Fastest path to product evaluation
Use the hosted dashboard, project Quickstart, managed service endpoints, and Hermetiq Cloud MCP endpoint.
Deployments
Choose the right deployment boundary
Understand the hosted and customer-managed deployment paths, including identity, telemetry authentication, and data boundaries.
Deployment options
Hermetiq supports a hosted product path and customer-managed deployment paths. The right choice depends on security, identity, networking, data-boundary, and Buildbarn ownership requirements.
Run the platform inside your environment
Deploy Hermetiq services and supporting infrastructure in a customer-controlled Kubernetes environment.
Support matrix
Hermetiq Cloud
Hermetiq operates the application and service endpoints. Projects use the hosted dashboard, authentication, Quickstart, and MCP URL.
GKE
The Helm installation is tested on GKE 1.33.x. The guide includes GKE-oriented examples for storage, workload identity, Gateway, DNS, and TLS.
EKS and AKS
Conformant Kubernetes 1.32+ is supported when the cloud database, storage classes, ingress or Gateway, identity, DNS, and TLS pieces are mapped to provider equivalents.
Helm and charts
Helm 3.8+ is required for OCI charts. Hermetiq, Buildbarn, and worker-operator charts are distributed through the private ghcr.io/hermetiq registry.
Prerequisites
- A conformant Kubernetes 1.32+ cluster and cluster-administrator access for installation.
- Helm 3.8+,
kubectl, DNS and TLS ownership, and access to the private chart registry. - A PostgreSQL service, storage classes, secrets-management process, and an OIDC identity provider.
- Capacity and topology decisions for NATS JetStream, telemetry storage, and optional Buildbarn schedulers, storage, and workers.
- Approved external routes for the dashboard, APIs, MCP, BEP ingestion, and any Buildbarn gRPC or browser endpoints.
Optional components include VictoriaMetrics, Grafana, OpenTelemetry Collector, KEDA, and the Buildbarn worker operator.
Installation access
The full customer installation and operations guide is supplied with customer-managed evaluation or licensing access. It covers registry authentication, values files, PostgreSQL, OIDC/JWKS, workload identity, NATS, routing, telemetry, Buildbarn, licensing, upgrades, and air-gapped considerations.
- Confirm the target platform, domains, identity provider, storage, database, and Buildbarn topology with Hermetiq.
- Obtain read access to the private OCI chart packages and the current customer guide.
- Prepare an environment-specific values file without committing secrets.
- Install dependencies and Hermetiq in the documented order, then run the guide’s route, identity, ingestion, and worker validation checks.
Identity and authentication
Hosted users
Authenticated through the hosted Stytch integration.
Customer-managed users
The documented deployment path uses oauth2-proxy with the customer’s OIDC provider.
Machine ingestion
Customer-managed deployment tooling supports JWKS-based machine authentication for BEP ingestion.
MCP
Use the hosted OAuth flow or the authentication configuration for the customer-managed endpoint.
Upgrades and operations
Treat chart and dependency updates as controlled infrastructure changes:
- Read the target chart release notes and diff the rendered manifests and values against the deployed release.
- Back up PostgreSQL and any stateful services according to the organization’s recovery policy.
- Apply the upgrade in a non-production environment and verify login, project selection, BEP ingestion, MCP, cache/RBE routes, telemetry, and worker scaling.
- Promote the same reviewed values to production and retain the previous chart versions and values for rollback.
Operational ownership should cover certificates, registry access, database migrations and backups, NATS health, telemetry retention, Buildbarn capacity, and license renewal.
Data boundary
In customer-managed deployments, the application services and configured data stores run in the customer environment. The exact boundary still depends on the deployment’s external identity provider, cloud-managed services, artifact storage, and any integrations the customer chooses to enable.
Last reviewedSeptember 1, 2026