Skip to content
Back to

Cloud deployment

Cloud deployment covers production Fontana on public cloud infrastructure: Fontana can operate the host for you, or you can run the same stack in your own VPC on AWS, Azure, or GCP. In both cases you get pinned releases, cluster-per-workspace isolation, and the same Flow, AI, and compliance surface as every other deployment model.

Where Fontana runs

Section titled “Where Fontana runs”
Model Summary
Fontana-managed cloud Fontana operates the host; you consume workspaces and set policy (preferred)
Customer VPC Your AWS, Azure, or GCP account; Fontana supplies pinned releases and the install bundle
Dedicated cloud host One customer per physical box in cloud or colo; same stack, smaller shared-kernel blast radius

For on-premises and private-registry installs, see Self-hosted deployment.

Fontana-managed cloud

Section titled “Fontana-managed cloud”

Preferred for most teams. Fontana provisions and operates the Kubernetes host: platform cluster, workspace clusters, edge TLS, upgrades, backups, and monitoring. You focus on workspaces, policy, and consumption.

You provide Fontana provides
Business requirements, access policy, approved models and connectors Host provisioning, Kubernetes lifecycle, pinned upgrades
Identity federation decisions (SSO, MFA) in your IdP Workspace clusters with Zitadel, Vault, and the full app stack
BYOK and connector secrets for your integrations Snapshots before upgrades, rollback path, operational telemetry
Cloud account audit perimeter: CloudTrail, Config, GuardDuty + Security Hub, daily volume snapshots (see Network and hardening)

Contact Fontana for managed cloud onboarding, host sizing, and diligence materials.

Customer VPC

Section titled “Customer VPC”

Run Fontana inside your cloud account when you need direct control over networking, residency, backup policy, or cloud commit consumption.

You operate Fontana supplies
Cloud account, VPC, subnets, security groups, DNS where applicable Pinned OCI images and verified install bundle from GHCR
Host backups, change windows, and facility-adjacent cloud governance Same cluster-per-workspace architecture and release cadence as managed cloud
fontana apply on the box (your platform team or Fontana professional services) Upgrade bundles, snapshot/rollback semantics, observability hooks

Your workloads and persistent volumes stay in your account boundary. Fontana does not require a shared multi-tenant SaaS data plane for this model.

Releases and supply chain

Section titled “Releases and supply chain”

Cloud production hosts pull immutable release tags from GHCR (never floating latest). Bundle checksums and image scanning gates apply before a release is promoted. Your operators pin a tag in host config and reconcile with the Fontana CLI.

Getting started

Section titled “Getting started”
  1. Choose managed cloud or customer VPC with Fontana sales or your platform team.
  2. Provision or receive the host and install the CLI from the published bundle.
  3. Configure fontana.yaml (domain, tenants, release source) and run fontana apply.
  4. Wire SSO in Zitadel, BYOK in Vault, and observability webhooks per Observability.
Section titled “Related documentation”