Skip to content
Back to

Cloud deployment

Cloud deployment covers production Fontana on public cloud infrastructure. Fontana can operate the environment for you, or you can run the same stack in your own account. Either way you get pinned releases, the same namespace layout, and the same Flow, AI, and compliance surface as every other deployment model.

Where Fontana runs

Section titled “Where Fontana runs”
Model Summary
Fontana-managed cloud Fontana provisions and operates the cluster; you consume workspaces and set policy (preferred)
Customer VPC Your cloud account and your cluster; Fontana supplies pinned releases and the CLI
Dedicated cluster One customer per cluster, for contracts that require it; same charts, smaller shared surface

For on-premises and private-registry installs, see Self-hosted deployment.

Provisioning on AWS

Section titled “Provisioning on AWS”

The provisioning layer is Terraform, and it stops where Fontana begins:

Terraform provisions fontana apply installs
The Amazon EKS cluster, node roles, and node autoscaling Traefik ingress and cert-manager, with Traefik behind the load balancer
The network load balancer and DNS records Shared platform services you declared
Block storage drivers and storage classes One namespace per workspace, with its own data, secrets, identity, and nightly backup job
The pipeline role that is allowed to deploy Every Helm release, in one pass, with no maintenance page

There is no application server to log into. The cluster API is the only deploy target, which removes a whole class of drift: no files copied onto a machine, no service edited by hand, no state that exists only on one box.

Fontana-managed cloud

Section titled “Fontana-managed cloud”

Preferred for most teams. Fontana provisions and operates the cluster, ingress, certificates, upgrades, backups, and monitoring. You focus on workspaces, policy, and consumption.

You provide Fontana provides
Business requirements, access policy, approved models and connectors Cluster provisioning and Kubernetes lifecycle
Identity federation decisions (SSO, MFA) in your identity provider Workspace namespaces with Zitadel, Vault, and the full app stack
BYOK and connector secrets for your integrations Pinned upgrades with no downtime, nightly online backups to an encrypted bucket, operational telemetry
Cloud account audit perimeter: CloudTrail, Config, GuardDuty with Security Hub, and daily volume snapshots (see Network and hardening)

Contact Fontana for managed cloud onboarding, sizing, and diligence materials.

Customer VPC

Section titled “Customer VPC”

Run Fontana inside your cloud account when you need direct control over networking, residency, backup policy, or cloud commit consumption.

You operate Fontana supplies
The cloud account, VPC, subnets, security groups, and DNS Pinned OCI images and charts, and the verified CLI bundle
Cluster provisioning and capacity The same namespace architecture and release cadence as managed cloud
fontana apply from your pipeline or an operator session Release artifacts, rollout semantics, and observability hooks
Change windows and your own cloud governance Upgrade and recovery documentation

Your workloads and persistent volumes stay inside your account boundary. This model does not route your data through a shared multi-tenant service operated by Fontana.

Releases and promotion

Section titled “Releases and promotion”

Every release is built once and promoted unchanged:

  1. A commit on the main branch produces one immutable set of images and charts, tagged by commit and addressed by digest.
  2. Supply-chain checks run on those artifacts: vulnerability scanning, a software bill of materials, and signatures.
  3. The release deploys to staging automatically.
  4. Production takes the same digests after an approval gate. Nothing is rebuilt between the two, so what you approved is what runs.

Your operators pin the tag in fontana.yaml and reconcile with fontana apply. See Supply chain for the verification steps and Fontana CLI for the command surface.

Deploying without a shell

Section titled “Deploying without a shell”

On AWS the deploy job authenticates to your account with short-lived credentials from your pipeline’s identity provider, fetches a kubeconfig for the cluster, and runs fontana apply. An operator laptop with SSO can run exactly the same command as a break-glass path. Because both routes execute the same code against the same file, an emergency deploy is not a different procedure with different results.

Getting started

Section titled “Getting started”
  1. Choose managed cloud or customer VPC with Fontana or your platform team.
  2. Provision the cluster with Terraform, or receive a provisioned one.
  3. Install the CLI, author fontana.yaml (base domain, release, certificate issuer, platform services, workspaces, backup bucket), and run fontana apply.
  4. Wire SSO in Zitadel, BYOK in Vault, and observability per Observability.
Section titled “Related documentation”