Skip to main content

Self-managed BYOC

In a self-managed BYOC region, you deploy the Diagrid data plane onto a Kubernetes cluster you run, and manage it through the Diagrid control plane, which Diagrid hosts. This combines a streamlined cloud management experience with the security, control, and flexibility of keeping your applications and data in your own environment.

Your applications connect directly to the Diagrid region over your private network. That keeps data local and removes the Diagrid control plane from the critical path of your application's data flow: the control plane manages the lifecycle of resources within your region, while your application availability and reliability remain fully under your control.

If you'd rather Diagrid provision and operate the region inside your cloud account, see Managed BYOC — it needs no cluster of your own.

Choose your path​

How you deploy depends on what you're doing:

Your situationStart here
Evaluating Diagrid, or deploying onto a cluster you already haveQuick deployment — diagrid region deploy takes you from zero to a connected region against a local kind cluster or an existing EKS, AKS, or GKE cluster.
Building a production region on AWSAWS deployment — a reference architecture with Terraform for a private VPC and EKS.
Building a production region on AzureAzure deployment — a Terraform reference architecture for an AKS cluster with PostgreSQL Flexible Server.
Building a deployment that survives the loss of a cloud regionMulti-region high availability — several regions behind one endpoint, one of them active at a time. AWS multi-region deployment builds a two-region group with Terraform, and AWS failover and failback is the runbook for it.

Whichever path you take, read Production planning before sizing a production region — it covers cluster requirements, sizing profiles, high availability, and private registries.

Start using the region​

Once your region is deployed and reports as connected, it behaves like any other Diagrid region. Create a project in it:

diagrid project create my-project --region my-region

To make it the default region for every new project in your organization, use diagrid region use.

From here, run any quickstart against your new project to verify the region end to end — the workflow and agent quickstarts exercise the data plane you just deployed.

Operate the region​

  • Lifecycle management — supported versions, upgrade and rollback, join-token rotation, region updates and deletion.
  • Architecture — components, data flow, inbound and outbound connections, network policies, and regional PKI.
  • Ingress and DNS — why the region needs a wildcard domain, how to avoid a public wildcard record, and resolving project hostnames inside your cluster with CoreDNS.
  • Protect PKI keys — keep the root CA key in a managed CA such as AWS Private CA, and restrict, encrypt and rotate the issuer key.
  • Private gateway CA — run the gateway on a certificate from a private or self-signed CA, and make your applications trust it.
  • Observability — forward metrics, traces, and logs to your own OpenTelemetry backend.
  • Helm reference — every configuration option in the Diagrid Helm chart.

Support plans​

A self-managed BYOC region can be purchased with the select or premium support plan, set with the --support-plan flag on diagrid region create. Regions running on your own infrastructure start at select.

See Plans & support for what each plan covers.

Next steps​

Last updated on