Self-hosted reference architecture

This page draws one deployment. It is a self-hosted instance installed on Kubernetes from the policyarc-server Helm chart, with the chart's default values. PolicyArc also runs as a hosted service, and this section does not describe how that service is run. How it works covers the request flow inside an instance.

We built the picture from the chart's rendered output, helm template with the default values. We have not installed the chart on a cluster for this page.

Each outlined group is a trust boundary. The table below says what crosses each one. It also covers the link between the server and OPA, which stays inside your namespace and is guarded by the chart's network policies.

What crosses each boundary

Boundary	What crosses it	How the other side is checked
Network to the ingress controller	Every path of the server. The chart's ingress sends / and everything under it to the server, including /admin, /bundles and /actuator.	TLS is your ingress controller's job. The chart's ingress.tls is empty by default. Each path checks its own caller, see Security overview.
Ingress controller to the server pods	Plain HTTP on port 8080 inside the cluster	The server's network policy accepts port 8080 from OPA, from the namespace in networkPolicy.ingressNamespaceSelector, and from the pods in networkPolicy.controlPlaneAccess, which is on by default. The server reads the client address from one proxy hop of X-Forwarded-For, because the chart sets authServer.trustedProxyCount to 1.
Server and OPA, inside your namespace	The server posts each decision input to OPA on port 8181. OPA fetches the policy bundle from the server on port 8080.	Plain HTTP. The bundle fetch carries the X-Bundle-API-Key header. OPA's decision API takes no key. The chart's network policy lets only the server pods reach OPA.
Server to PostgreSQL	All instance state	The default JDBC URL sets sslmode=require. The password comes from the chart's Secret.
Server to outside services	Identity provider sign-ins, calls the managed gateway forwards to upstream APIs, and telemetry when you turn it on	The server's network policy allows TCP 80 and 443 to any address. Data handling lists each outbound call.

The managed gateway runs inside the authorization server pods. The chart also has a gateway component, off by default, for a separate gateway process. It is not drawn here.

What the picture leaves out

• PostgreSQL is not in the chart. You run it, back it up and size its connections. Deployment model lists what you operate.
• The server and OPA run one replica each by default. Availability and recovery covers more replicas and what happens when a pod stops.
• The network policies take effect only when the cluster's network plugin enforces them. We read the policies from the rendered chart. We have not run them on a cluster.