Choose the right deployment boundary

Start with Hermetiq on-prem

Run Hermetiq intelligence in your private cloud or data center. Choose whether Hermetiq also supplies the build infrastructure.

Prepare Kubernetes 1.32+, Helm 3.8+, PostgreSQL 16+ with pg_partman, identity, storage, DNS and TLS. Managed Builds also needs suitable worker capacity. Review the full prerequisites before installing.

The guide includes a self-service evaluation path. See installation and trial requirements, or use the optional AI installation skill for the documented GKE workflow.

Deployment options

Hermetiq supports a hosted product path and customer-managed deployment paths. The right choice depends on security, identity, networking, data-boundary, and Buildbarn ownership requirements.

Support matrix

Prerequisites

• A conformant Kubernetes 1.32+ cluster and cluster-administrator access for installation.
• Helm 3.8+, kubectl, DNS and TLS ownership, and a way to pull or mirror the published charts and application images.
• PostgreSQL 16+ with pg_partman, storage classes, a secrets-management process, and an OIDC identity provider.
• Capacity and topology decisions for NATS JetStream, telemetry storage, and optional Buildbarn schedulers, storage, and workers.
• Approved external routes for the dashboard, APIs, MCP, BEP ingestion, and any Buildbarn gRPC or browser endpoints.

Optional components include VictoriaMetrics, Grafana, OpenTelemetry Collector, KEDA, and the Buildbarn worker operator.

Install with Helm

The installation guide, starter values, and operations runbooks are public. You can start a self-hosted evaluation without scheduling a call.

1. Review the guide’s prerequisites and supported chart bundle, then choose your platform, domains, identity provider, storage, database, and Buildbarn topology.
2. Prepare an environment-specific values file without committing secrets. For a trial, supply a valid contact email and accept the software license agreement.
3. Install dependencies and Hermetiq in the documented order, then run the guide’s route, identity, ingestion, and worker validation checks.
4. Once the deployment is ready, connect your first Bazel build.

Identity and authentication

Upgrades and operations

Treat chart and dependency updates as controlled infrastructure changes:

1. Read the target chart release notes and diff the rendered manifests and values against the deployed release.
2. Back up PostgreSQL and any stateful services according to the organization’s recovery policy.
3. Apply the upgrade in a non-production environment and verify login, project selection, BEP ingestion, MCP, cache/RBE routes, telemetry, and worker scaling.
4. Promote the same reviewed values to production and retain the previous chart versions and values for rollback.

Operational ownership should cover certificates, registry access, database migrations and backups, NATS health, telemetry retention, Buildbarn capacity, and license renewal.

Data boundary

Cloud Managed Builds hosts cache, execution and intelligence with Hermetiq. Cloud Intelligence keeps your existing Buildbarn and sends connected build data to Hermetiq-hosted intelligence. With either On-Prem offering, Hermetiq intelligence and its configured data stores run in your environment.

Build data can include commands, file paths, logs and outputs, depending on the sources you enable. Review ingestion, storage retention and access for those sources. External identity providers, artifact stores and observability integrations can cross the deployment boundary.

AI clients receive the results they request over MCP. Their model provider and repository or terminal permissions are configured separately from Hermetiq hosting. Review agent access and changes alongside your deployment design.