Before You Begin¶
Review these requirements before you install Sovereign Home Cloud. Most failed installations come from something on this page: a missing StorageClass, a pull secret that does not match the registry, or a hostname nobody can resolve.
What You Install¶
When you install Sovereign Home Cloud, the home-cloud-control-plane Helm chart deploys:
| Component | What it is | Deployment |
|---|---|---|
| Control plane | One pod running Cloud Console, the Ops UI, and the services behind them | Included |
| PostgreSQL | The main database | Bundled, or bring your own |
| OpenSearch | Search and the audit log | Bundled, or bring your own |
| Valkey | Cache and sessions | Bundled, or bring your own (Redis-compatible) |
| Object store | S3-compatible storage (SeaweedFS) | Bundled, or bring your own S3 |
| In-cluster event broker | An event broker for the control plane's own messaging | Quick Start only; production requires your own |
| Datacenter agent | Deploys and manages event broker services in a datacenter | Quick Start installs; production onboards via Ops UI |
Kubernetes Cluster¶
| Requirement | Details |
|---|---|
| Distribution | Sovereign Home Cloud supports any Kubernetes distribution, including OpenShift, and was validated on Amazon EKS with Kubernetes 1.33, and on OKD. For OpenShift, read Installing on OpenShift. |
| Node architecture | linux/amd64 is the only validated architecture. Every image used by Sovereign Home Cloud except the datacenter agent's is published for linux/arm64; the datacenter agent requires a linux/amd64 node. |
| Capacity | About 4 CPU and 13 GiB of memory are requested by Sovereign Home Cloud itself, plus any additional requirements for the event broker services you create. See Compute Resources. |
| Storage | A StorageClass that provisions ReadWriteOnce volumes. You can leave the chart's setting blank to use the cluster's default StorageClass, or name one. The bundled components use about 55 GiB, and every event broker service adds its own volume requirement. |
| Ingress controller | Any controller that serves Kubernetes Ingress resources with TLS, such as ingress-nginx, the AWS Load Balancer Controller, or the OpenShift router. An Ingress controller is not required for the Quick Start. |
| Event broker exposure | When you onboard a datacenter, you choose how it exposes its event broker services: NodePort, the default, reaches event broker services from outside the cluster on a node's high ports; the nodes that take event broker service traffic need the label node-role.kubernetes.io/worker=true, and applications need a node address they can reach. ClusterIP reaches event broker services from inside the cluster only and needs nothing more. LoadBalancer gives each event broker service its own address on standard ports and needs a load balancer provider, such as a cloud load balancer or MetalLB. See Event Broker Service Exposure. |
| Permissions | Rights to create namespaced resources in the target namespace. The datacenter agent also reads the cluster's nodes to publish event broker services as NodePorts. |
Tools¶
| Tool | Version |
|---|---|
kubectl |
Matching your cluster |
helm |
3 |
Obtain the Helm Chart and Image Pull Credentials¶
The chart and its images are published in Solace's container registry, registry.solace.com:
| What | Reference |
|---|---|
| Helm chart | oci://registry.solace.com/solace/home-cloud-control-plane/charts/home-cloud-control-plane |
| Images | registry.solace.com/solace/home-cloud-control-plane/<image> |
During Early Access, Solace gives each participant pull credentials for that registry. Before installing, use your credentials to log in to the registry:
helm registry login registry.solace.com --username <username>
Kubernetes needs the same credentials as a pull secret in the target namespace:
kubectl create namespace home-cloud-control-plane
kubectl create secret docker-registry <pull secret name> -n home-cloud-control-plane \
--docker-server=registry.solace.com --docker-username=<username> --docker-password=<password>
If your cluster cannot reach Solace's registry, mirror the images into your own registry: see Installing in an Air-Gapped Environment.
Data Stores: Bundled or Your Own¶
Each data store is bundled by default, running as a single replica on a persistent volume in the release's namespace. You can replace any of them with your own:
| Data store | Bundled | Your own must provide |
|---|---|---|
| PostgreSQL | PostgreSQL 18 | One PostgreSQL server, validated with PostgreSQL 15 and 18. The account needs CREATEDB, or the service databases must exist before you install. |
| OpenSearch | OpenSearch 1.3 | The OpenSearch 1.3 REST API over HTTP or HTTPS, without authentication. Isolate it by network. |
| Cache | Valkey 8.1 | A Redis-compatible cache (RESP2) in standalone mode, not cluster mode. Either unauthenticated and isolated by network, or Amazon ElastiCache with IAM authentication and TLS. Username and password authentication is not supported. |
| Object store | SeaweedFS | Any S3-compatible store, or Amazon S3. Create the bucket first; the identity needs s3:PutObject, s3:GetObject, s3:DeleteObject, s3:ListBucket, s3:HeadBucket and s3:PutObjectTagging on it. |
WARNING! High availability is not available during Early Access The control plane and every bundled data store run as one replica. A node failure stops the service until its pods are rescheduled. For resilience, use your own replicated data stores, and see Backup and Restore.
Dependency Matrix¶
| Dependency | Required? | Notes |
|---|---|---|
| Kubernetes cluster | Required | See Kubernetes Cluster |
| PostgreSQL | Required | Bundled, or bring your own |
| OpenSearch | Required | Bundled, or bring your own |
| Redis-compatible cache | Required | Bundled Valkey, or bring your own |
| S3-compatible object store | Required | Bundled SeaweedFS, or bring your own |
| Event broker for the control plane | Required | Your own Solace event broker; the in-cluster event broker is for the Quick Start only |
| Datacenter agent | Required to create event broker services | See Onboarding a Datacenter |
| Ingress controller | Required except for the Quick Start | Your own |
| TLS certificates | Required except for the Quick Start | From your own PKI |
| CA certificate and key | Required except for the Quick Start | Signs event broker service certificates; see The CA Certificate |
| Secrets manager | Optional | Encryption works with a key the chart holds; an external Vault is optional |
| Email (SMTP) | Not used | Invitations and password resets go through the Ops UI administrator |
| Datadog | Not used | Off by default |
DNS and TLS¶
You bring the hostnames and the certificates. Sovereign Home Cloud manages neither.
- Hostnames. The Cloud Console and the Ops User Interface (UI) each need their own hostname, such as
console.example.comandops.example.com; an API hostname is optional. Create DNS records that point them at your ingress controller. - Ingress certificate. One certificate covering those hostnames, and any single sign-on hostnames you plan to add under the same base domain, stored as a Kubernetes TLS Secret or managed by your ingress controller. Renewing it is your responsibility. Replace the Secret before it expires, by hand or with a tool such as cert-manager.
- Private CA. If your certificates or data stores use a private CA, the control plane can be given it to trust; see Installing for Production.
- Event broker service certificates. In production, every datacenter signs its event broker services' certificates with one CA you provide, and the control plane trusts the same CA; see The CA Certificate. The Quick Start gives each event broker service a self-signed certificate.
Network Requirements¶
Inbound¶
| From | To | Port |
|---|---|---|
| Users' browsers and API clients | The Cloud Console, Ops UI and API hostnames, through your ingress controller | 443 |
| Messaging applications | Each event broker service's client ports, depending on how the datacenter exposes event broker services; see Event Broker Service Exposure | Per event broker service |
| Your workstation | The Kubernetes API | Your cluster's API port |
Outbound¶
| From | To | Why |
|---|---|---|
| Cluster nodes | The image registry | Pulling images, including each event broker image when an event broker service is created or upgraded |
| Control plane | Your external data stores, if any | Their ports |
Sovereign Home Cloud needs nothing else from the internet. These calls can still be attempted; none is needed, and blocking them breaks nothing you need:
| What | Destination | When |
|---|---|---|
| Database migration tool usage report | config.liquibase.com |
At startup |
| Email delivery | api.sparkpost.com |
Rarely; email is disabled in Sovereign Home Cloud |
| Datadog | *.datadoghq.com |
Never with the default values |
| Amazon S3 | AWS | Only if you use Amazon S3 as the object store |
Third-Party Images and Licenses¶
The chart deploys these third-party images unmodified, under their own licenses:
| Component | License |
|---|---|
| PostgreSQL | PostgreSQL License |
| OpenSearch | Apache License 2.0 |
| Valkey | BSD 3-Clause |
| SeaweedFS | Apache License 2.0 |
| Eclipse Temurin (the control plane's Java runtime) | GPL-2.0 with Classpath Exception |
The Valkey image carries no license text of its own. Its notices, and those of the libraries compiled into it, are in THIRD-PARTY-NOTICES.txt at the root of the chart. Keep that file with the chart whenever you copy or mirror it.
When you replace a bundled data store with your own, its license is between you and its vendor.
Next Steps¶
- Choose an installation path: Deploying with Kubernetes.