Overview

Lifecycle Management runs through the Lerian BYOC agent. You install the agent in your Kubernetes cluster. Lerian then installs, upgrades, rolls back, and removes Lerian products in your cluster through the agent. The agent installs and operates applications. It does not create cloud infrastructure, and it holds no cloud credential.

​

How the agent connects to Lerian

---

• You install one agent in each cluster.
• The agent opens every connection to Lerian. Your cluster needs no inbound access from Lerian.
• The agent connects to Lerian over HTTPS.
• Each agent has its own credential. Lerian identifies your company from that credential, not from data that the agent sends.
• Inside the cluster, the agent serves a health and metrics endpoint.

​

What Lerian does through the agent

---

At your request, Lerian runs these operations in your cluster through the agent:

• Install a Lerian product.
• Upgrade a product.
• Roll back a product to an earlier version.
• Remove a product.
• Check that the cluster meets the needs of a product before the install.

If an upgrade fails, the agent rolls the product back to its last working version. The agent does not roll back after a database schema change ran. In that case, the product stays on the failed upgrade. The agent pulls a product’s chart from an allowed registry, by the exact content digest that Lerian names. It refuses a chart that has no digest. The agent also reports to Lerian the health of the products that Lerian asks it to observe. Lerian also updates the agent itself. The agent first runs the new build once in your cluster as a test. It replaces itself only when that test passes.

​

What you control

---

• Namespaces: You create the namespaces where the agent can install products, and you list them when you install the agent. To add a namespace later, upgrade the agent chart.
• Registries: You set the registries from which the agent can pull product charts and its own image.
• Private registry credential: If your registry needs a credential, the agent sends it only to that registry.
• Your secret manager: The agent can use your own secret manager through External Secrets.
• Network: You can limit the outbound traffic of the agent, and set a proxy and your own certificate authorities.
• Removal: You can uninstall the agent.

For each of these settings, see the agent chart README.

​

What Lerian sees

---

The agent sends information about your cluster and your products to Lerian. For example:

• At regular intervals: The status of the agent, and the health of each product that it observes.
• When a product looks unwell: The last output of its stopped containers, and the warning events about the product.
• On request from a Lerian operator: Product status, an upgrade preview, the computed configuration values, live resource usage, and the cluster check result.

For the full inventory, with when each item leaves and where it lands, see “What leaves your cluster” in the agent chart README.

​

Security

---

• The agent runs as a non-root user, with a read-only file system and no added privileges.
• Across the cluster, the agent reads information such as nodes, pods, and services. It can also create namespaces and manage storage classes.
• In the namespaces that you list, the agent installs products and writes their Secrets.
• Install the agent in a dedicated namespace.

​

Get started

---

​

Manage installed products

---

To install, upgrade, roll back, or remove a product, send a request through the Lerian Support Portal. Lerian runs the operation in your cluster through the agent. To remove the agent itself, uninstall its chart. See the agent chart README.

​

Related

---