From 89659c7f69f72fc8361b603c14f6ee85daa690b2 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Wed, 16 Sep 2026 16:26:39 +0200 Subject: [PATCH 01/31] Installing the Mx Operator for PMP with Helmfile --- .../quickstart/pmp-quickstart-helm.md | 88 +++++++++++++++++-- 1 file changed, 80 insertions(+), 8 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index 7b7137bd6c5..fcff75da96f 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -17,20 +17,92 @@ Helmfile installation supports the following tasks: * Installation and upgrade of components such as Svix, PCLM, and others * Installation and upgrade of Private Mendix Platform -### Out-of-Scope Tasks +## Installing the Mendix Operator -The following tasks are not performed by the Helmfile installation: +The Helmfile installation does not support installing or upgrading the Mendix Operator. To install the Operator, perform the following steps: -* Mendix Operator installation -* Mendix Operator upgrade +### Preparing the Installation Files -To install or upgrade the Operator, see [Installing Components through the Helm Chart UI](/developerportal/deploy/helm-charts/). +Before you start the installation, download the required files by performing the following steps: -## Components +1. Download the release binary from your [Private Mendix Platform download portal](https://privateplatform.mendix.com/). If you do not have access to the download portal, contact your Mendix partner for information. + +2. Unzip the release binary to a local folder on your Windows or Linux server. The release binary contains the following files: + + * **Tools** - *mx-pclm-cli*, which can be used to manage PCLM + * **helm**, and **helmfile** tools, which are used to deploy and manage Private Mendix Platform charts and Svix charts + * **images** - Private Mendix Platform image, PCLM image, Svix image, test application image + * **Installer** - installer tools + * **mxpc-cli** - installation tools which can be used to manage or configure the Mendix Operator + * **charts** - charts, including Private Mendix Platform charts and Svix charts + + {{< figure src="/attachments/private-platform/pmp-binary.png" class="no-border" >}} + +### Optional: Initializing the Installation for Air-Gapped Environments + +If your clusters can connect to a public registry with a passable network, skip to the next section, otherwise initialize the installation by performing the following steps: + +1. Upload the images to your private repository in an air-gapped environment. + + ```text + ~/mpp-binary-linux$ ./installer init migrate --help + Migrate Mendix Private Platform related image to your own registry + + Usage: + installer init migrate [flags] + Flags: + -h, --help help for migrate + -r, --registryurl string registry url (required) + -e, --repo string Repository name + -u, --username string Username (required) for your private registry + ``` + + The destination image is named `${registryurl }/${repo}/mendix-private-platform: ${tag}`. + +2. The `registryurl` and `repo` are read from the input parameters. The `tag` is automatically read by the installer. If the repository does not exist, you must create it before running the `init migrate` command. + + ```text + ~/mpp-binary-linux$ ./installer init migrate -r [registry] -u user -e [repositoryName] + Please enter user password: *** + + Confirm password: *** + the config checksum is empty + The image destination[REDACTED] svix-server:v0.75.0 + The image destiation [REDACTED] mendix-private-platform:1.4.0.80d447b1 + the config checksum is empty + The image destiation [REDACTED] mxpc-test:1.0 + the config checksum is empty + The image destiation [REDACTED] privatecloud-license-manager:0.3.0 + svix-server_v0.75.0 => [REDACTED] svix-server:v0.75.0 - ok + mendix-private-platform_1.4.0.80d447b1 => [REDACTED] mendix-private-platform:1.4.0.80d447b1 - ok + mxpc-test_1.0 => [REDACTED] mxpc-test:1.0 - ok + privatecloud-license-manager_0.3.0 => [REDACTED] privatecloud-license-manager:0.3.0 - ok + ``` + +3. By default, mxpc-cli tools install the latest version of Mendix Operator. You can specify a different Mendix Operator version by using the following command: `./installer operator init -v="version number"` + +## Installing the Mendix Operator {#install-operator} + +Install the Mendix Operator by doing the following steps: + +1. Run one of the following commands, where `-n` indicates the namespace: + + * `./mxpc-cli installer -n=` - To install the Operator in [Standard](/developerportal/deploy/standard-operator/) mode + * `./mxpc-cli installer --global -n=` - To install the Operator in [Global](/developerportal/deploy/global-operator/) mode; you must use a Global namespace for this installation type. + + In order to install and configure a cluster with a Global installation of the Operator and the Agent, you must use Operator version 2.21.2 or above. + +2. Click **Base Installation**, and then select the cluster type. + + {{< figure src="/attachments/private-platform/pmp-install1.png" class="no-border" >}} + +3. Click **Run Installer** to install the Mendix Operator in your cluster. + +## Helmfile Components Helmfile manages multiple Helm releases with dependency ordering, ensuring components are installed in the correct sequence. -The following components must be installed in a shared namespace (that is, the same namespace as Private Mendix Platform): +After installing the Mendix Operator, you must install the following components in a shared namespace (that is, the same namespace as Private Mendix Platform): * `mx-privatecloud` * `maia-appgen` @@ -57,7 +129,7 @@ ServiceAccount creation depends on the value of the **UseStoragePlanwithIRSA** f ### Dependency and Install Order -The following components are installed in parallel during the first phase of the installation: +The following components are installed in parallel during the first phase of the Helmfile installation: * `mx-privatecloud-license-manager` * `mx-privatecloud` From 085830a7fdcb158dc96aaf4bde21ece83dbf08b4 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Wed, 16 Sep 2026 16:35:53 +0200 Subject: [PATCH 02/31] update --- .../en/docs/private-platform/quickstart/pmp-quickstart-helm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index fcff75da96f..c2bfeed46b9 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -19,7 +19,7 @@ Helmfile installation supports the following tasks: ## Installing the Mendix Operator -The Helmfile installation does not support installing or upgrading the Mendix Operator. To install the Operator, perform the following steps: +The Helmfile installation does not support installing or upgrading the Mendix Operator with the `mx-ops-cli tool`. To install the Operator, perform the following steps instead: ### Preparing the Installation Files From 5826cae9649fd1b541841a191f8e70eda0b2bce0 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Fri, 18 Sep 2026 14:31:23 +0200 Subject: [PATCH 03/31] Make a clear distinction that Operator is installed independently from PMP --- .../quickstart/pmp-quickstart-helm.md | 176 ++++++------------ 1 file changed, 52 insertions(+), 124 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index c2bfeed46b9..c0604539b8f 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -19,7 +19,9 @@ Helmfile installation supports the following tasks: ## Installing the Mendix Operator -The Helmfile installation does not support installing or upgrading the Mendix Operator with the `mx-ops-cli tool`. To install the Operator, perform the following steps instead: +Before deploying the Mendix Private Platform components, you must install the Mendix Operator with proper configuration. + +The Helmfile installation does not support installing or upgrading the Mendix Operator with the `mx-ops-cli tool`. To install the Operator, perform the following steps. ### Preparing the Installation Files @@ -38,6 +40,50 @@ Before you start the installation, download the required files by performing the {{< figure src="/attachments/private-platform/pmp-binary.png" class="no-border" >}} +### Private Cloud License Manager Credentials + +You must configure the Mendix Operator with Private Cloud License Manager (PCLM) credentials that match the credentials you will use when installing `mx-privatecloud-license-manager` with Helmfile. + +{{% alert color="warning" %}} +The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. +{{% /alert %}} + +#### Operator Installation Values + +```yaml +licenseManager: + enable: true + credentialsSecretName: "mendix-pclm-credentials" + serverURL: "http://mx-privatecloud-license-manager" + username: "operatoruser" # Must match pclm bootstrap operator_user + password: "operatorpass" # Must match pclm bootstrap operator_password +``` + +#### Helmfile Values for Mx-privatecloud-license-manager + +```yaml +mx-privatecloud-license-manager: + enable: true + bootstrap_users: + create_operator_user: true + operator_user: "operatoruser" # Must match operator licenseManager.username + operator_password: "operatorpass" # Must match operator licenseManager.password +``` + +{{% alert color="info" %}} +The `operator_user` and `operator_password` in PCLM bootstrap configuration must exactly match the `licenseManager.username` and `licenseManager.password` in the Operator installation. A mismatch will prevent the Operator from obtaining licenses. +{{% /alert %}} + +### ServiceAccount Token Automount for Maia Integration + +If you plan to use Maia AppGen and LLM gateway integration, you must configure the Operator to automount ServiceAccount tokens for Mendix app pods. Maia AppGen requires automounting in order to communicate with Mendix applications through the Kubernetes API. Without this setting, the application pods will not have the necessary ServiceAccount token to authenticate API calls. + +```yaml +operator_config: + # REQUIRED for Maia integration: Allow Mendix app Pods to access Kubernetes API + runtimeAutomountServiceAccountToken: true +``` + ### Optional: Initializing the Installation for Air-Gapped Environments If your clusters can connect to a public registry with a passable network, skip to the next section, otherwise initialize the installation by performing the following steps: @@ -98,6 +144,8 @@ Install the Mendix Operator by doing the following steps: 3. Click **Run Installer** to install the Mendix Operator in your cluster. +You must configure the storage and database plans in the Operator installation values, not in the Helmfile values for `mxplatform`. + ## Helmfile Components Helmfile manages multiple Helm releases with dependency ordering, ensuring components are installed in the correct sequence. @@ -116,14 +164,14 @@ The following components can use different (independent) namespaces: | Component | Description | Namespace | Required | ServiceAccount | | --- | --- | --- | --- | --- | -| `mx-privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Shared | Required | `mendix-pclm` (created by chart) | +| `mx-privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Shared | Required | `mendix-pclm` (created by Operator) | | `mx-privatecloud` | Private Cloud services (authenticator, collector, interactor, bridge) | Shared | Optional | `mx-privatecloud` (created by chart) | | `maia-appgen` | Maia AI AppGen service | Shared | Optional | `maia-appgen` (created by chart) | | `maia-llm-gateway` | Maia LLM Gateway service for routing LLM requests | Shared | Optional | `maia-llm-gateway` (created by chart) | | `svix-server` | Webhook delivery service | Shared | Optional | `svix` (created by chart) | -| `mxplatform` | Mendix Platform application (MendixApp CR) | Shared | Optional | `mxplatform` (created by chart or operator) | +| `mxplatform` | Mendix Platform application (MendixApp CR) | Shared | Optional | `mxplatform` (created by chart or Operator) | | `mxplatform-kube-agent` | Build agent for mxplatform | Independent | Optional | `mxplatform-kube-agent` (created by chart) | -| `mx-private-document-generation` | PDF document generation service | Independent | Optional | `mx-private-document-generation (created by chart)` | +| `mx-private-document-generation` | PDF document generation service | Independent | Optional | `mx-private-document-generation` (created by chart) | ServiceAccount creation depends on the value of the **UseStoragePlanwithIRSA** field. If set to **false**, Chart creates the ServiceAccount with workload identity annotations. If set to **true**, Mendix Operator creates ServiceAccount based on StoragePlan configuration. @@ -131,7 +179,6 @@ ServiceAccount creation depends on the value of the **UseStoragePlanwithIRSA** f The following components are installed in parallel during the first phase of the Helmfile installation: -* `mx-privatecloud-license-manager` * `mx-privatecloud` * `maia-appgen` * `svix-server` @@ -221,126 +268,7 @@ helm plugin install https://github.com/databus23/helm-diff helm plugin list | grep diff ``` -## Installation Requirements for the Mendix Operator - -Before deploying the Mendix Private Platform components, you must install the Mendix Operator with proper configuration. - -### Private Cloud License Manager Credentials - -You must configure the Mendix Operator with Private Cloud License Manager (PCLM) credentials that match the credentials you will use when installing `mx-privatecloud-license-manager` with Helmfile. - -{{% alert color="warning" %}} -The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. -{{% /alert %}} - -#### Operator Installation Values - -```yaml -licenseManager: - enable: true - credentialsSecretName: "mendix-pclm-credentials" - serverURL: "http://mx-privatecloud-license-manager" - username: "operatoruser" # Must match pclm bootstrap operator_user - password: "operatorpass" # Must match pclm bootstrap operator_password -``` - -#### Helmfile Values for Mx-privatecloud-license-manager - -```yaml -mx-privatecloud-license-manager: - enable: true - bootstrap_users: - create_operator_user: true - operator_user: "operatoruser" # Must match operator licenseManager.username - operator_password: "operatorpass" # Must match operator licenseManager.password -``` - -{{% alert color="info" %}} -The `operator_user` and `operator_password` in PCLM bootstrap configuration must exactly match the `licenseManager.username` and `licenseManager.password` in the Operator installation. A mismatch will prevent the Operator from obtaining licenses. -{{% /alert %}} - -### ServiceAccount Token Automount for Maia Integration - -If you plan to use Maia AppGen and LLM gateway integration, you must configure the Operator to automount ServiceAccount tokens for Mendix app pods. Maia AppGen requires automounting in order to communicate with Mendix applications through the Kubernetes API. Without this setting, the application pods will not have the necessary ServiceAccount token to authenticate API calls. - -```yaml -operator_config: - # REQUIRED for Maia integration: Allow Mendix app Pods to access Kubernetes API - runtimeAutomountServiceAccountToken: true -``` - -### StoragePlan and Database Plan Configuration - -You must configure the storage and database plans in the Operator installation values, not in the Helmfile values for `mxplatform`. - -{{% alert color="warning" %}} -The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. -{{% /alert %}} - -#### Example: Azure Database and Storage with Workload Identity - -```yaml -# Credential Service Accounts (for Workload Identity) -credentialServiceAccounts: - enabled: true - serviceAccounts: - - authType: "azure-wi" - k8sServiceAccountName: "db-admin-sa" - azwiClientID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" - - authType: "azure-wi" - k8sServiceAccountName: "storage-admin-sa" - azwiClientID: "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" - -# Database Storage Plans -database: - postgres: - enabled: true - plans: - - planName: "azure-db" - planType: "on-demand" - useAzureWIAuth: true - k8sServiceAccountName: "db-admin-sa" - host: "myserver.postgres.database.azure.com" - port: 5432 - database: "postgres" - user: "mendix-storage-admin" - password: "" # Empty when using Workload Identity - strictTLS: true - -# Object Store Storage Plans -storage: - azure_blob: - enabled: true - plans: - - planName: "azure-sp" - k8sServiceAccountName: "storage-admin-sa" - useAzureWIAuth: true - azureStorageAccount: "mystorageaccount" - azureResourceGroup: "my-resource-group" - azureAccountSubscriptionID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" - azureContainerName: "" # Auto-created per environment - preventDataDeletion: false - -# Operator Configuration -operator_config: - runtimeAutomountServiceAccountToken: true # Required for Maia integration -``` - -### Complete Operator Installation Example - -For an example of the complete Operator installation values,see *samples/operator-sp.yaml*. - -To install the Operator, use the following commands: - -```text -helm install --create-namespace \ - -n \ - -f samples/operator-sp.yaml \ - operator \ - mx-privatecloud-operator-installer -``` -For detailed Operator installation instructions, see [Installing and Configuring Mendix on Kubernetes with Helm Charts](/developerportal/deploy/helm-charts/#installing-and-configuring-the-mendix-on-kubernetes-with-helm-charts). ## Quick Start From cd2a4ce01e92a1ea8743dae47c0084b29c7ec3c0 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Fri, 18 Sep 2026 14:35:43 +0200 Subject: [PATCH 04/31] Update the Helm Chart documentations --- .../quickstart/pmp-quickstart-helm.md | 26 ------------------- 1 file changed, 26 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index c0604539b8f..c89037979e1 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -44,32 +44,6 @@ Before you start the installation, download the required files by performing the You must configure the Mendix Operator with Private Cloud License Manager (PCLM) credentials that match the credentials you will use when installing `mx-privatecloud-license-manager` with Helmfile. -{{% alert color="warning" %}} -The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. -{{% /alert %}} - -#### Operator Installation Values - -```yaml -licenseManager: - enable: true - credentialsSecretName: "mendix-pclm-credentials" - serverURL: "http://mx-privatecloud-license-manager" - username: "operatoruser" # Must match pclm bootstrap operator_user - password: "operatorpass" # Must match pclm bootstrap operator_password -``` - -#### Helmfile Values for Mx-privatecloud-license-manager - -```yaml -mx-privatecloud-license-manager: - enable: true - bootstrap_users: - create_operator_user: true - operator_user: "operatoruser" # Must match operator licenseManager.username - operator_password: "operatorpass" # Must match operator licenseManager.password -``` - {{% alert color="info" %}} The `operator_user` and `operator_password` in PCLM bootstrap configuration must exactly match the `licenseManager.username` and `licenseManager.password` in the Operator installation. A mismatch will prevent the Operator from obtaining licenses. {{% /alert %}} From 3fc65d3bde741c3cb293e0c9a6651178c876aae5 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Fri, 18 Sep 2026 14:44:38 +0200 Subject: [PATCH 05/31] added release version --- .../docs/private-platform/quickstart/pmp-quickstart-helm.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index c89037979e1..2ff3a7fc039 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -265,6 +265,8 @@ helmfile --file helmfile.d/helmfile.yaml \ ### Minimal Values File Template +Replace the component versions in the following template with the correct versions for your Private Mendix Platform release. For more information, refer to [Private Mendix Platform Release Notes](/releasenotes/private-platform/). + ```yaml # ───────────────────────────────────────────────────────────────────────────── # REQUIRED: Shared namespace @@ -291,7 +293,7 @@ mx-privatecloud-license-manager: image: registry: "private-cloud.registry.mendix.com" name: "privatecloud-license-manager" - tag: "0.11.0" + tag: "{insert component version as indicated in release notes}" # Database configuration db: From e8004651fe08cc7114705a7c13e3804951294390 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Fri, 18 Sep 2026 14:55:53 +0200 Subject: [PATCH 06/31] deleted integration with Mx Operator --- .../quickstart/pmp-quickstart-helm.md | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index 2ff3a7fc039..0714c22e71d 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -685,24 +685,6 @@ mx-privatecloud-license-manager: enabled: false ``` -#### Integration with Mendix Operator - -The Mendix Operator must be configured to use PCLM for license management. - -{{% alert color="warning" %}} -The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. -{{% /alert %}} - -```text -# In Mendix Operator installation values -licenseManager: - enable: true - credentialsSecretName: "mendix-pclm-credentials" - serverURL: "http://mx-privatecloud-license-manager" # Service name in same namespace - username: "operatoruser" # Must match bootstrap_users.operator_user - password: "operatorpass" # Must match bootstrap_users.operator_password -``` - #### Service URL The PCLM service is accessible within the cluster at the following: From b1bef7ba72e517abde7d307de840e6810a9054c8 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Wed, 23 Sep 2026 13:38:38 +0200 Subject: [PATCH 07/31] sme review --- .../en/docs/private-platform/quickstart/pmp-quickstart-helm.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index 0714c22e71d..cc5eb4ecda4 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -256,7 +256,6 @@ The code samples are intended to show the range of available options. No rights # 1. Create your values file cp examples/my-values.yaml my-values.yaml # Edit my-values.yaml with your configuration - # 2. Deploy all enabled components helmfile --file helmfile.d/helmfile.yaml \ --state-values-file my-values.yaml \ From a3793f418b136c4545d0f44c86af49793dee2eaa Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Wed, 23 Sep 2026 15:45:56 +0200 Subject: [PATCH 08/31] sme review --- .../private-platform/quickstart/_index.md | 1 + .../quickstart/pmp-quickstart-airgapped.md | 14 ++++ .../quickstart/pmp-quickstart-helm.md | 83 +++++-------------- .../quickstart/pmp-quickstart.md | 5 +- 4 files changed, 40 insertions(+), 63 deletions(-) create mode 100644 content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md diff --git a/content/en/docs/private-platform/quickstart/_index.md b/content/en/docs/private-platform/quickstart/_index.md index 8c37c6f6de9..bfe30c86737 100644 --- a/content/en/docs/private-platform/quickstart/_index.md +++ b/content/en/docs/private-platform/quickstart/_index.md @@ -33,6 +33,7 @@ You can perform the installation by using one of the following methods: * [With GUI](/private-mendix-platform/interactive-installation/), where you manually install Private Mendix Platform components * [With Helmfile](/private-mendix-platform/helmfile-installation/), where you use Helmfile to automatically install Private Mendix Platform components. +* [Air-Gapped](/private-mendix-platform/airgapped-installation/), where you install Private Mendix Platform for an air-gapped environment. #### Installation Order diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md new file mode 100644 index 00000000000..aff94a86947 --- /dev/null +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -0,0 +1,14 @@ +--- +title: "Install Private Mendix Platform for Air-Gapped Environments" +linktitle: "Air-Gapped Installation" +url: /private-mendix-platform/air-gapped-installation/ +description: "Documents the installation process for Private Mendix Platform for air-gapped environments." +weight: 31 +--- + +## Introduction + +For other installation types, see the following topics: + +* [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/) +* [Install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index cc5eb4ecda4..abf1e12f34f 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -8,7 +8,10 @@ weight: 30 ## Introduction -To automate the declarative installation of Private Mendix Platform, you can now use Helm and Helmfile in order to automate the declarative installation of Private Mendix Platform. In this way, you can automatically install Private Mendix Platform components. If you would like to perform a manual installation instead, see [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/). +To automate the declarative installation of Private Mendix Platform, you can now use Helm and Helmfile in order to automate the declarative installation of Private Mendix Platform. In this way, you can automatically install Private Mendix Platform components. For other installation types, see the following topics: + +* [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/) +* [Install Private Mendix Platform for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) ### Supported Tasks @@ -27,27 +30,18 @@ The Helmfile installation does not support installing or upgrading the Mendix Op Before you start the installation, download the required files by performing the following steps: -1. Download the release binary from your [Private Mendix Platform download portal](https://privateplatform.mendix.com/). If you do not have access to the download portal, contact your Mendix partner for information. - -2. Unzip the release binary to a local folder on your Windows or Linux server. The release binary contains the following files: - - * **Tools** - *mx-pclm-cli*, which can be used to manage PCLM - * **helm**, and **helmfile** tools, which are used to deploy and manage Private Mendix Platform charts and Svix charts - * **images** - Private Mendix Platform image, PCLM image, Svix image, test application image - * **Installer** - installer tools - * **mxpc-cli** - installation tools which can be used to manage or configure the Mendix Operator - * **charts** - charts, including Private Mendix Platform charts and Svix charts - - {{< figure src="/attachments/private-platform/pmp-binary.png" class="no-border" >}} - -### Private Cloud License Manager Credentials +1. In the [Private Mendix Platform download portal](https://privateplatform.mendix.com/), click **Releases**. -You must configure the Mendix Operator with Private Cloud License Manager (PCLM) credentials that match the credentials you will use when installing `mx-privatecloud-license-manager` with Helmfile. + If you do not have access to the download portal, contact your Mendix partner for information. -{{% alert color="info" %}} -The `operator_user` and `operator_password` in PCLM bootstrap configuration must exactly match the `licenseManager.username` and `licenseManager.password` in the Operator installation. A mismatch will prevent the Operator from obtaining licenses. -{{% /alert %}} +2. Click the three-dot menu (**•••**) for the desired release, and then click **View addons**. +3. Find the *Addons/pmp-charts-x.x.x.zip* file, where `x.x.x` is the version number, and click **Download**. +4. Unzip the downloaded file to a local folder on your Windows or Linux server. The release binary contains the following files: + * **helmfile.d** - Helmfile templates and configuration + * **charts** - Helm charts for all components + * **samples** - Example configuration files + ### ServiceAccount Token Automount for Maia Integration If you plan to use Maia AppGen and LLM gateway integration, you must configure the Operator to automount ServiceAccount tokens for Mendix app pods. Maia AppGen requires automounting in order to communicate with Mendix applications through the Kubernetes API. Without this setting, the application pods will not have the necessary ServiceAccount token to authenticate API calls. @@ -58,49 +52,6 @@ operator_config: runtimeAutomountServiceAccountToken: true ``` -### Optional: Initializing the Installation for Air-Gapped Environments - -If your clusters can connect to a public registry with a passable network, skip to the next section, otherwise initialize the installation by performing the following steps: - -1. Upload the images to your private repository in an air-gapped environment. - - ```text - ~/mpp-binary-linux$ ./installer init migrate --help - Migrate Mendix Private Platform related image to your own registry - - Usage: - installer init migrate [flags] - Flags: - -h, --help help for migrate - -r, --registryurl string registry url (required) - -e, --repo string Repository name - -u, --username string Username (required) for your private registry - ``` - - The destination image is named `${registryurl }/${repo}/mendix-private-platform: ${tag}`. - -2. The `registryurl` and `repo` are read from the input parameters. The `tag` is automatically read by the installer. If the repository does not exist, you must create it before running the `init migrate` command. - - ```text - ~/mpp-binary-linux$ ./installer init migrate -r [registry] -u user -e [repositoryName] - Please enter user password: *** - - Confirm password: *** - the config checksum is empty - The image destination[REDACTED] svix-server:v0.75.0 - The image destiation [REDACTED] mendix-private-platform:1.4.0.80d447b1 - the config checksum is empty - The image destiation [REDACTED] mxpc-test:1.0 - the config checksum is empty - The image destiation [REDACTED] privatecloud-license-manager:0.3.0 - svix-server_v0.75.0 => [REDACTED] svix-server:v0.75.0 - ok - mendix-private-platform_1.4.0.80d447b1 => [REDACTED] mendix-private-platform:1.4.0.80d447b1 - ok - mxpc-test_1.0 => [REDACTED] mxpc-test:1.0 - ok - privatecloud-license-manager_0.3.0 => [REDACTED] privatecloud-license-manager:0.3.0 - ok - ``` - -3. By default, mxpc-cli tools install the latest version of Mendix Operator. You can specify a different Mendix Operator version by using the following command: `./installer operator init -v="version number"` - ## Installing the Mendix Operator {#install-operator} Install the Mendix Operator by doing the following steps: @@ -120,6 +71,14 @@ Install the Mendix Operator by doing the following steps: You must configure the storage and database plans in the Operator installation values, not in the Helmfile values for `mxplatform`. +### Private Cloud License Manager Credentials + +You must configure the Mendix Operator with Private Cloud License Manager (PCLM) credentials that match the credentials you will use when installing `mx-privatecloud-license-manager` with Helmfile. + +{{% alert color="info" %}} +The `operator_user` and `operator_password` in PCLM bootstrap configuration must exactly match the `licenseManager.username` and `licenseManager.password` in the Operator installation. A mismatch will prevent the Operator from obtaining licenses. +{{% /alert %}} + ## Helmfile Components Helmfile manages multiple Helm releases with dependency ordering, ensuring components are installed in the correct sequence. diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart.md b/content/en/docs/private-platform/quickstart/pmp-quickstart.md index d929efb56e8..6df9fd6a1c4 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart.md @@ -8,7 +8,10 @@ weight: 20 ## Introduction -In interactive mode, you manually install Private Mendix Platform components. If you would like to perform an automatic installation instead, see [Install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/). +In interactive mode, you manually install Private Mendix Platform components. For other installation types, see the following topics: + +* [Install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/) +* [Install Private Mendix Platform for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) ## Preparing the Installation Files From a3898ededec559fc3f1fedd9c7020c6779f6c500 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Wed, 23 Sep 2026 22:10:28 +0200 Subject: [PATCH 09/31] updates --- .../quickstart/pmp-quickstart-airgapped.md | 149 +++++++++++++++++- 1 file changed, 148 insertions(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index aff94a86947..b60456fc63b 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -8,7 +8,154 @@ weight: 31 ## Introduction -For other installation types, see the following topics: +This document describes how you can perform a Private Mendix Platform in an air-gapped environment. For other installation types, see the following topics: * [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/) * [Install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/) + +## Image Migration for Private Mendix Platform 2.8.0 + +The 2.8.0 release of Private Mendix Platform requires some manual steps to migrate images from various sources to the customer's air-gapped container registry: + +* Some platform component images are provided as tarballs in one of the following ways: + + * In zip files downloaded over HTTP from the [Private Mendix Platform Download Portal](/private-mendix-platform/download-portal/) + * Packaged inside the zip file of the Private Mendix Platform installer + +* Some Platform components and Mendix images are provided through the Mendix public image registry + +Either set uses a different tool to migrate. For more information, refer to the following sections. + +### Images in a Zip File + +For images downloaded from the Private Mendix Platform Download Portal or with the installer file, perform the following steps. + +1. Download the release binary from your [Private Mendix Platform Download Portal](/private-mendix-platform/download-portal/). If you do not have access to the download portal, contact your Mendix partner for information. +2. Unzip the release binary to a local folder on your Windows or Linux server. The release binary contains the following files: + +* In the *Tools* folder: + + * **mx-pclm-cli**, which can be used to manage PCLM + * **helm** and **helmfile** tools, which are used to deploy and manage Private Mendix Platform charts and Svix charts + * **images** - Private Mendix Platform image, PCLM image, Svix image, test application image + +* In the *Installer* folder: + + * **mxpc-cli** - Installation tools which can be used to manage or configure the Mendix Operator + * **charts** - Charts, including Private Mendix Platform charts and Svix charts + +3. If your clusters can connect to a public registry with a passable network, skip to step 4 below, otherwise initialize the installation by performing the following steps: + + 1. Upload the images to your private repository in an air-gapped environment: + + ```text + ~/mpp-binary-linux$ ./installer init migrate --help + Migrate Mendix Private Platform related image to your own registry + + Usage: + installer init migrate [flags] + Flags: + -h, --help help for migrate + -r, --registryurl string registry url (required) + -e, --repo string Repository name + -u, --username string Username (required) for your private registry + ``` + + The destination image is named `${registryurl }/${repo}/mendix-private-platform: ${tag}`. The `registryurl` and `repo` are read from the input parameters. The `tag` is automatically read by the installer. + + 2. If the repository does not exist, you must create it before running the init migrate command: + + ```text + ~/mpp-binary-linux$ ./installer init migrate -r [registry] -u user -e [repositoryName] + Please enter user password: ****************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************** + + Confirm password: ****************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************** + the config checksum is empty + The image destination[REDACTED] svix-server:v0.75.0 + The image destiation [REDACTED] mendix-private-platform:1.4.0.80d447b1 + the config checksum is empty + The image destiation [REDACTED] mxpc-test:1.0 + the config checksum is empty + The image destiation [REDACTED] privatecloud-license-manager:0.3.0 + svix-server_v0.75.0 => [REDACTED] svix-server:v0.75.0 - ok + mendix-private-platform_1.4.0.80d447b1 => [REDACTED] mendix-private-platform:1.4.0.80d447b1 - ok + mxpc-test_1.0 => [REDACTED] mxpc-test:1.0 - ok + privatecloud-license-manager_0.3.0 => [REDACTED] privatecloud-license-manager:0.3.0 - ok + ``` + + 3. By default, mxpc-cli tools install the latest version of Mendix Operator. You can specify a different Mendix Operator version by using the following command: `./installer operator init -v="version number"` + +4. Migrate the files required to install the Private Cloud components by performing the following steps: + + 1. Download the *mx-private-cloud.zip* file from your Private Mendix Platform download portal. + 2. Unzip the *mx-private-cloud.zip* file. + 3. Copy the *images* from the *mx-private-cloud* directory to the *images* sub-directory of the installer by running the following command: `cp -r mx-private-cloud/images/* /pmp-binary-linux/images` + 4. Upload the directory to your private registry by using the `installer init migrate` command. All the images must be in the same registry. + +5. Migrate the files required to enable Maia for Private Mendix Platform by performing the following steps: + + 1. Download the *maia-appgen-pmp.zip* file from your Private Mendix Platform download portal. + 2. Unzip the *maia-appgen-pmp.zip* file. + 3. Copy the *maia-appgen-pmp* directory to the *images* sub-directory of the installer by running the following command: `cp -r maia-appgen-pmp/images/* /pmp-binary-linux/images` + 4. Upload the Maia directory to your private registry by using the `installer init migrate` command. + +6. After the migration is completed, [install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/). + +### Images from the Public Mendix Registry + +For SVIX, the Mendix Operator and its subcomponents (for example, sidecars, storage provisioners, image builder), as well as Mendix runtime base images and app building blocks for supported Mendix versions, you must use an AIP tool to download and migrate to a local registry. + +#### Accessing Mendix Container Images + +To install Private Mendix in an air-gapped environment, you must provision a list of images in your registry. + +1. Download an aip tool for your operating system. + + Mendix has created *aip* tools for different operating systems. Download them from the following links: + + * [Aip for Mac (amd64)](https://cdn.mendix.com/mendix-for-private-cloud/airgapped-image-package/airgapped-image-package-0.1.0-macos-amd64.tar.gz) + * [Aip for Mac (arm64)](https://cdn.mendix.com/mendix-for-private-cloud/airgapped-image-package/airgapped-image-package-0.1.0-macos-arm64.tar.gz) + * [Aip for Windows (amd64)](https://cdn.mendix.com/mendix-for-private-cloud/airgapped-image-package/airgapped-image-package-0.1.0-windows-amd64.zip) + * [Aip for Windows (arm64)](https://cdn.mendix.com/mendix-for-private-cloud/airgapped-image-package/airgapped-image-package-0.1.0-windows-arm64.zip) + * [Aip for Linux (amd64)](https://cdn.mendix.com/mendix-for-private-cloud/airgapped-image-package/airgapped-image-package-0.1.0-linux-amd64.tar.gz) + * [Aip for Linux (arm64)](https://cdn.mendix.com/mendix-for-private-cloud/airgapped-image-package/airgapped-image-package-0.1.0-linux-arm64.tar.gz) + +Export image list. + +Access PMP download portal → Image Management → Choose Private Mendix Platform Version → Filter Category and choose the images → Export Selection will export the list to a file. File name is like export-images-v2.7.0.json + +Create PAT + +Some images are private, and need create PAT(Personal Access Token) from Mendix portal for authentication. + +Sign in to Mendix home -> User Settings → Developer Settings → Personal Access Token, click New Token button and choose mx:registry:access scope under OCI registry to create your PAT. + +Run aip commands to synchronise images to your air-gapped registry + +mkdir pmp-images +cd pmp-images + +# Initialize aip with exported image list. +aip init ~/Downloads/export-images-v2.7.0.json + +# Login Mendix registry +aip login -u pat -p registry.mendix.com + +# Download all images from source registry to local folder. +aip pull + +# Configure destination registry. +aip set-base-destination + +# Login new registry. +aip login -u -p + +# Upload all the images to new registry. +aip push + + + +In case some registry need create repository before push, you can get all the repositories via below command: + +# get list of required repositories - these will need to be created before you can push to them +jq -r '.["images", "charts", "custom-artifacts"][] .destination' state.json From 57965bd70e91aa2f439cd9ecdabb143fbe8cd5ab Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Wed, 23 Sep 2026 22:16:07 +0200 Subject: [PATCH 10/31] updates --- .../private-platform/quickstart/_index.md | 2 +- .../quickstart/pmp-quickstart-airgapped.md | 34 +++++++++++++++++-- .../quickstart/pmp-quickstart-helm.md | 2 +- .../quickstart/pmp-quickstart.md | 2 +- 4 files changed, 34 insertions(+), 6 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/_index.md b/content/en/docs/private-platform/quickstart/_index.md index bfe30c86737..139825f9b4f 100644 --- a/content/en/docs/private-platform/quickstart/_index.md +++ b/content/en/docs/private-platform/quickstart/_index.md @@ -33,7 +33,7 @@ You can perform the installation by using one of the following methods: * [With GUI](/private-mendix-platform/interactive-installation/), where you manually install Private Mendix Platform components * [With Helmfile](/private-mendix-platform/helmfile-installation/), where you use Helmfile to automatically install Private Mendix Platform components. -* [Air-Gapped](/private-mendix-platform/airgapped-installation/), where you install Private Mendix Platform for an air-gapped environment. +* [Air-Gapped (for Private Mendix Platform 2.8.0)](/private-mendix-platform/airgapped-installation/), where you install Private Mendix Platform 2.8.0 for an air-gapped environment. #### Installation Order diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index b60456fc63b..fe00c29d01f 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -1,5 +1,5 @@ --- -title: "Install Private Mendix Platform for Air-Gapped Environments" +title: "Install Private Mendix Platform 2.8.0 for Air-Gapped Environments" linktitle: "Air-Gapped Installation" url: /private-mendix-platform/air-gapped-installation/ description: "Documents the installation process for Private Mendix Platform for air-gapped environments." @@ -120,9 +120,37 @@ To install Private Mendix in an air-gapped environment, you must provision a lis * [Aip for Linux (amd64)](https://cdn.mendix.com/mendix-for-private-cloud/airgapped-image-package/airgapped-image-package-0.1.0-linux-amd64.tar.gz) * [Aip for Linux (arm64)](https://cdn.mendix.com/mendix-for-private-cloud/airgapped-image-package/airgapped-image-package-0.1.0-linux-arm64.tar.gz) -Export image list. +2. Export the image list. + + 1. In the [https://privateplatform.mendix.com/](https://privateplatform.mendix.com/), go to **Image Management** and select a Private Mendix Platform version. + 2. Filter by **Category** and select the images + 3. Click **Export Selection** to export the list to a file named *export-images-vx.x.x.json*, where `x.x.x` corresponds to a Private Mendix Platform version. + +2. In the Mendix Portal, create a Personal Access Token (PAT) for private images that require a PAT for authentication. + + 1. Sign in to Mendix and go to **User Settings > Developer Settings > Personal Access Token** + 2. Click **New Token**. + 3. Under **OCI registry**, select the **mx:registry:access** as scope. + +3. Fetch the images. + + 1. Log in to the OCI registry for Oras by using the following command: `oras login -u pat -p   registry.mendix.com`. + 2. Use the `oras pull` command to download the Helmfile from the OCI registry, for example, ` oras pull registry.mendix.com/private-platform/installer-helmfile:0.2.1`. + 3. Unzip the downloaded file by using the following command: `tar -xvf helmfile-config.tar.gz`. + 4. Test it by using the following command: `helmfile --file helmfile.d/helmfile.yaml --state-values-file apply`. + +4. Pull the charts. + + 1. Log in to the OCI registry for Helm by using the following command: `helm registry login -u pat -p ${YOUR_PAT} registry.mendix.com`. + 2. Use the `helm pull` command to download the Helmfile from the OCI registry, for example: + + ```text + helm pull oci://registry.mendix.com/private-cloud/charts/mx-privatecloud-operator-installer --version 0.2.36 + helm install operator mx-privatecloud-operator-installer-0.2.36.tgz -f ./Downloads/20260916T113717Z-pmp-test-oci-generated-values.yaml --namespace pmp-oci-test + ``` + + where `/Downloads/20260916T113717Z-pmp-test-oci-generated-values.yaml` is the yaml file for Operator configuration. You can find this yaml file among the example files in the installer package. -Access PMP download portal → Image Management → Choose Private Mendix Platform Version → Filter Category and choose the images → Export Selection will export the list to a file. File name is like export-images-v2.7.0.json Create PAT diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index abf1e12f34f..d06e7e78069 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -11,7 +11,7 @@ weight: 30 To automate the declarative installation of Private Mendix Platform, you can now use Helm and Helmfile in order to automate the declarative installation of Private Mendix Platform. In this way, you can automatically install Private Mendix Platform components. For other installation types, see the following topics: * [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/) -* [Install Private Mendix Platform for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) +* [Install Private Mendix Platform 2.8.0 for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) ### Supported Tasks diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart.md b/content/en/docs/private-platform/quickstart/pmp-quickstart.md index 6df9fd6a1c4..94509a7f85f 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart.md @@ -11,7 +11,7 @@ weight: 20 In interactive mode, you manually install Private Mendix Platform components. For other installation types, see the following topics: * [Install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/) -* [Install Private Mendix Platform for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) +* [Install Private Mendix Platform 2.8.0 for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) ## Preparing the Installation Files From f868845c4237e8d4dc9b02f2e8c0bcaceb65f82f Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Wed, 23 Sep 2026 22:22:22 +0200 Subject: [PATCH 11/31] draft --- .../quickstart/pmp-quickstart-airgapped.md | 76 +++++++------------ 1 file changed, 27 insertions(+), 49 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index fe00c29d01f..fa2679f12bb 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -132,58 +132,36 @@ To install Private Mendix in an air-gapped environment, you must provision a lis 2. Click **New Token**. 3. Under **OCI registry**, select the **mx:registry:access** as scope. -3. Fetch the images. - - 1. Log in to the OCI registry for Oras by using the following command: `oras login -u pat -p   registry.mendix.com`. - 2. Use the `oras pull` command to download the Helmfile from the OCI registry, for example, ` oras pull registry.mendix.com/private-platform/installer-helmfile:0.2.1`. - 3. Unzip the downloaded file by using the following command: `tar -xvf helmfile-config.tar.gz`. - 4. Test it by using the following command: `helmfile --file helmfile.d/helmfile.yaml --state-values-file apply`. - -4. Pull the charts. - - 1. Log in to the OCI registry for Helm by using the following command: `helm registry login -u pat -p ${YOUR_PAT} registry.mendix.com`. - 2. Use the `helm pull` command to download the Helmfile from the OCI registry, for example: +3. Fetch the images by using the following aip commands: ```text - helm pull oci://registry.mendix.com/private-cloud/charts/mx-privatecloud-operator-installer --version 0.2.36 - helm install operator mx-privatecloud-operator-installer-0.2.36.tgz -f ./Downloads/20260916T113717Z-pmp-test-oci-generated-values.yaml --namespace pmp-oci-test + mkdir pmp-images + cd pmp-images + + # Initialize aip with the exported image list + aip init ~/Downloads/export-images-v2.7.0.json + + # Log in to the Mendix registry + aip login -u pat -p registry.mendix.com + + # Download all images from source registry to local folder. + aip pull + + # Configure the destination registry + aip set-base-destination + + # Log in to the new registry + aip login -u -p + + # Upload all the images to new registry. + aip push ``` - where `/Downloads/20260916T113717Z-pmp-test-oci-generated-values.yaml` is the yaml file for Operator configuration. You can find this yaml file among the example files in the installer package. - - -Create PAT - -Some images are private, and need create PAT(Personal Access Token) from Mendix portal for authentication. - -Sign in to Mendix home -> User Settings → Developer Settings → Personal Access Token, click New Token button and choose mx:registry:access scope under OCI registry to create your PAT. +4. If your registry requires you to create a repository before pushing, use the following command: -Run aip commands to synchronise images to your air-gapped registry - -mkdir pmp-images -cd pmp-images - -# Initialize aip with exported image list. -aip init ~/Downloads/export-images-v2.7.0.json - -# Login Mendix registry -aip login -u pat -p registry.mendix.com - -# Download all images from source registry to local folder. -aip pull - -# Configure destination registry. -aip set-base-destination - -# Login new registry. -aip login -u -p - -# Upload all the images to new registry. -aip push - - - -In case some registry need create repository before push, you can get all the repositories via below command: + ```text + # get list of required repositories - these will need to be created before you can push to them + jq -r '.["images", "charts", "custom-artifacts"][] .destination' state.json + ``` -# get list of required repositories - these will need to be created before you can push to them -jq -r '.["images", "charts", "custom-artifacts"][] .destination' state.json +5. After the migration is completed, [install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/). \ No newline at end of file From 551135e2e2e7265556495504fb2014f51b4d77c1 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Thu, 24 Sep 2026 14:14:04 +0200 Subject: [PATCH 12/31] added new config --- .../quickstart/pmp-quickstart-helm.md | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index d06e7e78069..726cb535e52 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -437,6 +437,39 @@ global: - name: acr-secret ``` +### ChartRepo + +This is the custom Helm chart repository URL for all components. It allows you to host all charts in your own OCI registry instead of pulling from the default Mendix registry. + +* **Type** - `string` +* Default value - `""` (uses default Mendix registries) + +When `chartRepo` is not specified, each component pulls from its default Mendix registry location with the following full paths: + +* `installer-config` - `oci://registry.mendix.com/private-platform/charts/installer-config` +* `mxplatform` - `oci://registry.mendix.com/private-platform/charts/mxplatform` +* `mxplatform-kube-agent` - `oci://registry.mendix.com/private-platform/charts/mxplatform-kube-agent` +* `svix-server` - `oci://registry.mendix.com/private-platform/charts/svix-server` +* `mx-privatecloud` - `oci://registry.mendix.com/private-cloud/charts/mx-privatecloud` +* `mx-privatecloud-license-manager` - `oci://registry.mendix.com/private-cloud/charts/mx-privatecloud-license-manager` +* `maia-appgen` - `oci://registry.mendix.com/maia/charts/maia-appgen` +* `maia-llm-gateway` - `oci://registry.mendix.com/maia/charts/maia-llm-gateway` +* `mx-private-document-generation` - `oci://registry.mendix.com/docgen/charts/mx-private-document-generation` + +#### Custom Repository Structure + +When a custom Helm chart repository is configured using `chartRepo`, all charts are pulled using a flat structure. The chart name is appended to your repository URL, as in the following example: + +```text +# Example: Use Azure Container Registry +chartRepo: "oci://crpmp001.azurecr.io/helm/pmp" +# Charts will be pulled from: +# - oci://crpmp001.azurecr.io/helm/pmp/mxplatform +# - oci://crpmp001.azurecr.io/helm/pmp/mx-privatecloud +# - oci://crpmp001.azurecr.io/helm/pmp/maia-appgen +# etc. +``` + ## Component Configurations The following configurations are component-specific. @@ -515,6 +548,13 @@ Admin user credentials (`admin_user` and `admin_password`) must exactly match th | `ingress.annotations` | object | No | Additional ingress annotations | | `ingress.labels` | object | No | Additional ingress labels | +##### TLS Configuration for Ingress + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `ingress.enableTLS` | Boolean | No | `false` | Set to `true` to enable TLS termination at ingress. | +| `ingress.tlsSecretName` | string | Conditional | "" | Kubernetes Secret name containing TLS certificate. Required if `ingress.enableTLS: true`. | + ##### Workload Identity Configuration For passwordless database authentication using cloud-native identity, configure the following settings. From 367ce9d061b0c806f6d182bd4f8dbc7700a18f66 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 10:34:37 +0200 Subject: [PATCH 13/31] Update pmp-quickstart-airgapped.md --- .../private-platform/quickstart/pmp-quickstart-airgapped.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index fa2679f12bb..f776f6ab66f 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -105,7 +105,7 @@ For images downloaded from the Private Mendix Platform Download Portal or with t For SVIX, the Mendix Operator and its subcomponents (for example, sidecars, storage provisioners, image builder), as well as Mendix runtime base images and app building blocks for supported Mendix versions, you must use an AIP tool to download and migrate to a local registry. -#### Accessing Mendix Container Images +#### Accessing Mendix Container Images {#aip} To install Private Mendix in an air-gapped environment, you must provision a list of images in your registry. @@ -164,4 +164,4 @@ To install Private Mendix in an air-gapped environment, you must provision a lis jq -r '.["images", "charts", "custom-artifacts"][] .destination' state.json ``` -5. After the migration is completed, [install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/). \ No newline at end of file +5. After the migration is completed, [install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/). From cbf59b3daece3f652e3fdee6987afd4d66ae7572 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 14:39:26 +0200 Subject: [PATCH 14/31] Update Image Management to Artifact Management --- .../private-platform/quickstart/pmp-quickstart-airgapped.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index f776f6ab66f..dddc3bb584e 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -122,7 +122,7 @@ To install Private Mendix in an air-gapped environment, you must provision a lis 2. Export the image list. - 1. In the [https://privateplatform.mendix.com/](https://privateplatform.mendix.com/), go to **Image Management** and select a Private Mendix Platform version. + 1. In the [https://privateplatform.mendix.com/](https://privateplatform.mendix.com/), go to **Artifact Management** and select a Private Mendix Platform version. 2. Filter by **Category** and select the images 3. Click **Export Selection** to export the list to a file named *export-images-vx.x.x.json*, where `x.x.x` corresponds to a Private Mendix Platform version. From 9dac82f02dffb0314936c2d80dc8a13fbdff6459 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 14:41:53 +0200 Subject: [PATCH 15/31] Update pmp-quickstart-airgapped.md --- .../private-platform/quickstart/pmp-quickstart-airgapped.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index dddc3bb584e..af9eafb6b29 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -123,7 +123,7 @@ To install Private Mendix in an air-gapped environment, you must provision a lis 2. Export the image list. 1. In the [https://privateplatform.mendix.com/](https://privateplatform.mendix.com/), go to **Artifact Management** and select a Private Mendix Platform version. - 2. Filter by **Category** and select the images + 2. Filter by **Category** and **ArtifactType** to select the images, charts, and Helm file. 3. Click **Export Selection** to export the list to a file named *export-images-vx.x.x.json*, where `x.x.x` corresponds to a Private Mendix Platform version. 2. In the Mendix Portal, create a Personal Access Token (PAT) for private images that require a PAT for authentication. From 29649c7f3872a78031cec7c05e2ef191d6cf7c68 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 14:53:15 +0200 Subject: [PATCH 16/31] Update pmp-quickstart-helm.md --- .../quickstart/pmp-quickstart-helm.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index 726cb535e52..c467304fb7a 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -30,13 +30,16 @@ The Helmfile installation does not support installing or upgrading the Mendix Op Before you start the installation, download the required files by performing the following steps: -1. In the [Private Mendix Platform download portal](https://privateplatform.mendix.com/), click **Releases**. +1. Log in to the [Private Mendix Platform download portal](https://privateplatform.mendix.com/), click **Releases**. If you do not have access to the download portal, contact your Mendix partner for information. -2. Click the three-dot menu (**•••**) for the desired release, and then click **View addons**. -3. Find the *Addons/pmp-charts-x.x.x.zip* file, where `x.x.x` is the version number, and click **Download**. -4. Unzip the downloaded file to a local folder on your Windows or Linux server. The release binary contains the following files: +2. Find the installation by performing the following steps, depending on your Private Mendix Platform version: + + * For version 2.8.1 and newer, go to **Artifacts Management**, select the version from the **Private Mendix Platform Version** dropdown, and select **Chart** as the **Artifact Type**. + * For version 2.8.0 and older, go to **Releases**, click the three-dot menu (**•••**) for the desired release, and then click **View addons**. Find the *Addons/pmp-charts-x.x.x.zip* file, where `x.x.x` is the version number, and click **Download**. + +3. Unzip the downloaded file to a local folder on your Windows or Linux server. The release binary contains the following files: * **helmfile.d** - Helmfile templates and configuration * **charts** - Helm charts for all components From 98a41e6e3a6b9d10dbd4719abfe77a967762ae96 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 15:05:58 +0200 Subject: [PATCH 17/31] Update pmp-quickstart-helm.md --- .../quickstart/pmp-quickstart-helm.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index c467304fb7a..ecc638f3885 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -24,19 +24,19 @@ Helmfile installation supports the following tasks: Before deploying the Mendix Private Platform components, you must install the Mendix Operator with proper configuration. -The Helmfile installation does not support installing or upgrading the Mendix Operator with the `mx-ops-cli tool`. To install the Operator, perform the following steps. +The Helmfile installation does not support installing or upgrading the Mendix Operator with the mx-ops-cli tool. To install the Operator, perform the following steps. ### Preparing the Installation Files Before you start the installation, download the required files by performing the following steps: -1. Log in to the [Private Mendix Platform download portal](https://privateplatform.mendix.com/), click **Releases**. +1. Log in to the [Private Mendix Platform download portal](https://privateplatform.mendix.com/). If you do not have access to the download portal, contact your Mendix partner for information. 2. Find the installation by performing the following steps, depending on your Private Mendix Platform version: - * For version 2.8.1 and newer, go to **Artifacts Management**, select the version from the **Private Mendix Platform Version** dropdown, and select **Chart** as the **Artifact Type**. + * For version 2.8.1 and newer, go to **Artifacts Management**, select the version from the **Private Mendix Platform Version** dropdown, and select **Chart** as the **Artifact Type**. Select the charts and click **Export Selection**. * For version 2.8.0 and older, go to **Releases**, click the three-dot menu (**•••**) for the desired release, and then click **View addons**. Find the *Addons/pmp-charts-x.x.x.zip* file, where `x.x.x` is the version number, and click **Download**. 3. Unzip the downloaded file to a local folder on your Windows or Linux server. The release binary contains the following files: @@ -51,8 +51,9 @@ If you plan to use Maia AppGen and LLM gateway integration, you must configure t ```yaml operator_config: - # REQUIRED for Maia integration: Allow Mendix app Pods to access Kubernetes API + # REQUIRED for Maia integration: Allow Mendix app pods to access Kubernetes API runtimeAutomountServiceAccountToken: true + # Set runtimeAutomountServiceAccountToken: true in the Operator values file and apply the helm charts again. ``` ## Installing the Mendix Operator {#install-operator} @@ -76,7 +77,7 @@ You must configure the storage and database plans in the Operator installation v ### Private Cloud License Manager Credentials -You must configure the Mendix Operator with Private Cloud License Manager (PCLM) credentials that match the credentials you will use when installing `mx-privatecloud-license-manager` with Helmfile. +You must configure the Mendix Operator with Private Cloud License Manager (PCLM) credentials that match the credentials you will use when installing `mx-privatecloud-license-manager` with Helmfile. After installing Operator and PCLM, you must also update the license manager credentials in the Operator Helm chart *value* file, and then apply it again. {{% alert color="info" %}} The `operator_user` and `operator_password` in PCLM bootstrap configuration must exactly match the `licenseManager.username` and `licenseManager.password` in the Operator installation. A mismatch will prevent the Operator from obtaining licenses. From e66b21237479def4600f9789127240c45f858422 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 15:12:26 +0200 Subject: [PATCH 18/31] Update pmp-quickstart-airgapped.md --- .../quickstart/pmp-quickstart-airgapped.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index af9eafb6b29..fb3b1e59b74 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -30,8 +30,13 @@ Either set uses a different tool to migrate. For more information, refer to the For images downloaded from the Private Mendix Platform Download Portal or with the installer file, perform the following steps. -1. Download the release binary from your [Private Mendix Platform Download Portal](/private-mendix-platform/download-portal/). If you do not have access to the download portal, contact your Mendix partner for information. -2. Unzip the release binary to a local folder on your Windows or Linux server. The release binary contains the following files: +1. Log in to your [Private Mendix Platform Download Portal](/private-mendix-platform/download-portal/). If you do not have access to the Download Portal, contact your Mendix partner for information. +2. Download the release binary from by performing the following steps, depending on your Private Mendix Platform version: + + * For version 2.8.1 and newer, go to **Artifacts Management**, select the version from the **Private Mendix Platform Version** dropdown, and select **Chart** as the **Artifact Type**. Select the charts and click **Export Selection**. + * For version 2.8.0 and older, go to **Releases**, click the three-dot menu (**•••**) for the desired release, and then click **View addons**. Find the *Addons/pmp-charts-x.x.x.zip* file, where `x.x.x` is the version number, and click **Download**. + +3. Unzip the release binary to a local folder on your Windows or Linux server. The release binary contains the following files: * In the *Tools* folder: From f9b6a433ef542fc456f97c5e28b8a4b1f6eaceef Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 15:17:44 +0200 Subject: [PATCH 19/31] Update pmp-quickstart-airgapped.md --- .../private-platform/quickstart/pmp-quickstart-airgapped.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index fb3b1e59b74..ad725daa132 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -88,8 +88,6 @@ For images downloaded from the Private Mendix Platform Download Portal or with t privatecloud-license-manager_0.3.0 => [REDACTED] privatecloud-license-manager:0.3.0 - ok ``` - 3. By default, mxpc-cli tools install the latest version of Mendix Operator. You can specify a different Mendix Operator version by using the following command: `./installer operator init -v="version number"` - 4. Migrate the files required to install the Private Cloud components by performing the following steps: 1. Download the *mx-private-cloud.zip* file from your Private Mendix Platform download portal. @@ -112,7 +110,7 @@ For SVIX, the Mendix Operator and its subcomponents (for example, sidecars, stor #### Accessing Mendix Container Images {#aip} -To install Private Mendix in an air-gapped environment, you must provision a list of images in your registry. +To install Private Mendix Platform in an air-gapped environment, you must provision a list of images in your registry. 1. Download an aip tool for your operating system. From 4bde88ba96a38d91c976bada02782a41f504f6ce Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 15:48:00 +0200 Subject: [PATCH 20/31] Update pmp-quickstart-helm.md --- .../quickstart/pmp-quickstart-helm.md | 53 +++++++++++++++---- 1 file changed, 43 insertions(+), 10 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index ecc638f3885..1f93dec5917 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -60,20 +60,53 @@ operator_config: Install the Mendix Operator by doing the following steps: -1. Run one of the following commands, where `-n` indicates the namespace: - - * `./mxpc-cli installer -n=` - To install the Operator in [Standard](/developerportal/deploy/standard-operator/) mode - * `./mxpc-cli installer --global -n=` - To install the Operator in [Global](/developerportal/deploy/global-operator/) mode; you must use a Global namespace for this installation type. +1. Log in to the [Download Portal](https://privateplatform.mendix.com/). +2. Export the image and charts list. - In order to install and configure a cluster with a Global installation of the Operator and the Agent, you must use Operator version 2.21.2 or above. - -2. Click **Base Installation**, and then select the cluster type. + 1. In the [https://privateplatform.mendix.com/](https://privateplatform.mendix.com/), go to **Artifact Management** and select a Private Mendix Platform version. + 2. Filter by **Category** and select the images + 3. Click **Export Selection** to export the list to a file named *export-images-vx.x.x.json*, where `x.x.x` corresponds to a Private Mendix Platform version. + +3. In the Mendix Portal, create a Personal Access Token (PAT) for private images that require a PAT for authentication. + + 1. Sign in to Mendix and go to **User Settings > Developer Settings > Personal Access Token** + 2. Click **New Token**. + 3. Under **OCI registry**, select the **mx:registry:access** as scope. + +4. Fetch the images. - {{< figure src="/attachments/private-platform/pmp-install1.png" class="no-border" >}} + 1. Log in to the OCI registry for Oras by using the following command: `oras login -u pat -p registry.mendix.com`. + 2. Use the `oras pull` command to download the Helmfile from the OCI registry, for example, ` oras pull registry.mendix.com/private-platform/installer-helmfile:0.2.1`. + 3. Unzip the downloaded file by using the following command: `tar -xvf helmfile-config.tar.gz`. + 4. Test it by using the following command: `helmfile --file helmfile.d/helmfile.yaml --state-values-file apply`. + +5. Pull the charts. + + 1. Log in to the OCI registry for Helm by using the following command: `helm registry login -u pat -p ${YOUR_PAT} registry.mendix.com`. + 2. Use the `helm pull` command to download the Helmfile from the OCI registry, for example: + + ```text + helm pull oci://registry.mendix.com/private-cloud/charts/mx-privatecloud-operator-installer --version 0.2.36 + helm install operator mx-privatecloud-operator-installer-0.2.36.tgz -f ./Downloads/20260916T113717Z-pmp-test-oci-generated-values.yaml --namespace pmp-oci-test + ``` -3. Click **Run Installer** to install the Mendix Operator in your cluster. + where `/Downloads/20260916T113717Z-pmp-test-oci-generated-values.yaml` is the yaml file for Operator configuration. You can find this yaml file among the example files in the installer package. -You must configure the storage and database plans in the Operator installation values, not in the Helmfile values for `mxplatform`. +#### Download Package API {#download-api} + +The following Download Portal APIs enable automating package downloads. + +##### Get Private Mendix Platform Release Version List + +```text +GET https://privateplatform.mendix.com/rest/pmpreleaseservice/v1/versions +``` + +##### Get the Manifest of a Specific Private Mendix Platform Version + +```text +GET https://privateplatform.mendix.com/rest/pmpreleaseservice/v1/versions/{version}/manifest +``` ### Private Cloud License Manager Credentials From 2096242f06ea28be7cbff9bf6274f2e6a9688447 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 15:50:05 +0200 Subject: [PATCH 21/31] Update _index.md --- content/en/docs/private-platform/quickstart/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/_index.md b/content/en/docs/private-platform/quickstart/_index.md index 139825f9b4f..3cc9a7c5dd6 100644 --- a/content/en/docs/private-platform/quickstart/_index.md +++ b/content/en/docs/private-platform/quickstart/_index.md @@ -32,7 +32,7 @@ Private Mendix Platform can run with FIPS-compliant encryption across the entire You can perform the installation by using one of the following methods: * [With GUI](/private-mendix-platform/interactive-installation/), where you manually install Private Mendix Platform components -* [With Helmfile](/private-mendix-platform/helmfile-installation/), where you use Helmfile to automatically install Private Mendix Platform components. +* [With Helmfile](/private-mendix-platform/helmfile-installation/), where you use Helmfile to automatically install Private Mendix Platform components. Helm charts are available from Private Mendix Platform 2.8.0. Namespaces created with Private Mendix Platform 2.7.0 and older do not currently support Helm charts. * [Air-Gapped (for Private Mendix Platform 2.8.0)](/private-mendix-platform/airgapped-installation/), where you install Private Mendix Platform 2.8.0 for an air-gapped environment. #### Installation Order From a5ab684a0ef53c5a9acfcd55da23e7d1892ebc30 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 15:50:44 +0200 Subject: [PATCH 22/31] Update pmp-quickstart-helm.md --- .../en/docs/private-platform/quickstart/pmp-quickstart-helm.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index 1f93dec5917..db3e7e165da 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -13,6 +13,8 @@ To automate the declarative installation of Private Mendix Platform, you can now * [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/) * [Install Private Mendix Platform 2.8.0 for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) +Helm charts are available from Private Mendix Platform 2.8.0. Namespaces created with Private Mendix Platform 2.7.0 and older do not currently support Helm charts. + ### Supported Tasks Helmfile installation supports the following tasks: From be4728811e4c56fb2c3f275eca188f34291778cf Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 15:51:14 +0200 Subject: [PATCH 23/31] Update _index.md --- content/en/docs/private-platform/quickstart/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/_index.md b/content/en/docs/private-platform/quickstart/_index.md index 3cc9a7c5dd6..fe3ad07e263 100644 --- a/content/en/docs/private-platform/quickstart/_index.md +++ b/content/en/docs/private-platform/quickstart/_index.md @@ -33,7 +33,7 @@ You can perform the installation by using one of the following methods: * [With GUI](/private-mendix-platform/interactive-installation/), where you manually install Private Mendix Platform components * [With Helmfile](/private-mendix-platform/helmfile-installation/), where you use Helmfile to automatically install Private Mendix Platform components. Helm charts are available from Private Mendix Platform 2.8.0. Namespaces created with Private Mendix Platform 2.7.0 and older do not currently support Helm charts. -* [Air-Gapped (for Private Mendix Platform 2.8.0)](/private-mendix-platform/airgapped-installation/), where you install Private Mendix Platform 2.8.0 for an air-gapped environment. +* [Air-Gapped](/private-mendix-platform/airgapped-installation/), where you install Private Mendix Platform for an air-gapped environment. #### Installation Order From fcbc15efdce5e968a9dd3f24e2e0eb0194797f34 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 15:53:04 +0200 Subject: [PATCH 24/31] Update image registry for license manager and document generation --- .../docs/private-platform/quickstart/pmp-quickstart-helm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index db3e7e165da..312b7f289f8 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -288,7 +288,7 @@ global: mx-privatecloud-license-manager: enable: true image: - registry: "private-cloud.registry.mendix.com" + registry: "registry.mendix.com" name: "privatecloud-license-manager" tag: "{insert component version as indicated in release notes}" @@ -1458,7 +1458,7 @@ mx-private-document-generation: enable: true namespace: "document-generation" image: - registry: "private-cloud.registry.mendix.com" + registry: "registry.mendix.com" name: "mendix/document-generation-service" tag: "1.0.0" ``` From 3fcfa8049097f0b2a32e846ba837ca65f1490ee7 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Fri, 25 Sep 2026 15:56:30 +0200 Subject: [PATCH 25/31] draft --- .../quickstart/pmp-quickstart-helm.md | 137 +++++++++++++++++- 1 file changed, 136 insertions(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index 726cb535e52..2900ac61953 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -13,7 +13,142 @@ To automate the declarative installation of Private Mendix Platform, you can now * [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/) * [Install Private Mendix Platform 2.8.0 for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) -### Supported Tasks +# PMP Helm Installation Overview + +[Helmfile Installation](https://docs.mendix.com/private-mendix-platform/helmfile-installation/). + +## Installation at a Glance + +| Step | What you do | Key reference | +| --- | --- | --- | +| 1 | Retrieve the export manifest json via UI or via Download portal APIs | [Export json](https://docs.mendix.com/private-mendix-platform/download-portal/#pulling-images-and-charts) | +| 2 | Pull the required images, charts, and the `installer-helmfile` artifact into your own registry | [Images](#step-1--pull-images-and-charts) / [Charts](#charts) | +| 3 | Install the Mendix Operator: CRD chart, then the installer chart | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | +| 4 | Install the PMP charts via helmfile using your own values | [Installation Commands](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-commands) | +| 5 | Feed the PCLM hostname/credentials back into the operator values and re-apply | [Private Cloud License Manager Credentials](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#private-cloud-license-manager-credentials) | + +--- + +## Step 1 — Retrieve the list of image/charts version via GUI/API + +For pulling the versions, it can be done via Download portal UI as well as Download portal API. Check [Export Manifest Json](https://docs.mendix.com/private-mendix-platform/download-portal/#pulling-images-and-charts). + +--- + +## Step 2 — Pull Images and Charts + +Pull everything marked **Required** plus whichever optional components your deployment needs. + +For pulling the images, charts and helmfile installer(custom artifact) check [Download portal documentation](https://docs.mendix.com/private-mendix-platform/download-portal/#pulling-images-and-charts). + +### Images + +| Image | Description | Required | Documentation | +| --- | --- | --- | --- | +| `privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Required | [mx-privatecloud-license-manager](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud-license-manager) | +| `mendix-operator` | Mendix Operator | Required | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | +| `image-builder` | Builds app container images | Required | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | +| `mendix-private-platform` | Mendix Platform application runtime | Required | [mxplatform](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform) | +| `mx-m2ee-sidecar` | M2EE sidecar for app pods | Required | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | +| `mxpc-test` | Private Cloud connectivity/validation tests | Required | [mxplatform](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform) | +| `pmp-pipeline-tools` | PMP deployment pipeline tooling | Required | [mxplatform](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform) | +| `app-building-blocks` | App runtime and JRE base layers — pull the versions matching your app deployment requirements | Per deployment | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | +| `storage-provisioner` | Provisions app databases and file storage — pull the variants matching your database and storage requirements | Per deployment | [StoragePlan and Database Plan Configuration](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#storageplan-and-database-plan-configuration) | +| `kubernetes-agent` | Cluster agent — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | +| `interactor` | Interactor service — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | +| `interactor-bridge` | Interactor bridge — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | +| `privatecloud-authenticator` | Authenticator service — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | +| `privatecloud-collector` | Collector service — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | +| `mxplatform-kube-agent` | Build agent for mxplatform | Optional | [mxplatform-kube-agent](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform-kube-agent) | +| `maia-appgen` | Maia AI AppGen service — required only if Maia features are used | Optional | [maia-appgen](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#maia-appgen) | +| `maia-llm-gateway` | Maia LLM Gateway service — required only if Maia features are used | Optional | [maia-llm-gateway](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#maia-llm-gateway) | +| `document-generation-service` | PDF document generation service | Optional | [mx-private-document-generation](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-private-document-generation) | +| `svix-server` | Webhook delivery service (upstream image `svix/svix-server`) | Optional | [svix-server](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#svix-server) | + +Registry paths: `registry.mendix.com/private-cloud/` (license-manager, operator, image-builder, m2ee-sidecar, storage-provisioner, app-building-blocks, kubernetes-agent, interactor, interactor-bridge, authenticator, collector), `registry.mendix.com/private-platform/` (mxpc-test, pmp-pipeline-tools, mxplatform-kube-agent, mendix-private-platform), `registry.mendix.com/maia/` (maia-appgen, maia-llm-gateway), `registry.mendix.com/docgen/` (document-generation-service), Docker Hub `svix/` (svix-server). + + +### Charts + +| Component | Description | Namespace | Required | ServiceAccount | Documentation | +| --- | --- | --- | --- | --- | --- | +| `mx-privatecloud-operator-installer` | Mendix Operator installer | Independent | Required | created by chart | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | +| `mx-privatecloud-operator-crd` | Mendix Operator CRDs | Cluster-scoped | Required | n/a | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | +| `mx-privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Shared | Required | `mendix-pclm` (created by chart) | [mx-privatecloud-license-manager](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud-license-manager) | +| `installer-config` | Shared installer configuration | Shared | Required | n/a | [Global Configuration](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#global-configuration) | +| `mxplatform` | Mendix Platform application (MendixApp CR) | Shared | Required | `mxplatform` (created by chart or operator) | [mxplatform](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform) | +| `mx-privatecloud` | Private Cloud services (authenticator, collector, interactor, bridge) — used in Interactor-Agent mode | Shared | Optional | `mx-privatecloud` (created by chart) | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | +| `mxplatform-kube-agent` | Build agent for mxplatform | Independent | Optional | `mxplatform-kube-agent` (created by chart) | [mxplatform-kube-agent](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform-kube-agent) | +| `maia-appgen` | Maia AI AppGen service | Shared | Optional | `maia-appgen` (created by chart) | [maia-appgen](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#maia-appgen) | +| `maia-llm-gateway` | Maia LLM Gateway service for routing LLM requests | Shared | Optional | `maia-llm-gateway` (created by chart) | [maia-llm-gateway](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#maia-llm-gateway) | +| `mx-private-document-generation` | PDF document generation service | Independent | Optional | `mx-private-document-generation` (created by chart) | [mx-private-document-generation](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-private-document-generation) | +| `svix-server` | Webhook delivery service | Shared | Optional | `svix` (created by chart) | [svix-server](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#svix-server) | + +Pull with: + +```bash +helm pull oci://registry.mendix.com/private-cloud/charts/ --version +``` + +Registry paths: `private-cloud/charts/` (operator-installer, operator-crd, license-manager, mx-privatecloud), `private-platform/charts/` (mxplatform, mxplatform-kube-agent, installer-config, svix-server), `maia/charts/` (maia-appgen, maia-llm-gateway), `docgen/charts/` (mx-private-document-generation). + +### Custom Artifact + +| Artifact | Description | Required | +| --- | --- | --- | --- | +| `installer-helmfile` | Tarball containing the helmfile and `helmfile-config` sample values used in Step 3 | Required | + +Address: `registry.mendix.com/private-platform/installer-helmfile:` + +--- + + +## Step 3 — Install Operator Charts + +1. Apply below charts - [Documentation link] +`mx-privatecloud-operator-crd` +`mx-privatecloud-operator-installer` + +Make sure that the operator-crds are installed first and then operator-installer. + +2. Apply the operator CRDs: + + ```bash + kubectl apply -f mx-privatecloud-operator-crd/crds/ -n + ``` + +3. Apply the operator chart: + + ```bash + helm upgrade --install --create-namespace -n \ + -f operator-generated-values.yaml mx-privatecloud-operator-installer + ``` + +> `operator-generated-values.yaml` must be updated for the customer's configuration. Start from `values.yaml` inside the `mx-privatecloud-operator-installer` chart. Keep this file — Step 4 updates it again. + +Make sure that the new registry is updated in privateCloudRelease -> repo in the above values.yaml file + +--- + +## Step 4 — Install PMP Charts using Helm + +1. Pull the `installer-helmfile` artifact. +2. Unzip the tarball. +3. Navigate to `helmfile-config`. +4. Refer the samples file and create the PMP values file based on your requirements. +5. Apply the charts as described in [Installation Commands](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-commands). + +--- + +## Step 5 — Wire PCLM Back into the Operator + +1. Retrieve the PCLM hostname, username, and password, and set them in the ` Date: Fri, 25 Sep 2026 17:39:39 +0200 Subject: [PATCH 26/31] sme feedback --- .../private-platform/quickstart/_index.md | 3 +- .../quickstart/pmp-quickstart-airgapped.md | 26 +- .../quickstart/pmp-quickstart-artifacts.md | 1035 +++++++++++++ .../quickstart/pmp-quickstart-helm.md | 1284 ++--------------- .../quickstart/pmp-quickstart.md | 3 +- 5 files changed, 1143 insertions(+), 1208 deletions(-) create mode 100644 content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md diff --git a/content/en/docs/private-platform/quickstart/_index.md b/content/en/docs/private-platform/quickstart/_index.md index fe3ad07e263..c1b5653072e 100644 --- a/content/en/docs/private-platform/quickstart/_index.md +++ b/content/en/docs/private-platform/quickstart/_index.md @@ -33,7 +33,8 @@ You can perform the installation by using one of the following methods: * [With GUI](/private-mendix-platform/interactive-installation/), where you manually install Private Mendix Platform components * [With Helmfile](/private-mendix-platform/helmfile-installation/), where you use Helmfile to automatically install Private Mendix Platform components. Helm charts are available from Private Mendix Platform 2.8.0. Namespaces created with Private Mendix Platform 2.7.0 and older do not currently support Helm charts. -* [Air-Gapped](/private-mendix-platform/airgapped-installation/), where you install Private Mendix Platform for an air-gapped environment. + +Both types of installation can be performed in an [air-gapped environment](/private-mendix-platform/airgapped-installation/). #### Installation Order diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index ad725daa132..66db210ea4a 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -3,17 +3,17 @@ title: "Install Private Mendix Platform 2.8.0 for Air-Gapped Environments" linktitle: "Air-Gapped Installation" url: /private-mendix-platform/air-gapped-installation/ description: "Documents the installation process for Private Mendix Platform for air-gapped environments." -weight: 31 +weight: 32 --- ## Introduction -This document describes how you can perform a Private Mendix Platform in an air-gapped environment. For other installation types, see the following topics: +This document describes how you can migrate artifcates (images and charts), in order to perform an air-gapped installation using one of the following methods: * [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/) * [Install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/) -## Image Migration for Private Mendix Platform 2.8.0 +## Image Migration for Private Mendix Platform The 2.8.0 release of Private Mendix Platform requires some manual steps to migrate images from various sources to the customer's air-gapped container registry: @@ -102,11 +102,11 @@ For images downloaded from the Private Mendix Platform Download Portal or with t 3. Copy the *maia-appgen-pmp* directory to the *images* sub-directory of the installer by running the following command: `cp -r maia-appgen-pmp/images/* /pmp-binary-linux/images` 4. Upload the Maia directory to your private registry by using the `installer init migrate` command. -6. After the migration is completed, [install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/). +6. After the migration is completed, [install Private Mendix Platform in interactive GUI mode](/private-mendix-platform/interactive-installation/). ### Images from the Public Mendix Registry -For SVIX, the Mendix Operator and its subcomponents (for example, sidecars, storage provisioners, image builder), as well as Mendix runtime base images and app building blocks for supported Mendix versions, you must use an AIP tool to download and migrate to a local registry. +For SVIX, the Mendix Operator and its subcomponents (for example, sidecars, storage provisioners, image builder), as well as Mendix runtime base images and app building blocks for supported Mendix versions, you have the option to use an AIP tool to download and migrate to a local registry. You can use the `oras cp` command instead, if your registry allows it. #### Accessing Mendix Container Images {#aip} @@ -168,3 +168,19 @@ To install Private Mendix Platform in an air-gapped environment, you must provis ``` 5. After the migration is completed, [install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/). + +### Download Package API {#download-api} + +The following Download Portal APIs enable automating package downloads through manifest files. + +#### Get Private Mendix Platform Release Version List + +```text +GET https://privateplatform.mendix.com/rest/pmpreleaseservice/v1/versions +``` + +#### Get the Manifest of a Specific Private Mendix Platform Version + +```text +GET https://privateplatform.mendix.com/rest/pmpreleaseservice/v1/versions/{version}/manifest +``` \ No newline at end of file diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md new file mode 100644 index 00000000000..3cf04317ebe --- /dev/null +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md @@ -0,0 +1,1035 @@ +--- +title: "Installation Reference" +url: /private-mendix-platform/installation-reference/ +description: "Documents the required and optional components used in Private Mendix Platform installation." +weight: 18 +--- + +## Introduction + +The following reference document presents a list of required and optional components of Private Mendix Platform. + +## Images + +| Image | Description | Required | +| --- | --- | --- +| `privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Required | +| `mendix-operator` | Mendix Operator | Required | +| `image-builder` | Builds app container images | Required | +| `mendix-private-platform` | Mendix Platform application runtime | Required | +| `mx-m2ee-sidecar` | M2EE sidecar for app pods | Required | +| `mxpc-test` | Private Cloud connectivity/validation tests | Required | +| `pmp-pipeline-tools` | PMP deployment pipeline tooling | Required | +| `app-building-blocks` | App runtime and JRE base layers - pull the versions matching your app deployment requirements | Per deployment | +| `storage-provisioner` | Provisions app databases and file storage - pull the variants matching your database and storage requirements | Per deployment | +| `kubernetes-agent` | Cluster agent - used in Interactor-Agent mode | Optional | +| `interactor` | Interactor service - used in Interactor-Agent mode | Optional | +| `interactor-bridge` | Interactor bridge - used in Interactor-Agent mode | Optional | +| `privatecloud-authenticator` | Authenticator service - used in Interactor-Agent mode | Optional | +| `privatecloud-collector` | Collector service - used in Interactor-Agent mode | Optional | +| `mxplatform-kube-agent` | Build agent for mxplatform | Optional | +| `maia-appgen` | Maia AI AppGen service - required only if Maia features are used | Optional | +| `maia-llm-gateway` | Maia LLM Gateway service - required only if Maia features are used | Optional | +| `document-generation-service` | PDF document generation service | Optional | +| `svix-server` | Webhook delivery service (upstream image `svix/svix-server`) | Optional | + +### Registry Paths + +* `registry.mendix.com/private-cloud/` (license-manager, operator, image-builder, m2ee-sidecar, storage-provisioner, app-building-blocks, kubernetes-agent, interactor, interactor-bridge, authenticator, collector) +* `registry.mendix.com/private-platform/` (mxpc-test, pmp-pipeline-tools, mxplatform-kube-agent, mendix-private-platform) +* `registry.mendix.com/maia/` (maia-appgen, maia-llm-gateway) +* `registry.mendix.com/docgen/` (document-generation-service), Docker Hub +* `svix/` (svix-server). + +## Charts + +| Component | Description | Namespace | Required | ServiceAccount | +| --- | --- | --- | --- | --- | +| `mx-privatecloud-operator-installer` | Mendix Operator installer | Independent | Required | created by chart | +| `mx-privatecloud-operator-crd` | Mendix Operator CRDs | Cluster-scoped | Required | n/a | +| `mx-privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Shared | Required | `mendix-pclm` (created by chart) | +| `installer-config` | Shared installer configuration | Shared | Required | n/a | +| `mxplatform` | Mendix Platform application (MendixApp CR) | Shared | Required | `mxplatform` (created by chart or operator) | +| `mx-privatecloud` | Private Cloud services (authenticator, collector, interactor, bridge) - used in Interactor-Agent mode | Shared | Optional | `mx-privatecloud` (created by chart) | +| `mxplatform-kube-agent` | Build agent for mxplatform | Independent | Optional | `mxplatform-kube-agent` (created by chart) | +| `maia-appgen` | Maia AI AppGen service | Shared | Optional | `maia-appgen` (created by chart) | +| `maia-llm-gateway` | Maia LLM Gateway service for routing LLM requests | Shared | Optional | `maia-llm-gateway` (created by chart) | +| `mx-private-document-generation` | PDF document generation service | Independent | Optional | `mx-private-document-generation` (created by chart) | +| `svix-server` | Webhook delivery service | Shared | Optional | `svix` (created by chart) | + +### Pull Command + +```bash +helm pull oci://registry.mendix.com/private-cloud/charts/ --version +``` + +### Registry Paths + +* `private-cloud/charts/` (operator-installer, operator-crd, license-manager, mx-privatecloud) +* `private-platform/charts/` (mxplatform, mxplatform-kube-agent, installer-config, svix-server) +* `maia/charts/` (maia-appgen, maia-llm-gateway) +* `docgen/charts/` (mx-private-document-generation) + +## Custom Artifacts + +| Artifact | Description | Required | +| --- | --- | --- | --- | +| `installer-helmfile` | Tarball containing the helmfile and `helmfile-config` sample values | Required | + +### Address + +* `registry.mendix.com/private-platform/installer-helmfile:` + +## Component Configurations + +The following configurations are component-specific. + +### Mx-privatecloud-license-manager + +This is the Private Cloud License Manager (PCLM) component. It is required for Private Mendix Platform deployment. It manages licenses for Mendix applications running in Private Cloud. + +#### Basic Configuration + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `enable` | boolean | Yes | Enable PCLM deployment | +| `image.registry` | string | No | Container registry URL (uses the global value if not specified) | +| `image.name` | string | Yes | The image name | +| `image.tag` | string | Yes | Image tag (version) | +| `jwt_secret` | string | No | The JWT secret for license token signing (auto-generated if empty) | + +#### Database Configuration + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `db.type` | string | Yes | Database type: `postgres` or `sqlserver` | +| `db.strict_tls` | Boolean | No (default: `false`) | Enable strict TLS for database connection | +| `db.ssl_root_cert` | string | Conditional | The SSL root certificate in PEM format; required when `strict_tls` is set to `true` | + +##### PostgreSQL Configuration + +The following settings are used when `db.type` is set to `postgres`. + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `db.postgres.host` | string | Yes | The PostgreSQL host | +| `db.postgres.port` | number | No (default: `5432`) | The PostgreSQL port | +| `db.postgres.name` | string | Yes | The PostgreSQL database name | +| `db.postgres.user` | string | Yes | The PostgreSQL username | +| `db.postgres.password` | string | Conditional | The PostgreSQL password; required only when not using Azure Workload Identity (when `azureWorkloadIdentity.enable` is set to `false`) or AWS IRSA (when `awsIRSA.enable` is set to `false`) for IAM-based database authentication | + +##### SQL Server Configuration + +The following settings are used when `db.type` is set to `sqlserver`. + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `db.sqlserver.host` | string | Yes | The SQL Server host | +| `db.sqlserver.port` | number | No (default: `1433`) | The SQL Server port | +| `db.sqlserver.name` | string | Yes | The SQL Server database name | +| `db.sqlserver.user` | string | Yes | The SQL Server username | +| `db.sqlserver.password` | string | Conditional | The SQL Server password; required only when not using Azure Workload Identity (when `azureWorkloadIdentity.enable` is set to `false`) or AWS IRSA (when `awsIRSA.enable` is set to `false`) for IAM-based database authentication | + +##### Bootstrap User Configuration + +{{% alert color="info" %}} +Bootstrap user credentials must match the configuration in both Mendix Operator and `mxplatform`. + +Operator user credentials (`operator_user` and `operator_password`) must exactly match the `licenseManager.username` and `licenseManager.password` in your Mendix Operator installation values. A mismatch will prevent the Operator from obtaining licenses. + +Admin user credentials (`admin_user` and `admin_password`) must exactly match the `pclm.username` and `pclm.password` in your `mxplatform` configuration. A mismatch will prevent `mxplatform` from obtaining licenses. +{{% /alert %}} + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `bootstrap_users.admin_user` | string | Yes | The Administrator user name | +| `bootstrap_users.admin_password` | string | Yes | The Administrator password | +| `bootstrap_users.create_operator_user` | Boolean | Yes | Set to true to create the Operator user | +| `bootstrap_users.operator_user` | string | Yes | The Operator username; must match the Mendix Operator configuration | +| `bootstrap_users.operator_password` | string | Yes | The Operator password; must match the Mendix Operator configuration | + +##### Ingress Configuration + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `ingress.enabled` | Boolean | No (default: `false`) | Enable ingress for external access | +| `ingress.host` | string | Conditional | The hostname for the PCLM web UI | +| `ingress.ingressClassName` | string | Conditional | The Ingress class name (for example, `nginx`) | +| `ingress.annotations` | object | No | Additional ingress annotations | +| `ingress.labels` | object | No | Additional ingress labels | + +##### TLS Configuration for Ingress + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `ingress.enableTLS` | Boolean | No | `false` | Set to `true` to enable TLS termination at ingress. | +| `ingress.tlsSecretName` | string | Conditional | "" | Kubernetes Secret name containing TLS certificate. Required if `ingress.enableTLS: true`. | + +##### Workload Identity Configuration + +For passwordless database authentication using cloud-native identity, configure the following settings. + +###### Azure Workload Identity + +| Field | Type | Description | +| --- | --- | --- | +| `azureWorkloadIdentity.enable` | Boolean | Enable Azure Workload Identity | +| `azureWorkloadIdentity.clientID` | string | Azure Managed Identity Client ID | + +###### AWS IRSA (IAM Roles for Service Accounts) + +| Field | Type | Description | +| --- | --- | --- | +| `awsIRSA.enable` | Boolean | Enable AWS IRSA | +| `awsIRSA.roleArn` | string | AWS IAM Role ARN | + +{{% alert color="info" %}} +Component-level workload identity configuration overrides global settings. +{{% /alert %}} + +##### Example Configurations + +{{% alert color="warning" %}} +The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. +{{% /alert %}} + +The following is an example of basic setup with static credentials: + +```text +mx-privatecloud-license-manager: + enable: true + image: + name: "privatecloud-license-manager" + tag: "0.11.0" + # JWT secret (leave empty to auto-generate) + jwt_secret: "" + # Database configuration + db: + type: "postgres" + postgres: + host: "postgres.example.com" + port: 5432 + name: "pclm" + user: "pclm_user" + password: "StrongPassword123" + strict_tls: false + # Bootstrap users - MUST match operator installation + bootstrap_users: + admin_user: "administrator" + admin_password: "AdminPassword123" + create_operator_user: true + operator_user: "operatoruser" # Must match operator licenseManager.username + operator_password: "operatorpass" # Must match operator licenseManager.password + ingress: + enabled: false +``` + +The following is an example of an SSL/TLS database connection: + +```text +mx-privatecloud-license-manager: + enable: true + image: + name: "privatecloud-license-manager" + tag: "0.11.0" + jwt_secret: "" + db: + type: "postgres" + postgres: + host: "auto-infra-azure-postgre-db.postgres.database.azure.com" + port: 5432 + name: "pclm" + user: "postgres" + password: "StrongPassword123" + strict_tls: true # Enable strict TLS validation + ssl_root_cert: | + -----BEGIN CERTIFICATE----- + MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh + ... (Azure PostgreSQL DigiCert Global Root G2 certificate) + -----END CERTIFICATE----- + bootstrap_users: + admin_user: "administrator" + admin_password: "AdminPassword123" + create_operator_user: true + operator_user: "operatoruser" + operator_password: "operatorpass" + ingress: + enabled: false +``` + +The following example uses Azure Workload Identity with passwordless database authentication: + +```text +mx-privatecloud-license-manager: + enable: true + image: + name: "privatecloud-license-manager" + tag: "0.11.0" + # Enable Azure Workload Identity for passwordless database access + azureWorkloadIdentity: + enable: true + clientID: "cf85d643-0de1-477a-9d1b-647882fd44e0" # Managed Identity Client ID + jwt_secret: "" + db: + type: "postgres" + postgres: + host: "auto-infra-azure-postgre-db.postgres.database.azure.com" + port: 5432 + name: "pclm" + user: "pclm-database-identity" # Azure AD database user + password: "" # Empty - authentication via Managed Identity + strict_tls: true + ssl_root_cert: | + -----BEGIN CERTIFICATE----- + ... (Azure PostgreSQL certificate) + -----END CERTIFICATE----- + bootstrap_users: + admin_user: "administrator" + admin_password: "AdminPassword123" + create_operator_user: true + operator_user: "operatoruser" + operator_password: "operatorpass" + ingress: + enabled: false +``` + +#### Service URL + +The PCLM service is accessible within the cluster at the following: + +* Service name - `mx-privatecloud-license-manager` +* Port - 80 (HTTP) +* Full URL - `http://mx-privatecloud-license-manager` (when in same namespace) + +This URL is used by the following: + +* Mendix Operator (for obtaining licenses) +* `mxplatform` (configured through the `pclm.serviceUrl` field) + +### Mx-privatecloud + +The following configurations apply to Mendix Private Cloud core services (Authenticator, Collector, Interactor, Interactor-bridge). + +#### Quick Deployment Scenarios + +Refer to the following list for a quick summary of the supported deployment scenarios and the required configuration. + +* Basic setup + + Set the database credentials for authenticator and collector, and then configure NATS. + +* Database with SSL/TLS + + Set `dbssl` to `true` and provide a `dbca` certificate. + +* External agents + + Enable `interactor_bridge.ingress` with a host name. + +* AWS RDS IAM Authentication (Passwordless) + + Enable `awsIRSA` with `roleArn` and leave the database passwords empty. + +* Azure Managed Identity Database Auth (Passwordless) + + Enable `azureWorkloadIdentity` and leave the database passwords empty. + +* Azure Key Vault + + Enable `azureWorkloadIdentity + secretProviderclass` with `provider` set to `azure`. + +* AWS Secrets Manager + + Enable `awsIRSA + secretProviderclass` with `provider` set to `aws`. + +* HashiCorp Vault + + Enable `secretProviderclass` with `provider` set to `vault`. + +#### Basic Configuration + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `enable` | Boolean | Yes | Enable `mx-privatecloud` deployment | +| `nats.server_addr` | string | Yes | The NATS server address, for example, `nats://nats.nats.svc:4222` | + +This chart deploys 4 components (Authenticator, Collector, Interactor, and Interactor-Bridge). + +#### NATS Setup + +This chart does not install NATS. You must deploy it separately by running the following commands: + +```text +helm repo add nats https://nats-io.github.io/k8s/helm/charts/ +helm install nats nats/nats --namespace nats --create-namespace +``` + +### Database Configuration + +The following configurations apply to databases. + +#### Authenticator Database and Collector Database + +The Authenticator and Collector database have the same structure. + +| Field | Required | Description | +| --- | --- | --- | +| `authenticator.database.host` | Conditional | Database host name; not required when `secretProviderclass.enable` is set to `true` | +| `authenticator.database.port` | No (default: `5432`) | Database port | +| `authenticator.database.name` | Conditional | Database name; not required when `secretProviderclass.enable` is set to `true` | +| `authenticator.database.user` | Conditional | Database user name; not required when `secretProviderclass.enable` is set to `true` | +| `authenticator.database.password` | Conditional | Database password; not required when using AWS IRSA (`awsIRSA.enable: true`) or Azure Workload Identity (`azureWorkloadIdentity.enable: true`) for IAM-based database authentication | +| `authenticator.database.dbssl` | No | Enables SSL/TLS | +| `authenticator.database.dbca` | Conditional | CA certificate; required if `dbssl` is set to `true` | + +#### RSA Keys and Internal Credentials + +| Field | Default | Recommendation | +| --- | --- | --- | +| `rsa.privateKey` | Has a default value | It is recommended to override this value in production | +| `rsa.publicKey` | Has a default value | It is recommended to override this value in production | +| `credentials.authenticator_admin_pass` | Auto-generated | It is recommended to set this value explicitly | +| `credentials.authenticator_standard_pass` | Auto-generated | It is recommended to set this value explicitly | +| `credentials.collector_api_pass` | Auto-generated | It is recommended to set this value explicitly | +| `credentials.interactor_api_pass` | Auto-generated | It is recommended to set this value explicitly | + +##### Generate RSA Keys + +```text +openssl genrsa -out private.pem 2048 +openssl rsa -in private.pem -pubout -out public.pem +``` + +#### Example Configurations + +{{% alert color="warning" %}} +The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. +{{% /alert %}} + +##### Minimal Setup + +```text +mx-privatecloud: + enable: true + nats: + server_addr: "nats://nats.nats.svc:4222" + authenticator: + database: + host: "postgres-auth.example.com" + name: "authenticator" + user: "auth_user" + password: "StrongPassword123" + collector: + database: + host: "postgres-collector.example.com" + name: "collector" + user: "collector_user" + password: "StrongPassword456" +``` + +##### With AWS IAM Database Authentication (Passwordless) + +```text +mx-privatecloud: + enable: true + nats: + server_addr: "nats://nats.nats.svc:4222" + # Enable AWS IRSA for IAM-based database authentication + awsIRSA: + enable: true + roleArn: "arn:aws:iam::123456789012:role/mx-privatecloud-rds-iam-role" + # Database passwords not required when using IAM authentication + authenticator: + database: + host: "postgres-auth.region.rds.amazonaws.com" + name: "authenticator" + user: "iam_auth_user" + password: "" # Empty - IAM authentication used + collector: + database: + host: "postgres-collector.region.rds.amazonaws.com" + name: "collector" + user: "iam_collector_user" + password: "" # Empty - IAM authe +``` + +##### With Azure Managed Identity Database Authentication (Passwordless) + +```text +mx-privatecloud: + enable: true + nats: + server_addr: "nats://nats.nats.svc:4222" + # Enable Azure Workload Identity for Managed Identity database authentication + azureWorkloadIdentity: + enable: true + clientID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" + # Database passwords not required when using Managed Identity + authenticator: + database: + host: "postgres-auth.postgres.database.azure.com" + name: "authenticator" + user: "managed_identity_user" + password: "" # Empty - Managed Identity authentication used + collector: + database: + host: "postgres-collector.postgres.database.azure.com" + name: "collector" + user: "managed_identity_user" + password: "" # Empty - Managed Identity authentication used +``` + +##### With Database SSL + +```text +mx-privatecloud: + enable: true + nats: + server_addr: "nats://nats.nats.svc:4222" + authenticator: + database: + host: "postgres-auth.example.com" + name: "authenticator" + user: "auth_user" + password: "StrongPassword123" + dbssl: true + dbca: | + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + collector: + database: + host: "postgres-collector.example.com" + name: "collector" + user: "collector_user" + password: "StrongPassword456" + dbssl: true + dbca: | + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- +``` + +##### With Azure Key Vault + +```text +mx-privatecloud: + enable: true + nats: + server_addr: "nats://nats.default:4222" + # Azure Workload Identity (REQUIRED for Azure Key Vault) + azureWorkloadIdentity: + enable: true + clientID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" + tenantID: "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" + secretProviderclass: + enable: true + provider: "azure" + azureparameters: + keyvaultName: "my-mx-keyvault" + # clientID and tenantID inherited from azureWorkloadIdentity + # Database fields ignored when using Secret Provider + authenticator: + database: {host: "", name: "", user: "", password: ""} + collector: + database: {host: "", name: "", user: "", password: ""} +``` + +##### Required Azure Key Vault Secrets + +When using Azure Key Vault (with `provider` set to `azure`), you must create the following secrets in your Key Vault: + +| Secret Name | Description | Example Value | +| --- | --- | --- | +| `authenticator-db-name` | Authenticator database name | `authenticator` | +| `authenticator-db-host` | Authenticator database host | `postgres.example.com` | +| `authenticator-db-port` | Authenticator database port | `5432` | +| `authenticator-db-user` | Authenticator database username | `auth_user` | +| `authenticator-db-pass` | Authenticator database password | `StrongPassword123` | +| `collector-db-name` | Collector database name | `collector` | +| `collector-db-host` | Collector database host | `postgres.example.com` | +| `collector-db-port` | Collector database port | `5432` | +| `collector-db-user` | Collector database username | `collector_user` | +| `collector-db-pass` | Collector database password | `StrongPassword456` | + +##### With Ingress for External Agents + +```text +mx-privatecloud: + enable: true + nats: + server_addr: "nats://nats.default:4222" + # ... database config ... + interactor_bridge: + ingress: + enable: true + className: "nginx" + hostName: "bridge.mendix.example.com" + certSecret: "bridge-tls-cert" +# Agent connection URL: wss://bridge.mendix.example.com/agent +``` + +### Maia-appgen + +This component provides the Maia AI AppGen service for AI-powered application generation. + +#### Basic Configuration + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `enable` | Boolean | Yes | Enables Maia AppGen deployment | +| `env` | array | Yes | Must include the `MXASSIST_COPILOT_MXID3_URL` | + +#### Environment Variables + +##### Required + +```text +env: + - name: MXASSIST_COPILOT_MXID3_URL + value: "https://pmp.example.com/oidc/" # REQUIRED - OIDC endpoint +``` + +##### ServiceAccount + +| Field | Type | Must Stay | +| --- | --- | --- | +| `serviceAccount.create` | `true` | Yes - required for RBAC | +| `serviceAccount.name` | `maia-appgen` | Used for IRSA/Workload Identity | +| `serviceAccount.automount` | `true` | Yes - needs K8s API access | + +#### Example Configurations + +{{% alert color="warning" %}} +The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. +{{% /alert %}} + +##### Basic + +```text +maia-appgen: + enable: true + env: + - name: MXASSIST_COPILOT_MXID3_URL + value: "https://pmp.example.com/oidc/" +``` + +##### With Azure Workload Identity + +```text +maia-appgen: + enable: true + env: + - name: MXASSIST_COPILOT_MXID3_URL + value: "https://pmp.example.com/oidc/" + azureWorkloadIdentity: + enable: true + clientID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" +``` + +##### With Ingress + +```text +maia-appgen: + enable: true + env: + - name: MXASSIST_COPILOT_MXID3_URL + value: "https://pmp.example.com/oidc/" + ingress: + enable: true + className: "nginx" + hostName: "maia.example.com" + certSecret: "maia-tls-secret" +``` + +### Maia-llm-gateway + +The Maia LLM Gateway service is used for routing LLM requests to various AI model providers. + +#### Basic Configuration + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `enable` | Boolean | Yes | Enables Maia LLM Gateway deployment | +| `env` | array | Yes | Must include `MXASSIST_COPILOT_MXID3_URL`; optional for `MXASSIST_COPILOT_MXID3_SSL_CA_CERT` | + +#### Environment Variables + +The chart uses a two-tier environment variable system: + +* `defaultEnv` - Chart-managed defaults set in `values.yaml`. Do not modify them. +* `env` - User-defined variables (your overrides and required settings). + +##### Required + +```text +env: + - name: MXASSIST_COPILOT_MXID3_URL + value: "https://pmp.example.com/oidc/" # REQUIRED - OIDC endpoint +``` + +##### Optional + +```text +env: + - name: MXASSIST_COPILOT_MXID3_SSL_CA_CERT + value: | + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- # Optional - Custom CA certificate for MxID3 +``` + +#### ServiceAccount + +| Field | Type | Must Stay | +| --- | --- | --- | +| `serviceAccount.create` | `true` | Yes - required for RBAC | +| `serviceAccount.name` | `maia-llm-gateway` | Used for IRSA/Workload Identity | +| `serviceAccount.automount` | `true` | Yes - needs K8s API access | + +#### Example Configurations + +{{% alert color="warning" %}} +The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. +{{% /alert %}} + +##### Basic + +```text +maia-llm-gateway: + enable: true + env: + - name: MXASSIST_COPILOT_MXID3_URL + value: "https://pmp.example.com/oidc/" +``` + +##### With Custom CA Certificate + +```text +maia-llm-gateway: + enable: true + env: + - name: MXASSIST_COPILOT_MXID3_URL + value: "https://pmp.example.com/oidc/" + - name: MXASSIST_COPILOT_MXID3_SSL_CA_CERT + value: | + -----BEGIN CERTIFICATE----- + MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG... + -----END CERTIFICATE----- +``` + +##### With Ingress + +```text +maia-llm-gateway: + enable: true + env: + - name: MXASSIST_COPILOT_MXID3_URL + value: "https://pmp.example.com/oidc/" + ingress: + enable: true + className: "nginx" + hostName: "llm-gateway.example.com" + certSecret: "llm-gateway-tls-secret" +``` + +#### Integration with Mxplatform + +When `maia-llm-gateway` is enabled, `mxplatform` automatically configures the following microflow constants. You do not need to configure anything yourself - the integration happens automatically when you enable the component. + +| Constant | Value | Description | +| --- | --- | --- | +| `Maia.Enable` | `true | Set when `maia-llm-gateway` or `maia-appgen` is enabled | +| `Maia.Config_Secret_Name_LLM_GW` | Secret name | Auto-discovered through label lookup | +| `Maia.Config_Secret_Namespace_LLM_GW` | Namespace | Same as thw `mxplatform` namespace | +| `Maia.LLM_GW_URL` | `https://` | Set when Ingress is enabled with host name | + +### Svix-server + +The Svix webhooks server is used for event delivery and webhook management. + +#### Quick Deployment Scenarios + +Refer to the following list for a quick summary of the supported deployment scenarios and the required configuration. + +* Basic production + + Set `postgres`, and optionally also `redis` and `useRedis` to `true`. + +* Azure Key Vault + + Enable `azureWorkloadIdentity` and `secretProviderclass` with `provider` set to `azure`. + +* AWS Secrets Manager + + Enable `awsIRSA` and `secretProviderclass` with `provider` set to `aws`. + +* HashiCorp Vault + + Enable `secretProviderclass` with `provider` set to `vault`. + +#### Basic Configuration + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `enable` | Boolean | Yes | Enables svix-server deployment | +| `postgres` | string | Conditional | The PostgreSQL DSN. Required when `secretProviderclass.enable` is set to `false` | +| `secretKey` | string | Recommended | The JWT secret key; auto-generated if empty | + +#### Database and Cache + +```text +svix-server: + enable: true + postgres: "postgresql://user:pass@host:5432/svix" + redis: "redis://host:6379/0" # Optional + useRedis: false # Set true to enable Redis + secretKey: "" # Leave empty for auto-generation +``` + +#### Secret Key Management + +The JWT secret is managed through `svix-configmap` in the following way: + +* If the user provides a `secretKey`, the provided value is used. +* If the `secretKey` is empty and the ConfigMap exists, the existing key is preserved (`upgrade-safe`). +* If the `secretKey` is empty and the ConfigMap does not exist, a 64-character key is auto-generated. + +The JWT secret is automatically injected into the `SvixClient.JwtSecret` constant of the `mxplatform`. + +#### Example Configurations + +{{% alert color="warning" %}} +The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. +{{% /alert %}} + +##### Basic + +```text +svix-server: + enable: true + postgres: "postgresql://svix:pass@host:5432/svix" + secretKey: "" # Auto-generated +``` + +##### With Redis + +```text +svix-server: + enable: true + postgres: "postgresql://svix:pass@host:5432/svix" + redis: "redis://redis-master:6379/0" + useRedis: true +``` + +##### With Azure Key Vault + +```text +svix-server: + enable: true + # Azure Workload Identity (REQUIRED for Azure Key Vault) + azureWorkloadIdentity: + enable: true + clientID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" + tenantID: "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" + secretProviderclass: + enable: true + provider: "azure" + azureparameters: + keyvaultName: "my-svix-keyvault" + # clientID and tenantID inherited from azureWorkloadIdentity + # postgres ignored when using Secret Provider +``` + +When using Azure Key Vault (with `provider` set to `azure`), you must create the following secrets in your Key Vault: + +| Secret Name | Description | Example Value | +| --- | --- | --- | +| `svix-db-dsn` | The PostgreSQL connection string | `postgresql://user:pass@host:5432/svix` | +| `svix-redis-dsn` | The Redis connection string (optional, used when `useRedis` is set to `true`) | `redis://host:6379/0` | + +### Mxplatform + +The `mxplatform` component is used for Mendix application platform deployment. + +#### Basic Configuration + +| Field | Type | Required | Description | +| --- | --- | --- | --- | +| `enable` | Boolean | Yes | Enables `mxplatform` deployment | +| `name` | string | No (default: `mxplatform`) | The name of the MendixApp CR and ServiceAccount, if created | +| `UseStoragePlanwithIRSA` | Boolean | No (default: `false`) | Set to `true` when using StoragePlans with Workload Identity | + +#### PCLM Integration (Required) + +| Field | Required | Description | +| --- | --- | --- | +| `pclm.serviceUrl` | Yes | PCLM service endpoint | +| `pclm.username` | Conditional | The PCLM username; not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | +| `pclm.password` | Conditional | The PCLM password; not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | + +#### Spec Configuration + +| Field | Required | Description | +| --- | --- | --- | +| `spec.appURL` | Yes | A public domain for the app | +| `spec.sourceURL` | Yes | The OCI image path in the following format: `oci-image:///:` | +| `spec.database.servicePlan` | Conditional | The database service plan name; not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | +| `spec.storage.servicePlan` | Conditional | The storage service plan name; not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | +| `spec.runtime.mxAdminPassword` | Conditional | The admin password not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | + +#### Automatic Integration Detection + +`Mxplatform` automatically integrates with enabled components. You only need to enable or disable components. Do not configure integration flags manually. + +| Auto-detected Flag | When Used | Purpose | +| --- | --- | --- | +| `privatecloudEnabled` | Set when `mx-privatecloud.enable` is set to `true` | Connects to Private Cloud services | +| `maiaEnabled` | Set when `maia-appgen.enable` is set to `true` | Enables the Maia AI assistant | +| `svixEnabled` | Set when `svix-server.enable` is set to `true` | Enables webhook delivery | +| `kubeAgentEnabled` | Set when `mxplatform-kube-agent.enable` is set to `true` | Enables build agent | + +#### Example Configurations + +{{% alert color="warning" %}} +The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. +{{% /alert %}} + +##### Basic + +```text +mxplatform: + enable: true + pclm: + serviceUrl: "http://mx-privatecloud-license-manager" + username: "administrator" + password: "PCLMPassword" + spec: + appURL: "app.example.com" + sourceURL: "oci-image://registry/app:1.0" + database: + servicePlan: "production-db" + storage: + servicePlan: "production-storage" + resources: + limits: + cpu: 2000m + memory: 4096Mi + requests: + cpu: 1000m + memory: 2048Mi + runtime: + applicationRootUrl: "https://app.example.com" + mxAdminPassword: "AdminPassword" + dtapMode: "P" +``` + +##### With Secret Provider + +```text +mxplatform: + enable: true + # PCLM credentials from Secret Provider + pclm: + serviceUrl: "http://mx-privatecloud-license-manager" + username: "" # Empty - injected from Secret Provider + password: "" # Empty - injected from Secret Provider + secretProviderclass: + enable: true + provider: "azure" + azureparameters: + clientID: "..." + tenantID: "..." + keyvaultName: "my-keyvault" + spec: + appURL: "app.example.com" + sourceURL: "oci-image://registry/app:1.0" + # Leave empty when using Secret Provider + database: + servicePlan: "" + storage: + servicePlan: "" + runtime: + mxAdminPassword: "" # Empty - injected from Secret Provider +``` + +When using Azure Key Vault (with `provider` set to `azure`), you must create the following secrets in your Key Vault: + +| Secret Name | Description | Example Value | When Required | +| --- | --- | --- | --- | +| `mx-admin-password` | The Mendix application admin password | `AdminPassword123` | Always | +| `pclm-admin-username` | The PCLM administrator username | `administrator` | Always | +| `pclm-admin-password` | The PCLM administrator password | `PCLMPassword123` | Always | +| `database-type` | Database type | `PostgreSQL` | Database secrets; required when `spec.database.servicePlan` is empty | +| `database-host` | Database host | `postgres.example.com` | Database secrets; required when `spec.database.servicePlan` is empty | +| `database-name` | Database name | `mxplatform` | Database secrets; required when `spec.database.servicePlan` is empty | +| `database-username` | Database username | `mxplatform_user` | Database secrets; required when `spec.database.servicePlan` is empty | +| `database-password` | Database password | `DBPassword123` | Database secrets; required when `spec.database.servicePlan` is empty | +| `database-jdbc-url` | JDBC connection URL | `jdbc:postgresql://postgres.example.com:5432/mxplatform` | Database secrets; required when `spec.database.servicePlan` is empty | +| `storage-service-name` | Storage service name | `azure` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | +| `storage-azure-container` | Azure Blob container name | +`mxplatform-files` | Storage service name | `azure` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | +| `storage-azure-blob-endpoint` | Azure Blob endpoint | `https://mystorageaccount.blob.core.windows.net` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | +| `storage-azure-use-default-azure-credential` | Use Azure Workload Identity | `true` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | +| `storage-perform-delete` | Allow delete operations | `true` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | +| `storage-use-ca-certificates` | Use CA certificates | `false` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | +| `storage-azure-use-https` | Use HTTPS for Blob access | `true` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | + +Azure Blob Storage Secrets (with static credentials - when useManagedIdentityForBlob: false): + +| `storage-azure-account-name` | Azure Storage account name | `mystorageaccount` | Azure Blob Storage secrets with static credentials; required when `useManagedIdentityForBlob` is set to `false` | +| `storage-azure-account-key` | Azure Storage account key | `base64encodedkey==` | Azure Blob Storage secrets with static credentials; required when `useManagedIdentityForBlob` is set to `false` | + +### Mxplatform-kube-agent + +Mxplatform-kube-agent is the Build agent for `mxplatform` app deployments. + +#### Basic Configuration + +| Field | Type | Required | +| --- | --- | --- | +| `enable` | Boolean | Yes | +| `namespace` | string | Yes | +| `config.buildUser` | string | No (default: `pmpbuilder`) | +| `config.buildPassword` | string | No (auto-generated) | + +##### Example + +{{% alert color="warning" %}} +The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. +{{% /alert %}} + +```text +mxplatform-kube-agent: + enable: true + namespace: "build-agents" +``` + +### Mx-private-document-generation + +Mx-private-document-generation is the PDF document generation service. + +The wervice URL for Mendix apps is `http://document-generation.:8085`. + +#### Basic Configuration + +| Field | Type | Required | +| --- | --- | --- | +| `enable` | Boolean | Yes | +| `namespace` | string | Yes | + +##### Example + +{{% alert color="warning" %}} +The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. +{{% /alert %}} + +```text +mx-private-document-generation: + enable: true + namespace: "document-generation" + image: + registry: "registry.mendix.com" + name: "mendix/document-generation-service" + tag: "1.0.0" +``` \ No newline at end of file diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index 6e56a888925..1eaf7439f9b 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -8,180 +8,108 @@ weight: 30 ## Introduction -To automate the declarative installation of Private Mendix Platform, you can now use Helm and Helmfile in order to automate the declarative installation of Private Mendix Platform. In this way, you can automatically install Private Mendix Platform components. For other installation types, see the following topics: +To automate the declarative installation of Private Mendix Platform, you can now use Helm and Helmfile in order to automate the declarative installation of Private Mendix Platform. In this way, you can automatically install Private Mendix Platform components. For other installation types, see the following topic: * [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/) -* [Install Private Mendix Platform 2.8.0 for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) -Helm charts are available from Private Mendix Platform 2.8.0. Namespaces created with Private Mendix Platform 2.7.0 and older do not currently support Helm charts. +Helm charts are available for Private Mendix Platform 2.8.0 and newer. Namespaces created with Private Mendix Platform 2.7.0 and older do not currently support Helm charts. -# PMP Helm Installation Overview - -[Helmfile Installation](https://docs.mendix.com/private-mendix-platform/helmfile-installation/). +## Required Tools -## Installation at a Glance +Before running Helmfile, ensure you have the following tools installed: -| Step | What you do | Key reference | -| --- | --- | --- | -| 1 | Retrieve the export manifest json via UI or via Download portal APIs | [Export json](https://docs.mendix.com/private-mendix-platform/download-portal/#pulling-images-and-charts) | -| 2 | Pull the required images, charts, and the `installer-helmfile` artifact into your own registry | [Images](#step-1--pull-images-and-charts) / [Charts](#charts) | -| 3 | Install the Mendix Operator: CRD chart, then the installer chart | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | -| 4 | Install the PMP charts via helmfile using your own values | [Installation Commands](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-commands) | -| 5 | Feed the PCLM hostname/credentials back into the operator values and re-apply | [Private Cloud License Manager Credentials](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#private-cloud-license-manager-credentials) | +| Tool | Minimum Version | Purpose | Installation | +| --- | --- | --- | --- | +| **helmfile** | 0.150.0+ | Declarative Helm deployment orchestration | [Installation Guide](https://helmfile.readthedocs.io/en/latest/#installation) | +| **helm** | 3.10.0+ | Kubernetes package manager | [Installation Guide](https://helm.sh/docs/intro/install/) | +| **helm-diff plugin** | 3.0.0+ | Required for helmfile diff and helmfile apply | `helm plugin install https://github.com/databus23/helm-diff` | +| **kubectl** | 1.24.0+ | Kubernetes command-line tool | [Installation Guide](https://kubernetes.io/docs/tasks/tools/) | +| **bash** | 4.0+ | Shell for running hooks | Linux and macOS: pre-installed; Windows: [Git Bash](https://git-scm.com/download/win) | ---- +{{% alert color="info" %}} +`Helm-diff` is required for `helmfile apply` and `helmfile diff` commands. If you only use `helmfile sync` (which forces synchronization without using `diff`), it is optional. +{{% /alert %}} -## Step 1 — Retrieve the list of image/charts version via GUI/API +## Platform-Specific Installation Notes -For pulling the versions, it can be done via Download portal UI as well as Download portal API. Check [Export Manifest Json](https://docs.mendix.com/private-mendix-platform/download-portal/#pulling-images-and-charts). +### Linux ---- +For Linux, all tools are typically available through package managers: -## Step 2 — Pull Images and Charts +```bash +# Ubuntu/Debian +apt-get install kubectl helm -Pull everything marked **Required** plus whichever optional components your deployment needs. +# CentOS/RHEL +yum install kubectl helm -For pulling the images, charts and helmfile installer(custom artifact) check [Download portal documentation](https://docs.mendix.com/private-mendix-platform/download-portal/#pulling-images-and-charts). +# Arch +pacman -S kubectl helm +``` -### Images +### MacOS -| Image | Description | Required | Documentation | -| --- | --- | --- | --- | -| `privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Required | [mx-privatecloud-license-manager](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud-license-manager) | -| `mendix-operator` | Mendix Operator | Required | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | -| `image-builder` | Builds app container images | Required | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | -| `mendix-private-platform` | Mendix Platform application runtime | Required | [mxplatform](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform) | -| `mx-m2ee-sidecar` | M2EE sidecar for app pods | Required | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | -| `mxpc-test` | Private Cloud connectivity/validation tests | Required | [mxplatform](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform) | -| `pmp-pipeline-tools` | PMP deployment pipeline tooling | Required | [mxplatform](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform) | -| `app-building-blocks` | App runtime and JRE base layers — pull the versions matching your app deployment requirements | Per deployment | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | -| `storage-provisioner` | Provisions app databases and file storage — pull the variants matching your database and storage requirements | Per deployment | [StoragePlan and Database Plan Configuration](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#storageplan-and-database-plan-configuration) | -| `kubernetes-agent` | Cluster agent — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | -| `interactor` | Interactor service — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | -| `interactor-bridge` | Interactor bridge — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | -| `privatecloud-authenticator` | Authenticator service — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | -| `privatecloud-collector` | Collector service — used in Interactor-Agent mode | Optional | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | -| `mxplatform-kube-agent` | Build agent for mxplatform | Optional | [mxplatform-kube-agent](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform-kube-agent) | -| `maia-appgen` | Maia AI AppGen service — required only if Maia features are used | Optional | [maia-appgen](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#maia-appgen) | -| `maia-llm-gateway` | Maia LLM Gateway service — required only if Maia features are used | Optional | [maia-llm-gateway](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#maia-llm-gateway) | -| `document-generation-service` | PDF document generation service | Optional | [mx-private-document-generation](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-private-document-generation) | -| `svix-server` | Webhook delivery service (upstream image `svix/svix-server`) | Optional | [svix-server](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#svix-server) | - -Registry paths: `registry.mendix.com/private-cloud/` (license-manager, operator, image-builder, m2ee-sidecar, storage-provisioner, app-building-blocks, kubernetes-agent, interactor, interactor-bridge, authenticator, collector), `registry.mendix.com/private-platform/` (mxpc-test, pmp-pipeline-tools, mxplatform-kube-agent, mendix-private-platform), `registry.mendix.com/maia/` (maia-appgen, maia-llm-gateway), `registry.mendix.com/docgen/` (document-generation-service), Docker Hub `svix/` (svix-server). - - -### Charts - -| Component | Description | Namespace | Required | ServiceAccount | Documentation | -| --- | --- | --- | --- | --- | --- | -| `mx-privatecloud-operator-installer` | Mendix Operator installer | Independent | Required | created by chart | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | -| `mx-privatecloud-operator-crd` | Mendix Operator CRDs | Cluster-scoped | Required | n/a | [Installation Requirements for the Mendix Operator](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-requirements-for-the-mendix-operator) | -| `mx-privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Shared | Required | `mendix-pclm` (created by chart) | [mx-privatecloud-license-manager](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud-license-manager) | -| `installer-config` | Shared installer configuration | Shared | Required | n/a | [Global Configuration](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#global-configuration) | -| `mxplatform` | Mendix Platform application (MendixApp CR) | Shared | Required | `mxplatform` (created by chart or operator) | [mxplatform](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform) | -| `mx-privatecloud` | Private Cloud services (authenticator, collector, interactor, bridge) — used in Interactor-Agent mode | Shared | Optional | `mx-privatecloud` (created by chart) | [mx-privatecloud](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-privatecloud) | -| `mxplatform-kube-agent` | Build agent for mxplatform | Independent | Optional | `mxplatform-kube-agent` (created by chart) | [mxplatform-kube-agent](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mxplatform-kube-agent) | -| `maia-appgen` | Maia AI AppGen service | Shared | Optional | `maia-appgen` (created by chart) | [maia-appgen](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#maia-appgen) | -| `maia-llm-gateway` | Maia LLM Gateway service for routing LLM requests | Shared | Optional | `maia-llm-gateway` (created by chart) | [maia-llm-gateway](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#maia-llm-gateway) | -| `mx-private-document-generation` | PDF document generation service | Independent | Optional | `mx-private-document-generation` (created by chart) | [mx-private-document-generation](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#mx-private-document-generation) | -| `svix-server` | Webhook delivery service | Shared | Optional | `svix` (created by chart) | [svix-server](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#svix-server) | - -Pull with: +For macOS, use Homebrew: ```bash -helm pull oci://registry.mendix.com/private-cloud/charts/ --version +brew install helmfile helm kubectl ``` -Registry paths: `private-cloud/charts/` (operator-installer, operator-crd, license-manager, mx-privatecloud), `private-platform/charts/` (mxplatform, mxplatform-kube-agent, installer-config, svix-server), `maia/charts/` (maia-appgen, maia-llm-gateway), `docgen/charts/` (mx-private-document-generation). - -### Custom Artifact - -| Artifact | Description | Required | -| --- | --- | --- | --- | -| `installer-helmfile` | Tarball containing the helmfile and `helmfile-config` sample values used in Step 3 | Required | - -Address: `registry.mendix.com/private-platform/installer-helmfile:` - ---- - - -## Step 3 — Install Operator Charts - -1. Apply below charts - [Documentation link] -`mx-privatecloud-operator-crd` -`mx-privatecloud-operator-installer` - -Make sure that the operator-crds are installed first and then operator-installer. - -2. Apply the operator CRDs: - - ```bash - kubectl apply -f mx-privatecloud-operator-crd/crds/ -n - ``` - -3. Apply the operator chart: +### Windows - ```bash - helm upgrade --install --create-namespace -n \ - -f operator-generated-values.yaml mx-privatecloud-operator-installer - ``` +For Windows, we recommend Git Bash with Chocolatey, or Scoop: -> `operator-generated-values.yaml` must be updated for the customer's configuration. Start from `values.yaml` inside the `mx-privatecloud-operator-installer` chart. Keep this file — Step 4 updates it again. +```bash +# Using Chocolatey +choco install kubernetes-cli kubernetes-helm helmfile -Make sure that the new registry is updated in privateCloudRelease -> repo in the above values.yaml file +# Using Scoop +scoop install kubectl helm helmfile +``` ---- +{{% alert color="info" %}} +Helmfile hooks require bash. Install Git for Windows and run Helmfile from the Git Bash terminal. +{{% /alert %}} -## Step 4 — Install PMP Charts using Helm +```bash +helmfile version v0.150.0+ +version.BuildInfo{Version:"v3.12.0", ...} +Client Version: v1.27.0 +GNU bash, version 5.x.x -1. Pull the `installer-helmfile` artifact. -2. Unzip the tarball. -3. Navigate to `helmfile-config`. -4. Refer the samples file and create the PMP values file based on your requirements. -5. Apply the charts as described in [Installation Commands](https://docs.mendix.com/private-mendix-platform/helmfile-installation/#installation-commands). +Kubernetes control plane is running at https://... ---- +NAME VERSION +diff 3.11.0 ← This is REQUIRED +``` -## Step 5 — Wire PCLM Back into the Operator +### Installing the Helm-diff Plugin -1. Retrieve the PCLM hostname, username, and password, and set them in the `` | Set when Ingress is enabled with host name | - -### Svix-server - -The Svix webhooks server is used for event delivery and webhook management. - -#### Quick Deployment Scenarios - -Refer to the following list for a quick summary of the supported deployment scenarios and the required configuration. - -* Basic production - - Set `postgres`, and optionally also `redis` and `useRedis` to `true`. - -* Azure Key Vault - - Enable `azureWorkloadIdentity` and `secretProviderclass` with `provider` set to `azure`. - -* AWS Secrets Manager - - Enable `awsIRSA` and `secretProviderclass` with `provider` set to `aws`. - -* HashiCorp Vault - - Enable `secretProviderclass` with `provider` set to `vault`. - -#### Basic Configuration - -| Field | Type | Required | Description | -| --- | --- | --- | --- | -| `enable` | Boolean | Yes | Enables svix-server deployment | -| `postgres` | string | Conditional | The PostgreSQL DSN. Required when `secretProviderclass.enable` is set to `false` | -| `secretKey` | string | Recommended | The JWT secret key; auto-generated if empty | - -#### Database and Cache - -```text -svix-server: - enable: true - postgres: "postgresql://user:pass@host:5432/svix" - redis: "redis://host:6379/0" # Optional - useRedis: false # Set true to enable Redis - secretKey: "" # Leave empty for auto-generation -``` - -#### Secret Key Management - -The JWT secret is managed through `svix-configmap` in the following way: - -* If the user provides a `secretKey`, the provided value is used. -* If the `secretKey` is empty and the ConfigMap exists, the existing key is preserved (`upgrade-safe`). -* If the `secretKey` is empty and the ConfigMap does not exist, a 64-character key is auto-generated. - -The JWT secret is automatically injected into the `SvixClient.JwtSecret` constant of the `mxplatform`. - -#### Example Configurations - -{{% alert color="warning" %}} -The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. -{{% /alert %}} - -##### Basic - -```text -svix-server: - enable: true - postgres: "postgresql://svix:pass@host:5432/svix" - secretKey: "" # Auto-generated -``` - -##### With Redis - -```text -svix-server: - enable: true - postgres: "postgresql://svix:pass@host:5432/svix" - redis: "redis://redis-master:6379/0" - useRedis: true -``` - -##### With Azure Key Vault - -```text -svix-server: - enable: true - # Azure Workload Identity (REQUIRED for Azure Key Vault) - azureWorkloadIdentity: - enable: true - clientID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" - tenantID: "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" - secretProviderclass: - enable: true - provider: "azure" - azureparameters: - keyvaultName: "my-svix-keyvault" - # clientID and tenantID inherited from azureWorkloadIdentity - # postgres ignored when using Secret Provider -``` - -When using Azure Key Vault (with `provider` set to `azure`), you must create the following secrets in your Key Vault: - -| Secret Name | Description | Example Value | -| --- | --- | --- | -| `svix-db-dsn` | The PostgreSQL connection string | `postgresql://user:pass@host:5432/svix` | -| `svix-redis-dsn` | The Redis connection string (optional, used when `useRedis` is set to `true`) | `redis://host:6379/0` | - -### Mxplatform - -The `mxplatform` component is used for Mendix application platform deployment. - -#### Basic Configuration - -| Field | Type | Required | Description | -| --- | --- | --- | --- | -| `enable` | Boolean | Yes | Enables `mxplatform` deployment | -| `name` | string | No (default: `mxplatform`) | The name of the MendixApp CR and ServiceAccount, if created | -| `UseStoragePlanwithIRSA` | Boolean | No (default: `false`) | Set to `true` when using StoragePlans with Workload Identity | - -#### PCLM Integration (Required) - -| Field | Required | Description | -| --- | --- | --- | -| `pclm.serviceUrl` | Yes | PCLM service endpoint | -| `pclm.username` | Conditional | The PCLM username; not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | -| `pclm.password` | Conditional | The PCLM password; not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | - -#### Spec Configuration - -| Field | Required | Description | -| --- | --- | --- | -| `spec.appURL` | Yes | A public domain for the app | -| `spec.sourceURL` | Yes | The OCI image path in the following format: `oci-image:///:` | -| `spec.database.servicePlan` | Conditional | The database service plan name; not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | -| `spec.storage.servicePlan` | Conditional | The storage service plan name; not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | -| `spec.runtime.mxAdminPassword` | Conditional | The admin password not required when `secretProviderclass.enable` is set to `true` (for credentials injected from a secret manager) | - -#### Automatic Integration Detection - -`Mxplatform` automatically integrates with enabled components. You only need to enable or disable components. Do not configure integration flags manually. - -| Auto-detected Flag | When Used | Purpose | -| --- | --- | --- | -| `privatecloudEnabled` | Set when `mx-privatecloud.enable` is set to `true` | Connects to Private Cloud services | -| `maiaEnabled` | Set when `maia-appgen.enable` is set to `true` | Enables the Maia AI assistant | -| `svixEnabled` | Set when `svix-server.enable` is set to `true` | Enables webhook delivery | -| `kubeAgentEnabled` | Set when `mxplatform-kube-agent.enable` is set to `true` | Enables build agent | - -#### Example Configurations - -{{% alert color="warning" %}} -The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. -{{% /alert %}} - -##### Basic - -```text -mxplatform: - enable: true - pclm: - serviceUrl: "http://mx-privatecloud-license-manager" - username: "administrator" - password: "PCLMPassword" - spec: - appURL: "app.example.com" - sourceURL: "oci-image://registry/app:1.0" - database: - servicePlan: "production-db" - storage: - servicePlan: "production-storage" - resources: - limits: - cpu: 2000m - memory: 4096Mi - requests: - cpu: 1000m - memory: 2048Mi - runtime: - applicationRootUrl: "https://app.example.com" - mxAdminPassword: "AdminPassword" - dtapMode: "P" -``` - -##### With Secret Provider - -```text -mxplatform: - enable: true - # PCLM credentials from Secret Provider - pclm: - serviceUrl: "http://mx-privatecloud-license-manager" - username: "" # Empty - injected from Secret Provider - password: "" # Empty - injected from Secret Provider - secretProviderclass: - enable: true - provider: "azure" - azureparameters: - clientID: "..." - tenantID: "..." - keyvaultName: "my-keyvault" - spec: - appURL: "app.example.com" - sourceURL: "oci-image://registry/app:1.0" - # Leave empty when using Secret Provider - database: - servicePlan: "" - storage: - servicePlan: "" - runtime: - mxAdminPassword: "" # Empty - injected from Secret Provider -``` - -When using Azure Key Vault (with `provider` set to `azure`), you must create the following secrets in your Key Vault: - -| Secret Name | Description | Example Value | When Required | -| --- | --- | --- | --- | -| `mx-admin-password` | The Mendix application admin password | `AdminPassword123` | Always | -| `pclm-admin-username` | The PCLM administrator username | `administrator` | Always | -| `pclm-admin-password` | The PCLM administrator password | `PCLMPassword123` | Always | -| `database-type` | Database type | `PostgreSQL` | Database secrets; required when `spec.database.servicePlan` is empty | -| `database-host` | Database host | `postgres.example.com` | Database secrets; required when `spec.database.servicePlan` is empty | -| `database-name` | Database name | `mxplatform` | Database secrets; required when `spec.database.servicePlan` is empty | -| `database-username` | Database username | `mxplatform_user` | Database secrets; required when `spec.database.servicePlan` is empty | -| `database-password` | Database password | `DBPassword123` | Database secrets; required when `spec.database.servicePlan` is empty | -| `database-jdbc-url` | JDBC connection URL | `jdbc:postgresql://postgres.example.com:5432/mxplatform` | Database secrets; required when `spec.database.servicePlan` is empty | -| `storage-service-name` | Storage service name | `azure` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | -| `storage-azure-container` | Azure Blob container name | -`mxplatform-files` | Storage service name | `azure` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | -| `storage-azure-blob-endpoint` | Azure Blob endpoint | `https://mystorageaccount.blob.core.windows.net` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | -| `storage-azure-use-default-azure-credential` | Use Azure Workload Identity | `true` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | -| `storage-perform-delete` | Allow delete operations | `true` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | -| `storage-use-ca-certificates` | Use CA certificates | `false` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | -| `storage-azure-use-https` | Use HTTPS for Blob access | `true` | Azure Blob Storage secrets; required when `spec.storage.servicePlan is empty` | - -Azure Blob Storage Secrets (with static credentials - when useManagedIdentityForBlob: false): - -| `storage-azure-account-name` | Azure Storage account name | `mystorageaccount` | Azure Blob Storage secrets with static credentials; required when `useManagedIdentityForBlob` is set to `false` | -| `storage-azure-account-key` | Azure Storage account key | `base64encodedkey==` | Azure Blob Storage secrets with static credentials; required when `useManagedIdentityForBlob` is set to `false` | - -### Mxplatform-kube-agent - -Mxplatform-kube-agent is the Build agent for `mxplatform` app deployments. - -#### Basic Configuration - -| Field | Type | Required | -| --- | --- | --- | -| `enable` | Boolean | Yes | -| `namespace` | string | Yes | -| `config.buildUser` | string | No (default: `pmpbuilder`) | -| `config.buildPassword` | string | No (auto-generated) | - -##### Example - -{{% alert color="warning" %}} -The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. -{{% /alert %}} - -```text -mxplatform-kube-agent: - enable: true - namespace: "build-agents" -``` - -### Mx-private-document-generation - -Mx-private-document-generation is the PDF document generation service. - -The wervice URL for Mendix apps is `http://document-generation.:8085`. - -#### Basic Configuration - -| Field | Type | Required | -| --- | --- | --- | -| `enable` | Boolean | Yes | -| `namespace` | string | Yes | - -##### Example - -{{% alert color="warning" %}} -The code samples are intended to show the range of available options. No rights can be derived from them, as they are presented as examples only, and may require significant adaptation to work in your own environment. It is your responsibility to interpret and adjust them to fit real-world scenarios. -{{% /alert %}} - -```text -mx-private-document-generation: - enable: true - namespace: "document-generation" - image: - registry: "registry.mendix.com" - name: "mendix/document-generation-service" - tag: "1.0.0" -``` +For a list of component-specific configurations, see [Installation Reference](/private-mendix-platform/installation-reference/). ## Container Registry Configuration diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart.md b/content/en/docs/private-platform/quickstart/pmp-quickstart.md index 94509a7f85f..4c2e4e54058 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart.md @@ -8,10 +8,9 @@ weight: 20 ## Introduction -In interactive mode, you manually install Private Mendix Platform components. For other installation types, see the following topics: +In interactive mode, you manually install Private Mendix Platform components. For other installation types, see the following topic: * [Install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/) -* [Install Private Mendix Platform 2.8.0 for Air-Gapped Environments](/private-mendix-platform/air-gapped-installation/) ## Preparing the Installation Files From 03721cb5d80f3219f48860887f1266acf168f7d5 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Fri, 25 Sep 2026 19:55:39 +0200 Subject: [PATCH 27/31] SME review --- .../quickstart/pmp-quickstart-airgapped.md | 2 +- .../quickstart/pmp-quickstart-artifacts.md | 14 +++++++------- .../quickstart/pmp-quickstart-helm.md | 13 +++---------- 3 files changed, 11 insertions(+), 18 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md index 66db210ea4a..55f5eb07d11 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-airgapped.md @@ -8,7 +8,7 @@ weight: 32 ## Introduction -This document describes how you can migrate artifcates (images and charts), in order to perform an air-gapped installation using one of the following methods: +This document describes how you can migrate artifacts (images and charts), in order to perform an air-gapped installation using one of the following methods: * [Install Private Mendix Platform in GUI Mode](/private-mendix-platform/interactive-installation/) * [Install Private Mendix Platform with Helmfile](/private-mendix-platform/helmfile-installation/) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md index 3cf04317ebe..b6395ead3ca 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md @@ -35,18 +35,18 @@ The following reference document presents a list of required and optional compon ### Registry Paths -* `registry.mendix.com/private-cloud/` (license-manager, operator, image-builder, m2ee-sidecar, storage-provisioner, app-building-blocks, kubernetes-agent, interactor, interactor-bridge, authenticator, collector) -* `registry.mendix.com/private-platform/` (mxpc-test, pmp-pipeline-tools, mxplatform-kube-agent, mendix-private-platform) -* `registry.mendix.com/maia/` (maia-appgen, maia-llm-gateway) -* `registry.mendix.com/docgen/` (document-generation-service), Docker Hub -* `svix/` (svix-server). +* `registry.mendix.com/private-cloud/ (license-manager, operator, image-builder, m2ee-sidecar, storage-provisioner, app-building-blocks, kubernetes-agent, interactor, interactor-bridge, authenticator, collector)` +* `registry.mendix.com/private-platform/ (mxpc-test, pmp-pipeline-tools, mxplatform-kube-agent, mendix-private-platform)` +* `registry.mendix.com/maia/ (maia-appgen, maia-llm-gateway)` +* `registry.mendix.com/docgen/ (document-generation-service)`, Docker Hub +* `svix/ (svix-server)` ## Charts | Component | Description | Namespace | Required | ServiceAccount | | --- | --- | --- | --- | --- | | `mx-privatecloud-operator-installer` | Mendix Operator installer | Independent | Required | created by chart | -| `mx-privatecloud-operator-crd` | Mendix Operator CRDs | Cluster-scoped | Required | n/a | +| `mx-privatecloud-operator-crd` | Mendix Operator CRDs | Cluster-scoped | Required | N/A | | `mx-privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Shared | Required | `mendix-pclm` (created by chart) | | `installer-config` | Shared installer configuration | Shared | Required | n/a | | `mxplatform` | Mendix Platform application (MendixApp CR) | Shared | Required | `mxplatform` (created by chart or operator) | @@ -73,7 +73,7 @@ helm pull oci://registry.mendix.com/private-cloud/charts/ --version registry.mendix.com`. - 2. Use the `oras pull` command to download the Helmfile from the OCI registry, for example, ` oras pull registry.mendix.com/private-platform/installer-helmfile:0.2.1`. - 3. Unzip the downloaded file by using the following command: `tar -xvf helmfile-config.tar.gz`. - 4. Test it by using the following command: `helmfile --file helmfile.d/helmfile.yaml --state-values-file apply`. - -5. Pull the charts. +4. Pull the charts. 1. Log in to the OCI registry for Helm by using the following command: `helm registry login -u pat -p ${YOUR_PAT} registry.mendix.com`. 2. Use the `helm pull` command to download the Helmfile from the OCI registry, for example: From b62fd4b5db3f49568cbd7055e803624b1e263e17 Mon Sep 17 00:00:00 2001 From: katarzyna_koltun Date: Fri, 25 Sep 2026 20:04:08 +0200 Subject: [PATCH 28/31] fixed broken link --- content/en/docs/private-platform/quickstart/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/_index.md b/content/en/docs/private-platform/quickstart/_index.md index c1b5653072e..b1c8ad27bb7 100644 --- a/content/en/docs/private-platform/quickstart/_index.md +++ b/content/en/docs/private-platform/quickstart/_index.md @@ -34,7 +34,7 @@ You can perform the installation by using one of the following methods: * [With GUI](/private-mendix-platform/interactive-installation/), where you manually install Private Mendix Platform components * [With Helmfile](/private-mendix-platform/helmfile-installation/), where you use Helmfile to automatically install Private Mendix Platform components. Helm charts are available from Private Mendix Platform 2.8.0. Namespaces created with Private Mendix Platform 2.7.0 and older do not currently support Helm charts. -Both types of installation can be performed in an [air-gapped environment](/private-mendix-platform/airgapped-installation/). +Both types of installation can be performed in an [air-gapped environment](/private-mendix-platform/air-gapped-installation/). #### Installation Order From a827ab8c85183a33c077e4f3280eb4eed746c7be Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 20:13:01 +0200 Subject: [PATCH 29/31] Update pmp-quickstart-artifacts.md --- .../private-platform/quickstart/pmp-quickstart-artifacts.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md index b6395ead3ca..96d7d252889 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md @@ -92,7 +92,7 @@ This is the Private Cloud License Manager (PCLM) component. It is required for P | Field | Type | Required | Description | | --- | --- | --- | --- | -| `enable` | boolean | Yes | Enable PCLM deployment | +| `enable` | Boolean | Yes | Enable PCLM deployment | | `image.registry` | string | No | Container registry URL (uses the global value if not specified) | | `image.name` | string | Yes | The image name | | `image.tag` | string | Yes | Image tag (version) | @@ -1032,4 +1032,4 @@ mx-private-document-generation: registry: "registry.mendix.com" name: "mendix/document-generation-service" tag: "1.0.0" -``` \ No newline at end of file +``` From cd6154ab1b3cdc7e3024eeef65f77c0dbcce662c Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 20:13:41 +0200 Subject: [PATCH 30/31] Fix capitalization for 'N/A' in documentation --- .../private-platform/quickstart/pmp-quickstart-artifacts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md index 96d7d252889..ba82594fe6c 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-artifacts.md @@ -48,7 +48,7 @@ The following reference document presents a list of required and optional compon | `mx-privatecloud-operator-installer` | Mendix Operator installer | Independent | Required | created by chart | | `mx-privatecloud-operator-crd` | Mendix Operator CRDs | Cluster-scoped | Required | N/A | | `mx-privatecloud-license-manager` | Private Cloud License Manager (PCLM) | Shared | Required | `mendix-pclm` (created by chart) | -| `installer-config` | Shared installer configuration | Shared | Required | n/a | +| `installer-config` | Shared installer configuration | Shared | Required | N/A | | `mxplatform` | Mendix Platform application (MendixApp CR) | Shared | Required | `mxplatform` (created by chart or operator) | | `mx-privatecloud` | Private Cloud services (authenticator, collector, interactor, bridge) - used in Interactor-Agent mode | Shared | Optional | `mx-privatecloud` (created by chart) | | `mxplatform-kube-agent` | Build agent for mxplatform | Independent | Optional | `mxplatform-kube-agent` (created by chart) | From 0bb2211dfc93722d212b56ffa80728748e843372 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 25 Sep 2026 20:14:48 +0200 Subject: [PATCH 31/31] Add installation overview for Mendix Private Platform Added an overview of the installation process for the Mendix Private Platform, detailing high-level steps and configuration requirements. --- .../quickstart/pmp-quickstart-helm.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md index 95860b375d9..de024c18b88 100644 --- a/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md +++ b/content/en/docs/private-platform/quickstart/pmp-quickstart-helm.md @@ -30,6 +30,16 @@ Before running Helmfile, ensure you have the following tools installed: `Helm-diff` is required for `helmfile apply` and `helmfile diff` commands. If you only use `helmfile sync` (which forces synchronization without using `diff`), it is optional. {{% /alert %}} +## Installation Overview + +The installation process consists of the following high-level steps. For more information, refer to the sections below. + +1. Retrieve the manifest of image and charts version through the Download Portal GUI or API. +2. Pull the images and charts marked **Required**, as well as any optional components your deployment needs. For a list of required and optional components, see [Installation Reference](/private-mendix-platform/installation-reference/). +3. Install the Operator charts. +4. Install Priave Mendix Platform charts using Helm. +5. Configure the PCLM host name, user name and password in the `