Installation Guidelines

This section provides Helm chart installation guides for each component of the Mia Platform v15 product suite in self-hosted and BYOI deployments.

For the infrastructure model overview, distribution responsibility breakdown, and the shared infrastructure requirements matrix (PostgreSQL, Kafka, Redis, etc. per product), refer to the Infrastructure Overview.

Required tooling

The following tools must be available on the operator's workstation before installing any product chart:

Tool	Version	Notes
kubectl		Configured to access the target cluster.
Helm	v3
helm-secrets (optional)		Required only when using SOPS-encrypted values files.
Kubernetes cluster	1.32 – 1.34
Traefik		Required for IngressRoute resources. Other ingress controllers can be used but require custom configuration.
Container registry access		Credentials for nexus.mia-platform.eu, provided by Mia Platform.

Installation map

Auth tooling (Keycloak + Realm Management) must be operational before any product chart is installed: it provides the OIDC issuer URL required by every other component.

Homepage & RBAC is also a prerequisite and must be installed right after the Auth tooling, before any product: it exposes the rbacManagement authorization API (via authzUrl) that Console, Catalog, and AI Foundry rely on to manage users, tenants, roles, and permissions, so without it the products cannot be used. Each product bundles its own authtool-bff instance for browser login and does not depend on the services chart for it.

AI Services completes the shared services layer and is installed right after Homepage & RBAC, whose authorization API it uses. It provides the AI gateway (LiteLLM), the secret store holding each tenant's gateway key, document conversion (Docling), the workflow engine and the memory service. These are used not only by AI Foundry but also by the AI components bundled in Homepage & RBAC and in Catalog (the adk-be-app agent backend and the chat attachments), so the AI features of every product need AI Services to be running.

Once the shared services layer is running, Console and Catalog can be installed in parallel. AI Foundry depends on Catalog (shared agent backend and navigation links) and must be installed last.

Looking for a working reference example?

If you'd like to see the whole suite running end-to-end before planning your own installation, see the On-Prem Quickstart: a local reference implementation you can use as a blueprint.

┌──────────────────────────────────────────────────────────────────────┐
│  Shared services layer                                               │
│                                                                      │
│  1 — Auth tooling  (prerequisite for all)                            │
│       Keycloak  ──►  Realm Management                                │
│                              │                                       │
│                              ▼                                       │
│  2 — Homepage & RBAC  (prerequisite for all — authz API)             │
│                              │                                       │
│                              ▼                                       │
│  3 — AI Services  (AI gateway, secret store, Docling — used by the   │
│                    AI features of Homepage, Catalog and AI Foundry)  │
└────────────────────────────────┬─────────────────────────────────────┘
                                 ▼
                     ┌───────────┴───────────┐
                     ▼                       ▼
           ┌──────────────────┐    ┌──────────────────┐
           │  4: Console      │    │  4: Catalog      │
           └──────────────────┘    └────────┬─────────┘
                                            ▼
                              ┌──────────────────────────────┐
                              │  5: AI Foundry               │
                              │  (requires Catalog)          │
                              └──────────────────────────────┘

Component index

Before you start: Auth architecture

If this is your first self-hosted Mia Platform installation, read the Authentication Architecture overview and the Federation Strategies guide before touching any product chart. These decisions (realm layout, IdP federation model) propagate to every product's configurations.keycloak block.

Shared services & tools

Component	Helm chart	Documentation
Auth: Keycloak	keycloak-operator	Overview · Getting Started
Auth: Realm Management	keycloak-realm-management	Overview · Getting Started
Homepage & RBAC	services	Overview · Getting Started
AI Services	ai-services	Overview · Getting Started

Products

Product	Helm chart	Documentation
Console	console	Overview · Getting Started
Catalog	catalog	Overview · Getting Started
AI Foundry	ai-foundry	Overview · Getting Started