Skip to main content
Ryvn makes deploying applications to customer cloud environments seamless and secure. Our provisioning system handles everything from initial setup to ongoing maintenance, letting you focus on building great software while we manage the infrastructure.
Ryvn supports AWS, Google Cloud, and Azure. The setup process varies by cloud provider.
Here’s an overview of how Ryvn works with your customer’s cloud infrastructure:

​
Cloud provider setup

Configure permissions for each environment before provisioning. The exact setup differs by cloud provider:
1

Choose the account

Enter the AWS account ID where Ryvn will create the environment.
2

Grant permissions

Create the Ryvn cross-account IAM role using the dashboard’s CloudFormation, command-line, or Terraform instructions.
3

Infrastructure provisioning

After the role is verified, Ryvn assumes it to provision the infrastructure. No long-lived AWS credentials are stored.
4

Workload identity

After provisioning, the Ryvn agent uses IAM Roles for Service Accounts (IRSA) for ongoing authentication.

​
Infrastructure provisioning

Once credentials are configured, Ryvn provisions the necessary infrastructure using Terraform:
  • VPC and network configuration
  • Subnets and security groups
  • Kubernetes cluster (EKS, GKE, or AKS)
  • Load balancers and ingress controllers
  • DNS and certificate management
Finally, Ryvn deploys your application and configures monitoring with metrics collection and logging.
You can disable logging collection at your customer’s request.

​
Security

Security is foundational to our provisioning system, with multiple layers of protection throughout the process:
  • Least Privilege Access: Provisioning credentials are scoped to the minimum permissions required to set up the Ryvn environment and deploy vendor resources.
  • Workload Identity: After provisioning, the Ryvn agent authenticates using cloud-native workload identity (IRSA for AWS, Workload Identity for GCP/Azure) rather than static credentials.
  • Environment Isolation: Each customer environment has dedicated VPCs, Kubernetes namespaces, network policies, and independent access controls.
  • Secure Communication: All communication between Ryvn and your customer’s cloud environment is secured using TLS encryption, with mutual TLS authentication for service-to-service communication.

​
Customer deployment controls

After provisioning, you can give customers control over when deployments happen. Enable requireApproval on the environment so customers can review and approve changes before they’re applied to their infrastructure. See Deployment Approvals.

​
Ongoing maintenance

Ryvn handles all aspects of cluster maintenance and upgrades to ensure your infrastructure remains secure and performant.
We handle Kubernetes version upgrades twice per year using blue-green deployments for zero downtime. All upgrades are extensively tested and coordinated with cloud provider releases.