diff --git a/content/case-studies/spear-ai.md b/content/case-studies/spear-ai.md index c095d5c9f0dc..fd5c5fa80088 100644 --- a/content/case-studies/spear-ai.md +++ b/content/case-studies/spear-ai.md @@ -6,7 +6,7 @@ description: | meta_desc: Learn how Spear AI used Pulumi to achieve government Authorization to Operate in 3 months. customer_name: Spear AI -industry: ai-ml +industry: public-sector customer_logo: /logos/customers/spearAI.svg logo_bg_color: "#000031" logo_style: white diff --git a/content/docs/_index.md b/content/docs/_index.md index 3cb0ee355327..da880bd738ca 100644 --- a/content/docs/_index.md +++ b/content/docs/_index.md @@ -69,6 +69,10 @@ sections: heading: Administration description: Manage organizations, access, security, and self-hosting. link: /docs/administration/ + - icon: hard-drives + heading: Self-Hosting + description: Run the full Pulumi Cloud platform in your own cloud account or data center. + link: /docs/administration/self-hosting/ - icon: package heading: Registry ↗ description: Browse and search Pulumi packages for 150+ cloud providers and services. diff --git a/content/docs/administration/_index.md b/content/docs/administration/_index.md index 765007bf9082..c785e88bb534 100644 --- a/content/docs/administration/_index.md +++ b/content/docs/administration/_index.md @@ -46,10 +46,13 @@ sections: link: /docs/administration/security-compliance/ description: Set up audit logs and customer managed encryption keys. +- type: full-width-cards + heading: Self-hosting + cards: - icon: buildings - heading: Self-Hosting + heading: Run Pulumi Cloud in your own infrastructure link: /docs/administration/self-hosting/ - description: Deploy Pulumi Cloud in your own infrastructure with the Business Critical edition. + description: Install and operate the full platform on AWS, Azure, Google Cloud, Kubernetes, or your own hardware, including fully air-gapped networks. Available with the Business Critical edition. - type: flat heading: Have questions? diff --git a/content/docs/administration/self-hosting/_index.md b/content/docs/administration/self-hosting/_index.md index 0646a6bc8e39..d177fd11558f 100644 --- a/content/docs/administration/self-hosting/_index.md +++ b/content/docs/administration/self-hosting/_index.md @@ -12,7 +12,7 @@ menu: administration: name: Self-Hosting parent: administration-home - weight: 40 + weight: 25 identifier: administration-self-hosting aliases: - /docs/guides/self-hosted/ @@ -32,6 +32,14 @@ sections: Pulumi can be deployed in any on-premise or cloud environment and integrated with your preferred identity provider: GitHub Enterprise, GitLab Enterprise, SAML SSO, or email/password authentication. +- type: button-cards + heading: Get started + cards: + - icon: rocket-launch + heading: Install Self-Hosted Pulumi Cloud + link: /docs/administration/self-hosting/install/ + description: Pick your platform and install. Evaluate with Docker Compose in minutes, or deploy to production on AWS, Azure, Google Cloud, or Kubernetes. + - type: button-cards heading: Deployment options cards: diff --git a/content/docs/administration/self-hosting/airgapped.md b/content/docs/administration/self-hosting/airgapped.md index 4092b89e3586..b58d281704a3 100644 --- a/content/docs/administration/self-hosting/airgapped.md +++ b/content/docs/administration/self-hosting/airgapped.md @@ -8,7 +8,7 @@ menu: name: Air-Gapped parent: administration-self-hosting weight: 5 - identifier: administration-security-compliance-self-hosted-airgapped + identifier: administration-self-hosting-airgapped aliases: - /docs/administration/self-hosting/airgapped/ - /docs/pulumi-cloud/admin/self-hosted/airgapped/ @@ -19,7 +19,7 @@ pulumi_cloud_feature: self-hosting For organizations operating in highly regulated industries or environments with strict security requirements, deploying cloud infrastructure in an air-gapped environment is often a requirement. Such environments do not have network connectivity with the outside world, which many of Pulumi's default workflows assume. -Pulumi can be configured to run in air-gapped environments through [self-hosting](/docs/administration/self-hosting/pulumi-cloud), enabling enterprises to manage infrastructure as code securely within their private networks, remaining compliant while gaining the benefits of modern infrastructure automation. +Pulumi can be configured to run in air-gapped environments through [self-hosting](/docs/administration/self-hosting/), enabling enterprises to manage infrastructure as code securely within their private networks, remaining compliant while gaining the benefits of modern infrastructure automation. In this guide, we will explore how to deploy Pulumi Self-Hosted in an air-gapped environment, covering the key requirements, setup process, and best practices. @@ -93,8 +93,8 @@ Pulumi Self-Hosted can be installed using Kubernetes, Docker, or virtual machine 2. Download the [Pulumi Self-Hosted images](/docs/administration/self-hosting/components) * Retrieve the necessary installation files and images from a networked machine. * Transfer them to your air-gapped environment using an offline medium (USB drive, offline repository, etc.). -3. Install Pulumi Self-Hosted (for instance, on Kubernetes) per [these instructions](/docs/administration/self-hosting/deployment-options) - * Deploy the Pulumi API server, database, and storage backend using Helm or static manifests. +3. Install Pulumi Self-Hosted (for instance, on Kubernetes) per the [install guide](/docs/administration/self-hosting/install/) + * Deploy the Pulumi API server, database, and storage backend with the [bring-your-own-infrastructure installer](/docs/administration/self-hosting/deployment-options/byo-infra-hosted/), which applies Kubernetes manifests to a cluster you already operate. * Configure internal object storage (e.g., MinIO or an internal S3-compatible service) for state management. 4. Configure Authentication and Access Control * Integrate with your organization's internal identity provider (OIDC, LDAP, SAML). diff --git a/content/docs/administration/self-hosting/changelog.md b/content/docs/administration/self-hosting/changelog.md index 53ed1e215414..ebefec94b386 100644 --- a/content/docs/administration/self-hosting/changelog.md +++ b/content/docs/administration/self-hosting/changelog.md @@ -8,7 +8,7 @@ menu: name: Changelog parent: administration-self-hosting weight: 7 - identifier: administration-security-compliance-self-hosted-changelog + identifier: administration-self-hosting-changelog aliases: - /docs/pulumi-cloud/self-hosted/changelog/ - /docs/administration/self-hosting/pulumi-cloud/changelog/ diff --git a/content/docs/administration/self-hosting/components/_index.md b/content/docs/administration/self-hosting/components/_index.md index c154eb9d1c6e..95ce9f902d28 100644 --- a/content/docs/administration/self-hosting/components/_index.md +++ b/content/docs/administration/self-hosting/components/_index.md @@ -7,7 +7,7 @@ menu: administration: parent: administration-self-hosting weight: 2 - identifier: administration-security-compliance-self-hosted-components + identifier: administration-self-hosting-components aliases: - /docs/guides/self-hosted/console/ - /docs/guides/self-hosted/components/ diff --git a/content/docs/administration/self-hosting/components/api.md b/content/docs/administration/self-hosting/components/api.md index d0569a3fdef7..47626b1f5508 100644 --- a/content/docs/administration/self-hosting/components/api.md +++ b/content/docs/administration/self-hosting/components/api.md @@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted API menu: administration: name: Pulumi API - parent: administration-security-compliance-self-hosted-components + parent: administration-self-hosting-components weight: 1 - identifier: administration-security-compliance-self-hosted-components-api + identifier: administration-self-hosting-components-api aliases: - /docs/guides/self-hosted/components/api/ - /docs/pulumi-cloud/self-hosted/components/api/ @@ -26,9 +26,9 @@ The Pulumi API is one of the components required for self-hosting the Pulumi Clo * Provide a server or virtual machine to install and run the Pulumi components (see Minimum System Requirements below). * Provide a persistent volume for the service to store checkpoint objects. -* Provider a persistent volume for the MySQL data (optional if you are providing your own DB.) +* Provide a persistent volume for the MySQL data (optional if you are providing your own DB.) * If you are providing your own DB instance, ensure that it is accessible within the same Docker network that the service and the UI containers will be running in. - * The default DB endpoint is `pulumi-db:3306`. If you wish to change this, set `PULUMI_LOCAL_DATABASE_NAME` and `PULUMI_LOCAL_DATABASE_PORT` accordingly (see Script Variables.) + * The default DB endpoint is `pulumi-db:3306`. If you wish to change this, set `PULUMI_LOCAL_DATABASE_HOST` and `PULUMI_LOCAL_DATABASE_PORT` accordingly (see Script Variables.) * If you do not create this network prior to running `run-ee.sh`, it will create only a bridged network on your local host. Ensure that the DB can be accessed by the API service container. * Provide an external load balancer with TLS termination. @@ -316,153 +316,19 @@ To use [AWS DynamoDB](https://aws.amazon.com/dynamodb) to persist Audit Logs, sp ], ``` -## OpenTelemetry +## OpenTelemetry {#opentelemetry} -The API service is configured to export OpenTelemetry metrics and traces to the vendor of your choice via the OpenTelemetry collector. You will need to manage your own OpenTelemetry collector. - -The following environment variables are needed to configure OpenTelemetry in the service: +The API service exports OpenTelemetry metrics and traces to a collector you run, and exposes a `/metrics` endpoint for Prometheus. These are the variables the API container reads; for collector configuration, the metrics endpoint, and both Prometheus options, see [Telemetry](/docs/administration/self-hosting/operations/telemetry/). | Variable name | Description | | --- | --- | | OTEL_EXPORTER_OTLP_ENDPOINT | (Required) Used to configure the OTLP exporter. The base URL to which all telemetry will be sent. If not set, the API service will use no-op metrics and traces. | | OTEL_EXPORTER_OTLP_PROTOCOL | (Optional) Used to configure the OTLP exporter. Valid values are `http` or `grpc`. Defaults to `grpc`. | | PULUMI_ENABLE_DEPRECATED_METRICS | (Optional) Whether to continue emitting API service metrics in a log-based format. Defaults to `true`. | -| METRICS_WEBHOOK_SECRET | Required to successfully authenticate to the `/metrics` endpoint. The Authorization header should be set as follows: `Authorization: webhook-token `. | +| METRICS_WEBHOOK_SECRET | Required to successfully authenticate to the `/metrics` endpoint. | OpenTelemetry is not yet available for the [console service](/docs/administration/self-hosting/components/console/). -### Metrics endpoint - -The API service exposes a metrics endpoint (`https://api.pulumi.com/metrics`) that is secured by a bearer token. This token is configured using the environment variable `METRICS_WEBHOOK_SECRET`. - -{{% notes type="info" %}} -The token type is `webhook-token`, not `Bearer`. -{{% /notes %}} - -```sh -curl -s GET https://api.pulumi.com/metrics -H 'Authorization: webhook-token -``` - -### Prometheus - -The API service provides two options to get metrics into Prometheus: - -1. From the OpenTelemetry collector via a [Prometheus remote write exporter](#prometheus-remote-write-exporter). This is a push-based exporter. -1. From a [Prometheus exporter](#prometheus-exporter) by scraping the `/metrics` endpoint. This is a pull-based exporter. - -#### Prometheus remote write exporter - -This option does not use the `/metrics` endpoint. Instead, it exports metrics from the collector to a [Prometheus remote write compatible backend](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/prometheusremotewriteexporter/README.md). - -Example OpenTelemetry collector configuration for a service using AWS and the AWS Distro for OpenTelemetry Collector: - -```yaml -extensions: - sigv4auth: - -receivers: - otlp: - protocols: - grpc: - endpoint: localhost:4317 - -processors: - memory_limiter: - - batch: - -exporters: - logging: - - prometheusremotewrite: - endpoint: https://aws-managed-prometheus-endpoint/v1/api/remote_write - auth: - authenticator: sigv4auth - -service: - telemetry: - logs: - - pipelines: - traces: - receivers: [otlp] - processors: [memory_limiter, batch] - exporters: [logging] - - metrics: - receivers: [otlp] - processors: [memory_limiter, batch] - exporters: [prometheusremotewrite] - - extensions: [sigv4auth] -``` - -#### Prometheus exporter - -This option requires configuring the environment variable `METRICS_WEBHOOK_SECRET` to successfully authenticate to the [`/metrics` endpoint](#metrics-endpoint). - -Example OpenTelemetry collector configuration: - -```yaml -extensions: - bearertokenauth: - scheme: webhook-token - token: ${env:METRICS_WEBHOOK_SECRET} - -receivers: - otlp: - protocols: - grpc: - endpoint: localhost:4317 - -processors: - memory_limiter: - - batch: - -exporters: - debug: - - prometheus: - endpoint: api.pulumi.com:443 - auth: - authenticator: bearertokenauth - namespace: pulumi - resource_to_telemetry_conversion: - enabled: true - -service: - telemetry: - logs: - - pipelines: - traces: - receivers: [otlp] - processors: [memory_limiter, batch] - exporters: [debug] - - metrics: - receivers: [otlp] - processors: [memory_limiter, batch] - exporters: [prometheus] - - extensions: [bearertokenauth] -``` - -The bearer token also needs to be included in the Prometheus server configuration: - -```yaml -scrape_configs: - - job_name: pulumi - scrape_interval: 15s - authorization: - type: webhook-token - credentials: - scheme: https - static_configs: - - targets: ["api.pulumi.com"] -``` - ## Pulumi Deployments To enable [Pulumi Deployments](/docs/deployments/concepts/), the following must be configured: diff --git a/content/docs/administration/self-hosting/components/console.md b/content/docs/administration/self-hosting/components/console.md index 3bb1f1268757..d9ee4675c9e8 100644 --- a/content/docs/administration/self-hosting/components/console.md +++ b/content/docs/administration/self-hosting/components/console.md @@ -6,9 +6,9 @@ meta_desc: Pulumi console is one of the components required for self-hosting Pul menu: administration: name: Pulumi console - parent: administration-security-compliance-self-hosted-components + parent: administration-self-hosting-components weight: 2 - identifier: administration-security-compliance-self-hosted-components-console + identifier: administration-self-hosting-components-console aliases: - /docs/guides/self-hosted/components/console/ - /docs/pulumi-cloud/self-hosted/components/console/ @@ -43,7 +43,7 @@ You can run this container on the same host that your API container is running o ## What's In The Container? {{% notes type="info" %}} -The container image repository is private. [Contact us](/contact/) if you would like to evaluate the Self-Hosted Pulumi Cloud. +The console image is published publicly at [`pulumi/console`](https://hub.docker.com/r/pulumi/console). Running it still requires a license key — see [Components](/docs/administration/self-hosting/components/) for the full image list. {{% /notes %}} The Console container runs a web server using a Node 18-based image. diff --git a/content/docs/administration/self-hosting/components/deployments.md b/content/docs/administration/self-hosting/components/deployments.md index 26f54c89a9f1..ee4fd544c14c 100644 --- a/content/docs/administration/self-hosting/components/deployments.md +++ b/content/docs/administration/self-hosting/components/deployments.md @@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted Deployments menu: administration: name: Pulumi Deployments - parent: administration-security-compliance-self-hosted-components + parent: administration-self-hosting-components weight: 4 - identifier: administration-security-compliance-self-hosted-components-deployments + identifier: administration-self-hosting-components-deployments aliases: - /docs/guides/self-hosted/components/deployments/ - /docs/pulumi-cloud/self-hosted/components/deployments/ diff --git a/content/docs/administration/self-hosting/components/search.md b/content/docs/administration/self-hosting/components/search.md index d87790e14434..96cedaf45ac7 100644 --- a/content/docs/administration/self-hosting/components/search.md +++ b/content/docs/administration/self-hosting/components/search.md @@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted OpenSearch cluster menu: administration: name: OpenSearch cluster - parent: administration-security-compliance-self-hosted-components + parent: administration-self-hosting-components weight: 3 - identifier: administration-security-compliance-self-hosted-components-search + identifier: administration-self-hosting-components-search aliases: - /docs/guides/self-hosted/components/search/ - /docs/pulumi-cloud/self-hosted/components/search/ diff --git a/content/docs/administration/self-hosting/deployment-options/_index.md b/content/docs/administration/self-hosting/deployment-options/_index.md index 119c8c56f840..d474c6cf7d50 100644 --- a/content/docs/administration/self-hosting/deployment-options/_index.md +++ b/content/docs/administration/self-hosting/deployment-options/_index.md @@ -7,16 +7,19 @@ menu: administration: parent: administration-self-hosting weight: 1 - identifier: administration-security-compliance-self-hosted-deployment-options + identifier: administration-self-hosting-deployment-options aliases: - /docs/pulumi-cloud/self-hosted/deployment-options/ - /docs/administration/self-hosting/pulumi-cloud/deployment-options/ - /docs/pulumi-cloud/admin/self-hosted/deployment-options/ pulumi_cloud_feature: self-hosting --- -Pulumi offers a number of deployment options for self-hosting the Pulumi Cloud. -* [Docker Compose](quickstart-docker-compose/) +{{< self-hosting-trial-note />}} + +Pulumi offers a number of deployment options for self-hosting the Pulumi Cloud. To get started, see [Install Self-Hosted Pulumi Cloud](/docs/administration/self-hosting/install/), which walks you through each platform. Use Docker Compose to evaluate on a single host in minutes; the other options are production deployments. + +* [Docker Compose](quickstart-docker-compose/) — evaluation and testing * [ECS](ecs-hosted/) * [EKS](eks-hosted/) * [AKS](aks-hosted/) diff --git a/content/docs/administration/self-hosting/deployment-options/aks-hosted.md b/content/docs/administration/self-hosting/deployment-options/aks-hosted.md index 884f3184a32e..3b715a66a28d 100644 --- a/content/docs/administration/self-hosting/deployment-options/aks-hosted.md +++ b/content/docs/administration/self-hosting/deployment-options/aks-hosted.md @@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted AKS install menu: administration: name: AKS - parent: administration-security-compliance-self-hosted-deployment-options + parent: administration-self-hosting-deployment-options weight: 4 - identifier: administration-security-compliance-self-hosted-deployment-options-aks + identifier: administration-self-hosting-deployment-options-aks aliases: - /docs/guides/self-hosted/aks-hosted/ - /docs/pulumi-cloud/self-hosted/deployment-options/aks-hosted/ @@ -16,6 +16,8 @@ aliases: pulumi_cloud_feature: self-hosting --- +{{< self-hosting-trial-note />}} + The [AKS-Hosted Installer](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/aks-hosted) installer is used to deploy the self-hosted Pulumi Cloud in Azure Kubernetes Service (AKS) ## AKS-Hosted Deployment @@ -40,10 +42,14 @@ To this end, you need to set up the following: See the [README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/aks-hosted/README.md) file provided with the installer package for detailed deployment steps. +{{< self-hosted-first-admin-note />}} + ## AKS-Hosted System Management and Maintenance ### Pulumi Cloud Updates +{{< self-hosting-schema-v2-note />}} + When deploying the Service, it is recommended to pin the Pulumi Cloud image tag to a specific version. See the [installer's README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/aks-hosted/README.md) file to set the `imageTag` configuration property for the installer to use. When ready to update the Pulumi Cloud containers to use a different version, do the following: diff --git a/content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md b/content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md index 64893b5e2018..4f4639efcb03 100644 --- a/content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md +++ b/content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md @@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted BYO-infra install menu: administration: name: Bring-your-own infra - parent: administration-security-compliance-self-hosted-deployment-options + parent: administration-self-hosting-deployment-options weight: 7 - identifier: administration-security-compliance-self-hosted-deployment-options-byo-infra-hosted + identifier: administration-self-hosting-deployment-options-byo-infra-hosted aliases: - /docs/guides/self-hosted/byo-infra-hosted/ - /docs/pulumi-cloud/self-hosted/deployment-options/byo-infra-hosted/ @@ -16,6 +16,8 @@ aliases: pulumi_cloud_feature: self-hosting --- +{{< self-hosting-trial-note />}} + The [BYO-Infrastructure Installer](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/byo-infra) installer is used to deploy the self-hosted Pulumi Cloud on your own K8s, MySQL and S3-compatible infrastructure. ## BYO-Infra Deployment @@ -40,10 +42,14 @@ To this end, you need to set up the following: See the [README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/byo-infra/README.md) file provided with the installer package for detailed deployment steps. +{{< self-hosted-first-admin-note />}} + ## BYO Infrastructure Hosted System Management and Maintenance ### Pulumi Cloud Updates +{{< self-hosting-schema-v2-note />}} + When deploying the Pulumi Cloud, it is recommended to pin the image tag to a specific version. See the [installer's README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/byo-infra/README.md) file to set the `imageTag` configuration property for the installer to use. When ready to update the Pulumi Cloud containers to use a different version, do the following: diff --git a/content/docs/administration/self-hosting/deployment-options/ecs-hosted.md b/content/docs/administration/self-hosting/deployment-options/ecs-hosted.md index 699ed68e5334..cfa56693c8ee 100644 --- a/content/docs/administration/self-hosting/deployment-options/ecs-hosted.md +++ b/content/docs/administration/self-hosting/deployment-options/ecs-hosted.md @@ -1,14 +1,14 @@ --- -title_tag: ECS-Hosted Install | Self-Hosting Pulumi -meta_desc: Installer and installation instructions for deploying the self-hosted Pulumi Cloud in ECS. +title_tag: ECS Install | Self-Hosting Pulumi +meta_desc: Install self-hosted Pulumi Cloud on Amazon ECS Fargate — prerequisites, the three Pulumi projects, configuration reference, and how to verify the installation. title: ECS -h1: Pulumi Cloud self-hosted ECS install +h1: Install Self-Hosted Pulumi Cloud on Amazon ECS menu: administration: name: ECS - parent: administration-security-compliance-self-hosted-deployment-options + parent: administration-self-hosting-deployment-options weight: 2 - identifier: administration-security-compliance-self-hosted-deployment-options-ecs + identifier: administration-self-hosting-deployment-options-ecs aliases: - /docs/guides/self-hosted/ecs-hosted/ - /docs/pulumi-cloud/self-hosted/deployment-options/ecs-hosted/ @@ -16,70 +16,235 @@ aliases: pulumi_cloud_feature: self-hosting --- -The [ECS-Hosted Installer](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/ecs-hosted) is used to deploy the self-hosted Pulumi Cloud in Amazon Elastic Container Service. You can choose between using a TypeScript or Golang installer. +{{< self-hosting-trial-note />}} -## Prerequisites - -The customer is required to provide and manage the following: - -* AWS VPC with - * At least 2 public subnets available. - * At least 2 private subnets available. - * At least 2 isolated subnets available. - * An "isolated" subnet means it can only route traffic within the subnet. So there is no NAT gateway. -* Route53 hosted zone. -* ACM Certificate that covers FQDNs of the following form, where `{subdomain}` is optional: - * `{subdomain}.{zoneDomainName}` - * `api.{subdomain}.{zoneDomainName}` - * `app.{subdomain}.{zoneDomainName}` -* KMS key to be used the self-hosted Pulumi Cloud for encryption/decryption purposes. - -## ECS-Hosted Deployment +The [ECS installer](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/ecs-hosted) runs the Pulumi API and console as Fargate services behind Application Load Balancers, backed by Aurora MySQL and S3. Pick this option when you want a production installation on AWS without operating Kubernetes. -The ECS-hosted installation of Pulumi deploys the following services: +The installer ships in TypeScript and Go. The commands below use the TypeScript version; the Go version lives in `ecs-hosted/go` and takes the same configuration. -* ECS - Managed ECS Cluster -* Fargate - Managed Container Service -* RDS Aurora - Managed MySQL DB for persistent state and automated replication and snapshotting. -* S3 - Object storage for checkpoints and policy packs. -* CloudWatch Logs - Centralized logging for all cluster pods. -* Route53 - Managed DNS records. -* NLB - Managed L4/application traffic and TLS termination. -* ACM - Managed Public TLS certificates. +## What gets deployed -### Pulumi deploying Pulumi +| Service | Purpose | +| :-- | :-- | +| ECS on Fargate | Runs the API and console containers | +| Aurora MySQL | Persistent state, with automated replication and snapshots | +| S3 | Checkpoints, policy packs, and service metadata | +| OpenSearch | Resource search (optional) | +| Application Load Balancer | Traffic routing and TLS termination | +| Route 53 | DNS records for the API and console | +| VPC endpoints | Private connectivity to AWS services | -This installer uses Pulumi to deploy the Pulumi Cloud. In this case, one uses the pulumi CLI with a self-managed backend (e.g., S3) to deploy all services listed above to stand up the self-hosted Pulumi Cloud. The installation package includes the Pulumi project code so you can deploy the service by running `pulumi up`. - -To this end, you need to set up the following: - -* [Download and install the Pulumi CLI](/docs/install/) on your workstation -* [Login to S3-compatible backend](/docs/iac/concepts/state-and-backends/#logging-into-and-out-of-state-backends) - -### Deployment Steps +## Prerequisites -See the [README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/ecs-hosted) file provided with the installer package for detailed deployment steps. +You provide the network, DNS, certificate, and key material. The installer builds everything else. -## ECS-Hosted System Management and Maintenance +**AWS access.** `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` in the environment, plus `AWS_SESSION_TOKEN` if you use temporary credentials. -### Pulumi Cloud Updates +**Networking.** An existing VPC with at least two public, two private, and two isolated subnets. -When deploying the Pulumi Cloud, it is recommended to pin the image tag to a specific version. See the [installer's README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/ecs-hosted) file to set the `imageTag` configuration property for the installer to use. +**DNS and TLS.** A Route 53 hosted zone, and an ACM certificate covering the base domain plus `app.{sub}.example.com` and `api.{sub}.example.com`. -When ready to update the Pulumi Cloud containers to use a different version, do the following: +**Encryption.** A KMS key for the service to encrypt and decrypt secrets. -* `pulumi login` to the self-managed (not self-hosted) backend as chosen above when installing the self-hosted service. -* `pulumi config set imageTag {image tag}` to set the version you want to use. -* `pulumi up` to deploy the updates. +**Images.** ECR repositories holding the Pulumi API, console, and migrations images. -### Database Maintenance +**License.** A `PULUMI_LICENSE_KEY` and an AG Grid license key. -The installer configures the RDS backend database for replication and checkpointing. So no additional maintenance is needed by the customer. +See [System requirements](/docs/administration/self-hosting/system-requirements/) for database, storage, and sizing details that apply to every installation. -### Blob Storage Maintenance +## Sizing -The service automatically creates backups of checkpoint (i.e. state) files. However the customer may want to enable AWS Backup to periodically backup the S3 buckets created by the installer. -The buckets will have names of the form: +Defaults are deliberately small so a first deployment comes up quickly. Raise them before running production workloads. -* `pulumi-checkpoint-XXX` -* `pulumi-policy-XXX` +| Setting | Default | +| :-- | :-- | +| `dbInstanceType` | `db.t3.small` — burstable; see [Database](/docs/administration/self-hosting/operations/database/) | +| `apiTaskCpu` / `apiTaskMemory` | 512 / 1024 MB | +| `consoleTaskCpu` / `consoleTaskMemory` | 256 / 512 MB | +| `apiDesiredNumberTasks` | 1 — raise to at least 2 for high availability | + +## Install + +The installer is itself a set of Pulumi programs, so you need a state backend for them. These use an S3 bucket, which keeps the installer's own state independent of the installation it creates. + +Deploy the three projects in order. Each consumes outputs from the one before it. + +### 1. Get the installer + +```bash +git clone https://github.com/pulumi/pulumi-self-hosted-installers.git +cd pulumi-self-hosted-installers/ecs-hosted/ts +pulumi login s3:// +``` + +### 2. Deploy base infrastructure + +Creates the Aurora cluster, VPC endpoints, and security groups. + +```bash +cd infrastructure +npm install +pulumi stack init +pulumi config set aws:region us-west-2 +pulumi config set vpcId vpc-0123456789abcdef0 +pulumi config set publicSubnetIds '["subnet-aaa","subnet-bbb"]' +pulumi config set privateSubnetIds '["subnet-ccc","subnet-ddd"]' +pulumi config set isolatedSubnetIds '["subnet-eee","subnet-fff"]' +pulumi up +``` + +### 3. Deploy the application + +Creates the ECS clusters and the API and console services. + +```bash +cd ../application +npm install +pulumi stack init +pulumi config set aws:region us-west-2 +pulumi config set imageTag +pulumi config set acmCertificateArn +pulumi config set kmsServiceKeyId +pulumi config set licenseKey --secret +pulumi config set route53ZoneName example.com +pulumi config set route53Subdomain pulumi +pulumi up +``` + +The database, security group, and OpenSearch values come from the previous stack's outputs. Set them with `pulumi config set` as shown in the [configuration reference](#configuration-reference) below. + +{{% notes type="info" %}} +Pin `imageTag` to a specific version rather than `latest`, so an unrelated `pulumi up` cannot roll the service forward unintentionally. Tags are listed on [Docker Hub](https://hub.docker.com/r/pulumi/service/tags). +{{% /notes %}} + +### 4. Create DNS records + +```bash +cd ../dns +npm install +pulumi stack init +pulumi config set aws:region us-west-2 +pulumi config set route53ZoneName example.com +pulumi config set route53Subdomain pulumi +pulumi config set apiLoadBalancerDnsName +pulumi config set apiLoadBalancerZoneId +pulumi config set consoleLoadBalancerDnsName +pulumi config set consoleLoadBalancerZoneId +pulumi up +``` + +## Configuration reference + +### Base infrastructure + +| Key | Required | Default | Description | +| :-- | :-- | :-- | :-- | +| `aws:region` | Yes | | AWS region | +| `vpcId` | Yes | | Existing VPC | +| `publicSubnetIds` | Yes | | At least two public subnet IDs | +| `privateSubnetIds` | Yes | | At least two private subnet IDs | +| `isolatedSubnetIds` | Yes | | At least two isolated subnet IDs | +| `dbInstanceType` | No | `db.t3.small` | RDS instance type | +| `enableOpenSearch` | No | | Deploy an OpenSearch domain for resource search | +| `openSearchInstanceType` | No | `t3.medium.search` | OpenSearch instance type | +| `openSearchInstanceCount` | No | `2` | Cannot be lower than 2 | +| `openSearchDomainName` | No | `pulumi` | OpenSearch domain name | +| `openSearchDedicatedMasterCount` | No | none | Dedicated master nodes | + +### Application + +| Key | Required | Default | Description | +| :-- | :-- | :-- | :-- | +| `aws:region` | Yes | | AWS region | +| `vpcId` | Yes | | Existing VPC | +| `publicSubnetIds` / `privateSubnetIds` / `isolatedSubnetIds` | Yes | | Subnet IDs, as above | +| `imageTag` | Yes | | Pulumi container image tag | +| `licenseKey` | Yes | | Set with `--secret` | +| `acmCertificateArn` | Yes | | Covers the Route 53 domain | +| `kmsServiceKeyId` | Yes | | KMS key securing secrets | +| `route53ZoneName` | Yes | | Hosted zone name | +| `route53Subdomain` | Yes | | Subdomain for DNS records | +| `dbClusterEndpoint` | Yes | | Aurora cluster endpoint | +| `dbPort` | Yes | `3306` | MySQL port | +| `dbName` | Yes | | Database name | +| `dbUsername` / `dbPassword` | Yes | | Database credentials | +| `dbSecurityGroupId` | Yes | | Database security group | +| `endpointSecurityGroupId` | Yes | | Security group for VPC endpoints | +| `openSearchUser` / `openSearchPassword` | Yes | | OpenSearch credentials | +| `openSearchEndpoint` / `openSearchDomain` | Yes | | OpenSearch endpoint and domain | +| `apiDesiredNumberTasks` | No | `1` | API task count | +| `apiTaskCpu` / `apiTaskMemory` | No | `512` / `1024` | API task-level CPU and memory | +| `apiContainerCpu` | No | task CPU | CPU for the API container | +| `apiContainerMemoryReservation` | No | task memory | Memory reserved for the API container | +| `apiDisabledEmailLogin` / `apiDisabledEmailSignup` | No | | Disable the email login and signup handlers | +| `consoleDesiredNumberTasks` | No | `1` | Console task count | +| `consoleTaskCpu` / `consoleTaskMemory` | No | `256` / `512` | Console task-level CPU and memory | +| `consoleContainerCpu` | No | task CPU | CPU for the console container | +| `consoleContainerMemoryReservation` | No | task memory | Memory reserved for the console container | +| `consoleHideEmailLogin` / `consoleHideEmailSignup` | No | | Hide email login and signup in the UI | +| `smtpServer` | No | | Fully qualified SMTP address | +| `smtpUsername` / `smtpPassword` | No | | SMTP credentials | +| `smtpGenericSender` | No | | From address for outgoing email | +| `logType` | No | none | Log driver, for example `awslogs` | +| `logArgs` | No | | Log driver arguments | +| `agGridLicenseKey` | No | | AG Grid license key for the console | + +Hiding email login in the console does not disable the API handler behind it. To turn the handler off, set `apiDisabledEmailLogin` and `apiDisabledEmailSignup` as well. + +### DNS + +| Key | Required | Description | +| :-- | :-- | :-- | +| `aws:region` | Yes | AWS region | +| `route53ZoneName` | Yes | Route 53 zone name | +| `route53Subdomain` | Yes | Subdomain | +| `apiLoadBalancerDnsName` / `apiLoadBalancerZoneId` | Yes | API load balancer | +| `consoleLoadBalancerDnsName` / `consoleLoadBalancerZoneId` | Yes | Console load balancer | + +## Verify the installation + +```bash +curl -fsS https://api.{sub}.example.com/api/status +pulumi login https://api.{sub}.example.com +pulumi whoami +``` + +Then open `https://app.{sub}.example.com` and create the first account. + +{{< self-hosted-first-admin-note />}} + +Confirm an end-to-end update works: + +```bash +pulumi new aws-typescript --stack dev --yes +pulumi up --yes +pulumi destroy --yes +``` + +## Upgrade + +{{< self-hosting-schema-v2-note />}} + +```bash +pulumi login s3:// +cd pulumi-self-hosted-installers/ecs-hosted/ts/application +pulumi config set imageTag +pulumi up +``` + +Migrations run before the services roll. See [Upgrades](/docs/administration/self-hosting/operations/upgrades/) for staged rollouts and ordering. + +## Uninstall + +Destroy the projects in reverse order — `dns`, then `application`, then `infrastructure`. Aurora and S3 carry deletion protection, so remove that first if you intend to delete the data. + +## Maintenance + +The installer configures Aurora for replication and automated snapshots, so no routine database work is needed. For S3, consider enabling AWS Backup on the buckets the installer creates, which are named `pulumi-checkpoint-*` and `pulumi-policy-*`. + +## Troubleshooting + +- Migrations failing with `ALGORITHM=INPLACE is not supported` means `sql_mode` is missing `STRICT_TRANS_TABLES`. Aurora MySQL 8.0 does not set it by default. +- The API cannot start without `licenseKey`. + +See [Troubleshooting](/docs/administration/self-hosting/troubleshooting/) for the full list. diff --git a/content/docs/administration/self-hosting/deployment-options/eks-hosted.md b/content/docs/administration/self-hosting/deployment-options/eks-hosted.md index 9052ed980172..ad60631f5a98 100644 --- a/content/docs/administration/self-hosting/deployment-options/eks-hosted.md +++ b/content/docs/administration/self-hosting/deployment-options/eks-hosted.md @@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted EKS install menu: administration: name: EKS - parent: administration-security-compliance-self-hosted-deployment-options + parent: administration-self-hosting-deployment-options weight: 3 - identifier: administration-security-compliance-self-hosted-deployment-options-eks + identifier: administration-self-hosting-deployment-options-eks aliases: - /docs/guides/self-hosted/eks-hosted/ - /docs/pulumi-cloud/self-hosted/deployment-options/eks-hosted/ @@ -16,6 +16,8 @@ aliases: pulumi_cloud_feature: self-hosting --- +{{< self-hosting-trial-note />}} + The [EKS-Hosted Installer](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/eks-hosted) installer is used to deploy the self-hosted Pulumi Cloud in Amazon Elastic Kubernetes Service (EKS). ## Prerequisites @@ -49,10 +51,14 @@ To this end, you need to set up the following: See the [README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/eks-hosted/README.md) file provided with the installer package for detailed deployment steps. +{{< self-hosted-first-admin-note />}} + ## EKS-Hosted System Management and Maintenance ### Pulumi Cloud Updates +{{< self-hosting-schema-v2-note />}} + When deploying the service, it is recommended to pin the Pulumi Cloud image tag to a specific version. See the installer's [README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/eks-hosted/README.md) file to set the `imageTag` configuration property for the installer to use. When ready to update the Pulumi Cloud containers to use a different version, do the following: @@ -73,15 +79,22 @@ The buckets will have names of the form: * `pulumi-checkpoint-XXX` * `pulumi-policy-XXX` -### Updating the EKS Cluster Kubernetes Version +### Supported Kubernetes versions -If your EKS-hosted installation was deployed on Kubernetes version 1.19 or later, you can update the `clusterConfig:ClusterVersion` configuration property to the desired version. -Then, rerun the `npm run install -- update --` command to update the cluster with the new version. +| Installer version | Released | Kubernetes | +| :-- | :-- | :-- | +| 4.0 | March 2026 | 1.34.0 | +| 3.1 | February 2025 | 1.31.0 | +| 3.0 | December 2024 | 1.30.3 | +| 2.1 | November 2024 | 1.30.3 | +| 1.0 | October 2024 | 1.30.3 | -{{% notes type="info" %}} -AWS requires moving one Kubernetes release at a time. So if moving from 1.19 to 1.21, perform the steps twice: once to move to 1.20 and wait for that to complete before moving to 1.21. -{{% /notes %}} +### Updating the EKS cluster Kubernetes version + +Set `clusterVersion` in the `05-eks-cluster` project's stack configuration to the version you want, then run `pulumi up` in that project. {{% notes type="info" %}} -If running the Pulumi Cloud with Kubernetes version 1.18, please refer to the installation package README for details on how to upgrade to V2.0 of the EKS installer before upgrading the Kubernetes version. +AWS upgrades the EKS control plane one minor release at a time. To move from 1.31 to 1.34, repeat the step for each intervening release, waiting for each upgrade to finish before starting the next. {{% /notes %}} + +If you are still running an EKS installer released before October 2024, contact [Pulumi support](/support/) to plan a migration to the current installer before changing the Kubernetes version. diff --git a/content/docs/administration/self-hosting/deployment-options/gke-hosted.md b/content/docs/administration/self-hosting/deployment-options/gke-hosted.md index 2f24dad190d3..38620d7dc19a 100644 --- a/content/docs/administration/self-hosting/deployment-options/gke-hosted.md +++ b/content/docs/administration/self-hosting/deployment-options/gke-hosted.md @@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted GKE install menu: administration: name: GKE - parent: administration-security-compliance-self-hosted-deployment-options + parent: administration-self-hosting-deployment-options weight: 5 - identifier: administration-security-compliance-self-hosted-deployment-options-gke + identifier: administration-self-hosting-deployment-options-gke aliases: - /docs/guides/self-hosted/gke-hosted/ - /docs/pulumi-cloud/self-hosted/deployment-options/gke-hosted/ @@ -16,6 +16,8 @@ aliases: pulumi_cloud_feature: self-hosting --- +{{< self-hosting-trial-note />}} + The [GKE-Hosted Installer](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/gke-hosted) installer is used to deploy the self-hosted Pulumi Cloud in Google Kubernetes Engine (GKE). ## GKE-Hosted Deployment @@ -39,10 +41,14 @@ To this end, you need to set up the following: See the [README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/gke-hosted/README.md) file provided with the installer package for detailed deployment steps. +{{< self-hosted-first-admin-note />}} + ## GKE-Hosted System Management and Maintenance ### Pulumi Cloud Updates +{{< self-hosting-schema-v2-note />}} + When deploying the Pulumi Cloud, it is recommended to pin the image tag to a specific version. See the [installer's README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/gke-hosted/README.md) file to set the `imageTag` configuration property for the installer to use. When ready to update the Pulumi Cloud containers to use a different version, do the following: diff --git a/content/docs/administration/self-hosting/deployment-options/local-docker.md b/content/docs/administration/self-hosting/deployment-options/local-docker.md index bd0651c52380..8c22b27f2daa 100644 --- a/content/docs/administration/self-hosting/deployment-options/local-docker.md +++ b/content/docs/administration/self-hosting/deployment-options/local-docker.md @@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted local-Docker install menu: administration: name: Local-Docker - parent: administration-security-compliance-self-hosted-deployment-options + parent: administration-self-hosting-deployment-options weight: 6 - identifier: administration-security-compliance-self-hosted-deployment-options-local-docker + identifier: administration-self-hosting-deployment-options-local-docker aliases: - /docs/guides/self-hosted/local-docker/ - /docs/pulumi-cloud/self-hosted/deployment-options/local-docker/ @@ -16,6 +16,8 @@ aliases: pulumi_cloud_feature: self-hosting --- +{{< self-hosting-trial-note />}} + The [Local-Docker Installer](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/local-docker) is generally meant to be used where an on-premise solution is needed or where the cloud-based installation solutions (i.e. EKS, ECS, AKS) are not possible. ## Prerequisites @@ -51,10 +53,14 @@ To this end, you need to set up the following: See the [README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/local-docker/README.md) file provided with the installer package for detailed deployment steps. +{{< self-hosted-first-admin-note />}} + ## Local-Docker System Management and Maintenance ### Pulumi Cloud Updates +{{< self-hosting-schema-v2-note />}} + When deploying the Pulumi Cloud, it is recommended to pin the image tag to a specific version. See the [installer's README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/local-docker/README.md) file to set the `imageTag` configuration property for the installer to use. When ready to update the Pulumi Cloud containers to use a different version, do the following: diff --git a/content/docs/administration/self-hosting/deployment-options/quickstart-docker-compose.md b/content/docs/administration/self-hosting/deployment-options/quickstart-docker-compose.md index c0d19ef51d64..0223a4034924 100644 --- a/content/docs/administration/self-hosting/deployment-options/quickstart-docker-compose.md +++ b/content/docs/administration/self-hosting/deployment-options/quickstart-docker-compose.md @@ -1,14 +1,14 @@ --- -title_tag: Quickstart Docker Compose | Self-Hosting Pulumi -meta_desc: Quickstart Docker compose installer for testing of the self-hosted Pulumi Cloud. +title_tag: Try Self-Hosted Pulumi Cloud with Docker Compose +meta_desc: Evaluate self-hosted Pulumi Cloud in about ten minutes with the all-in-one Docker Compose stack. title: Docker Compose -h1: Pulumi Cloud self-hosted Docker Compose install +h1: Try Self-Hosted Pulumi Cloud with Docker Compose menu: administration: name: Docker Compose - parent: administration-security-compliance-self-hosted-deployment-options + parent: administration-self-hosting-deployment-options weight: 1 - identifier: administration-security-compliance-self-hosted-deployment-options-quickstart-docker-compose + identifier: administration-self-hosting-deployment-options-quickstart-docker-compose aliases: - /docs/guides/self-hosted/quickstart-docker-compose/ - /docs/pulumi-cloud/self-hosted/deployment-options/quickstart-docker-compose/ @@ -16,49 +16,76 @@ aliases: pulumi_cloud_feature: self-hosting --- -The Pulumi Cloud Docker container images can be run using any OCI-compatible container orchestrator. We provide sample docker-compose files that can help you get started with your self-evaluation quickly. +{{< self-hosting-trial-note />}} -> **Note**: docker-compose is not required to run these containers. We recommend that you choose a container orchestrator with which your IT team has experience. +The fastest way to try self-hosted Pulumi Cloud is the all-in-one Docker Compose stack. It runs the API, the web Console, a migrated MySQL database, and OpenSearch on a single host with working defaults, so you can evaluate the full platform in about ten minutes. Use it for evaluation and testing; for production, see the [production deployment options](/docs/administration/self-hosting/deployment-options/). -In addition to the environment variables that each container exposes, the following can be set when using either of the quickstart solutions below. These are used by the `run-ee.sh` script provided to you as part of the self-evaluation package. If any of these variables are not set when you run `run-ee.sh`, the default values will be used. +## Prerequisites -`PULUMI_DATA_PATH`: The persistent path where the service should store the checkpoint objects. Default uses `/tmp/pulumi-ee/data`. +- [Docker Engine](https://docs.docker.com/engine/install/) with the Docker Compose plugin (v2). +- A host with at least 2 CPU cores, 8 GB of memory, and 20 GB of free disk. +- Ports `3000` (Console), `8080` (API), and `9200`/`5601` (OpenSearch) available on the host. +- A Pulumi license key. -`PULUMI_LOCAL_DATABASE_NAME`: The database instance’s hostname. Default is `pulumi-db`. +{{% notes type="info" %}} +`run-ee.sh` exits immediately if `PULUMI_LICENSE_KEY` is not set. [Request an evaluation license](/product/self-hosted/#self-hosted-trial) and a solutions architect will get you a key. +{{% /notes %}} -`PULUMI_LOCAL_DATABASE_PORT`: The database instance’s port. Default is `3306`. +## Run the all-in-one stack -For example, `PULUMI_DATA_PATH=/my/persistent/dir LOCAL_DATABASE_NAME=my-db LOCAL_DATABASE_PORT=3306 ./scripts/run-ee.sh`. +1. Clone the installer and change into the quickstart directory: -Regardless of the quickstart option you choose below, `run-ee.sh` will be the way to start the necessary containers. There will be at most 3 containers (including the DB) for the system to be considered complete. + ```bash + git clone https://github.com/pulumi/pulumi-self-hosted-installers.git + cd pulumi-self-hosted-installers/quickstart-docker-compose + ``` -## Quickstart Docker Compose Deployment Options +1. Set your license key: -The [Quickstart Docker Compose Installer](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/quickstart-docker-compose) is used to deploy a test system using Docker. + ```bash + export PULUMI_LICENSE_KEY= + ``` -### Option #1 - Using the all-in-one approach +1. Start the stack: -If you would like to use Pulumi’s all-in-one solution, you just need to run `run-ee.sh` like this: `run-ee.sh -f ./all-in-one/docker-compose.yml`. This will start all components using working defaults, including a DB container that is migrated using our DB scripts. + ```bash + ./scripts/run-ee.sh -f ./all-in-one/docker-compose.yml + ``` -{{% notes type="info" %}} -Environment variables should be set in the `./all-in-one/docker-compose.yml` file. -{{% /notes %}} + This starts every component with working defaults, including a MySQL container that is migrated automatically. Checkpoint data is stored under `$HOME/pulumi-self-hosted-installers/data` by default; override it with `PULUMI_DATA_PATH`. -### Option #2 - Provide your own Database +1. Open the Console at [http://localhost:3000](http://localhost:3000) and create the first account. The first user to register becomes an administrator. -The service is tested against a MySQL version 8.0 instance. It is assumed that you have a DB instance called `pulumi-db` running at port `3306` and accessible within a network called `pulumi-ee`. +1. Point the CLI at your instance and follow the prompt to create an access token: -{{% notes type="info" %}} -You will need the `migrations` folder downloaded locally, which contains the DB scripts that need to be applied against your DB instance. -Your Pulumi sales contact should be able to provide you with this. -{{% /notes %}} + ```bash + pulumi login http://localhost:8080 + ``` + +1. Verify the connection: + + ```bash + pulumi whoami + ``` + +To stop the stack, press `Ctrl+C`, then remove the containers with `docker compose -f ./all-in-one/docker-compose.yml down`. Delete the data directory to discard evaluation state. + +## Advanced configuration + +The `run-ee.sh` script honors the following environment variables; unset variables fall back to working defaults: + +- `PULUMI_DATA_PATH`: persistent path for checkpoint objects. Defaults to `$HOME/pulumi-self-hosted-installers/data`. +- `PULUMI_LOCAL_DATABASE_HOST`: the database hostname. Defaults to `pulumi-db`. +- `PULUMI_LOCAL_DATABASE_PORT`: the database port. Defaults to `3306`. + +Other settings — identity providers, object storage, encryption keys — are configured in the `environment` blocks of `./all-in-one/docker-compose.yml`. See [Components](/docs/administration/self-hosting/components/) for the full set of variables each container accepts. -## Quickstart Docker Compose System Management and Maintenance +### Bring your own database -Since the quickstart option is meant to be used for testing purposes, there is no real maintenance or management needed other than perhaps updating the service containers with the latest versions. +To run against an existing MySQL 8.0 instance instead of the bundled database, start the service with the base `docker-compose.yml` and point `PULUMI_LOCAL_DATABASE_HOST` and `PULUMI_LOCAL_DATABASE_PORT` at it. The script creates and uses a Docker network named `pulumi-self-hosted-installers`, so the database must be reachable from that network. -### Updating the Pulumi Cloud Containers +The schema is applied by the `pulumi/migrations` container, which the compose file pulls from Docker Hub — you do not need to obtain migration scripts separately. -For testing purposes, it is recommended to use the `latest` image tag in the docker compose file and re-run the `run-ee.sh` script when there are newer versions of the service image pushed to docker hub. +## Updating -If you specified a specific image version in the docker compose file, then update the version tag and re-run the `run-ee.sh` script. +For evaluation, pin the `latest` image tag in the compose file and re-run `run-ee.sh` to pull newer service images. If you pinned a specific version, update the tag and re-run the script. diff --git a/content/docs/administration/self-hosting/install/_index.md b/content/docs/administration/self-hosting/install/_index.md new file mode 100644 index 000000000000..17d7294c61f0 --- /dev/null +++ b/content/docs/administration/self-hosting/install/_index.md @@ -0,0 +1,85 @@ +--- +title_tag: Install Self-Hosted Pulumi Cloud +meta_desc: Install self-hosted Pulumi Cloud on your platform — evaluate in minutes with Docker Compose, or deploy to production on AWS, Azure, Google Cloud, or Kubernetes. +title: Install +h1: Install Self-Hosted Pulumi Cloud +weight: 1 +menu: + administration: + name: Install + parent: administration-self-hosting + weight: 0 + identifier: administration-self-hosting-install +aliases: + - /self-hosted/install/ +pulumi_cloud_feature: self-hosting +--- + +Run the full Pulumi Cloud platform in your own cloud account or data center. Start with the all-in-one Docker Compose stack to evaluate on a single host, then choose a production deployment for your platform. + +{{< self-hosting-trial-note >}} +Every installation needs a license key, which you receive as part of the proof of concept. +{{< /self-hosting-trial-note >}} + +## Choose your platform + +{{< chooser cloud "docker,kubernetes,aws,azure,gcp" >}} + +{{% choosable cloud docker %}} + +The all-in-one Docker Compose stack runs the API, Console, database, and search on a single host — the fastest way to try self-hosted Pulumi Cloud. + +```bash +git clone https://github.com/pulumi/pulumi-self-hosted-installers.git +cd pulumi-self-hosted-installers/quickstart-docker-compose +export PULUMI_LICENSE_KEY= +./scripts/run-ee.sh -f ./all-in-one/docker-compose.yml +``` + +Then open the Console at [http://localhost:3000](http://localhost:3000), create the first account, and run `pulumi login http://localhost:8080`. + +See the [Docker Compose quickstart](/docs/administration/self-hosting/deployment-options/quickstart-docker-compose/) for prerequisites, first login, verification, and teardown. + +{{% /choosable %}} + +{{% choosable cloud kubernetes %}} + +Deploy to your own Kubernetes cluster with MySQL and S3-compatible object storage. This is the most flexible production option and works in any environment, including air-gapped networks. + +See [Bring your own infrastructure](/docs/administration/self-hosting/deployment-options/byo-infra-hosted/) for the Kubernetes deployment guide. + +{{% /choosable %}} + +{{% choosable cloud aws %}} + +Deploy a production system on AWS. Two managed options are available: + +- [Amazon EKS](/docs/administration/self-hosting/deployment-options/eks-hosted/) — Kubernetes-based, with RDS Aurora, S3, and CloudWatch. +- [Amazon ECS](/docs/administration/self-hosting/deployment-options/ecs-hosted/) — ECS and Fargate, with RDS Aurora, S3, and an Application Load Balancer. + +{{% /choosable %}} + +{{% choosable cloud azure %}} + +Deploy a production system on [Azure Kubernetes Service](/docs/administration/self-hosting/deployment-options/aks-hosted/) with Azure Database for MySQL and Azure Blob Storage. + +{{% /choosable %}} + +{{% choosable cloud gcp %}} + +Deploy a production system on [Google Kubernetes Engine](/docs/administration/self-hosting/deployment-options/gke-hosted/) with Cloud SQL for MySQL and Cloud Storage. + +{{% /choosable %}} + +{{< /chooser >}} + +## Before you go to production + +The deployment guides stand up a working system. Before you run production workloads, review the [Operations guide](/docs/administration/self-hosting/operations/) for high availability, backup and recovery, monitoring, sizing, and security hardening, and the [Network requirements](/docs/administration/self-hosting/network/) for ingress, egress, and air-gapped configurations. + +## Next steps + +- [Docker Compose quickstart](/docs/administration/self-hosting/deployment-options/quickstart-docker-compose/) +- [All deployment options](/docs/administration/self-hosting/deployment-options/) +- [Components and configuration](/docs/administration/self-hosting/components/) +- [Operations guide](/docs/administration/self-hosting/operations/) diff --git a/content/docs/administration/self-hosting/network.md b/content/docs/administration/self-hosting/network.md index 0d19703d3efd..3a3c9c166ad4 100644 --- a/content/docs/administration/self-hosting/network.md +++ b/content/docs/administration/self-hosting/network.md @@ -8,7 +8,7 @@ menu: name: Network reqs parent: administration-self-hosting weight: 4 - identifier: administration-security-compliance-self-hosted-network + identifier: administration-self-hosting-network aliases: - /docs/guides/self-hosted/requirements/ - /docs/guides/self-hosted/requirements/network/ diff --git a/content/docs/administration/self-hosting/operations/_index.md b/content/docs/administration/self-hosting/operations/_index.md index 24d515f83ff6..31d129a363cc 100644 --- a/content/docs/administration/self-hosting/operations/_index.md +++ b/content/docs/administration/self-hosting/operations/_index.md @@ -8,7 +8,7 @@ menu: name: Operations parent: administration-self-hosting weight: 6 - identifier: administration-security-compliance-self-hosted-operations + identifier: administration-self-hosting-operations pulumi_cloud_feature: self-hosting --- diff --git a/content/docs/administration/self-hosting/operations/architecture.md b/content/docs/administration/self-hosting/operations/architecture.md index 1553ac8d2975..db80755ef7bd 100644 --- a/content/docs/administration/self-hosting/operations/architecture.md +++ b/content/docs/administration/self-hosting/operations/architecture.md @@ -6,9 +6,9 @@ h1: Self-Hosted Architecture Overview menu: administration: name: Architecture - parent: administration-security-compliance-self-hosted-operations + parent: administration-self-hosting-operations weight: 1 - identifier: administration-security-compliance-self-hosted-operations-architecture + identifier: administration-self-hosting-operations-architecture pulumi_cloud_feature: self-hosting --- diff --git a/content/docs/administration/self-hosting/operations/backup-recovery.md b/content/docs/administration/self-hosting/operations/backup-recovery.md index d8be2973ca0c..d9f5762001f0 100644 --- a/content/docs/administration/self-hosting/operations/backup-recovery.md +++ b/content/docs/administration/self-hosting/operations/backup-recovery.md @@ -6,9 +6,9 @@ h1: Backup and Recovery menu: administration: name: Backup and Recovery - parent: administration-security-compliance-self-hosted-operations + parent: administration-self-hosting-operations weight: 7 - identifier: administration-security-compliance-self-hosted-operations-backup-recovery + identifier: administration-self-hosting-operations-backup-recovery pulumi_cloud_feature: self-hosting --- diff --git a/content/docs/administration/self-hosting/operations/compute-sizing.md b/content/docs/administration/self-hosting/operations/compute-sizing.md index ff3a4a553794..928036d1687f 100644 --- a/content/docs/administration/self-hosting/operations/compute-sizing.md +++ b/content/docs/administration/self-hosting/operations/compute-sizing.md @@ -6,9 +6,9 @@ h1: Compute Sizing menu: administration: name: Compute Sizing - parent: administration-security-compliance-self-hosted-operations + parent: administration-self-hosting-operations weight: 3 - identifier: administration-security-compliance-self-hosted-operations-compute-sizing + identifier: administration-self-hosting-operations-compute-sizing pulumi_cloud_feature: self-hosting --- diff --git a/content/docs/administration/self-hosting/operations/database.md b/content/docs/administration/self-hosting/operations/database.md index d6a78dbb709c..8f5e343e9805 100644 --- a/content/docs/administration/self-hosting/operations/database.md +++ b/content/docs/administration/self-hosting/operations/database.md @@ -6,9 +6,9 @@ h1: Database Best Practices menu: administration: name: Database - parent: administration-security-compliance-self-hosted-operations + parent: administration-self-hosting-operations weight: 2 - identifier: administration-security-compliance-self-hosted-operations-database + identifier: administration-self-hosting-operations-database pulumi_cloud_feature: self-hosting --- @@ -64,11 +64,12 @@ Deploy your database cluster across multiple availability zones with at least on The self-hosted installers default to the following database instance types: -| Cloud | Default instance type | Notes | +| Installer | Default instance type | Notes | | :-- | :-- | :-- | -| AWS | db.r5.large (16 GB RAM) | Memory-optimized, recommended for production | -| Azure | General Purpose D2ads_v5 or equivalent | 2 vCPU / 8 GB RAM | -| GCP | db-g1-small (1.7 GB RAM) | Minimal; upgrade for production use | +| AWS EKS | db.r5.large (16 GB RAM) | Memory-optimized, recommended for production. Set via `dbInstanceType` in the `20-database` project | +| AWS ECS | db.t3.small | Burstable; raise `dbInstanceType` before running production workloads | +| Azure AKS | General Purpose D2ads_v5 or equivalent | 2 vCPU / 8 GB RAM | +| GCP GKE | db-g1-small (1.7 GB RAM) | Minimal; upgrade for production use | For production workloads, start with a memory-optimized instance with at least 16 GB RAM (db.r5.large, db.r6g.large, General Purpose D4s_v3, or equivalent) and scale based on monitoring. Burstable instances (db.t3.*) are acceptable for development and light workloads but may throttle under sustained load. diff --git a/content/docs/administration/self-hosting/operations/monitoring.md b/content/docs/administration/self-hosting/operations/monitoring.md index c93eb185919a..4c09d30f1024 100644 --- a/content/docs/administration/self-hosting/operations/monitoring.md +++ b/content/docs/administration/self-hosting/operations/monitoring.md @@ -6,9 +6,9 @@ h1: Monitoring and Alerting menu: administration: name: Monitoring - parent: administration-security-compliance-self-hosted-operations + parent: administration-self-hosting-operations weight: 6 - identifier: administration-security-compliance-self-hosted-operations-monitoring + identifier: administration-self-hosting-operations-monitoring pulumi_cloud_feature: self-hosting --- @@ -16,7 +16,7 @@ pulumi_cloud_feature: self-hosting Effective monitoring is critical for maintaining a reliable self-hosted Pulumi Cloud deployment. This page covers a recommended alerting strategy and the key metrics to watch. -The API service exposes Prometheus metrics and supports OpenTelemetry for tracing. See [OpenTelemetry configuration](/docs/administration/self-hosting/components/api/#opentelemetry) for setup details. +The API service exposes Prometheus metrics and supports OpenTelemetry for tracing. See [Telemetry](/docs/administration/self-hosting/operations/telemetry/) for setup details. ## Three-tier alerting strategy diff --git a/content/docs/administration/self-hosting/operations/networking.md b/content/docs/administration/self-hosting/operations/networking.md index 851e43835b8e..33a4ed80f8d5 100644 --- a/content/docs/administration/self-hosting/operations/networking.md +++ b/content/docs/administration/self-hosting/operations/networking.md @@ -6,9 +6,9 @@ h1: Networking and Load Balancing menu: administration: name: Networking - parent: administration-security-compliance-self-hosted-operations + parent: administration-self-hosting-operations weight: 5 - identifier: administration-security-compliance-self-hosted-operations-networking + identifier: administration-self-hosting-operations-networking pulumi_cloud_feature: self-hosting --- diff --git a/content/docs/administration/self-hosting/operations/object-storage.md b/content/docs/administration/self-hosting/operations/object-storage.md index 11cc3788eccf..99590e88a94f 100644 --- a/content/docs/administration/self-hosting/operations/object-storage.md +++ b/content/docs/administration/self-hosting/operations/object-storage.md @@ -6,9 +6,9 @@ h1: Object Storage Best Practices menu: administration: name: Object Storage - parent: administration-security-compliance-self-hosted-operations + parent: administration-self-hosting-operations weight: 4 - identifier: administration-security-compliance-self-hosted-operations-object-storage + identifier: administration-self-hosting-operations-object-storage pulumi_cloud_feature: self-hosting --- diff --git a/content/docs/administration/self-hosting/operations/security-hardening.md b/content/docs/administration/self-hosting/operations/security-hardening.md index 4d124e52b1e2..abdbef5ce60f 100644 --- a/content/docs/administration/self-hosting/operations/security-hardening.md +++ b/content/docs/administration/self-hosting/operations/security-hardening.md @@ -6,9 +6,9 @@ h1: Security Hardening menu: administration: name: Security Hardening - parent: administration-security-compliance-self-hosted-operations + parent: administration-self-hosting-operations weight: 9 - identifier: administration-security-compliance-self-hosted-operations-security-hardening + identifier: administration-self-hosting-operations-security-hardening pulumi_cloud_feature: self-hosting --- diff --git a/content/docs/administration/self-hosting/operations/telemetry.md b/content/docs/administration/self-hosting/operations/telemetry.md new file mode 100644 index 000000000000..e290c96c8b00 --- /dev/null +++ b/content/docs/administration/self-hosting/operations/telemetry.md @@ -0,0 +1,165 @@ +--- +title_tag: "Telemetry | Self-Hosting Pulumi" +meta_desc: Export metrics and traces from a self-hosted Pulumi Cloud installation via OpenTelemetry, and scrape or remote-write them into Prometheus. +title: Telemetry +h1: Self-Hosted Pulumi Cloud Telemetry +menu: + administration: + name: Telemetry + parent: administration-self-hosting-operations + weight: 7 + identifier: administration-self-hosting-operations-telemetry +pulumi_cloud_feature: self-hosting +--- + +{{< self-hosting-trial-note />}} + +Getting metrics and traces out of a self-hosted installation. For what to alert +on once they are flowing, see [Monitoring](/docs/administration/self-hosting/operations/monitoring/). + +## Configuring the exporter + +The API service is configured to export OpenTelemetry metrics and traces to the vendor of your choice via the OpenTelemetry collector. You will need to manage your own OpenTelemetry collector. + +The following environment variables are needed to configure OpenTelemetry in the service: + +| Variable name | Description | +| --- | --- | +| OTEL_EXPORTER_OTLP_ENDPOINT | (Required) Used to configure the OTLP exporter. The base URL to which all telemetry will be sent. If not set, the API service will use no-op metrics and traces. | +| OTEL_EXPORTER_OTLP_PROTOCOL | (Optional) Used to configure the OTLP exporter. Valid values are `http` or `grpc`. Defaults to `grpc`. | +| PULUMI_ENABLE_DEPRECATED_METRICS | (Optional) Whether to continue emitting API service metrics in a log-based format. Defaults to `true`. | +| METRICS_WEBHOOK_SECRET | Required to successfully authenticate to the `/metrics` endpoint. The Authorization header should be set as follows: `Authorization: webhook-token `. | + +OpenTelemetry is not yet available for the [console service](/docs/administration/self-hosting/components/console/). + +### Metrics endpoint + +The API service exposes a metrics endpoint (`https://api.pulumi.com/metrics`) that is secured by a bearer token. This token is configured using the environment variable `METRICS_WEBHOOK_SECRET`. + +{{% notes type="info" %}} +The token type is `webhook-token`, not `Bearer`. +{{% /notes %}} + +```sh +curl -s GET https://api.pulumi.com/metrics -H 'Authorization: webhook-token +``` + +### Prometheus + +The API service provides two options to get metrics into Prometheus: + +1. From the OpenTelemetry collector via a [Prometheus remote write exporter](#prometheus-remote-write-exporter). This is a push-based exporter. +1. From a [Prometheus exporter](#prometheus-exporter) by scraping the `/metrics` endpoint. This is a pull-based exporter. + +#### Prometheus remote write exporter + +This option does not use the `/metrics` endpoint. Instead, it exports metrics from the collector to a [Prometheus remote write compatible backend](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/prometheusremotewriteexporter/README.md). + +Example OpenTelemetry collector configuration for a service using AWS and the AWS Distro for OpenTelemetry Collector: + +```yaml +extensions: + sigv4auth: + +receivers: + otlp: + protocols: + grpc: + endpoint: localhost:4317 + +processors: + memory_limiter: + + batch: + +exporters: + logging: + + prometheusremotewrite: + endpoint: https://aws-managed-prometheus-endpoint/v1/api/remote_write + auth: + authenticator: sigv4auth + +service: + telemetry: + logs: + + pipelines: + traces: + receivers: [otlp] + processors: [memory_limiter, batch] + exporters: [logging] + + metrics: + receivers: [otlp] + processors: [memory_limiter, batch] + exporters: [prometheusremotewrite] + + extensions: [sigv4auth] +``` + +#### Prometheus exporter + +This option requires configuring the environment variable `METRICS_WEBHOOK_SECRET` to successfully authenticate to the [`/metrics` endpoint](#metrics-endpoint). + +Example OpenTelemetry collector configuration: + +```yaml +extensions: + bearertokenauth: + scheme: webhook-token + token: ${env:METRICS_WEBHOOK_SECRET} + +receivers: + otlp: + protocols: + grpc: + endpoint: localhost:4317 + +processors: + memory_limiter: + + batch: + +exporters: + debug: + + prometheus: + endpoint: api.pulumi.com:443 + auth: + authenticator: bearertokenauth + namespace: pulumi + resource_to_telemetry_conversion: + enabled: true + +service: + telemetry: + logs: + + pipelines: + traces: + receivers: [otlp] + processors: [memory_limiter, batch] + exporters: [debug] + + metrics: + receivers: [otlp] + processors: [memory_limiter, batch] + exporters: [prometheus] + + extensions: [bearertokenauth] +``` + +The bearer token also needs to be included in the Prometheus server configuration: + +```yaml +scrape_configs: + - job_name: pulumi + scrape_interval: 15s + authorization: + type: webhook-token + credentials: + scheme: https + static_configs: + - targets: ["api.pulumi.com"] +``` diff --git a/content/docs/administration/self-hosting/operations/upgrades.md b/content/docs/administration/self-hosting/operations/upgrades.md index 147499d664ec..9cd630400f31 100644 --- a/content/docs/administration/self-hosting/operations/upgrades.md +++ b/content/docs/administration/self-hosting/operations/upgrades.md @@ -6,9 +6,9 @@ h1: Upgrade Pipeline menu: administration: name: Upgrades - parent: administration-security-compliance-self-hosted-operations + parent: administration-self-hosting-operations weight: 8 - identifier: administration-security-compliance-self-hosted-operations-upgrades + identifier: administration-self-hosting-operations-upgrades pulumi_cloud_feature: self-hosting --- @@ -16,6 +16,8 @@ pulumi_cloud_feature: self-hosting This page covers how to safely update your self-hosted Pulumi Cloud deployment. For version-specific changes, see the [Changelog](/docs/administration/self-hosting/changelog/). +{{< self-hosting-schema-v2-note />}} + ## Staged rollouts Deploy updates through staged environments: diff --git a/content/docs/administration/self-hosting/saml-sso.md b/content/docs/administration/self-hosting/saml-sso.md index 28a0e9d8622d..cdd92f40d390 100644 --- a/content/docs/administration/self-hosting/saml-sso.md +++ b/content/docs/administration/self-hosting/saml-sso.md @@ -8,7 +8,7 @@ menu: name: SAML SSO parent: administration-self-hosting weight: 3 - identifier: administration-security-compliance-self-hosted-saml-sso + identifier: administration-self-hosting-saml-sso aliases: - /docs/guides/self-hosted/saml-sso/ - /docs/pulumi-cloud/self-hosted/saml-sso/ @@ -17,6 +17,8 @@ aliases: pulumi_cloud_feature: self-hosting --- +{{< self-hosting-trial-note />}} + The self-hosted option allows you to control various aspects of Pulumi Cloud including how users will sign in to the [Pulumi Cloud console](/docs/administration/self-hosting/components/console/). ## Creating the keys diff --git a/content/docs/administration/self-hosting/system-requirements.md b/content/docs/administration/self-hosting/system-requirements.md new file mode 100644 index 000000000000..08536e16806c --- /dev/null +++ b/content/docs/administration/self-hosting/system-requirements.md @@ -0,0 +1,106 @@ +--- +title_tag: "System Requirements | Self-Hosting Pulumi" +meta_desc: Everything a self-hosted Pulumi Cloud installation needs — compute, MySQL, object storage, OpenSearch, DNS, TLS, and license keys. +title: System requirements +h1: Self-Hosted Pulumi Cloud System Requirements +menu: + administration: + name: System requirements + parent: administration-self-hosting + weight: 2 + identifier: administration-self-hosting-system-requirements +pulumi_cloud_feature: self-hosting +--- + +{{< self-hosting-trial-note />}} + +Every deployment option needs the same set of things: somewhere to run three containers, a MySQL database, an object store, and DNS and TLS for two endpoints. The managed-platform installers provision most of this for you. The [bring-your-own-infrastructure](/docs/administration/self-hosting/deployment-options/byo-infra-hosted/) and [Docker Engine](/docs/administration/self-hosting/deployment-options/local-docker/) options expect you to supply it. + +## Licenses + +| Key | Required | Notes | +| :-- | :-- | :-- | +| `PULUMI_LICENSE_KEY` | Yes | A JWT issued by Pulumi. The service will not start without it. | +| `AG_GRID_LICENSE_KEY` | Yes | Set on the console container. | + +You receive both as part of a [proof of concept](/product/self-hosted/#self-hosted-trial). + +## Compute + +Three containers make up an installation: the [API](/docs/administration/self-hosting/components/api/), the [console](/docs/administration/self-hosting/components/console/), and a migrations job that runs once per upgrade. + +| Service | CPU | Memory | +| :-- | :-- | :-- | +| API | 2 vCPU | 4 GB | +| Console | 0.5 vCPU | 512 MB | +| Migrations | 128m | 128 MB | + +The API and console are stateless, so scale the API horizontally rather than vertically. A single-host evaluation needs at least **2 CPU cores and 8 GB of memory**. + +For production sizing, high availability, and per-installer configuration, see [Compute sizing](/docs/administration/self-hosting/operations/compute-sizing/). + +## Database + +| Requirement | Value | +| :-- | :-- | +| Engine | MySQL 8.0.x | +| Storage | 20 GB SSD minimum | +| `sql_mode` | Must include `STRICT_TRANS_TABLES` | + +If you are supplying your own server rather than letting an installer provision one: + +- Create a database named `pulumi` before installing. The installers do not create it. +- Grant the application user the privileges it needs: + + ```sql + GRANT ALL PRIVILEGES ON `pulumi`.* TO 'pulumi'@'%'; + GRANT CREATE USER ON *.* TO 'pulumi'@'%' WITH GRANT OPTION; + ``` + +- Enable inbound ICMP (ping) on the MySQL server. The installer's connectivity check depends on it. + +{{% notes type="warning" %}} +`STRICT_TRANS_TABLES` is not a suggestion. Without it, schema migrations fail with `ALGORITHM=INPLACE is not supported. Try ALGORITHM=COPY`. Aurora MySQL 8.0 does not set it by default — see [Required sql_mode settings](/docs/administration/self-hosting/operations/database/#required-sql_mode-settings) for how to set it per engine. +{{% /notes %}} + +## Object storage + +| Requirement | Value | +| :-- | :-- | +| Type | S3-compatible, Azure Blob Storage, or Google Cloud Storage | +| Storage | 200 GB SSD minimum | + +An installation uses separate buckets for checkpoints, policy packs, engine events, and service metadata. See [Object storage](/docs/administration/self-hosting/operations/object-storage/) for the full inventory and replication guidance. + +Two requirements catch people out with non-AWS S3-compatible stores: + +- Pass `endpoint=IP:PORT` and `s3ForcePathStyle=true` as query parameters on the storage endpoint. +- The store, and any proxy or ingress in front of it, must preserve the `Content-Encoding: gzip` header on responses. Stripping it returns garbled state to clients. + +## Search + +| Requirement | Value | +| :-- | :-- | +| Engine | OpenSearch 2.x | +| Tested versions | 2.9 and 2.11 | + +Resource search needs an OpenSearch cluster, but it is not in the critical path — if the cluster is unreachable, stack updates still work and the console reports search as unavailable. See [Search](/docs/administration/self-hosting/components/search/). + +## Kubernetes + +The EKS, AKS, GKE, and bring-your-own-infrastructure options need a conformant Kubernetes cluster. Each installer pins the version it was validated against; see the deployment guide for the option you are using. The ECS, Docker Compose, and Docker Engine options need no Kubernetes. + +## DNS and TLS + +Every installation serves two endpoints from a domain you control: + +- `api.` — the API, which the CLI and console call. +- `app.` — the console. + +Each needs a TLS certificate. The managed-platform installers can request these for you; the others expect you to supply them. + +## Network access + +Ingress on 443 (and 80 redirecting to it) from CLI users and browsers, plus 8080 from the console to the API. Egress to your database on 3306, your object store, and — unless you are running [air-gapped](/docs/administration/self-hosting/airgapped/) — Docker Hub to pull images. SMTP on 25, 465, or 587 is optional and only needed for invitations and password resets. + +See [Network requirements](/docs/administration/self-hosting/network/) for the full list. diff --git a/content/docs/administration/self-hosting/troubleshooting.md b/content/docs/administration/self-hosting/troubleshooting.md new file mode 100644 index 000000000000..c477cfc5de78 --- /dev/null +++ b/content/docs/administration/self-hosting/troubleshooting.md @@ -0,0 +1,93 @@ +--- +title_tag: "Troubleshooting | Self-Hosting Pulumi" +meta_desc: Symptoms, causes, and fixes for common self-hosted Pulumi Cloud problems — failed migrations, garbled state, TLS errors, and search issues. +title: Troubleshooting +h1: Troubleshooting Self-Hosted Pulumi Cloud +menu: + administration: + name: Troubleshooting + parent: administration-self-hosting + weight: 9 + identifier: administration-self-hosting-troubleshooting +pulumi_cloud_feature: self-hosting +--- + +{{< self-hosting-trial-note />}} + +Problems that come up often enough to be worth naming, with the symptom first so you can find yours by searching the error text. + +## Migrations fail with `ALGORITHM=INPLACE is not supported` + +**Symptom.** The migrations container exits with an error containing `ALGORITHM=INPLACE is not supported. Try ALGORITHM=COPY`. + +**Cause.** The database's `sql_mode` does not include `STRICT_TRANS_TABLES`. Aurora MySQL 8.0 does not set it by default. + +**Fix.** Set `STRICT_TRANS_TABLES` in the parameter group or server configuration and restart, then re-run migrations. See [Required sql_mode settings](/docs/administration/self-hosting/operations/database/#required-sql_mode-settings). + +## The Docker Compose stack exits immediately + +**Symptom.** `run-ee.sh` prints a message about contacting sales and exits before any container starts. + +**Cause.** `PULUMI_LICENSE_KEY` is unset. The script hard-fails rather than starting a service that cannot run. + +**Fix.** Export the license key before running the script. See the [Docker Compose quickstart](/docs/administration/self-hosting/deployment-options/quickstart-docker-compose/). + +## Stack state or policy packs download garbled + +**Symptom.** The CLI reports corrupt or unreadable state, or policy packs fail to load, against an S3-compatible object store. + +**Cause.** The API stores objects gzip-compressed. Something between the store and the client — the store itself, a reverse proxy, or an ingress controller — is stripping the `Content-Encoding: gzip` response header. + +**Fix.** Configure the store and every intermediary to preserve that header. + +## Connection failures to a bring-your-own MySQL server + +**Symptom.** The installer cannot reach a MySQL server that is otherwise up and accepting connections. + +**Cause.** Inbound ICMP is disabled on the database server. The installer's connectivity check uses it. + +**Fix.** Allow inbound ICMP from the cluster to the database server. + +## S3-compatible object storage is not reachable + +**Symptom.** The API fails to read or write objects against a non-AWS S3-compatible store. + +**Cause.** The endpoint is missing the query parameters the storage client needs to address a non-AWS endpoint. + +**Fix.** Append `endpoint=IP:PORT` and `s3ForcePathStyle=true` to the storage endpoint. See [System requirements](/docs/administration/self-hosting/system-requirements/#object-storage). + +## TLS verification fails when connecting to MySQL + +**Symptom.** The API or migrations container fails TLS verification against the database. + +**Cause.** `DATABASE_CA_CERTIFICATE` is set to a file path rather than the PEM contents, or the certificate does not match the hostname the service connects to. + +**Fix.** Set the variable to the PEM value itself and connect using a hostname the certificate covers. See [Encrypting connections with TLS](/docs/administration/self-hosting/operations/database/#encrypting-connections-with-tls). + +## Duplicate or failed migrations across multiple Docker hosts + +**Symptom.** Running the containers on more than one host produces migration errors or repeated migration attempts. + +**Cause.** Every host is trying to run migrations against the shared database. + +**Fix.** Set `disableDbMigrations` on every host except the one that owns migrations. See the [Docker Engine guide](/docs/administration/self-hosting/deployment-options/local-docker/). + +## An unexpected account owns SAML administration + +**Symptom.** After enabling SAML SSO, the administrator is an account nobody intended. + +**Cause.** On a fresh installation the first user to sign up becomes the administrator, and setting `samlEnabled: true` does not by itself block email and password signup. + +**Fix.** Create the intended administrator account first, before sharing the console URL. To stop further email signups, set `PULUMI_DISABLE_EMAIL_SIGNUP` on the API container — hiding the option on the console with `PULUMI_HIDE_EMAIL_SIGNUP` does not disable the underlying handler. + +## Stacks are missing from the Resources page + +**Symptom.** Resource search returns nothing, or is missing recently updated stacks. + +**Cause.** The OpenSearch index is stale or was built while the cluster was unavailable. + +**Fix.** Reindex from **Settings → Self-hosted** in the console. Search reindexes automatically each week, and search is never in the critical path for stack updates. See [Search](/docs/administration/self-hosting/components/search/). + +## Still stuck? + +Contact [Pulumi support](/support/) with your installer, its version, and the failing container's logs. diff --git a/content/docs/iac/comparisons/terraform/_index.md b/content/docs/iac/comparisons/terraform/_index.md index f12459bb9c2e..73a57036762f 100644 --- a/content/docs/iac/comparisons/terraform/_index.md +++ b/content/docs/iac/comparisons/terraform/_index.md @@ -52,8 +52,9 @@ Terraform is an infrastructure as code tool created by HashiCorp (acquired by IB | Modularity and reuse | [Component Resources](/docs/iac/concepts/components/) authored in any supported language; [Pulumi Packages](/docs/iac/concepts/packages/) let a component written in one language be consumed from any Pulumi language; language-native package managers (npm, PyPI, NuGet, Maven, Go modules); the [Pulumi Registry](/registry/) for publicly available packages; plus existing [Terraform modules](/docs/iac/guides/building-extending/using-existing-tools/use-terraform-module/) consumed directly and [hosted in Pulumi Cloud's registry](/docs/idp/concepts/terraform-modules/) | [Terraform modules](https://developer.hashicorp.com/terraform/language/modules) (HCL) and the [Terraform Registry](https://registry.terraform.io/) for public modules | | Import existing resources | [`pulumi import`](/docs/iac/guides/migration/import/) and the [`import` resource option](/docs/iac/concepts/resources/options/import/), both of which generate code in your language | [`terraform import`](https://developer.hashicorp.com/terraform/cli/commands/import) and [`import` blocks](https://developer.hashicorp.com/terraform/language/import); HCL must be hand-authored, though `terraform plan -generate-config-out` can emit a draft | | Policy as code | [Pulumi Policies](/docs/insights/policy/) — open source, with rules written in Python, TypeScript, or Open Policy Agent Rego; Pulumi Cloud commercial plans add centralized policy management plus [Pulumi-maintained policy packs](/docs/insights/policy/policy-packs/pre-built-packs/) for compliance frameworks like CIS, HITRUST, NIST, and PCI DSS | [Sentinel](https://developer.hashicorp.com/sentinel) (proprietary, HCP Terraform / Enterprise only) and Open Policy Agent | +| Self-hosting and on-prem | [Self-hosted Pulumi Cloud](/product/self-hosted/) runs the entire platform — state, secrets, RBAC, policy, and deployments — in your own cloud account or data center, including air-gapped environments, with the same capabilities as the SaaS | [Terraform Enterprise](https://developer.hashicorp.com/terraform/enterprise) is HashiCorp's self-managed offering; Sentinel policy, run tasks, and no-code provisioning are gated to HCP Terraform and Enterprise tiers | | Open source | Yes — [Apache License 2.0](https://github.com/pulumi/pulumi/blob/master/LICENSE) | No — [Business Source License 1.1](https://github.com/hashicorp/terraform/blob/main/LICENSE) | -| Commercial option | [Pulumi Cloud](/docs/iac/guides/basics/pulumi-cloud-vs-oss/) | HCP Terraform / Terraform Enterprise | +| Commercial option | [Pulumi Cloud](/docs/iac/guides/basics/pulumi-cloud-vs-oss/) — SaaS or [self-hosted](/product/self-hosted/) | HCP Terraform (SaaS) / Terraform Enterprise (self-managed) | ## Real-world results @@ -83,6 +84,10 @@ Pulumi Cloud manages state by default — encrypted in transit and at rest, vers Pulumi Cloud can also serve as the [state backend for Terraform and OpenTofu](/docs/iac/get-started/terraform/terraform-state-backend/). It implements Terraform's remote backend API, so a team points the Terraform CLI at Pulumi Cloud with a standard `backend "remote"` block and keeps its existing HCL and day-to-day workflow unchanged. In return they get encrypted state, update history, automatic state locking, RBAC, audit policies, and a unified view of Terraform-managed resources alongside Pulumi-managed ones in [Resource Search](/docs/insights/discovery/search/). Root module outputs surface as Pulumi [stack outputs](/docs/iac/concepts/stacks/#stackreferences), so other stacks can consume them without extra credentials. This makes Pulumi Cloud a governance and visibility plane you can adopt on its own merits, not only a stepping stone to converting code. +### Self-hosting and data control + +Both platforms offer a self-managed deployment for teams that can't use SaaS. Terraform Enterprise is HashiCorp's self-managed product. [Self-hosted Pulumi Cloud](/product/self-hosted/) runs the complete platform — state, secrets, RBAC, policy enforcement, and deployments — inside your own cloud account or data center, including fully air-gapped networks with no egress to the public internet. Data lives in a database and object store you control, and you integrate your own identity provider (GitHub Enterprise, GitLab, SAML SSO, and others). The self-hosted edition tracks the same capabilities as the SaaS, so teams evaluate features once and choose the deployment topology that fits their compliance posture. See the [self-hosting docs](/docs/administration/self-hosting/) for deployment options across AWS, Azure, Google Cloud, Kubernetes, and Docker. + ### Secrets handling Pulumi treats secrets as a first-class primitive. Values marked as secrets are encrypted in transit and at rest in the state file, anything derived from a secret is also encrypted, and each stack has its own encryption key. The default encryption provider can be replaced with [AWS KMS, Azure Key Vault, Google Cloud KMS, or HashiCorp Vault](/docs/iac/concepts/secrets/#available-encryption-providers). Terraform does not encrypt sensitive values in its state file; the recommended approach is to integrate with HashiCorp Vault, which is a separate product. HCP Terraform encrypts state at rest, but values inside that state are still readable to anyone with access to the workspace. @@ -166,9 +171,14 @@ Yes. [Pulumi HCL](/docs/iac/languages-sdks/hcl/) is a supported language: a proj [`pulumi refresh`](/docs/iac/cli/commands/pulumi_refresh/) compares the state file to the actual state in the cloud and reports differences, and `pulumi preview --diff` shows what would change on the next update. Pulumi Cloud commercial plans add [scheduled drift detection and remediation](/docs/deployments/concepts/drift/) that runs on a configurable cadence and can auto-remediate. +### Can I run Pulumi on-prem like Terraform Enterprise? + +Yes. [Self-hosted Pulumi Cloud](/product/self-hosted/) runs the full platform in your own cloud account or data center, including air-gapped environments, with the same state, secrets, RBAC, policy, and deployment capabilities as the SaaS. It's available with the Business Critical edition; see the [self-hosting documentation](/docs/administration/self-hosting/) for deployment options and requirements. + ## Next steps * [Get started with Pulumi](/docs/get-started/) +* [Migrating from Terraform Enterprise to self-hosted Pulumi Cloud](/docs/iac/comparisons/terraform/from-terraform-enterprise/) * [Pulumi HCL: run Terraform HCL on Pulumi](/docs/iac/languages-sdks/hcl/) * [Pulumi terms and command equivalents for Terraform users](/docs/iac/comparisons/terraform/terminology/) * [Using Pulumi Cloud as a Terraform state backend](/docs/iac/get-started/terraform/terraform-state-backend/) diff --git a/content/docs/iac/comparisons/terraform/from-terraform-enterprise.md b/content/docs/iac/comparisons/terraform/from-terraform-enterprise.md new file mode 100644 index 000000000000..6d36bd011fdd --- /dev/null +++ b/content/docs/iac/comparisons/terraform/from-terraform-enterprise.md @@ -0,0 +1,46 @@ +--- +title_tag: "Migrating from Terraform Enterprise to Pulumi" +meta_desc: How teams running self-managed Terraform Enterprise move to self-hosted Pulumi Cloud — the same on-prem operating model, with a phased migration path. +title: From Terraform Enterprise +h1: Migrating from Terraform Enterprise to Self-Hosted Pulumi Cloud +menu: + iac: + name: From Terraform Enterprise + parent: iac-comparisons-terraform + weight: 3 +aliases: + - /docs/iac/comparisons/terraform/migrating-from-terraform-enterprise/ +--- + +Terraform Enterprise teams run infrastructure as code on their own infrastructure for data control, network isolation, and compliance. [Self-hosted Pulumi Cloud](/product/self-hosted/) offers the same operating model: the complete Pulumi Cloud platform — state, secrets, RBAC, policy, and deployments — running in your own cloud account or data center, including fully air-gapped networks. This guide is for teams evaluating a move from Terraform Enterprise to Pulumi without giving up self-management. + +## What you get with self-hosted Pulumi Cloud + +Self-hosted Pulumi Cloud runs the same platform as the [SaaS](https://app.pulumi.com/), so teams evaluate features once and choose the deployment topology that fits their compliance posture: + +- **The full platform in your environment.** State management, secrets, role-based access control, [policy enforcement](/docs/insights/policy/), and [deployments](/docs/deployments/) all run on infrastructure you operate. +- **Data you control.** State and secrets live in a MySQL database and an object store within your own network. Encryption keys can be managed locally or through AWS KMS or Azure Key Vault. +- **Air-gapped operation.** Run with no egress to the public internet. Because you install and operate it, the deployment sits inside a compliance boundary you own and assess. +- **Your identity provider.** Integrate GitHub Enterprise, GitLab, SAML SSO, and others. + +For a feature-by-feature comparison of the two tools, see [Pulumi vs. Terraform](/docs/iac/comparisons/terraform/). + +## How migration works + +You don't rewrite everything at once. Pulumi is designed to adopt incrementally, and these paths combine: + +1. **Run side by side.** Pulumi programs can [reference existing Terraform state](/docs/iac/guides/migration/migrating-to-pulumi/from-terraform/#referencing-terraform-state) and read its outputs, so you keep existing infrastructure in Terraform while adopting Pulumi for new work. +1. **Store Terraform state in Pulumi.** [Pulumi Cloud can act as a Terraform state backend](/docs/iac/get-started/terraform/terraform-state-backend/), giving you encrypted state, history, locking, RBAC, and audit policies while you continue to run Terraform day-to-day. +1. **Convert HCL.** [`pulumi convert --from terraform`](/docs/iac/guides/migration/migrating-to-pulumi/from-terraform/#converting-terraform-hcl-to-pulumi) translates Terraform HCL into a Pulumi program in the language of your choice, preserving names, modules, and structure where possible. +1. **Import existing resources.** [`pulumi import`](/docs/iac/guides/migration/import/) brings already-provisioned resources under Pulumi management and generates the corresponding code. + +For a complete walkthrough including bulk conversion and state migration, see [Migrating from Terraform to Pulumi](/docs/iac/guides/migration/migrating-to-pulumi/from-terraform/). + +## Pricing + +Self-hosted Pulumi Cloud is available with the Business Critical edition. See [pricing](/pricing/) for what each edition includes, and [contact us](/contact/) to discuss licensing and an evaluation for your environment. + +## Get started + +1. [Request a Proof of Concept (PoC)](/product/self-hosted/#self-hosted-trial) to get an evaluation license key and a solutions architect to size the install. +1. Follow the [install guide](/docs/administration/self-hosting/install/) — evaluate on a single host with Docker Compose, then deploy to production on AWS, Azure, Google Cloud, or Kubernetes. diff --git a/content/docs/install/_index.md b/content/docs/install/_index.md index fb3f7d465cab..92e4589a71f2 100644 --- a/content/docs/install/_index.md +++ b/content/docs/install/_index.md @@ -38,6 +38,8 @@ The latest version of Pulumi is **{{< latest-version >}}**. For previous version By default, the Pulumi CLI stores state in [Pulumi Cloud](/docs/iac/guides/basics/pulumi-cloud-vs-oss/), our free, hosted state-management backend. Pulumi Cloud is free for individuals and is the recommended backend when you're learning Pulumi — no credit card required. If you'd rather host state yourself (S3, Azure Blob, GCS, or local), see [self-managed state backends](/docs/iac/concepts/state-and-backends/). +Organizations that need to keep everything in their own environment can run the full Pulumi Cloud platform self-hosted — the same managed experience as the SaaS, in your own cloud account or data center. See [self-hosted Pulumi Cloud](/product/self-hosted/) and the [self-hosting docs](/docs/administration/self-hosting/). + {{% notes type="info" %}} You don't need a Pulumi Cloud account to install the CLI. You'll be prompted to sign in (or to pick a self-managed backend) the first time you run `pulumi login`. {{% /notes %}} diff --git a/content/enterprise/_index.md b/content/enterprise/_index.md index 22f8c638cdf9..98651d3aef02 100644 --- a/content/enterprise/_index.md +++ b/content/enterprise/_index.md @@ -143,7 +143,7 @@ capabilities: icon: buildings icon_color: blue description: | - Enterprises that require specific data controls can use the self-hosted Pulumi service in their own cloud or datacenter and maintain complete control over their hosting, network isolation, identity, and data ownership. Deployment options include Kubernetes clusters, VMWare vSphere, virtual private clouds in AWS, Azure, Google Cloud, and many other configurations. + Enterprises that require specific data controls can run [self-hosted Pulumi Cloud](/product/self-hosted/) in their own cloud account or data center and maintain complete control over their hosting, network isolation, identity, and data ownership. Supported installations include AWS ECS and EKS, Azure AKS, Google GKE, any conformant Kubernetes cluster, and Docker on your own hosts. - title: Security icon: shield @@ -165,7 +165,7 @@ support: partners: title: Cloud Partners description: | - Pulumi works with the leading cloud providers including AWS, Google Cloud, and Microsoft Azure to ensure best-in-class support of the Pulumi Cloud Engineering Platform across each cloud. Pulumi provides Native Providers which enables same-day support of all new products and features in each cloud. Pulumi is also available for purchase through [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-dwn22batkhsyg) with support for additional cloud provider marketplaces coming soon. + Pulumi works with the leading cloud providers including AWS, Google Cloud, and Microsoft Azure to ensure best-in-class support of the Pulumi platform across each cloud. Pulumi provides Native Providers which enables same-day support of all new products and features in each cloud. Pulumi is also available for purchase through [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-dwn22batkhsyg) with support for additional cloud provider marketplaces coming soon. get_started: title: Get Started @@ -174,9 +174,9 @@ get_started: link: https://app.pulumi.com/site/trial/ link_text: Start Free Trial - - title: Self-Hosted Pulumi Service + - title: Self-Hosted Pulumi Cloud link: /product/self-hosted/#self-hosted-trial - link_text: Request Free Trial + link_text: Request a Proof of Concept - title: Migration Guide link: /docs/iac/guides/migration/ diff --git a/content/pricing/_index.md b/content/pricing/_index.md index 1f537bf84db2..03d13d72662e 100644 --- a/content/pricing/_index.md +++ b/content/pricing/_index.md @@ -138,7 +138,7 @@ faq: - question: Is Pulumi SOC 2 compliant? answer: Yes, Pulumi has completed the SOC 2 Type 2 compliance process. Pulumi is committed to operational excellence for our customers. - question: Can I host Pulumi Cloud in my cloud or datacenter? - answer: Yes, we offer a self-hosted Pulumi Cloud for companies that have specific data control requirements and want to maintain complete control over hosting Pulumi Cloud. This option is available in Business Critical Edition. You can [request a Proof of Concept (PoC)](/product/self-hosted/#self-hosted-trial) to get started. + answer: Yes, we offer a self-hosted Pulumi Cloud for companies that have specific data control requirements and want to maintain complete control over hosting Pulumi Cloud. This option is available in Business Critical Edition. The [install guide](/docs/administration/self-hosting/install/) covers every deployment option, from a single-host Docker Compose evaluation to production on AWS, Azure, Google Cloud, and Kubernetes. [Request a Proof of Concept (PoC)](/product/self-hosted/#self-hosted-trial) to get an evaluation license key. - question: How do I convince my boss? answer: | Do you want to use Pulumi in your organization, but aren't sure how to bring it up with your boss? We've created a sample email to help you explain its benefits. Feel free to use the full letter or pieces of it. We are always happy to meet to learn more about your needs and explain these benefits in person — just [contact us](/contact/?form=sales). diff --git a/content/product/_index.md b/content/product/_index.md index 92a300f52ce3..230bc59b0523 100644 --- a/content/product/_index.md +++ b/content/product/_index.md @@ -149,6 +149,15 @@ sections: Drift detection, dependency management, and enterprise RBAC give you visibility and control across the full infrastructure lifecycle. anchor: idp + - type: section_header + tag_line: Deployment options + title: Run Pulumi Cloud anywhere + description: | + Use Pulumi Cloud as a fully managed SaaS, or run the same platform yourself in your own cloud account or data center. Self-hosted Pulumi Cloud gives you complete control over data, identity, and network isolation, including air-gapped environments, with the same IaC, secrets, insights, and governance capabilities. + cta_text: Explore self-hosted Pulumi Cloud + cta_link: /product/self-hosted/ + anchor: self-hosted + - type: two_column anchor: get-started highlight_first_card: true diff --git a/content/product/infrastructure-as-code.md b/content/product/infrastructure-as-code.md index 47afedd34240..77a7167749e5 100644 --- a/content/product/infrastructure-as-code.md +++ b/content/product/infrastructure-as-code.md @@ -144,7 +144,7 @@ sections: title: Open source core. title_line_2: Pulumi Cloud built-in. description: | - Get started with Pulumi Cloud for free, state management and secrets included. Our [open source engine](https://github.com/pulumi/pulumi) powers everything underneath. Scale to enterprise features when you need them, or self-host if required. + Get started with Pulumi Cloud for free, state management and secrets included. Our [open source engine](https://github.com/pulumi/pulumi) powers everything underneath. Scale to enterprise features when you need them, and run the same platform [fully self-hosted](/product/self-hosted/) in your own cloud or data center. image: /images/product/infrastructure-as-code/pulumi-concentric-circles.svg image_alt: Open source core and Pulumi Cloud image_above: true @@ -397,4 +397,8 @@ sections: title: Complete audit trail description: | Every action logged. Who changed what, when, and why. Export to SIEM. Compliance reports at your fingertips. + - icon: buildings + title: Self-host the whole platform + description: | + Run all of Pulumi Cloud in your own cloud account or data center. Full control over data, identity, and network, including air-gapped deployments. [Learn about self-hosting](/product/self-hosted/). --- diff --git a/content/product/self-hosted.md b/content/product/self-hosted.md index e51737873f1f..1e0876665603 100644 --- a/content/product/self-hosted.md +++ b/content/product/self-hosted.md @@ -1,66 +1,211 @@ --- title: Self-Hosted Pulumi Cloud -layout: self-hosted +meta_desc: Run the full Pulumi Cloud platform in your own AWS, Azure, Google Cloud, or on-premises environment, including fully air-gapped networks. +meta_image: /images/product/self-hosted/self-hosted-meta.png +type: page +layout: template-page +include_floqer: true -meta_desc: Learn how to operate Pulumi Cloud in your own cloud account or data center. +sections: + - type: hero + title_primary: Pulumi Cloud, + title_secondary: running inside your network. + description: | + Install the Pulumi Cloud API and console into your own AWS, Azure, Google Cloud, or on-premises environment. State, secrets, and audit history live in a database and object store you own, and the installation can run with no route to the public internet. + cta_primary_text: Request a proof of concept + cta_primary_link: "#self-hosted-trial" + cta_secondary_text: Read the install guide + cta_secondary_link: /docs/administration/self-hosting/install/ + anchor: hero -overview: - title: Try Self-Hosted Pulumi - descriptionTop: | - Maintain complete control over your hosting, network isolation, identity, and data ownership to satisfy compliance requirements. [Request a Proof of Concept](#self-hosted-trial) to evaluate self-hosted Pulumi. - descriptionBottom: | - Want Pulumi Cloud delivered as SaaS? [Start Using Pulumi Cloud for free](https://app.pulumi.com/signin). -trial: - title: Request a Proof of Concept + - type: feature_split + heading: For teams that can't hand infrastructure state to a vendor description: | - Fill out the form to connect with a solutions architect and start your evaluation. - hubspot_form_id: b6ff58c0-2b40-4202-9a7f-d6d8aca4414a -capabilities: - title: Capabilities of Self-Hosted Pulumi - items: - - title: Cloud Engineering Platform - icon: rocketship - icon_color: violet - description: | - All the capabilities of Pulumi Cloud: state management, role-based access controls, policy and compliance guardrails. - - title: Full Control of Data - icon: gear - icon_color: violet - description: | - All data in Self-Hosted Pulumi is stored in a MySQL database and an encrypted object store within your own network. - - title: Air-gapped Communications - icon: abstract-shapes - icon_color: blue - description: | - No communication outside of your private network, eliminating all communication over the public internet. - - title: Federated Identity & Group Management - icon: shield - icon_color: yellow - description: | - Integrate with your preferred identity provider and manage permissions across your organization. - items: - - image: /logos/pkg/azuread.svg - text: Azure Active Directory - - image: /logos/pkg/github.svg - text: GitHub - - image: /logos/pkg/gitlab.svg - text: GitLab - - image: /images/self-hosted/bitbucket.svg - text: Bitbucket - - image: /images/self-hosted/samlsso.svg - text: SAML SSO -deployment: - title: Hosting Options - descriptionTop: | - [Install Self-Hosted Pulumi Cloud](/docs/pulumi-cloud/self-hosted/) in any on-premises or cloud provider environment or run in air-gapped environments, including those requiring FedRAMP. - descriptionBottom: | - [Talk to a Pulumi team member](/contact/) if you don't see your desired deployment option. -pricing: - title: Pricing + Most Pulumi customers run on the hosted service at app.pulumi.com, and most should. Self-hosting exists for the organizations that can't: regulators who dictate where data lives, programs that operate with no internet route, and contracts that name a country. + cta_text: Compare hosted and self-hosted + cta_link: /docs/administration/onboarding-guide/choose-edition/ + cards: + - icon: bank + title: Regulated industries + description: | + Financial services, insurance, and healthcare teams that keep infrastructure metadata inside an audited boundary and have to produce evidence for it on demand. + - icon: wall + title: Air-gapped networks + description: | + Installations with no egress at all. Mirror the container images and provider plugins into your environment and run from there — see the [air-gapped guide](/docs/administration/self-hosting/airgapped/). + - icon: globe + title: Data sovereignty + description: | + Statutory or contractual requirements that stack state, secrets, and audit logs never leave a named region or cloud account. + anchor: audience + + - type: testimonial + quote: | + We gave our auditors access to our policy packs because it's far easier to understand and prove controls in code than in docs and diagrams. With Pulumi's Policy as Code approach, that manual review process has gone away. We've reduced our Authority to Operate (ATO) timeline from a year and a half to expecting approval in three months. + author: Michael Hunter + title: CEO + company: Spear AI + anchor: testimonial + + - type: section_header + title: The whole platform, not a state backend + description: | + A self-hosted installation runs the Pulumi Cloud API and console as container images you pull and operate, backed by a MySQL 8.0 database, object storage, and an OpenSearch cluster you provide. Everything below is part of it. + cards_cols: 3 + cards: + - icon: custom/pulumi-iac + title: Pulumi IaC + description: | + Encrypted state, stack history, role-based access control, and audit logs, stored in your own database and object store. + - icon: custom/pulumi-secrets + title: Pulumi ESC + description: | + Environments, secrets, and configuration ship with the install — no separate deployment. + - icon: custom/pulumi-insights + title: Discovery and Policies + description: | + Run Discovery scans and policy evaluations on [customer-managed runners](/docs/insights/self-hosted/) inside your network, so cloud credentials never leave it. + - icon: custom/pulumi-neo + title: Pulumi Neo + description: | + Pulumi's infrastructure agent works against a self-hosted installation, so teams keep AI-assisted infrastructure work inside their own boundary. + - icon: identification-card + title: Your identity provider + description: | + SAML 2.0 SSO against any IdP — Okta, Microsoft Entra ID, Ping — plus GitHub, GitLab, and Bitbucket OAuth, or email and password. SCIM keeps users and groups in sync. + - icon: magnifying-glass + title: Resource search + description: | + Point the API at an OpenSearch cluster you run and resource search indexes across every stack in the installation. + anchor: capabilities + + - type: card_grid + title: Seven supported installations description: | - Self-Hosted Pulumi is available as an additional license for the Business Critical Edition of Pulumi and provided as part of a guided Proof of Concept. -questions: - title: Talk to a Human + Every option below ships as a Pulumi program in [pulumi-self-hosted-installers](https://github.com/pulumi/pulumi-self-hosted-installers). Run them as they are, or treat them as reference architectures and fold the resources into your own pipeline — plenty of customers do. + small_cards_cols: 4 + small_cards: + - icon: cube + title: Docker Compose + description: | + Evaluation only. Brings up the API, console, database, and search on one host so you can try the product before designing a production topology. + cta_text: Docker Compose guide + cta_link: /docs/administration/self-hosting/deployment-options/quickstart-docker-compose/ + - icon: cloud + title: AWS ECS + description: | + Fargate services behind a load balancer with Aurora MySQL, S3, ACM, and Route 53. TypeScript and Go installers. + cta_text: ECS guide + cta_link: /docs/administration/self-hosting/deployment-options/ecs-hosted/ + - icon: tree-structure + title: AWS EKS + description: | + Nine composable Pulumi projects on Kubernetes. Bring your own IAM, VPC, or state buckets when another team owns them. + cta_text: EKS guide + cta_link: /docs/administration/self-hosting/deployment-options/eks-hosted/ + - icon: tree-structure + title: Azure AKS + description: | + Azure Kubernetes Service with Azure Database for MySQL and Blob Storage, behind an NGINX ingress. + cta_text: AKS guide + cta_link: /docs/administration/self-hosting/deployment-options/aks-hosted/ + - icon: tree-structure + title: Google GKE + description: | + Google Kubernetes Engine with Cloud SQL for MySQL and Cloud Storage buckets. + cta_text: GKE guide + cta_link: /docs/administration/self-hosting/deployment-options/gke-hosted/ + - icon: wrench + title: Bring your own Kubernetes + description: | + Any conformant cluster plus MySQL 8.0 and S3-compatible object storage. This is the path for on-premises clusters and air-gapped networks. + cta_text: BYO infrastructure guide + cta_link: /docs/administration/self-hosting/deployment-options/byo-infra-hosted/ + - icon: hard-drives + title: Docker on your own hosts + description: | + For data centers with no Kubernetes platform: run the container images directly against an external MySQL and object store. + cta_text: Docker Engine guide + cta_link: /docs/administration/self-hosting/deployment-options/local-docker/ + - icon: chats-circle + title: Something else? + description: | + The images run on any OCI-compatible orchestrator. Tell us what you operate and a solutions architect will size the installation. + cta_text: Talk to a solutions architect + cta_link: /contact/?form=sales + anchor: deploy + + - type: section_header + tag_line: Day 2 + title: You own uptime. We document the job. + description: | + The [operations guide](/docs/administration/self-hosting/operations/) covers architecture, compute sizing, database and object storage configuration, network layout, and security hardening. These are the four things platform teams ask about first. + cards_cols: 4 + cards: + - icon: pulse + title: High availability + description: | + Stateless API and console services across availability zones, in front of a managed MySQL cluster and replicated object storage. + - icon: floppy-disk + title: Recovery targets + description: | + Under 5 minutes for an availability zone failure, under 1 minute for an Aurora failover, and 1 to 4 hours to rebuild a region from cross-region backups. + - icon: arrows-clockwise + title: Upgrades + description: | + Pin the image tag, run migrations before rolling services, stage through a test environment. Every release lands in the [changelog](/docs/administration/self-hosting/changelog/). + - icon: chart-line-up + title: Observability + description: | + The API exposes Prometheus metrics and OpenTelemetry traces. The [monitoring guide](/docs/administration/self-hosting/operations/monitoring/) gives a three-tier alerting strategy and the metrics worth paging on. + anchor: operations + + - type: three_column + tag_line: Compliance + title: What we claim, and what we don't + subtitle: Security reviews move faster when the vendor is precise. Here is the posture in plain terms. + icon_layout: above + columns: + - icon: certificate + title: SOC 2 Type II + description: | + Pulumi Cloud is covered by an annual SOC 2 Type II audit performed by an independent CPA firm. The report is available under NDA. Architecture, key hierarchy, and operational controls are documented in the security whitepaper. + cta_text: Read the whitepaper + cta_link: /security/pulumi-cloud-security-whitepaper/ + - icon: wall + title: Inside a boundary you already authorized + description: | + Because you install and operate it, the assessment surface is your own infrastructure under your own controls, rather than a third-party service your assessor has to scope separately. + cta_text: Air-gapped deployment guide + cta_link: /docs/administration/self-hosting/airgapped/ + - icon: warning + title: No FedRAMP authorization + description: | + Pulumi holds no FedRAMP authorization. There is no Pulumi ATO and no FedRAMP Marketplace listing. If your program requires a FedRAMP-authorized service, Pulumi Cloud does not meet that requirement today, and self-hosting does not change it — it changes who owns the boundary. + cta_text: Talk to us about your program + cta_link: /contact/?form=sales + anchor: compliance + + - type: two_column + highlight_first_card: true + columns: + - label: Business Critical + title: How self-hosting is licensed + description: | + Self-hosting is part of [Pulumi Business Critical](/pricing/), along with self-hosted Pulumi ESC and self-hosted Discovery scans and policy evaluations. Pricing is custom, and evaluations run as a guided proof of concept with a solutions architect. + cta_text: See pricing + cta_link: /pricing/ + - title: Would the hosted service do? + description: | + For most teams, yes, and it is a great deal less work. Pulumi Cloud at app.pulumi.com gives you high availability, disaster recovery, and upgrades without operating anything, and it is free to start. + cta_text: Compare editions + cta_link: /docs/administration/onboarding-guide/choose-edition/ + anchor: pricing + + - type: hubspot_form + anchor: self-hosted-trial + title: Request a proof of concept description: | - If you have any questions about Self-Hosted Pulumi, please contact us or visit the self-hosted docs. + A solutions architect will walk through your target environment, size the installation, and get you the installer package and an evaluation license key. If you would rather ask a question first, [contact us](/contact/). + hubspot_form_id: b6ff58c0-2b40-4202-9a7f-d6d8aca4414a --- diff --git a/content/security/_index.md b/content/security/_index.md index ac0bb203666e..9df16174b426 100644 --- a/content/security/_index.md +++ b/content/security/_index.md @@ -1,15 +1,34 @@ --- title: Pulumi Security -meta_desc: A summary of security topics and how they relate to the Pulumi platform. +meta_desc: Pulumi's security posture — SOC 2 Type II attestation, what we do and don't certify, platform architecture, and how to report a vulnerability. +aliases: + - /trust/ + - /trust-center/ --- Pulumi takes security and privacy matters very seriously. We appreciate that our customers and users place a high degree of confidence and trust in our products and services and we strive to meet those expectations. -## Pulumi Platform Security +## Certifications and attestations -The Pulumi platform employs industry best practices for security and is SOC 2 Type II certified. +Pulumi Cloud is covered by an annual **SOC 2 Type II** audit performed by an independent CPA firm against the AICPA Trust Services Criteria. The report is shared under NDA — request it from your account team or email [security@pulumi.com](mailto:security@pulumi.com). -For more details, see our [security whitepaper](/security/pulumi-cloud-security-whitepaper). +Pulumi does not currently hold ISO 27001, HITRUST, or PCI DSS certification. Customers in regulated industries do run Pulumi under those frameworks, because Pulumi Cloud never receives your cloud credentials and never has standing access to your cloud accounts — the architecture that makes this true is described in the [security whitepaper](/security/pulumi-cloud-security-whitepaper/). + +Pulumi also publishes [pre-built policy packs](/docs/insights/policy/policy-packs/pre-built-packs/) for CIS, ISO/IEC 27001, NIST SP 800-53, CMMC, HITRUST, and PCI DSS. Those help you assess *your* infrastructure against a framework; they are not a statement about Pulumi's own certification status. + +## Government and federal programs + +Pulumi holds **no FedRAMP authorization**. There is no Pulumi ATO and no listing in the FedRAMP Marketplace. A program that requires a FedRAMP-authorized service cannot use hosted Pulumi Cloud to satisfy that requirement. + +[Self-hosted Pulumi Cloud](/product/self-hosted/) changes who owns the boundary. Because you install and operate it in your own environment, it is a software component in your inventory, and the controls that apply to it are yours. It can run fully [air-gapped](/docs/administration/self-hosting/airgapped/), with no egress to the public internet. + +## Architecture and controls + +The [security whitepaper](/security/pulumi-cloud-security-whitepaper/) is the technical reference for how Pulumi Cloud is built and operated. It covers the service architecture and data storage model, the three-tier encryption key hierarchy and its KMS integration, organizational key isolation and key rotation, transport security, how secrets are handled in stack state, diagnostic log protection, audit logging, monitoring, incident detection and response, vulnerability management, and backup, recovery, and business continuity. + +## Data processing + +Pulumi's [Privacy Statement](/privacy/) describes what personal data we collect and how it is handled, including transfers out of the EEA under standard contractual clauses. For a Data Processing Addendum, or for questions about data processing in a procurement review, contact [privacy@pulumi.com](mailto:privacy@pulumi.com). ## Vulnerability Reporting diff --git a/data/footer.yml b/data/footer.yml index 174f6c859337..d851307ff932 100644 --- a/data/footer.yml +++ b/data/footer.yml @@ -107,7 +107,7 @@ columns: - label: Awards href: /awards/ track: footer-awards - - label: Security + - label: Security & compliance href: /security/ track: footer-security - label: Brand diff --git a/data/header_nav.yaml b/data/header_nav.yaml index cbe1755e512f..1281347ee5c9 100644 --- a/data/header_nav.yaml +++ b/data/header_nav.yaml @@ -41,6 +41,19 @@ items: description: The fastest, most secure way to deliver cloud infrastructure icon: custom/pulumi-idp track: header-product-idp + - heading: Security & trust + columns: 2 + items: + - label: Self-hosted Pulumi Cloud + href: /product/self-hosted/ + description: Run the full Pulumi Cloud platform in your own cloud account or data center + icon: buildings + track: header-product-self-hosted + - label: Security & compliance + href: /security/ + description: SOC 2 Type II, our security architecture, and the Pulumi Cloud security whitepaper + icon: shield-check + track: header-product-security - label: For engineers wide: true @@ -106,6 +119,11 @@ items: description: Security, compliance, and support for teams icon: buildings track: header-enterprise-solutions + - label: Self-hosted Pulumi Cloud + href: /product/self-hosted/ + description: Full data control, air-gapped and on-prem deployment options + icon: shield-check + track: header-enterprise-self-hosted - label: Case studies href: /case-studies/ description: How Snowflake, Mercedes-Benz, and others use Pulumi diff --git a/data/pulumi_pricing.yaml b/data/pulumi_pricing.yaml index d2905f98595a..e205c541e081 100644 --- a/data/pulumi_pricing.yaml +++ b/data/pulumi_pricing.yaml @@ -213,7 +213,7 @@ editions: style: primary features_intro: "Everything in **Enterprise**, plus:" features: - - "[Self-hosting available](/product/self-hosted)" + - "[Self-hosting available](/product/self-hosted/)" - Built-in compliance (NIST, PCI, and more) - Automatic group & user sync (SCIM) - Audit logs export diff --git a/layouts/index.llms.txt b/layouts/index.llms.txt index f0e576c5fb99..1b2ce3ab21db 100644 --- a/layouts/index.llms.txt +++ b/layouts/index.llms.txt @@ -74,6 +74,7 @@ If you are an AI agent or programmatic consumer, start with these endpoints. Eac This llms.txt covers www.pulumi.com, which includes: - [Product](https://www.pulumi.com/product/): Pulumi Cloud platform overview and capabilities +- [Self-hosted Pulumi Cloud](https://www.pulumi.com/product/self-hosted/): Run the full Pulumi Cloud platform in your own cloud account or data center, including air-gapped environments - [Pricing](https://www.pulumi.com/pricing/): Plans and pricing for Pulumi Cloud (Individual, Team, Enterprise, Business Critical) - [Pulumi Registry](https://www.pulumi.com/registry/): Documentation for 150+ cloud providers and components, available at `https://www.pulumi.com/registry/packages//` - [Infrastructure AI](https://www.pulumi.com/docs/ai/): Using AI agents with Pulumi — bring your own agent via [Agent Skills](https://www.pulumi.com/docs/ai/skills/) and the [MCP server](https://www.pulumi.com/docs/ai/mcp-server/), or use [Pulumi Neo](https://www.pulumi.com/neo/), Pulumi's purpose-built infrastructure agent diff --git a/layouts/partials/template-page-content.html b/layouts/partials/template-page-content.html index f7736f770237..f2e32b359923 100644 --- a/layouts/partials/template-page-content.html +++ b/layouts/partials/template-page-content.html @@ -25,6 +25,7 @@ latest_posts — template-latest-posts.html (fields: title, description, ctas[{text, link}], count, show_event, anchor) video_embed — template-video-embed.html (fields: youtube_id, title, poster_image, poster_alt, anchor) feature_callout — template-feature-callout.html (fields: tag_line, title, lead, description, cta_primary_text/link, cta_secondary_text/link, background, anchor) + hubspot_form — template-hubspot-form.html (fields: title, description, hubspot_form_id, anchor) promo_banner — template-promo-banner.html (fields: title, description, cta_text, bg_image, anchor) location — template-location.html (fields: tag_line, title, location, description, map_embed, cta_text, cta_link, anchor) diff --git a/layouts/partials/template-partials/template-hubspot-form.html b/layouts/partials/template-partials/template-hubspot-form.html new file mode 100644 index 000000000000..d106a85dd066 --- /dev/null +++ b/layouts/partials/template-partials/template-hubspot-form.html @@ -0,0 +1,38 @@ +{{/* + Template HubSpot Form Partial + + A centered HubSpot form block for template-driven pages. Wraps the shared + element, which handles lazy loading and styling. + + The anchor is part of the contract, not decoration: /product/self-hosted/ + #self-hosted-trial is linked from the self-hosting-trial-note shortcode + (which fans out across the self-hosting docs), the pricing FAQ, and the + enterprise page. Renaming it breaks all of them. + + Parameters: + - title: Section heading. + - description: Optional body copy above the form (markdown supported). + - hubspot_form_id: HubSpot form GUID. + - anchor: Anchor for the section id. Required when the form is deep-linked. +*/}} + +{{ $title := .title }} +{{ $description := .description }} +{{ $formID := .hubspot_form_id }} +{{ $anchor := .anchor }} + +
+
+ {{ with $title }} +

{{ . }}

+ {{ end }} + {{ with $description }} +

{{ . | markdownify }}

+ {{ end }} +
+
+
+ +
+
+
diff --git a/layouts/product/self-hosted.html b/layouts/product/self-hosted.html deleted file mode 100644 index 54b98ebff1ca..000000000000 --- a/layouts/product/self-hosted.html +++ /dev/null @@ -1,146 +0,0 @@ -{{ define "hero" }} - {{ partial "hero" (dict "title" .Params.title) }} -{{ end }} - -{{ define "main" }} - {{ $pageContext := . }} - -
-
- {{ with .Params.overview }} -

{{ .title }}

-
-

{{ .descriptionTop | markdownify }}

-

{{ .descriptionBottom | markdownify }}

-
- {{ end }} -
-
- -
- {{ with .Params.deployment }} -

{{ .title }}

-
-

{{ .descriptionTop | markdownify }}

-

{{ .descriptionBottom | markdownify }}

-
-
-
- AWS -
AWS
- AWS Docs -
- -
- Azure -
Azure
- Azure Docs -
- -
- Docker -
Docker
- Docker Docs -
-
-
-
-
- Google Cloud -
-
Google Cloud
- Google Docs -
- -
-
- Kubernetes -
-
Kubernetes
- Kubernetes Docs -
- -
- VMware -
VMware
- Talk to a human -
-
- {{ end }} -
- -
-
- {{ with .Params.capabilities }} -

{{ .title }}

-
- {{ range $item := .items }} -
-
-
- {{ partial "color-icon.html" (dict "icon" $item.icon "icon_color" $item.icon_color) }} -
-
{{ $item.title }}
-

{{ $item.description | markdownify }}

- - {{ if $item.items }} - - -

Identity providers include Azure Active Directory, Bitbucket, GitHub, GitLab, and SAML SSO.

- {{ end }} -
-
- {{ end }} -
- {{ end }} -
-
- -
-
-
- {{ with .Params.pricing }} -

{{ .title }}

-

{{ .description | markdownify }}

-
- Pricing -
- {{ end }} -
-
-
- -
-
- {{ with .Params.trial }} -

{{ .title }}

-

{{ .description | markdownify }}

-
- -
- {{ end }} -
-
- -
- {{ with .Params.questions }} -
-
-

{{ .title }}

-

{{ .description }}

-
- Talk to a human - Self-Hosted Docs -
-
-
- {{ end }} -
-{{ end }} diff --git a/layouts/security/section.html b/layouts/security/section.html index beebc4c0048c..78c5dc78ba9a 100644 --- a/layouts/security/section.html +++ b/layouts/security/section.html @@ -21,7 +21,12 @@

{{ .Title }}

Learn more

Read our whitepaper to learn more about our product architecture and security practices.

- Read Whitepaper + {{/* The whitepaper is a content page, not a page resource, so .Resources.GetMatch never finds it. */}} + {{ with site.GetPage "/security/pulumi-cloud-security-whitepaper" }} + Read the whitepaper + {{ else }} + {{ errorf "layouts/security/section.html: security whitepaper page not found" }} + {{ end }}
diff --git a/layouts/shortcodes/self-hosted-first-admin-note.html b/layouts/shortcodes/self-hosted-first-admin-note.html new file mode 100644 index 000000000000..b4c4d3c36846 --- /dev/null +++ b/layouts/shortcodes/self-hosted-first-admin-note.html @@ -0,0 +1,15 @@ +{{- /* Applies to every deployment option, so it lives here rather than being + restated per page. Sourced from the AKS installer README, which is the + only place upstream that spells it out. */ -}} +
+
+ {{ partial "icon.html" (dict "name" "warning" "weight" "fill") }} +
+
+
+ {{ printf "On a fresh installation the **first user to sign up becomes the administrator**, including the SAML administrator. Create the account you intend to own the organization before sharing the console URL. Enabling SAML does not by itself close email and password signup — set `PULUMI_DISABLE_EMAIL_SIGNUP` on the API container to do that, since hiding the option in the console leaves the underlying handler active." | markdownify }} + {{- with .Inner }} + {{ . | markdownify }} + {{- end }} +
+
diff --git a/layouts/shortcodes/self-hosted-first-admin-note.markdown.md b/layouts/shortcodes/self-hosted-first-admin-note.markdown.md new file mode 100644 index 000000000000..ef2c85f3ed28 --- /dev/null +++ b/layouts/shortcodes/self-hosted-first-admin-note.markdown.md @@ -0,0 +1,3 @@ +{{- $inner := trim (printf "%s" .Inner) " \t\n\r" -}} + +> **Warning:** On a fresh installation the **first user to sign up becomes the administrator**, including the SAML administrator. Create the account you intend to own the organization before sharing the console URL. Enabling SAML does not by itself close email and password signup — set `PULUMI_DISABLE_EMAIL_SIGNUP` on the API container to do that, since hiding the option in the console leaves the underlying handler active.{{ with $inner }} {{ . }}{{ end }} diff --git a/layouts/shortcodes/self-hosting-schema-v2-note.html b/layouts/shortcodes/self-hosting-schema-v2-note.html new file mode 100644 index 000000000000..daabe4b10d72 --- /dev/null +++ b/layouts/shortcodes/self-hosting-schema-v2-note.html @@ -0,0 +1,15 @@ +{{- /* The V2 engine-events schema gate. Stated once here and included wherever a + reader is about to upgrade an install, because the installer READMEs carry + this as a hard stop and the API reference buries it in a table row. */ -}} +
+
+ {{ partial "icon.html" (dict "name" "warning" "weight" "fill") }} +
+
+
+ {{ printf "**Upgrading an existing installation?** The current installers enable the V2 engine events database schema (`PULUMI_ENGINE_EVENTS_SCHEMA_V2`). Moving an existing installation onto it requires a database migration that Pulumi performs with you. [Contact Pulumi support](/support/) before pointing an existing install at a current installer version or changing `PULUMI_ENGINE_EVENTS_SCHEMA_V2` or `PULUMI_ENGINE_EVENTS_LEGACY_WRITE`. Fresh installations are unaffected." | markdownify }} + {{- with .Inner }} + {{ . | markdownify }} + {{- end }} +
+
diff --git a/layouts/shortcodes/self-hosting-schema-v2-note.markdown.md b/layouts/shortcodes/self-hosting-schema-v2-note.markdown.md new file mode 100644 index 000000000000..74ed3e5d0ed3 --- /dev/null +++ b/layouts/shortcodes/self-hosting-schema-v2-note.markdown.md @@ -0,0 +1,3 @@ +{{- $inner := trim (printf "%s" .Inner) " \t\n\r" -}} + +> **Warning:** **Upgrading an existing installation?** The current installers enable the V2 engine events database schema (`PULUMI_ENGINE_EVENTS_SCHEMA_V2`). Moving an existing installation onto it requires a database migration that Pulumi performs with you. [Contact Pulumi support](/support/) before pointing an existing install at a current installer version or changing `PULUMI_ENGINE_EVENTS_SCHEMA_V2` or `PULUMI_ENGINE_EVENTS_LEGACY_WRITE`. Fresh installations are unaffected.{{ with $inner }} {{ . }}{{ end }} diff --git a/static/images/product/self-hosted/self-hosted-meta.png b/static/images/product/self-hosted/self-hosted-meta.png new file mode 100644 index 000000000000..3f13a0ef3463 Binary files /dev/null and b/static/images/product/self-hosted/self-hosted-meta.png differ