked through ",[150,151,18],"a",{"href":19},".",[154,155,157],"h2",{"id":156},"_0-prerequisites","0. Prerequisites",[146,159,160,161,165],{},"Postgres and Kafka run under CloudNativePG and Strimzi by default, so both need to be installed in the cluster before ",[162,163,164],"code",{},"helm install",", alongside ingress-nginx and cert-manager. The one-command path installs all four:",[167,168,173],"pre",{"className":169,"code":170,"language":171,"meta":172,"style":172},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight",".\u002Fdeploy\u002Fscripts\u002Finstall-prereqs.sh\n","bash","",[162,174,175],{"__ignoreMap":172},[176,177,180],"span",{"class":178,"line":179},"line",1,[176,181,170],{"class":182},"sBMFI",[146,184,185,186,188],{},"Already have a DNS record pointing at the cluster, and pull access to the images? ",[150,187,18],{"href":19}," covers those too, including the GKE Autopilot cert-manager trap if that is where you are installing.",[154,190,192],{"id":191},"_1-mint-an-activation-code","1. Mint an activation code",[146,194,195],{},"In the Hub console, open the deployment you are installing and mint an activation code for it. The code is single use and expires in 15 minutes, so do this immediately before the next step.",[154,197,199],{"id":198},"_2-install","2. Install",[167,201,203],{"className":169,"code":202,"language":171,"meta":172,"style":172},"helm install my-mvno oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform --version \u003Cversion> \\\n  --namespace my-mvno --create-namespace \\\n  --set platform.kind=mvno \\\n  --set platform.host=esim.acme.com \\\n  --set activation.code=\u003Ccode-from-the-hub-console>\n",[162,204,205,240,253,264,274],{"__ignoreMap":172},[176,206,207,210,214,217,220,223,227,230,234,237],{"class":178,"line":179},[176,208,209],{"class":182},"helm",[176,211,213],{"class":212},"sfazB"," install",[176,215,216],{"class":212}," my-mvno",[176,218,219],{"class":212}," oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform",[176,221,222],{"class":212}," --version",[176,224,226],{"class":225},"sMK4o"," \u003C",[176,228,229],{"class":212},"versio",[176,231,233],{"class":232},"sTEyZ","n",[176,235,236],{"class":225},">",[176,238,239],{"class":232}," \\\n",[176,241,243,246,248,251],{"class":178,"line":242},2,[176,244,245],{"class":212},"  --namespace",[176,247,216],{"class":212},[176,249,250],{"class":212}," --create-namespace",[176,252,239],{"class":232},[176,254,256,259,262],{"class":178,"line":255},3,[176,257,258],{"class":212},"  --set",[176,260,261],{"class":212}," platform.kind=mvno",[176,263,239],{"class":232},[176,265,267,269,272],{"class":178,"line":266},4,[176,268,258],{"class":212},[176,270,271],{"class":212}," platform.host=esim.acme.com",[176,273,239],{"class":232},[176,275,277,279,282,285,288,291],{"class":178,"line":276},5,[176,278,258],{"class":212},[176,280,281],{"class":212}," activation.code=",[176,283,284],{"class":225},"\u003C",[176,286,287],{"class":212},"code-from-the-hub-consol",[176,289,290],{"class":232},"e",[176,292,293],{"class":225},">\n",[146,295,296,297,300,301,304,305,152],{},"That is the whole install. Swap ",[162,298,299],{},"mvno"," for ",[162,302,303],{},"mvne"," to install an MVNE. Nothing else about the command changes: the API image and the web image both derive from ",[162,306,307],{},"platform.kind",[146,309,310,311,314],{},"Everything not on that command line either defaults or generates itself: the JWT secret, the encryption keypair, the Postgres and Redis passwords, the connection strings, and the bundled Postgres, Redis and Kafka. Generated values are persisted across ",[162,312,313],{},"helm upgrade",", so an upgrade never rotates a credential a running deployment depends on.",[146,316,317,318,321],{},"Add ",[162,319,320],{},"--set imagePullSecret=ghcr-pull"," if the images are private to you.",[154,323,325],{"id":324},"_3-watch-it-come-up","3. Watch it come up",[167,327,329],{"className":169,"code":328,"language":171,"meta":172,"style":172},"kubectl -n my-mvno get pods -w\n",[162,330,331],{"__ignoreMap":172},[176,332,333,336,339,341,344,347],{"class":178,"line":179},[176,334,335],{"class":182},"kubectl",[176,337,338],{"class":212}," -n",[176,340,216],{"class":212},[176,342,343],{"class":212}," get",[176,345,346],{"class":212}," pods",[176,348,349],{"class":212}," -w\n",[146,351,352,353,356,357,360],{},"The API and the license agent start at the same time. The API sits in ",[162,354,355],{},"Init:0\u002F2"," while its ",[162,358,359],{},"wait-for-lease"," initContainer blocks, and it stays there until the agent has enrolled and written the lease. That is the expected shape, not a deadlock. Watch the agent do its work:",[167,362,364],{"className":169,"code":363,"language":171,"meta":172,"style":172},"kubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-license-agent -f\n",[162,365,366],{"__ignoreMap":172},[176,367,368,370,372,374,377,380],{"class":178,"line":179},[176,369,335],{"class":182},[176,371,338],{"class":212},[176,373,216],{"class":212},[176,375,376],{"class":212}," logs",[176,378,379],{"class":212}," deploy\u002Fmy-mvno-platform-license-agent",[176,381,382],{"class":212}," -f\n",[146,384,385,386,388],{},"Once the lease lands, ",[162,387,359],{}," releases and the API rolls out.",[167,390,392],{"className":169,"code":391,"language":171,"meta":172,"style":172},"kubectl -n my-mvno rollout status deploy\u002Fmy-mvno-platform-api --timeout=180s\n",[162,393,394],{"__ignoreMap":172},[176,395,396,398,400,402,405,408,411],{"class":178,"line":179},[176,397,335],{"class":182},[176,399,338],{"class":212},[176,401,216],{"class":212},[176,403,404],{"class":212}," rollout",[176,406,407],{"class":212}," status",[176,409,410],{"class":212}," deploy\u002Fmy-mvno-platform-api",[176,412,413],{"class":212}," --timeout=180s\n",[154,415,417],{"id":416},"_4-confirm-it-is-licensed","4. Confirm it is licensed",[146,419,420,421,424],{},"The agent writes the signed lease into the platform Secret as ",[162,422,423],{},"PARENT_LEASE_TOKEN",". A non-empty value means the deployment enrolled successfully and holds a live license:",[167,426,428],{"className":169,"code":427,"language":171,"meta":172,"style":172},"kubectl -n my-mvno get secret my-mvno-platform-env \\\n  -o jsonpath='{.data.PARENT_LEASE_TOKEN}' | base64 -d | head -c 20; echo\n",[162,429,430,448],{"__ignoreMap":172},[176,431,432,434,436,438,440,443,446],{"class":178,"line":179},[176,433,335],{"class":182},[176,435,338],{"class":212},[176,437,216],{"class":212},[176,439,343],{"class":212},[176,441,442],{"class":212}," secret",[176,444,445],{"class":212}," my-mvno-platform-env",[176,447,239],{"class":232},[176,449,450,453,456,459,462,464,467,470,473,475,478,481,485,488],{"class":178,"line":242},[176,451,452],{"class":212},"  -o",[176,454,455],{"class":212}," jsonpath=",[176,457,458],{"class":225},"'",[176,460,461],{"class":212},"{.data.PARENT_LEASE_TOKEN}",[176,463,458],{"class":225},[176,465,466],{"class":225}," |",[176,468,469],{"class":182}," base64",[176,471,472],{"class":212}," -d",[176,474,466],{"class":225},[176,476,477],{"class":182}," head",[176,479,480],{"class":212}," -c",[176,482,484],{"class":483},"sbssI"," 20",[176,486,487],{"class":225},";",[176,489,491],{"class":490},"s2Zo4"," echo\n",[146,493,494,495,497],{},"Empty output means the agent has not enrolled. Its logs will say why, and ",[150,496,120],{"href":121}," covers the common causes (an expired code, a code already redeemed by another install, no egress to the Hub).",[146,499,500],{},"Then hit the API:",[167,502,504],{"className":169,"code":503,"language":171,"meta":172,"style":172},"curl -sf https:\u002F\u002Fesim.acme.com\u002Fhealth\n",[162,505,506],{"__ignoreMap":172},[176,507,508,511,514],{"class":178,"line":179},[176,509,510],{"class":182},"curl",[176,512,513],{"class":212}," -sf",[176,515,516],{"class":212}," https:\u002F\u002Fesim.acme.com\u002Fhealth\n",[146,518,519,520,522,523,526],{},"An unlicensed deployment never reaches this point, because the API would still be blocked in ",[162,521,359],{},". A ",[162,524,525],{},"200"," here means the chain worked end to end: code redeemed, lease minted, lease written, API serving.",[154,528,530],{"id":529},"_5-turn-on-the-web-tier","5. Turn on the web tier",[146,532,533],{},"The install above brings up the API, auth, the data services and the license agent. The web tier is off by default. To serve the storefront (or the MVNE console), enable it and give it a hostname:",[167,535,537],{"className":169,"code":536,"language":171,"meta":172,"style":172},"helm upgrade my-mvno oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform --version \u003Cversion> \\\n  --reuse-values \\\n  --set app.enabled=true \\\n  --set ingress.hosts.app=shop.acme.com\n",[162,538,539,562,569,581],{"__ignoreMap":172},[176,540,541,543,546,548,550,552,554,556,558,560],{"class":178,"line":179},[176,542,209],{"class":182},[176,544,545],{"class":212}," upgrade",[176,547,216],{"class":212},[176,549,219],{"class":212},[176,551,222],{"class":212},[176,553,226],{"class":225},[176,555,229],{"class":212},[176,557,233],{"class":232},[176,559,236],{"class":225},[176,561,239],{"class":232},[176,563,564,567],{"class":178,"line":242},[176,565,566],{"class":212},"  --reuse-values",[176,568,239],{"class":232},[176,570,571,573,576,579],{"class":178,"line":255},[176,572,258],{"class":212},[176,574,575],{"class":212}," app.enabled=",[176,577,578],{"class":225},"true",[176,580,239],{"class":232},[176,582,583,585],{"class":178,"line":266},[176,584,258],{"class":212},[176,586,587],{"class":212}," ingress.hosts.app=shop.acme.com\n",[146,589,590],{},"The app Ingress only renders when the workload is enabled and a host is set. Without a host, the app runs but stays reachable inside the cluster only.",[154,592,594],{"id":593},"next","Next",[146,596,597,598,600],{},"Walk through ",[150,599,44],{"href":45}," to check the pieces this page did not: the auth realm, the email pipeline, and the heartbeat reaching the Hub.",[602,603,604],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}",{"title":172,"searchDepth":179,"depth":242,"links":606},[607,608,609,610,611,612,613],{"id":156,"depth":242,"text":157},{"id":191,"depth":242,"text":192},{"id":198,"depth":242,"text":199},{"id":324,"depth":242,"text":325},{"id":416,"depth":242,"text":417},{"id":529,"depth":242,"text":530},{"id":593,"depth":242,"text":594},"Install the chart, watch it enroll against the Hub, and confirm the deployment is licensed and serving.","md",null,{},true,{"title":22,"description":614},"MY4hSOds00RFvPJX-JZCYAnd6fSU-BbXLMpOaj3lKdM",[622,624],{"title":18,"path":19,"stem":20,"description":623,"children":-1},"The cluster, the four operators, DNS, image pull access, and an activation code you need before you run helm install.",{"title":32,"path":33,"stem":34,"description":625,"children":-1},"Install a self-hosted MVNE or MVNO from the published OCI chart with two values.",1783967740854]