Requirements

The platform installs onto a Kubernetes cluster you run. RigFabTech ships charts and images. It never builds or changes your cluster.

Kubernetes

Each release supports three Kubernetes minor versions: its newest and the two before it. This release supports 1.35 to 1.37.

Any CNCF-conformant distribution works, with the prerequisites below.
rft check says whether your cluster's version is supported.
The support policy names the distributions every release is tested on, the ones RigFabTech supports and the one the platform runs in production on.

Prerequisites in your cluster

What	Why
CloudNativePG operator	Each product's database is a CloudNativePG cluster
An OpenID Connect provider, such as Microsoft Entra ID, AD FS, Okta or Keycloak	Sign-in to every product. See Sign-in
A default StorageClass	Volumes for the databases and the bundled object store
An IngressClass, or the Gateway API with a Gateway	Routes to the products
cert-manager, when your Ingress or Gateway takes certificates from an issuer	TLS for the platform's names

The charts install none of these, so they never collide with the ones you already run. rft check finds each one.

Pod Security

Every pod the charts create meets restricted, the strictest Pod Security Standard. So does every database pod CloudNativePG creates for a product. Each pod:

Runs as a non-root user.
Drops every capability.
Can't escalate privileges.
Uses the runtime's default seccomp profile.

RigFabTech's release gate installs each release into namespaces that enforce restricted.

Namespace	Pod Security level it needs	Exception
`rft-system`	`restricted`	None
`rft-app-<PRODUCT>`, one per product	`restricted`	None

Helm can't label the namespace it installs into, so you set the label yourself, as Install shows.

A cluster that enforces restricted everywhere, such as RKE2 with its CIS profile, needs no exemption for these namespaces.
CloudNativePG's operator, cert-manager and your ingress controller run in their own namespaces, at the level their own documentation gives.
Anything you add to these namespaces must meet restricted too. For example, with an HTTP-01 issuer, cert-manager starts its solver pods next to each Ingress, in these namespaces.

Size

The base chart asks for about 500 MB of memory and a 50 GB volume for the bundled object store.
Each product asks for between 100 MB and 1 GB of memory, plus a 1 GB database volume unless its chart says otherwise.

Names and network

One base domain, such as rft.example.com. Each product answers on <product>.<domain>, and user provisioning on scim.<domain>. Point them at your ingress.
Entra ID provisioning: scim.<domain> must be reachable from Microsoft's AzureActiveDirectory addresses, or you use its provisioning agent. See User provisioning.
s3.<domain> for the bundled object store. People's browsers upload files to it and download them from it. Give it a DNS record and a certificate like the products' names. A *.<domain> wildcard covers both. Your ingress must pass request bodies of at least 100 MB to it and allow each request at least 60 seconds. See Object storage.
The registry: the nodes and the machine you run rft on reach registry.rigfab.com and its blob host on HTTPS. An air-gapped site uses its own registry instead. See Install without internet access.
Your identity provider: the products and the base chart's controller reach it on HTTPS, such as login.microsoftonline.com. People's browsers reach it to sign in.
The licence service: the licence agent reaches it on HTTPS for the daily check-in. Without it, everything still works.

Telemetry lists what the platform sends to RigFabTech.

On your machine

kubectl, pointed at the cluster.
helm 3.8 or later, pointed at the cluster.
rft. See Install.