Authdog
Back to journal
Identity ArchitectureSelf-hostingEnterprise

Self-hosting Authdog on your Kubernetes cluster

Enterprise teams can install the same Authdog control plane, console, and identity runtime on-premises with the official Helm chart.

From the changelog: Self-hosting documentation

Authdog Team

2 min read
Centered Authdog, Kubernetes, and Helm marks on a grainy steel wash with a hex field

Authdog runs as a managed service on the edge by default. Regulated workloads, air-gapped networks, and data-residency rules sometimes require the same software inside your cluster. Enterprise customers can now follow a published guide for the official Authdog Helm chart.

This is the longer note behind the August 30 changelog entry.

What the chart installs

The chart packages the same control plane, identity endpoints, console, and worker runtime as the hosted platform:

  • API — control plane and public identity endpoints (sign-in, sign-up, sessions, SSO, webhooks, actions)
  • Console — admin console and account portal, served from your cluster
  • Worker runtime — auth flows, actions, and session validation close to traffic
  • Data services — a relational store for tenants and users, object storage for branding, and a secrets backend for Vault
  • Migrations job — a pre-install / pre-upgrade hook that applies schema migrations

Each component is a separately scalable Deployment behind one Ingress.

Prerequisites

  • Kubernetes 1.27+
  • Helm 3.12+
  • A container registry your cluster can reach, plus the image pull secret Authdog provides
  • PostgreSQL 15+ (bring your own for production)
  • An S3-compatible object store (S3, R2, MinIO, or GCS via the S3 API)
  • An Ingress controller with TLS termination
  • A DNS record for the hostname Authdog should answer on

For evaluation only, --set postgresql.enabled=true,minio.enabled=true spins up in-cluster stores. Do not use those bundled stores in production.

Self-hosting is an Enterprise feature. Contact your CSM or support for the chart repository and pull secret.

Install

helm repo add authdog https://charts.authdog.com
helm repo update

Inspect values, set the Ingress hostname, Postgres and object-storage credentials, and the KMS key material the platform expects, then install or upgrade with your values file. The published guide covers air-gapped image mirrors, backups, and disaster recovery.

Trust boundaries

You operate the cluster, the database, object storage, and TLS. Authdog still encrypts environment key material; the chart expects environment_kms_keys (and related encrypted material) to exist after migrations. A skipped KMS migration is a failed install, not a warning.

Bot protection on self-hosted identity pages can use Google reCAPTCHA. Cloudflare Turnstile needs reachability to Cloudflare's siteverify endpoint; air-gapped clusters should plan on reCAPTCHA or no captcha add-on.

Try it

The full procedure is in Self-hosting. The original release note is in the changelog.

More from Authdog
ShareLinkedInX