2. Provision your cloud
Owner: Cloud Ops
Choose exactly one provider guide. Each guide ends with the same deliverables: a working Kubernetes context, a managed PostgreSQL database, workload identity for External Secrets, a customer-controlled HTTPS host, and a provider values file for the shared Helm step.
Choose a deployment target
Section titled “Choose a deployment target”Deploy EKS, Aurora PostgreSQL, AWS Secrets Manager, and an ALB protected by an ACM certificate. Choose AWS when the customer standardizes on AWS networking, IAM, and managed database operations.
Deploy GKE, Cloud SQL for PostgreSQL, Google Secret Manager, a static global address, and a Google-managed certificate. Choose Google Cloud when the customer standardizes on GKE and Workload Identity.
Deploy AKS, PostgreSQL Flexible Server, Azure Key Vault, a static public IP, ingress-nginx, and cert-manager. Choose Azure when the customer standardizes on Azure networking and managed identities.
What remains shared
Section titled “What remains shared”All provider guides return to the same Helm installation. Do not copy application configuration between provider documents. Entra/OIDC, the runtime workloads, migrations, the scheduler, the optional fleet console, SCIM, verification, upgrades, and the IT handoff are documented once in the shared steps.