Docs/Operate

Kubernetes and Civo K3s

Install RustyAuth as an integrated realm, a central Fleet control plane, or lightweight isolated realms with copy-ready Helm commands.

Pre-release deployment

RustyAuth and these charts are version 0.1. Use them for evaluation and integration work until the published production qualification gates pass. Pin a tagged chart and immutable image digests when evaluating upgrades.

Choose the boundary

Chart	Installs	Use it for
`rustyauth-integrated`	WASM dashboard gateway, Realm API, SableDB	One self-contained app environment
`rustyauth-fleet`	WASM Fleet dashboard gateway, control plane, Fleet SableDB	One central management plane
`rustyauth-realm`	Realm API and SableDB	One lightweight Fleet-managed environment

Yes, Fleet and realms should be separate charts. That makes each realm a real identity, secret, storage and recovery boundary instead of a subcomponent that shares the control plane's lifecycle.

The Dioxus application delivered to the browser is compiled to WebAssembly. The same-origin gateway, Rust API and SableDB remain native Linux binaries in hardened scratch containers. Kubernetes orchestrates those server processes; it does not turn them into browser WASM.

Why this fits Civo

Civo Kubernetes uses K3s and its default applications include Traefik, so the charts use standard Kubernetes resources and default to the traefik IngressClass. Confirm what is installed on your cluster:

kubectl get nodes
kubectl get ingressclass
kubectl get storageclass

The storage class is left unset so the cluster default is used. Civo documents its default civo-volume class with a Delete reclaim policy, so RustyAuth marks every SableDB claim for retention on Helm uninstall.

Integrated install

Save this as integrated-values.yaml, replacing all example names and origins:

config:
  tenantId: acme
  realmId: production
  publicIssuer: https://auth.acme.example
  relyingParty:
    id: auth.acme.example
    origin: https://auth.acme.example
    name: Acme Account
  tokens:
    audience: acme-api
    accessTtl: 5m
  operators:
    bootstrapEmails:
      - [email protected]

ingress:
  enabled: true
  className: traefik
  hosts:
    - host: auth.acme.example
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: auth-acme-tls
      hosts:
        - auth.acme.example

Create the namespace and high-entropy credentials outside Helm. This keeps credentials out of Helm release values:

kubectl create namespace rustyauth
kubectl -n rustyauth create secret generic auth-rustyauth-integrated-secrets \
  --from-literal=AUTH_MASTER_KEY_HEX="$(openssl rand -hex 32)" \
  --from-literal=BOOTSTRAP_TOKEN="$(openssl rand -base64 48)" \
  --from-literal=AUTH_EVENT_RPC_TOKEN="$(openssl rand -base64 48)" \
  --from-literal=AUTH_IDENTITY_RPC_TOKEN="$(openssl rand -base64 48)"

Install from a repository checkout:

helm upgrade --install auth ./charts/rustyauth-integrated \
  --namespace rustyauth \
  --values integrated-values.yaml \
  --wait --atomic

Tagged releases also attach version-matched chart archives:

VERSION=0.1.0
CHART=https://github.com/rusty-auth/rustyauth/releases/download/v$VERSION/rustyauth-integrated-$VERSION.tgz
helm upgrade --install auth "$CHART" \
  --namespace rustyauth \
  --values integrated-values.yaml \
  --wait --atomic

Fleet plus realms

Install rustyauth-fleet once. Install rustyauth-realm once per project environment, normally in separate namespaces. Each realm gets distinct keys, RPC tokens, SableDB volume, public issuer and backup boundary.

kubectl create namespace rustyauth-fleet
kubectl -n rustyauth-fleet create secret generic fleet-rustyauth-fleet-secrets \
  --from-literal=AUTH_MASTER_KEY_HEX="$(openssl rand -hex 32)" \
  --from-literal=BOOTSTRAP_TOKEN="$(openssl rand -base64 48)"
helm upgrade --install fleet ./charts/rustyauth-fleet \
  --namespace rustyauth-fleet --values fleet-values.yaml --wait --atomic

kubectl create namespace acme-payments-production
kubectl -n acme-payments-production create secret generic realm-rustyauth-realm-secrets \
  --from-literal=AUTH_MASTER_KEY_HEX="$(openssl rand -hex 32)" \
  --from-literal=BOOTSTRAP_TOKEN="$(openssl rand -base64 48)" \
  --from-literal=AUTH_EVENT_RPC_TOKEN="$(openssl rand -base64 48)" \
  --from-literal=AUTH_IDENTITY_RPC_TOKEN="$(openssl rand -base64 48)"
helm upgrade --install realm ./charts/rustyauth-realm \
  --namespace acme-payments-production --values realm-values.yaml --wait --atomic

The realm chart intentionally has no dashboard. Pair its public management endpoint through the normal Fleet workflow; Fleet never receives that realm's database URL or encryption keys.

Operational defaults

API and control-plane replicas are fixed at one and updated with Recreate, matching the current single-writer contract.
All containers run without privilege escalation, with read-only root filesystems, dropped capabilities and no service-account token.
A NetworkPolicy permits SableDB ingress only from its API or control-plane pod.
Liveness uses /healthz; readiness uses /readyz and therefore includes the datastore.
SableDB uses a retained ReadWriteOnce PVC. Deleting that claim is an explicit destructive operation.

For backups, webhooks, Analytics, external ConfigMaps, secret rotation, upgrades and exact release archive commands, use the complete repository runbook.