Install

Prerequisites

• A Kubernetes cluster you operate, with the gVisor runtime class available to workspace pods.
• A Postgres database and an object storage bucket for the installation.
• A network policy engine, so each workspace denies outbound traffic by default.
• Admin rights to install a GitHub app on the organisation that holds the repository.
• An SSO provider that speaks OIDC, and SCIM if you want deprovisioning to end grants.
• An API key from your model vendor, if agents run inside Occlude.

Steps

1. Install the chart into its own namespace, with a values file naming your database, bucket and network.
2. Connect your source host: install the read-only GitHub app on the repositories Occlude should observe.
3. Connect SSO, so admins and approvers sign in with the accounts they already have.
4. Run Observation Mode for a window you choose. Review the inventory and the proposed profiles.
5. Create a profile from the inventory, and issue the first grant.

helm install occlude <chart> --namespace occlude --values values.yaml

What you operate

The chart, the database, the bucket and the cluster's capacity. Nothing per contractor: a workspace starts per session and closes when its grant ends.