Prerequisites

Everything here applies no matter which cluster or installer you pick.

Onboarding credentials

You don’t self-generate these — a Marshal operator issues them once, per deployment, over a secure channel.

Value	Looks like	What it’s for
`deployment_id`	`dep_ab12cd`	Identifies your deployment. Registry username.
`installation_jwt`	`eyJhbGci...`	Your license — verified against Marshal’s public JWKS, refreshed periodically.
`registry_pull_token`	`mrpt_eyJhbGci...`	Authenticates every pull from `registry.marshal.codes`: product images, the Helm chart, and (without a pull-through cache) session tool images.
`chart_version`	`0.10.0`	Exact product version to install. Always ask for the current latest.

Verify them before anything else:


helm registry login registry.marshal.codes --username <deployment_id> --password '<registry_pull_token>'
helm pull oci://registry.marshal.codes/marshal-charts/marshal --version <chart_version>

If this fails, stop and go back to your Marshal contact — nothing below works without valid credentials. Also: the registry deliberately rejects tag/version listing (a 404, by design) — there’s no way to enumerate available versions client-side. chart_version must come from your onboarding email.

PostgreSQL 16

Marshal needs a durable Postgres 16 database for all persistent state (sessions, orgs, credentials, manifests, audit trail). No installer here provisions this for you by default (GKE/EKS have an opt-in exception — see their pages) — you bring a connection string in this shape, reachable from the cluster over private networking:


postgres://<db-user>:<db-password>@<private-ip>:5432/<db-name>?sslmode=require

Hostname & network access

Decide your hostname now (e.g. marshal.acme.com) — required as input to the first apply/sync even before real DNS exists.
Reach inside your VPC/VNet. Marshal is not exposed to the public internet by default. Have existing VPN/bastion access, or use the temporary-bastion steps on the cloud-specific pages.
Outbound HTTPS (443) from the cluster to registry.marshal.codes (routed through your pull-through cache where you run one) and keys.marshal.codes / tokens.marshal.codes for license verification. No inbound access into your environment is ever required. See Networking & Egress for the full picture.

A pull-through image registry cache — required, not optional

Every customer shares the same registry and the same per-token rate limit — direct pull at real usage causes throttled/failed session starts unrelated to your own configuration. Exactly how you get one depends on which target you pick — see Registry options.

Local tooling

Terraform ≥ 1.5 (Terraform paths only), Helm 3, kubectl
Your cloud’s CLI (gcloud / aws), authenticated
ArgoCD path only: ArgoCD installed in the cluster (namespace argocd) and the argocd CLI

☐ Four credentials verified with helm registry login + helm pull · ☐ Postgres 16 reachable, connection string in hand (unless provisioning it) · ☐ Hostname decided · ☐ Network access into the VPC sorted · ☐ Pull-through cache plan understood · ☐ Tooling installed