> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Manager via Helm

> Helm chart installation and version compatibility reference for deploying Access Manager on Kubernetes, including Auth, Identity, and supporting parts.

Access Manager handles authentication, authorization, and identity management across all Lerian products. It includes an Auth service for token management and an Identity service for user and role administration.

## What the chart installs

***

The chart installs three Deployments, each with its own Service and ConfigMap:

* **Auth**: issues and validates tokens.
* **Identity**: administers users, roles, and permissions.
* **Caradhras**, the identity backend, under the `caradhras` values block: holds the users, roles, and permissions that Auth and Identity act on. The chart also runs its schema migration Job, and an optional web UI Deployment. See [What is Caradhras](/en/platform/access-manager/what-is-caradhras).

Auth and Identity each get a Secret. The chart adds an Ingress, a HorizontalPodAutoscaler, and a PodDisruptionBudget per service when you enable each of them.

The chart bundles PostgreSQL and Valkey and enables both by default. Disable either one to use an externally managed service instead.

## Prerequisites

***

* Standalone: you can install it independently of Midaz.
* Helm 3.8 or later for OCI registry support. Use a [currently supported Kubernetes minor release](https://kubernetes.io/releases/) in production. The chart enables HorizontalPodAutoscaler and PodDisruptionBudget resources, so the cluster must serve `autoscaling/v2` and `policy/v1`.

## Values you must set

***

The chart refuses to render without these keys:

| Key                                         | Purpose                                          |
| :------------------------------------------ | :----------------------------------------------- |
| `auth.secrets.AUTHORIZER_CLIENT_SECRET`     | The Auth service's credential for Caradhras.     |
| `identity.secrets.AUTHORIZER_CLIENT_SECRET` | The Identity service's credential for Caradhras. |

Leave the database password empty while the bundled PostgreSQL is enabled. The subchart generates it into its own Secret, and the services read it from there. Set `auth.secrets.DB_PASSWORD` only when you point the chart at an external database that has no existing Secret of its own.

## OCI registry

***

```bash theme={null}
oci://registry-1.docker.io/lerianstudio/plugin-access-manager
```

## Installation

***

Read the current chart version and the application version it deploys before you install:

```bash theme={null}
helm show chart oci://registry-1.docker.io/lerianstudio/plugin-access-manager
```

```bash theme={null}
helm install access-manager oci://registry-1.docker.io/lerianstudio/plugin-access-manager --version <version> -n access-manager --create-namespace -f my-values.yaml
```

Override `auth.image.tag` or `identity.image.tag` only when your release process requires a different image.

## Upgrade and uninstall

***

```bash theme={null}
helm upgrade access-manager oci://registry-1.docker.io/lerianstudio/plugin-access-manager \
  --version <new-version> -n access-manager -f my-values.yaml
```

```bash theme={null}
helm uninstall access-manager -n access-manager
```

Uninstalling removes the Kubernetes resources. Check the storage settings of the bundled PostgreSQL and Valkey subcharts before you uninstall, and back up the data you want to keep.

## Resources

***

* [Access Manager documentation](/en/platform/access-manager)
* [Helm chart repository](https://github.com/LerianStudio/helm)