Platform setup
Stacklok Enterprise ships as an umbrella Helm chart that installs its platform components in one release.
How the platform fits together
The platform components run together in your Kubernetes cluster. The Enterprise Manager serves policy to the Stacklok clients, the Registry Server holds the approved MCP server and skills catalog, the console manages that catalog, and the ToolHive Operator reconciles MCP server workloads. Your identity provider authenticates every client and component.
Deployment sequence
When you are ready to deploy, work through these steps in order. Each links to its detailed guide.
- Configure identity. Set up your identity provider (authorization server, audiences, scopes, claims, and OAuth clients) so the platform components and clients can authenticate. Do this first, because deployment wires in the client IDs and audiences you create here. See Configure platform identity.
- Deploy the platform. Install the umbrella chart with the identity values from the previous step. The chart deploys the ToolHive operator, the Enterprise Manager, the console, and the Registry Server as subcharts. See Deploy the platform. Before you install, run preflight checks to catch cluster problems before Helm installs the release.
- Enable the gateways you need. Both are off by default. See Configure the AI Gateway and Configure the Connector Gateway.
- Populate the directory. Provision users and groups from your identity provider, since access and budgets are granted to them. See SCIM provisioning.
- Configure policies. Use the Enterprise Manager to pin the registry, control non-registry servers, and standardize telemetry across clients. experience. See Configure policies.
- Set up authorization. Map identity-provider groups and roles to MCP access with the enterprise authorization custom resources. See Enterprise authorization.
- Roll out the clients. Distribute the Stacklok CLI to your users, and point them at Roll out gateway clients to distribute setup instructions for editors and agents.
- Verify end to end. Sign in to the console and confirm the path from catalog to client.
Contents
Deploy the platform
Install the Stacklok Enterprise platform in your Kubernetes cluster as a single Helm release.
Distributed deployments
Spread Stacklok Enterprise components across clusters or environments by enabling only the components each one needs.
Install from a private registry (air-gapped)
Mirror the Stacklok Enterprise chart and images from Replicated into your own container registry, then install the platform from there.
Verify the distribution
Independently verify the signatures, SLSA provenance, and SBOMs of Stacklok Enterprise container images with cosign.
Configure the Registry Server
Enable the Registry Server in the Stacklok Enterprise platform chart and connect it to PostgreSQL.
Configure platform identity
Configure your identity provider so the Stacklok Enterprise platform components can authenticate users and validate their requests.
Configure the AI Gateway
Enable the AI Gateway in the platform chart, satisfy its prerequisites, and bring up a working gateway in the right order.
Configure the Connector Gateway
Enable the per-user Connector Gateway in the platform chart, choose its install identity, and understand how it scopes connector access per user.
Roll out gateway clients
Direct users to deployment-specific client setup and choose authentication methods for interactive and automated clients.
API reference
REST API reference for the Enterprise Manager, Connector Gateway, and AI Gateway management services.