Requirements and Planning

Before you install, choose a deployment, size the servers, and line up the database, network access, identity provider and secrets the installation needs. With these ready, the installation itself takes a day or less.

Choose a deployment

Every option runs in your own environment.

Deployment	Use it for	What it runs
Docker Compose on one server	A proof of concept, or one team. The simplest to run.	Governor’s web UI and API as containers on one Linux server, with Docker or Podman. Governor’s database is your own PostgreSQL.
Kubernetes or OpenShift with Helm	Production, several teams, and running many workflows at once.	Governor’s web UI, API and workers as deployments in your cluster. Add workers by raising the replica count.
TDK CLI only	Pipelines that run a fixed configuration, without the web UI.	The CLI on a machine with Java, or as a container in Docker, Kubernetes, AWS EKS or AWS ECS Fargate.
AWS or Google Cloud Marketplace	Buying and paying through your cloud account.	The TDK CLI in your cloud account, billed by usage.

Deployment

Use it for

What it runs

Docker Compose on one server

A proof of concept, or one team. The simplest to run.

Governor’s web UI and API as containers on one Linux server, with Docker or Podman. Governor’s database is your own PostgreSQL.

Kubernetes or OpenShift with Helm

Production, several teams, and running many workflows at once.

Governor’s web UI, API and workers as deployments in your cluster. Add workers by raising the replica count.

TDK CLI only

Pipelines that run a fixed configuration, without the web UI.

The CLI on a machine with Java, or as a container in Docker, Kubernetes, AWS EKS or AWS ECS Fargate.

AWS or Google Cloud Marketplace

Buying and paying through your cloud account.

The TDK CLI in your cloud account, billed by usage.

Docker Compose and Helm can both be installed on machines without internet access. See Offline Installation.

Wherever Governor runs, you can add workers in other networks, next to the databases they process.

Size the servers

The machine that runs workflows decides how fast they run. Start from this baseline:

Resource	Minimum
CPU	8 cores
Memory	32 GB
Storage	SSD, with at least 100 GB free for the platform’s working storage and logs
Network	10 Gbps

Resource

Minimum

CPU

8 cores

Memory

32 GB

Storage

SSD, with at least 100 GB free for the platform’s working storage and logs

Network

10 Gbps

On Kubernetes, treat the baseline as cluster capacity for Governor and its workers. Add capacity as data volumes grow, and add workers to run more workflows at once. Put workers close to the databases they read and write, because network latency to the databases slows every run. See Improving Performance.

The demo needs less: 8 GB of memory for Docker is enough.

Software

For You need

For	You need
Governor’s database	PostgreSQL 13 or later, with an empty database and a user that owns it.
Docker Compose	A Linux server with Docker and Docker Compose v2 or later, or Podman with Podman Compose. Red Hat Enterprise Linux with SELinux is supported.
Kubernetes or OpenShift	A cluster, `kubectl` set up for it, and Helm 3.
TDK CLI	Java 17 or later, or a container runtime.

Governor’s database

PostgreSQL 13 or later, with an empty database and a user that owns it.

Docker Compose

A Linux server with Docker and Docker Compose v2 or later, or Podman with Podman Compose. Red Hat Enterprise Linux with SELinux is supported.

Kubernetes or OpenShift

A cluster, kubectl set up for it, and Helm 3.

TDK CLI

Java 17 or later, or a container runtime.

Before you install

Different teams usually own these items. Start them early: approvals, not the software, usually set the pace.

Infrastructure

A server or cluster that meets the baseline.
Docker or Podman for Docker Compose; Helm 3 for Kubernetes.
An empty PostgreSQL 13 or later database for Governor, and the user name and password for it.
Your Synthesized license key.
For an offline installation: a way to move files to the target machines, and for Kubernetes, a container registry the cluster can reach.

Network and TLS

A DNS name for Governor, and a TLS certificate for it. Users reach Governor over HTTPS, with TLS 1.2 or later.
Access from users' browsers to Governor on port 443.
Network routes from the workers to each database they process, and from the workers to Governor’s gRPC port (50055 by default).
No outbound internet access is needed at runtime.

For every connection and its port, see Security & Compliance.

Databases

A dedicated user for the platform on each input database, with read-only access.
A dedicated output database, outside production, and a user that can write to it. A run can empty or recreate the output’s tables.
A separate user for each environment, so each can be audited and removed on its own.
Encrypted connections where your databases support them.

See Database Permissions.

Identity and secrets

An application in your identity provider for SAML or OAuth2, or the details of your LDAP or Active Directory server. See Authentication.
The groups that map to Governor’s roles: Owner, Administrator and Member.
A place to keep the secrets you generate at installation: JWT_SECRET, CREDENTIALS_ENCRYPTION_KEY and the first administrator’s password. If you use a secret manager for data source passwords, the path to them.