Skip to main content

Platform setup

Stacklok Enterprise

Stacklok Enterprise ships as an umbrella Helm chart that installs its platform components in one release.

Learn more about Stacklok Enterprise.

How the platform fits together​

The platform runs in your Kubernetes cluster, with a control plane for configuration and identity, gateways for AI client traffic, and an MCP runtime for in-cluster servers.

Stacklok Enterprise architecture showing the control plane, gateways, and MCP runtime in Kubernetes, connected to users, an identity provider, AI clients, LLM providers, and remote MCP servers.Stacklok Enterprise architecture showing the control plane, gateways, and MCP runtime in Kubernetes, connected to users, an identity provider, AI clients, LLM providers, and remote MCP servers.

In the control plane, Enterprise Manager serves policy to the Stacklok CLI and maintains the directory of users, groups, and connectors. The console provides the web interface for administrators and end users, and the optional Registry Server holds the approved MCP server and skills catalog. Your identity provider authenticates users and provisions users and groups into the directory.

Two optional gateways govern the traffic your AI clients send. The AI Gateway governs calls to large language model (LLM) providers, and the Connector Gateway governs MCP tool calls to connectors. A connector can be a remote MCP server or one the ToolHive Operator runs in your cluster, including a Virtual MCP Server (vMCP) that aggregates multiple servers. Both gateways use the Enterprise Manager's directory for identity and access configuration.

Green arrows show runtime traffic, and gray arrows show configuration and identity connections. Dashed component borders mark optional components. For the services and dependencies you need to prepare, see the deployment architecture.

Deployment sequence​

When you are ready to deploy, work through these steps in order. Each links to its detailed guide.

  1. Configure identity. Set up your identity provider (authorization server, audiences, scopes, claims, and OAuth clients) so the platform components and clients can authenticate. Do this first, because deployment wires in the client IDs and audiences you create here. See Configure platform identity.
  2. Deploy the platform. Install the umbrella chart with the identity values from the previous step. The chart deploys the ToolHive operator, the Enterprise Manager, the console, and the Registry Server as subcharts. See Deploy the platform. Before you install, run preflight checks to catch cluster problems before Helm installs the release.
  3. Enable the gateways you need. Both are off by default. See Configure the AI Gateway and Configure the Connector Gateway.
  4. Populate the directory. Provision users and groups from your identity provider, since access and budgets are granted to them. See SCIM provisioning.
  5. Configure policies. Use the Enterprise Manager to pin the registry, control non-registry servers, and standardize telemetry across clients. experience. See Configure policies.
  6. Set up authorization. Map identity-provider groups and roles to MCP access with the enterprise authorization custom resources. See Enterprise authorization.
  7. Roll out the clients. Distribute the Stacklok CLI to your users, and point them at Roll out gateway clients to distribute setup instructions for editors and agents.
  8. Verify end to end. Sign in to the console and confirm the path from catalog to client.

Contents​