Step 2.1: Select the Deployment Model¶
Hosted and BYOC describe where software runs; tenancy describes how customers are isolated. Offer distinct deployment models as separate plans under your product rather than combining every model into one plan.
BYOC Anywhere includes customer-account, existing-network, and customer-managed Kubernetes patterns. PrivateLink is a connectivity option, not an offline deployment mode.
Choose Where Customers Will Run Your Software¶
| Deployment path | Where it runs and who owns it | What to establish first |
|---|---|---|
| Hosted SaaS | Your provider cloud account, with the tenancy and isolation your product requires. | Connect the provider account. Select supported cloud, region, capacity, and networking. |
| BYOC account | A customer cloud account where Omnistrate bootstraps deployment cells. | Identify your Control Plane account separately from the customer account. The customer approves bootstrap and IAM setup. |
| BYOC VPC | A customer account using an existing network rather than a new default network. | Check subnets, tags, routing, DNS, egress, and network permissions. This does not import an existing cluster. |
| BYOC K8s / existing Kubernetes | A customer-managed cluster in a cloud, on premises, or another supported environment. | The customer supplies nodes, storage, networking, and endpoint exposure. Install the dataplane agent with required outbound access. |
| Air-gapped installer | A disconnected customer Kubernetes environment using a customer-operated installer. | Package Helm charts and images with INSTALLER_EMBED. Verify installation and updates without internet or control-plane connectivity. |
See Deployment Models, Tenancy Types, and BYOC Anywhere for the detailed configuration and responsibility boundaries.
Confirm the Boundary Before Connecting Accounts¶
- Record the cloud and region or cluster, network restrictions, registry access, data residency, and who owns upgrades, storage, backups, and incident response.
- Identify the account owner and required provider onboarding flow before granting permissions. Complete the selected flow in Step 2.2: Cloud account onboarding; never reuse another customer's bootstrap template or credentials.
- For BYOC, identify the designated AWS Control Plane account separately from the customer deployment target, including non-AWS and existing-Kubernetes targets.
- Confirm provider compatibility before building: OCI and Nebius require Custom Tenancy and organization enablement. OCI also requires a Plan specification, not Compose. Review provider restrictions and required permissions.
- For existing Kubernetes and air-gapped deployments, establish cluster, registry, networking, and operational prerequisites instead of assuming the hosted cloud bootstrap applies.
Next: Step 2.2: Cloud account onboarding. Connect the appropriate provider or customer account, or follow the cluster/installer onboarding path for your selected model, before building in development.