Install on Azure
Admin guide
Greenlight installs into an Azure subscription you own. The install provisions the AKS cluster, the control-plane services, the data broker, Key Vault, PostgreSQL, and the identity bindings needed for SSO. End-to-end deploy time is typically 8–12 minutes for a standard install.
Azure Supported
AWS Coming soon
GCP Coming soonThis page walks through the Azure install. AWS and GCP are planned provider targets behind Greenlight’s cloud provider interface. The full reference architecture of what the install puts in your subscription is on the Admin guide overview.
What you need before you start
Section titled “What you need before you start”- An Azure subscription where you have permission to deploy resources and create role assignments in the Greenlight resource group. Owner, or Contributor plus Role Based Access Control Administrator, is sufficient.
- An Azure tenant connected to the identity provider you intend to use for Greenlight SSO.
- A domain where you can delegate one subdomain to Azure DNS — Greenlight uses a single delegated zone (e.g.
greenlight.contoso.com) and manages every record inside it. - A GitHub organization to install the Greenlight GitHub App into (or your equivalent SCM — GitLab and Bitbucket support comes later).
Sizing defaults
Section titled “Sizing defaults”The defaults are tuned for a design-partner footprint — roughly 10–30 provisioned apps at modest load. The Bicep template’s parameter file is the place to scale up for a larger initial footprint.
| Resource | Default |
|---|---|
| AKS system node pool | 1 × Standard_D4s_v4 |
| AKS app node pool | Standard_D4s_v4, autoscale 0–3 |
| Postgres (control plane) | Flexible Server, B2ms |
| Postgres (app databases) | Flexible Server, B2ms |
| Key Vault | Standard SKU |
| Log Analytics workspace | Pay-as-you-go |
These defaults are intentionally small. Greenlight scales horizontally; the install template is the floor, not the ceiling. If the app node pool runs out of schedulable capacity, Internal Health flags it and a deploy check reports it as a platform-capacity issue rather than an app bug — raise the pool’s maxCount (az aks nodepool update -n apps --max-count N) or VM size, or the Azure vCPU quota for the region.
Install
Section titled “Install”-
Provision the resource group. In the target subscription, create a resource group in your chosen region. Greenlight expects to be the only platform in this group.
-
Run the install. Run the Greenlight Azure install against your parameter file. The install provisions AKS, the control-plane services, Key Vault, the Postgres flexible servers, storage, container registry, DNS, and managed identities, then brings up the bootstrap wizard URL.
-
Open the bootstrap wizard. Use the
bootstrapInstallUrlprinted by the install while DNS and HTTPS for your final Greenlight URL are still being verified. -
Delegate the zone. The wizard shows the Azure nameservers for your subdomain; create that single NS delegation in your authoritative DNS. Greenlight then creates the control-plane record, the wildcard app record, and the certificate-challenge records inside the delegated zone — you never hand-create an A or CNAME record.
-
Open the dashboard. Visit
https://<your-subdomain>after the wizard verifies HTTPS. You will be guided through SSO and the initial admin grant in the first-run wizard.
First-run wizard
Section titled “First-run wizard”The dashboard’s first-run wizard captures the install-specific configuration Greenlight needs before teams can build apps:
- The OIDC IdP endpoint and the group-to-role mapping for
org_admin. - The GitHub organization the Greenlight GitHub App should be installed into.
- The public-readable plugin marketplace repository Greenlight creates by default for Codex, Claude Code, and Cursor plugins, plus any private variants you choose for desktops with managed Git access.
- The first policy bundle — Greenlight ships sensible defaults you can accept or edit.
- The first integration — usually GitHub itself, so apps can write to repos under your org.
The wizard does not need to be completed in one sitting. Each step is independent, audited, and reversible.
Post-install verification
Section titled “Post-install verification”The dashboard’s “Installation health” page checks the things that need to be true for a working install:
- SSO sign-in resolves to a real IdP user.
- OIDC sign-in includes the claims Greenlight needs for group-to-role mapping.
- The GitHub App is installed and has access to at least one repository.
- At least one plugin marketplace repo exists and has its initial Greenlight-generated commit. A public repo serves agents that install by cloning from GitHub (Claude Code CLI, Codex, Cursor) without user credentials; a private repo is what the Claude admin console’s Plugins tab accepts — Anthropic hosts a copy for Claude.ai and Claude Desktop — so create one of each to cover every surface.
- At least one integration is registered and has a valid credential.
- The policy bundle is non-empty.
- The audit log has at least one event.
- A test app can be registered and pass the policy check.
Once every check is green, the install is complete. Re-run anytime — it’s idempotent.
Upgrades
Section titled “Upgrades”Greenlight upgrades through a customer-owned updater that lives inside the same subscription. The flow and rollback story are documented in Upgrades.