Skip to main content
Before deploying on ECS or Kubernetes, contact your Runlayer account or support team for the inputs below. Receive secrets through an agreed secure channel and store them in your secret manager; never publish them in Git, tickets, or chat.

​
Checklist

The catalog key is required for catalog and onboarding even where the configuration permits an empty default. Optional features may require additional credentials and cloud resources; select them before deployment. For Distribution, obtain a reader key registered and active for this deployment. Runlayer must provision its configuration/target registration before the application can fetch configuration. For delegated registration and key rotation, see Distribution configuration.

​
Images and chart versions

Application images are published in Customer Distribution private ECR, account 088332244652:
For ECS, pin a module release in source. Its default application version is listed in the module changelog; set app_version only when choosing a compatible override. Module and application version numbers are separate. For Kubernetes, also obtain the exact Operator chart version:
GKE and other clusters without direct ECR access may use a registry mirror you operate. See the Operator deployment guide.

​
Authentication (WorkOS)

Use the client ID and API key issued for this installation. Coordinate the hostname, redirects, SSO, and initial administrator access with Runlayer before deploying.
  • ECS: pass auth_client_id and the sensitive auth_api_key input. The module stores runtime credentials in AWS Secrets Manager.
  • Kubernetes: create the runlayer-auth Secret after its namespace exists, then reference it through spec.auth.clientIdFrom and spec.auth.apiKeyFrom. Follow the Secret creation order.

​
MCP Catalog

The default catalog URL is https://mcp-catalog.prod.runlayer.com. Use a key issued for that environment. Without a key, catalog requests return 503 and the catalog/setup UI fails.
  • ECS: pass mcp_catalog_api_key; leave mcp_catalog_api_url at its default unless Runlayer directs otherwise.
  • Kubernetes: put MCP_CATALOG_API_KEY in runlayer-app, referenced by spec.appSecretRef. Set MCP_CATALOG_API_URL there only when directed. Do not enable the in-cluster components.mcpCatalogApi for the standard hosted-catalog path.

​
AI Watch / binary packages

Request both RUNLAYER_DOWNLOAD_TOKEN and package entitlement. A token without entitlement cannot resolve an installer. Allow downloads.runlayer.com from the relevant workloads. After configuration and rollout, run release discovery using Check now or the scheduled poll and verify package discovery.

​
Registry access

Runlayer grants access to the AWS account or pull principal during onboarding. Confirm both the operator/deployment identity and workload image-pull identity can access the required artifacts. ECS additionally needs S3 module download access from the machine running Terraform. Contact support@runlayer.com if downloads or pulls return AccessDenied.

​
Secrets you generate or provision

ECS: the module generates SECRET_KEY, MASTER_SALT, and managed database/cache credentials. Supply credentials yourself when using external PostgreSQL or Redis. See ECS secrets management. Kubernetes: generate SECRET_KEY and MASTER_SALT locally (at least 32 characters in production), and supply database/cache credentials through the required Secrets. The operator does not create Secret data. Follow the Operator Secret requirements.

​
Security expectations

Store ECS inputs through your secret manager or TF_VAR_* environment variables. For Kubernetes, use your secret manager’s synchronization mechanism or securely create Secrets after the namespace exists. Rotate credentials through Runlayer and your secret store, then restart the consuming tasks or pods. Continue to ECS prerequisites or Kubernetes prerequisites.