Azure Marketplace

If your organization runs Azure Kubernetes Service (AKS), you can deploy Scrydon straight from the Azure Marketplace. The listing installs Scrydon as an AKS Cluster Extension. You need no Helm CLI and no registry credentials.

Prerequisites

• An AKS cluster running Kubernetes 1.28 or later.
• cert-manager, for automatic TLS certificates, with its Gateway API support turned on (config.enableGatewayAPI: true). See TLS prerequisites.
• Access to your DNS zone, to create one A or CNAME record.

You do not need the AGIC add-on or any other ingress controller. Scrydon's edge is the Kubernetes Gateway API, and the listing installs its own controller: Traefik, together with the Gateway API CRDs and the traefik GatewayClass. Traefik's LoadBalancer Service provides the public IP.

Step 1: Deploy from the Azure portal

1. Find Scrydon in the Azure Marketplace and choose Deploy.

2. Fill in the wizard:

   Field	What to enter
   AKS cluster	The target cluster.
   Domain	The one hostname Scrydon is served on, for example scrydon.example.com. Every app is a path under it.
   Enable TLS	Leave on for automatic HTTPS certificates from cert-manager.
   Enable analytics	Turns on the analytics module.
   Database password	For the bundled PostgreSQL instance.
   Auth secret	Signs user sessions. Use a random value of at least 32 characters, for example openssl rand -hex 32.

3. Choose Create.

The extension creates every Scrydon service in the scrydon-platform namespace. It also installs the Dapr cluster extension that Scrydon depends on. Every image is bundled with the extension, so AKS pulls them without your registry token.

Data plane on Azure. In Azure mode the chart turns off the bundled StarRocks and SeaweedFS, because their third-party images are not carried in the Marketplace package. Instead:

• Object storage. After setup, point the platform at Azure Blob through its S3-compatible API at https://<domain>/platform/settings/platform/storage.
• Managed Tables. Either turn Tables off (apiTable.enabled: false) or point apiTable.starrocks.host at a StarRocks you run yourself, for example with the StarRocks operator. Both are Helm values the wizard does not show; see All options.

Step 2: Point DNS at the cluster

One record covers the whole platform. Every app is a path under your domain:

The paths behind it are /platform, /agentic, /cortex, /analytics, /horizon, /api/auth, /api/ontology, /api/table and the rest listed in DNS prerequisites.

To find the IP:

kubectl get svc -n traefik scrydon-traefik \
  -o jsonpath='{.status.loadBalancer.ingress[0].ip}'

Step 3: Complete setup

Once every pod is running and the record resolves, open:

https://<domain>/platform/setup

The wizard's first step asks for your license file. It then creates the first administrator and your organization, and optionally configures storage and email. Licensing walks through each step.

All options

The wizard covers the common settings. Underneath it runs the same Helm chart as every other install, so every value in the Helm reference exists: a bring-your-own database, scheduling, subdomain routing and the rest. The Marketplace wizard cannot set them. If you need one, deploy with Helm on AKS instead, where you control the whole values file.

Upgrades

The extension is installed with automatic minor-version upgrades. New major versions are published as new Marketplace versions, and the Azure portal tells you when one is available.

Troubleshooting

Pods stuck in ImagePullBackOff

The extension carries every image, so a pull failure is usually the extension itself or the network:

• Check that the extension installed: az k8s-extension show --name scrydon --cluster-name <aks> --resource-group <rg> --cluster-type managedClusters.
• Check for network policies or firewall rules that block the registry.

TLS certificates not issued

• Check that cert-manager is running: kubectl get pods -n cert-manager.
• Check that its Gateway API support is on. Without config.enableGatewayAPI: true it never creates a Certificate from the Gateway.
• Check the certificate: kubectl get certificates -n scrydon-platform.

Setup page unreachable

• Check that the record resolves to Traefik's IP: nslookup <domain>.
• Check the pods: kubectl get pods -n scrydon-platform.
• Check that the GatewayClass was accepted: kubectl get gatewayclass traefik.
• Check that the Gateway is programmed: kubectl get gateway -n scrydon-platform, then kubectl get httproute -A. A listener stuck on Accepted=False with reason PortUnavailable means gateway.listenerPorts does not match Traefik's entry points, which listen on 8000 and 8443, not 80 and 443.