Skip to content

Demo status

Hosted demo offline until beta

The hosted demo is offline until beta. Interactive sessions and the hosted walkthrough are unavailable. No beta reopening date is announced here. Customers must deploy their own relay; hosted customer and pilot enrollment are unavailable. See Beacon Installation.

Historical demo architecture

The earlier demo combined a managed GKE target in the US with two EU-hosted VMs for the beacon relay and OpenBao secret store. This describes the historical layout, not a currently available service or a newly qualified deployment.

System Historical location Role
Target cluster US GKE Standard Operator, wrapper and eBPF agent
Beacon relay EU Frankfurt TCP/TLS relay pairing Port and broker
Secret store and Port EU Netherlands OpenBao and source-side secret delivery

Port and the cluster broker connected outbound to the relay. The encrypted store session terminated at Port and broker; the relay forwarded the traffic. See Beacon Relay Architecture for the protocol and Supported Paths for the limits of historical evidence.

Scope of the historical demo

The three systems were on GCP. A GCP EU region does not satisfy the source-host ownership boundary in the sovereign deployment decision guide. A confidential-compute label alone does not qualify secret delivery or eBPF enforcement. No availability, deployment or security result is established by this offline demo page; use dated qualification evidence for the actual release and topology you intend to deploy.

Running your own demo

The hosted demo is offline until beta. You can evaluate on your own infrastructure, subject to the Supported Paths limits. For the documented cohort, follow the matched installation procedure.

The standalone installer below tracks the newest CLI and uses separate demo bootstrap pins; it does not reproduce the documented cohort:

curl -fsSL https://docs.cloudtaser.io/install.sh | bash -s -- --demo

This installs cloudtaser with the maintained cloudtaser-openbao chart (chart 0.2.0, OpenBao 2.6.0) and a test pod with secret injection. OpenBao uses verified TLS, a retained single-node Raft volume, scoped Kubernetes auth, and default-deny network policy; the installer does not create a second development-mode server manifest.

You need kubectl and helm, a default dynamic storage class, and a cluster with Kubernetes Secrets encryption at rest enabled. The OpenBao chart fails closed when that encryption preflight is not satisfied. At the end, capture the one-time demo unseal key with the command the installer prints; you need it to unseal OpenBao after a pod restart.

Alternatively, use the CLI's built-in demo command:

cloudtaser-cli demo

See the CLI Reference for options.

Next steps