Cloud deployment

Cloud deployment covers production Fontana on public cloud infrastructure: Fontana can operate the host for you, or you can run the same stack in your own VPC on AWS, Azure, or GCP. In both cases you get pinned releases, cluster-per-workspace isolation, and the same Flow, AI, and compliance surface as every other deployment model.

Where Fontana runs

GHCR - pinned OCI images

↓

Amazon Web Services

Microsoft Azure

Google Cloud

Other cloud providers

On-premises Kubernetes

Dedicated / private cloud

Model	Summary
Fontana-managed cloud	Fontana operates the host; you consume workspaces and set policy (preferred)
Customer VPC	Your AWS, Azure, or GCP account; Fontana supplies pinned releases and the install bundle
Dedicated cloud host	One customer per physical box in cloud or colo; same stack, smaller shared-kernel blast radius

For on-premises and private-registry installs, see Self-hosted deployment.

Fontana-managed cloud

Preferred for most teams. Fontana provisions and operates the Kubernetes host: platform cluster, workspace clusters, edge TLS, upgrades, backups, and monitoring. You focus on workspaces, policy, and consumption.

You provide	Fontana provides
Business requirements, access policy, approved models and connectors	Host provisioning, Kubernetes lifecycle, pinned upgrades
Identity federation decisions (SSO, MFA) in your IdP	Workspace clusters with Zitadel, Vault, and the full app stack
BYOK and connector secrets for your integrations	Snapshots before upgrades, rollback path, operational telemetry
	Cloud account audit perimeter: CloudTrail, Config, GuardDuty + Security Hub, daily volume snapshots (see Network and hardening)

Contact Fontana for managed cloud onboarding, host sizing, and diligence materials.

Customer VPC

Run Fontana inside your cloud account when you need direct control over networking, residency, backup policy, or cloud commit consumption.

You operate	Fontana supplies
Cloud account, VPC, subnets, security groups, DNS where applicable	Pinned OCI images and verified install bundle from GHCR
Host backups, change windows, and facility-adjacent cloud governance	Same cluster-per-workspace architecture and release cadence as managed cloud
fontana apply on the box (your platform team or Fontana professional services)	Upgrade bundles, snapshot/rollback semantics, observability hooks

Your workloads and persistent volumes stay in your account boundary. Fontana does not require a shared multi-tenant SaaS data plane for this model.

Dedicated cloud host

Some regulated customers choose a dedicated physical host in cloud or colo (one customer per box) with the same k3d cluster-per-workspace layout. That reduces shared-kernel exposure compared with multi-tenant hosts while keeping the standard Fontana stack.

Releases and supply chain

Cloud production hosts pull immutable release tags from GHCR (never floating latest). Bundle checksums and image scanning gates apply before a release is promoted. Your operators pin a tag in host config and reconcile with the Fontana CLI.

Getting started

1. Choose managed cloud or customer VPC with Fontana sales or your platform team.
2. Provision or receive the host and install the CLI from the published bundle.
3. Configure fontana.yaml (domain, tenants, release source) and run fontana apply.
4. Wire SSO in Zitadel, BYOK in Vault, and observability webhooks per Observability.

Related documentation

• Architecture - platform and workspace topology
• Backup and restore - snapshots and Admin configuration backup
• Fontana CLI - apply, tenants, snapshots, rollback
• Security - encryption at rest and workspace isolation
• Compliance evidence - audit and lineage evidence