Runlayer-Provided Inputs

Self-hosted Kubernetes deployments need values that only Runlayer can issue. Contact your Runlayer account or support team for each item below. Never publish secret values in tickets, git, chat, or public docs. After you receive them, store secrets in Kubernetes Secrets in the platform namespace (default runlayer-<customerId>). See Runlayer Operator for install order.

Checklist

Input	Where it lands	Notes
App / chart versions	`RunlayerInstance.spec.version`, Helm `--version`, `spec.images.*`	Pin a release Runlayer confirms for your tenant
Container images	`spec.images.backend` / `frontend` / `worker` (+ optionals)	Customer Distribution ECR `088332244652` (or a mirror you can pull)
Operator Helm chart	`helm upgrade --install … --version`	OCI chart from Customer Distribution ECR
WorkOS `AUTH_CLIENT_ID`	Secret `runlayer-auth` → `AUTH_CLIENT_ID`	Non-secret client id; still treat as tenant-specific
WorkOS `AUTH_API_KEY`	Secret `runlayer-auth` → `AUTH_API_KEY`	Secret — never commit
`MCP_CATALOG_API_KEY`	Secret `runlayer-app` → `MCP_CATALOG_API_KEY`	Required for onboarding / catalog UI; empty until Runlayer issues one
Catalog URL	Backend default / optional Secret override	`https://mcp-catalog.prod.runlayer.com` unless Runlayer directs otherwise
`RUNLAYER_DOWNLOAD_TOKEN`	Secret `runlayer-app` → `RUNLAYER_DOWNLOAD_TOKEN`	AI Watch / binary package discovery
AI Watch entitlement	(account-side)	Token alone is not enough — Runlayer must entitle packages for your tenant
Registry pull access	Node IAM / imagePullSecrets / GAR mirror	Account allowlisted to pull from `088332244652`

Also generate locally (do not ask Runlayer for these): SECRET_KEY and MASTER_SALT (≥32 characters in production) in runlayer-app, plus Postgres/Redis credentials in runlayer-db / runlayer-redis.

Images and chart versions

Runlayer publishes:

Application images under Customer Distribution ECR, for example:

088332244652.dkr.ecr.<region>.amazonaws.com/runlayer/backend:<version>
088332244652.dkr.ecr.<region>.amazonaws.com/runlayer/frontend:<version>
088332244652.dkr.ecr.<region>.amazonaws.com/runlayer/worker:<version>

Operator Helm chart (OCI):

oci://088332244652.dkr.ecr.us-east-1.amazonaws.com/runlayer-helm-charts/runlayer-operator

Ask Runlayer for the exact chart version and app image tags to pin. GKE and other non-org clusters usually need a registry mirror you control — see Runlayer Operator.

Authentication (WorkOS)

Key	Secret	`RunlayerInstance` field
`AUTH_CLIENT_ID`	`runlayer-auth`	`spec.auth.clientIdFrom`
`AUTH_API_KEY`	`runlayer-auth`	`spec.auth.apiKeyFrom`

kubectl create secret generic runlayer-auth -n runlayer-acme \
  --from-literal=AUTH_CLIENT_ID='client_…' \
  --from-literal=AUTH_API_KEY='…'

MCP Catalog

Catalog is required for a functional onboarding experience. Without a key, GET /api/v1/catalog/ returns 503 and setup UI fails.

Setting	Value
URL	Backend default: `https://mcp-catalog.prod.runlayer.com`. Override with `MCP_CATALOG_API_URL` on `runlayer-app` only if Runlayer directs otherwise.
API key	Empty by default — required; obtain from Runlayer

Put the key in runlayer-app (mounted via spec.appSecretRef):

kubectl create secret generic runlayer-app -n runlayer-acme \
  --from-literal=SECRET_KEY='…' \
  --from-literal=MASTER_SALT='…' \
  --from-literal=MCP_CATALOG_API_KEY='…'

Do not enable in-cluster components.mcpCatalogApi for the standard customer path. The operator injects catalog URL env only when that in-cluster component is enabled, so a Secret override of MCP_CATALOG_API_URL is honored for hosted catalog.

AI Watch / binary packages

Item	Who provides	Where configured
`RUNLAYER_DOWNLOAD_TOKEN`	Runlayer	`runlayer-app`
Package entitlement for that token	Runlayer	Account-side (contact Runlayer)
Cache bucket (`BINARY_PACKAGES_S3_BUCKET` / GCS equiv.)	You	`runlayer-app` + external dependencies
Workload IAM to the cache	You	Workload identity
Discovery CDN	Shared	`https://downloads.runlayer.com` (default `RUNLAYER_DOWNLOADS_BASE_URL`)

After Secrets and IAM are in place, restart backend/worker and run release discovery (Check now or the scheduled poll). A valid token without entitlement still cannot resolve an installer.

Registry access

Runlayer allowlists your cloud account (or pull principal) for Customer Distribution ECR during onboarding. Confirm you can pull the pinned tags before installing the operator. Contact support@runlayer.com if pulls return AccessDenied.

Security expectations

Obtain secrets only from Runlayer over an agreed secure channel.
Store them in Kubernetes Secrets (or your secret manager → sync into Secrets). Prefer sealed-secrets / External Secrets over plain manifests in git.
Rotate via Runlayer + your secret store; roll pods after rotation.
Never paste live AUTH_API_KEY, MCP_CATALOG_API_KEY, or RUNLAYER_DOWNLOAD_TOKEN values into docs, PRs, or support threads.

Enable

Control

Self-Hosted Deployment

Operations

Cookbook

Integrations

Connectors

Resources

Runlayer-Provided Inputs

Checklist

Images and chart versions

Authentication (WorkOS)

MCP Catalog

AI Watch / binary packages

Registry access

Security expectations

​Checklist

​Images and chart versions

​Authentication (WorkOS)

​MCP Catalog

​AI Watch / binary packages

​Registry access

​Security expectations

Checklist

Images and chart versions

Authentication (WorkOS)

MCP Catalog

AI Watch / binary packages

Registry access

Security expectations