Skip to main content
Version: v3.x

CloudPrem Deployment

warning

This feature is available in the Enterprise Edition of The Formance Platform.

Requirements​

  • Kubernetes
  • Helm
  • Ingress Controller
  • SSL Certificate
  • Oauth2 / OIDC Provider (eg: Dex)
  • Enterprise Edition (EE) license

Deployment Membership on Kubernetes​

We will start by creating the values.yaml file, which will contain the configuration values for our deployment. This will make our deployment more flexible and allow us to reuse this file for other deployments.

In this example, we will deploy a CloudPrem application consisting of several services:

  • Dex (OAuth2 / OIDC Provider)
  • Membership (Management API)
  • Console (Graphical Interface)
  • PostgreSQL (Database)
warning

Please note, the following values are examples and must be adapted to your environment. The PostgreSQL configuration does not provide any data persistence.

You can retrieve the values.yaml file with the following command:

# helm show values oci://ghcr.io/formancehq/helm/cloudprem --version v3.0.0 > values.yaml

You can adapt the configuration to your own needs, however, there are some minimum values that you need to replace. If you want more information about the values, please refer to the helm documentation.

export YOUR_LICENCE=$YOUR_LICENCE_KEY
export YOUR_CLUSTER_ID=$YOUR_CLUSTER_ID
export BASE_DOMAIN=example.com
export BASE_DOMAIN_WILDCARD_CERTIFICATE=example-com-wildcard-certificate-tls

helm install cloudprem oci://ghcr.io/formancehq/helm/cloudprem \
  --version v3.0.0 \
  --namespace formance-system \
  --create-namespace \
  --set global.licence.token=$YOUR_LICENCE_KEY \
  --set global.licence.clusterID=$YOUR_CLUSTER_ID \
  --set global.serviceHost=$BASE_DOMAIN \
  --set membership.ingress.tls[0].secretName=$BASE_DOMAIN_WILDCARD_CERTIFICATE \
  --set portal.ingress.tls[0].secretName=$BASE_DOMAIN_WILDCARD_CERTIFICATE \
  --set console.ingress.tls[0].secretName=$BASE_DOMAIN_WILDCARD_CERTIFICATE \
  --set dex.ingress.tls[0].secretName=$BASE_DOMAIN_WILDCARD_CERTIFICATE
warning

The use of this feature requires an Enterprise Edition (EE) license. Please ensure you have the appropriate license before enabling it.

Configuration of Membership​

Create a valid Dex configuration​

By default, we deploy a Dex as an OIDC / oAuth2 provider. This allows us to create default users that you can use.

It also enables us to connect protocols such as SAMLv2 to OIDC. To do this, you need to follow Dex's documentation to create a valid configuration.

warning

You can also choose not to deploy Dex and modify Membership's OIDC configuration to talk directly to the OIDC provider of your choice.

Login to the cluster​

fctl --profile demo login --membership-uri https://membership.BASE_URL/api

This will create a new organization and a user.

Add a domain for Auto Login​

fctl cloud organizations list
fctl cloud organizations update ORGANIZATION_ID --domain=DOMAIN_NAME --default-organization-role=GUEST --default-stack-role=GUEST
fctl cloud organizations list

The possible values are GUEST or ADMIN. This allows assigning default rights to a user who logs in with an email from the DOMAIN_NAME domain.

Init databases​

We will now create a region and a stack in the Membership database. To do this, replace BASE_URL with the domain of your choice.

warning

By default, all communications between Console and your Stack remain internal to the Kubernetes cluster.

insert into membership."regions" (id, base_url, name, creator_id, created_at, production, active) values (
    gen_random_uuid(),
    'https://BASE_URL',
    'default',
    (select id from membership."users" where id = (
        select owner_id from membership."organizations" limit 1
    )),
    now(),
    true,
    true
);
insert into membership."stacks" (name, organization_id, id, region_id, created_at, updated_at, stargate_enabled, client_secret, state, status, expected_status) values (
    'default',
     (select id from membership."organizations" limit 1),
     'demo', -- update if needed, this is your stack id
     (select id from membership."regions" limit 1),
     now(),
     now(),
     false,
     gen_random_uuid(),
     'ACTIVE',
     'READY',
     'READY'
);

Next Steps​

warning

Be sure to save your OrganizationID and StackID, as you'll need them when you create your Stack.

You now have an Organization containing a default region and a stack. In the next steps, you'll be able to deploy the Operator and then your Stack.