Azure (AKS)

Two ways to run Scrydon on Azure:

• Azure Marketplace — Portal-native, one-click, automatic upgrades, no Helm CLI or registry credentials. Use this unless you need custom Helm values.
• Helm on AKS (this page) — full control over chart values. Follow the five steps below; for every override the chart exposes, see the Helm reference.

Quick start

curl -fsSL https://get.scrydon.com | bash

The guided installer asks which version you want, where you are deploying, and for the registry credential and license file your account team issued. It checks your cluster before it changes anything — including that the GatewayClass and cert-manager issuer you name actually exist — installs, and then confirms the platform answers on your hostname.

Prefer to inspect it first, or need a pinned copy?

curl -fsSL https://get.scrydon.com -o setup.sh
curl -fsSL https://get.scrydon.com/setup.sh.sha256 | shasum -a 256 -c -
bash setup.sh

The manual steps later on this page remain supported, and are what the standard installer path runs for you.

NATO UNCLASSIFIED profile

The ordinary quick start and manual Helm path do not select the NATO UNCLASSIFIED profile. For a fresh installation on a purpose-built, approved AKS qualification substrate, use the release-owned profile together with its immutable target record and narrowly reviewed site overlay:

bash /absolute/private/setup.sh \
  --version <exact-version> \
  --profile nato-unclassified \
  --site-values /absolute/private/site.nato.yaml \
  --qualification-target /absolute/private/target.json \
  --kubeconfig /absolute/private/kubeconfig \
  --context <dedicated-context> \
  --location azure \
  --namespace scrydon-platform \
  --host <qualification-hostname> \
  --storage-class managed-csi \
  --gateway-class traefik \
  --tls-issuer <qualification-issuer> \
  --pull-secret /absolute/private/scrydon-pull-secret.yaml \
  --license /absolute/private/license.json \
  --backend connected \
  --non-interactive

--site-values is not an arbitrary Helm values escape hatch. It accepts only the profile's deployment-specific network, DNS, Kata node-group, and private Azure Blob backup fields; it rejects inline secrets and attempts to weaken mandatory controls. The target record must come from the reviewed guarded substrate procedure and must match the candidate, Azure resource, dedicated kubeconfig, and live cluster identity.

The profile is a deployment-control baseline, not a claim of NATO accreditation. Qualification and accreditation still require release-bound evidence, operational procedures, risk acceptance, and a decision by the applicable Security Accreditation Authority.

Before you start

• An AKS cluster running Kubernetes 1.28+ with kubectl access.
• A Gateway API implementation — the gateway.networking.k8s.io CRDs plus a GatewayClass. Set traefik.enabled: true to have the chart install a Traefik release that brings both, or point gateway.className at a class the cluster already runs. See Kubernetes prerequisites.
• cert-manager with its Gateway API support on, unless you terminate TLS yourself — see TLS prerequisites.
• Your license file from Scrydon — { "jwt": "…", "publicKey": "…" } JSON. See Licensing.
• Registry credentials for scrydonops.azurecr.io (the ACR token name + value from your account team).
• A single DNS name pointing at your edge load balancer (e.g. app.example.com).

Full sizing and checklist: Prerequisites.

Step 1: Log in to the registry

helm registry login scrydonops.azurecr.io --username <acr-token-name>
# (paste the token value at the password prompt)

Step 2: Create the namespace and pull secret

By default the chart deploys every service into one namespace, scrydon-platform:

kubectl create namespace scrydon-platform 2>/dev/null || true
kubectl create secret docker-registry scrydon-registry \
  --namespace scrydon-platform \
  --docker-server=scrydonops.azurecr.io \
  --docker-username=<acr-token-name> \
  --docker-password=<acr-token-password>

Splitting services across namespaces is opt-in via namespaces.* (see the Helm reference). If you do, create the same pull secret in each namespace you target.

Step 3: Write values.customer.yaml

The Azure-specific value is global.storageClass (managed-csi, or managed-csi-premium for higher IOPS). If an Application Gateway terminates TLS in front of the cluster, keep gateway.tls.enabled: true — the browser still uses HTTPS, so the public URL scheme, CORS, and secure cookies must reflect that even though App Gateway forwards plain HTTP to Traefik.

global:
  imageRegistry: scrydonops.azurecr.io  # pull images from the ACR you logged into
  imagePullSecrets:
    - name: scrydon-registry            # from Step 2
  storageClass: managed-csi             # or managed-csi-premium

routing:
  host: app.example.com               # the hostname your DNS points at

gateway:
  tls:
    enabled: true                     # browser reaches Scrydon over HTTPS (true even behind App Gateway)

traefik:
  enabled: true                       # remove if the cluster already runs a Gateway API controller

The chart generates every secret it needs on a live helm install and keeps them across upgrades. Set them yourself only when you manage secrets externally or render without a live cluster (ArgoCD, helm template) — see Rendering without a live cluster:

# Optional. Keep this file out of source control if you set these.
infra:
  db:
    credentials:
      password: REPLACE-WITH-DB-PASSWORD          # openssl rand -hex 16
auth:
  secrets:
    AUTH_SECRET: REPLACE-WITH-AUTH-SECRET         # openssl rand -hex 32
apiTable:
  secrets:
    STARROCKS_PASSWORD: REPLACE-WITH-STARROCKS-PW # openssl rand -hex 24

Step 4: Install

helm install scrydon oci://scrydonops.azurecr.io/scrydon/charts/scrydon \
  --version <version> \
  --namespace scrydon-platform \
  -f values.customer.yaml \
  --wait --wait-for-jobs

Step 5: Run the setup wizard

Open https://app.example.com/platform/setup and complete the six steps — paste your license file, create the admin account, name your organization, point it at object storage (or skip), configure email (or skip), finish. Then sign in at https://app.example.com/. Details: Helm → Run the setup wizard.

Azure specifics

• Storage class — managed-csi (Step 3), or managed-csi-premium for higher IOPS.
• The public IP — with traefik.enabled: true it is the external IP of the scrydon-traefik Service in the traefik namespace: kubectl get svc -n traefik scrydon-traefik. Point your DNS name at it.
• Behind Application Gateway — App Gateway terminates TLS and forwards plain HTTP to Traefik. Keep gateway.tls.enabled: true (done in Step 3) and trust the App Gateway subnet with Traefik's forwardedHeaders.trustedIPs. This trips everyone up — the full playbook is in TLS Offloading.
• Private domains or corporate PKI — if your AKS edge uses private DNS or certificates from an enterprise CA, follow TLS Certificates.
• Database — the bundled Postgres works out of the box; or point at Azure Database for PostgreSQL via BYO Database.
• Stream and push data sources — off until you set ingestBuffer.enabled (poll sources run without it). Give the buffer a managed-csi-premium volume, and with networkPolicies.enabled route outbound HTTPS through the cluster's NAT gateway or Azure Firewall so providers stay reachable. Push URLs, keys and requirements: Helm → apiIngestion.

All options

Everything beyond this minimal path — routing modes, BYO StarRocks, pod scheduling, low-resource trims, an existing Dapr control plane, and day-2 operations — lives in the Helm reference.