Deployment Options
Relevant source files
The following files were used as context for generating this wiki page:
Fleet offers a highly flexible deployment architecture, supporting environments ranging from local development setups to large-scale enterprise infrastructure. The system is designed to be platform-agnostic, provided that its core dependencies—MySQL for data persistence and Redis for caching and live query results—are satisfied. Fleet can be deployed on-premises, in air-gapped environments, or across major cloud providers like GCP, AWS, and Azure.
The deployment scope typically includes the main Fleet binary (running as a web service), a MySQL 8.0 database, and a Redis-compatible cache (such as Valkey). For production environments, organizations can leverage Infrastructure as Code (IaC) tools like Terraform and Helm to automate the provisioning of VPCs, load balancers, and managed database services.
Sources: articles/deploy-fleet-on-kubernetes.md:12-25, articles/deploy-fleet-on-gcp.md:3-12, infrastructure/render/README.md:1-25
Infrastructure Architecture
A standard Fleet deployment consists of three primary layers: the Load Balancer (ingress), the Application Layer (Fleet Service), and the Data Layer (MySQL and Redis).
Core Components
| Component | Role | Description |
|---|---|---|
| Fleet Web Service | Application | The core logic engine, processing API requests and managing host check-ins. |
| MySQL | Persistence | Stores host information, query results, policies, and configuration. Version 8.0 is standard. |
| Redis / Valkey | Caching | Handles live query results, background tasks, and session caching. |
| Load Balancer | Ingress | Terminates TLS and routes traffic to Fleet instances. |
Sources: infrastructure/render/README.md:9-25, articles/deploy-fleet-on-kubernetes.md:21-25
Deployment Logic Flow
The following diagram illustrates the typical network and data flow within a cloud-based deployment (e.g., GCP or Kubernetes).
Diagram showing the flow from external users through a load balancer into a private VPC containing the Fleet application and its data dependencies.
Sources: articles/deploy-fleet-on-gcp.md:188-212, articles/deploy-fleet-on-ubuntu-with-elastic.md:33-54
Kubernetes Deployment (Helm & Terraform)
Kubernetes is the recommended approach for orchestrating Fleet at scale. Deployment is typically handled via the official Fleet Helm chart or specialized Terraform modules.
Helm Chart Configuration
The Helm chart allows for granular control over the deployment, including the use of sub-charts for MySQL and Redis in development environments. In production, these are usually replaced by external managed services.
- Namespace: A dedicated namespace is recommended (e.g.,
kubectl create ns fleet). - Secrets: TLS certificates and database credentials must be provisioned as Kubernetes Secrets.
- Ingress: Supports Nginx ingress for TLS termination and path-based routing.
Sources: articles/deploy-fleet-on-kubernetes.md:27-55, articles/deploy-fleet-on-kubernetes.md:125-155
Deployment Logic
Sequence of events during a Kubernetes deployment, highlighting the critical database migration step.
Sources: articles/deploy-fleet-on-kubernetes.md:157-161, articles/deploy-fleet-on-kubernetes.md:229-234
Cloud Platform Deployment (GCP)
Fleet provides a dedicated Terraform project for Google Cloud Platform that automates the creation of a complete production environment.
Provisioned Resources
The GCP module creates a highly available environment using the following services:
- Cloud Run v2: Hosts the Fleet application and migration jobs.
- Cloud SQL: Managed MySQL instance with deletion protection.
- Memorystore: Managed Redis for caching.
- Cloud DNS & Load Balancing: Handles HTTPS traffic with managed SSL certificates.
- Secret Manager: Stores database passwords and private keys.
Sources: articles/deploy-fleet-on-gcp.md:3-15, articles/deploy-fleet-on-gcp.md:154-171
Bare Metal and Virtual Machines (Ubuntu)
For standalone deployments, Fleet can be installed directly on Linux distributions like Ubuntu 22.04 LTS. This method often integrates with the Elastic Stack (Elasticsearch, Kibana, Filebeat) for advanced logging.
Component Isolation
A common pattern involves using Nginx to segregate the administrative web interface from the agent data plane:
- Port 9443: Fleet Web UI (Restricted access).
- Port 443: Orbit/osquery agent check-ins (Publicly accessible).
- Port 8443: Kibana interface for data visualization.
Sources: articles/deploy-fleet-on-ubuntu-with-elastic.md:33-54, articles/deploy-fleet-on-ubuntu-with-elastic.md:86-125
Managed and Containerized Options
Render Blueprint
For rapid deployment with minimal configuration, a Render blueprint is provided. It defines a web service for the fleetdm/fleet:latest image, a 10GB MySQL disk, and a Redis private service.
Sources: infrastructure/render/README.md:7-25
Local Development (Docker Compose)
Developers can spin up a local environment using Docker Compose, which initializes the Fleet server, a MySQL container, and a Redis container. This is primarily used for testing and QA purposes.
Sources: ee/vulnerability-dashboard/README.md:35-50, infrastructure/loadtesting/terraform/readme.md:128-140
Deployment Configuration Summary
| Category | Key Configuration Variables | Purpose |
|---|---|---|
| Database | FLEET_MYSQL_ADDRESS, FLEET_MYSQL_DATABASE | Defines MySQL connection string. |
| Cache | FLEET_REDIS_ADDRESS | Defines Redis connection string. |
| Server | FLEET_SERVER_CERT, FLEET_SERVER_KEY | Paths to TLS certificate and private key. |
| Auth | FLEET_LICENSE_KEY | Applies premium features if provided. |
| Scaling | min_instance_count, max_instance_count | Controls Cloud Run / K8s replicas. |
Sources: articles/deploy-fleet-on-gcp.md:105-130, articles/deploy-fleet-on-kubernetes.md:173-205, infrastructure/render/README.md:30-33
Conclusion
Fleet's deployment options cater to a wide range of operational requirements. Whether utilizing the automated Terraform modules for GCP, the Helm charts for Kubernetes, or standalone Ubuntu installations, the core architecture remains consistent. This consistency ensures that the transition from a local Docker-based development environment to a global cloud-scale production deployment is manageable and predictable.
Sources: articles/deploy-fleet-on-gcp.md:182-186, articles/deploy-fleet-on-kubernetes.md:278-283