Skip to main content
Planned release. Self-hosted Asymptote is in development and offered to design partners through a Private Deployment engagement; the Helm chart and Terraform modules described in this section are not generally available yet. This section describes the planned release: chart names, values keys and paths may change before it ships. Today’s Asymptote Cloud dashboard uses hosted services for sign-in and product analytics; the self-hosted release replaces them, as described in System Architecture. Contact us to take part.

Kubernetes Deployment

Install the Helm chart in your cluster.

Terraform

Create the cluster and services on AWS, Google Cloud or Azure.

Overview

Services

Core services

Background workers

Data services

Data flow

  1. Beacon on an endpoint records agent activity and sends batches to ingest over HTTPS, with the device’s own key.
  2. ingest checks the key, stamps the device and organization on each event, and writes the batch to your bucket.
  3. The bucket posts a notice for the new object. loader reads it, fetches the object and loads it into ClickHouse. Retried batches collapse on Beacon’s deterministic event IDs.
  4. web and api read ClickHouse for search and timelines, and PostgreSQL for everything else.
  5. When enforcement is on, the hooks ask policy before a prompt or tool call goes ahead, and policy asks the LLM endpoint when a policy needs a judgment.
  6. workers review recorded sessions, raise findings, and post them to Slack if you turned that on.

Network requirements

Inbound

Expose these on the internet, or only on your private network or VPN.

From the cluster to your cloud account

Use private endpoints (AWS PrivateLink, Private Service Connect, Azure Private Link) to keep this traffic off the internet.

Outbound, outside your account

The deployment sends no telemetry, usage analytics, license checks or reporting to Asymptote. Product analytics in the dashboard are compiled out of self-hosted images.

Hosted services in Asymptote Cloud

Asymptote Cloud’s dashboard uses two hosted services that the self-hosted release does not:

Security model

Authentication

Secrets management

The chart reads credentials from one Kubernetes secret: the license key, the PostgreSQL URL, the two key peppers (for hashing device keys and enforcement tokens), the identity provider’s client secret, and, where they apply, an LLM API key and a Slack token. See Kubernetes Deployment. Create them yourself, or sync them from Secrets Manager, Secret Manager or Key Vault with the External Secrets Operator.

Network security

  • Every container runs as non-root with a read-only root file system.
  • The chart ships network policies that allow only the traffic in the table above.
  • Images are signed and come with an SBOM. Enforce the signature at admission if your cluster supports it.

Support access

Asymptote has no access to your deployment. For a support case, you can give an Asymptote engineer temporary access in a session you open and end, or send logs yourself.

Monitoring

Key metrics

Every service exposes Prometheus metrics and writes structured JSON logs. Scrape them with Prometheus or your cloud’s managed Prometheus, and ship logs with the agent you already run.