> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Runlayer-Provided Inputs

> Credentials, image pins, and registry access you must obtain from Runlayer before installing the operator

Self-hosted Kubernetes deployments need values that only Runlayer can issue. **Contact your Runlayer account or support team** for each item below. Never publish secret values in tickets, git, chat, or public docs.

After you receive them, store secrets in Kubernetes Secrets in the platform namespace (default `runlayer-<customerId>`). See [Runlayer Operator](/deployment/runlayer-operator) for install order.

## Checklist

| Input                         | Where it lands                                                     | Notes                                                                      |
| ----------------------------- | ------------------------------------------------------------------ | -------------------------------------------------------------------------- |
| **App / chart versions**      | `RunlayerInstance.spec.version`, Helm `--version`, `spec.images.*` | Pin a release Runlayer confirms for your tenant                            |
| **Container images**          | `spec.images.backend` / `frontend` / `worker` (+ optionals)        | Customer Distribution ECR `088332244652` (or a mirror you can pull)        |
| **Operator Helm chart**       | `helm upgrade --install … --version`                               | OCI chart from Customer Distribution ECR                                   |
| **WorkOS `AUTH_CLIENT_ID`**   | Secret `runlayer-auth` → `AUTH_CLIENT_ID`                          | Non-secret client id; still treat as tenant-specific                       |
| **WorkOS `AUTH_API_KEY`**     | Secret `runlayer-auth` → `AUTH_API_KEY`                            | Secret — never commit                                                      |
| **`MCP_CATALOG_API_KEY`**     | Secret `runlayer-app` → `MCP_CATALOG_API_KEY`                      | Required for onboarding / catalog UI; empty until Runlayer issues one      |
| **Catalog URL**               | Backend default / optional Secret override                         | `https://mcp-catalog.prod.runlayer.com` unless Runlayer directs otherwise  |
| **`RUNLAYER_DOWNLOAD_TOKEN`** | Secret `runlayer-app` → `RUNLAYER_DOWNLOAD_TOKEN`                  | AI Watch / binary package discovery                                        |
| **AI Watch entitlement**      | (account-side)                                                     | Token alone is not enough — Runlayer must entitle packages for your tenant |
| **Registry pull access**      | Node IAM / imagePullSecrets / GAR mirror                           | Account allowlisted to pull from `088332244652`                            |

Also generate locally (do **not** ask Runlayer for these): `SECRET_KEY` and `MASTER_SALT` (≥32 characters in production) in `runlayer-app`, plus Postgres/Redis credentials in `runlayer-db` / `runlayer-redis`.

## Images and chart versions

Runlayer publishes:

* **Application images** under Customer Distribution ECR, for example:

  ```text theme={null}
  088332244652.dkr.ecr.<region>.amazonaws.com/runlayer/backend:<version>
  088332244652.dkr.ecr.<region>.amazonaws.com/runlayer/frontend:<version>
  088332244652.dkr.ecr.<region>.amazonaws.com/runlayer/worker:<version>
  ```

* **Operator Helm chart** (OCI):

  ```text theme={null}
  oci://088332244652.dkr.ecr.us-east-1.amazonaws.com/runlayer-helm-charts/runlayer-operator
  ```

Ask Runlayer for the **exact chart version and app image tags** to pin. GKE and other non-org clusters usually need a registry mirror you control — see [Runlayer Operator](/deployment/runlayer-operator).

## Authentication (WorkOS)

| Key              | Secret          | `RunlayerInstance` field |
| ---------------- | --------------- | ------------------------ |
| `AUTH_CLIENT_ID` | `runlayer-auth` | `spec.auth.clientIdFrom` |
| `AUTH_API_KEY`   | `runlayer-auth` | `spec.auth.apiKeyFrom`   |

```bash theme={null}
kubectl create secret generic runlayer-auth -n runlayer-acme \
  --from-literal=AUTH_CLIENT_ID='client_…' \
  --from-literal=AUTH_API_KEY='…'
```

## MCP Catalog

Catalog is required for a functional onboarding experience. Without a key, `GET /api/v1/catalog/` returns `503` and setup UI fails.

| Setting     | Value                                                                                                                                               |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| **URL**     | Backend default: `https://mcp-catalog.prod.runlayer.com`. Override with `MCP_CATALOG_API_URL` on `runlayer-app` only if Runlayer directs otherwise. |
| **API key** | Empty by default — **required**; obtain from Runlayer                                                                                               |

Put the key in `runlayer-app` (mounted via `spec.appSecretRef`):

```bash theme={null}
kubectl create secret generic runlayer-app -n runlayer-acme \
  --from-literal=SECRET_KEY='…' \
  --from-literal=MASTER_SALT='…' \
  --from-literal=MCP_CATALOG_API_KEY='…'
```

Do not enable in-cluster `components.mcpCatalogApi` for the standard customer path. The operator injects catalog URL env **only** when that in-cluster component is enabled, so a Secret override of `MCP_CATALOG_API_URL` is honored for hosted catalog.

## AI Watch / binary packages

| Item                                                    | Who provides | Where configured                                                            |
| ------------------------------------------------------- | ------------ | --------------------------------------------------------------------------- |
| `RUNLAYER_DOWNLOAD_TOKEN`                               | Runlayer     | `runlayer-app`                                                              |
| Package entitlement for that token                      | Runlayer     | Account-side (contact Runlayer)                                             |
| Cache bucket (`BINARY_PACKAGES_S3_BUCKET` / GCS equiv.) | You          | `runlayer-app` + [external dependencies](/deployment/external-dependencies) |
| Workload IAM to the cache                               | You          | [Workload identity](/deployment/workload-identity)                          |
| Discovery CDN                                           | Shared       | `https://downloads.runlayer.com` (default `RUNLAYER_DOWNLOADS_BASE_URL`)    |

After Secrets and IAM are in place, restart backend/worker and run release discovery (**Check now** or the scheduled poll). A valid token without entitlement still cannot resolve an installer.

## Registry access

Runlayer allowlists your cloud account (or pull principal) for Customer Distribution ECR during onboarding. Confirm you can pull the pinned tags before installing the operator. Contact [support@runlayer.com](mailto:support@runlayer.com) if pulls return `AccessDenied`.

## Security expectations

* Obtain secrets **only** from Runlayer over an agreed secure channel.
* Store them in Kubernetes Secrets (or your secret manager → sync into Secrets). Prefer sealed-secrets / External Secrets over plain manifests in git.
* Rotate via Runlayer + your secret store; roll pods after rotation.
* **Never** paste live `AUTH_API_KEY`, `MCP_CATALOG_API_KEY`, or `RUNLAYER_DOWNLOAD_TOKEN` values into docs, PRs, or support threads.