🚀Quick-Start Guide
Our self-hosted solution is currently in alpha and available to a limited group of customers. Features and setup options are subject to change. Interested in early access? Reach out to your Customer Success Manager to learn more, or contact [email protected].
Current limitations:
S3 and the data execution service is not available at the moment. Data will be stored on Laputa's volume. Instant migration will be available when S3 and the data execution service is ready.
Migration between v2 and v3 is not stable.
The login page is still in development. Rolling updates has been enabled for the login page and may introduce issues.
SSO SAML2 is not available at the moment, and you should opt for SSO OIDC.
If you notice unexpected behavior, do not hesitate to contact us through predefined channels:
Through Slack. Access should have been given to the customers.
Your Customer Success Manager.
Eventually, [email protected].
This topic includes instructions for installing and running Toucan on Kubernetes using Helm Charts.
Helm is an open-source command line tool used for managing Kubernetes applications. It is a graduate project in the CNCF Landscape.
Before you begin
To install Toucan using Helm, ensure you have completed the following:
Install a Kubernetes server on your machine (or use a managed Kubernetes). For information about installing Kubernetes, refer to Install Kubernetes.
Install the latest stable version of Helm. For information on installing Helm, refer to Install Helm.
Install the latest stable version of kubectl. For information on installing kubectl, refer to Install kubectl.
Have access to the Toucan Toco's Quay registry. If you don't have access, contact us using our mail address: [email protected].
Have a Curity Community Edition license. You can sign up for one here.
Install cert-manager on the Kubernetes Cluster to generate TLS certificates. For information on installing cert-manager, refer to Install cert-manager.
An Ingress controller setup on the Kubernetes Cluster. For information on installing an Ingress controller, refer to Install an Ingress controller. We'll assume you are using the Nginx Ingress controller.
A DNS set up for the Toucan Toco's domain which points to your Ingress controller Load Balancer IP. For this example, we will use
demo.toucantoco.test
as the main domain, andauth-demo.toucantoco.test
as the authentication domain.
Install Toucan using Helm
Overview

You can simply consider the "Toucan Stack" Helm Chart as a single package.
To customize the chart, Helm can overrides the default values file by specifying additional values files. You can read more about it in the official Helm documentation.
Login to the Toucan Toco's Quay registry
To sign in to the Quay registry with Helm, run the following command:
helm registry login quay.io
(optional) Use minikuge sample configuration
Run the following command:
helm pull oci://quay.io/toucantoco/charts/toucan-stack
This command will download the latest Helm Charts from the Toucan Toco's Quay registry.
Extract the values.minikube.yaml
from the tgz file which will help define the configuration for the Toucan Stack Helm Charts:
# -x: extract
# -v: verbose
# -z: compressed
# -f <file>: file
# --strip-components: remove leading directories (toucan-stack/values.minikube.yaml -> values.minikube.yaml)
# toucan-stack/values.minikube.yaml: file to extract inside the archive
tar -xvzf toucan-stack-*.tgz --strip-components=1 toucan-stack/values.minikube.yaml
global:
defaultStorageClass: standard
hostname: demo.toucantoco.test
imagePullSecrets:
- dockerconfigjson
extraDeploy:
- |
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: 'test-selfsigned-issuer'
spec:
selfSigned: {}
# ...
Install Toucan
After you have set up Helm, you can start to deploy Toucan on your Kubernetes cluster.
When you deploy the Toucan Stack Helm charts, use a separate namespace instead of relying on the default namespace. The default namespace might already have other applications running, which can lead to conflicts and other potential issues.
When you create a new namespace in Kubernetes, you can better organize, allocate, and manage cluster resources. For more information, refer to Namespaces.
To create a namespace, run the following command:
kubectl create namespace toucan
Send your Quay credentials to Kubernetes by running the following command:
# Replace <username> and <password> with your credentials
# docker-registry: The type of secret to create.
# --namespace: The namespace to create the secret in.
# dockerconfigjson: The name of the secret to create.
# --docker-server: The server address of the registry.
# --docker-username: The username for the registry.
# --docker-password: The password for the registry.
kubectl create secret docker-registry --namespace toucan dockerconfigjson --docker-server=quay.io --docker-username="<username>" --docker-password="<password>"
Send your Curity credentials to Kubernetes by running the following command:
# Replace <License> with your Curity license, extracted from the json. It should start with `ey...`
# --namespace: The namespace to create the secret in.
# curity-secret: The name of the secret to create.
# --from-literal: The key and value of the secret to create.
kubectl create secret generic --namespace toucan curity-secret --from-literal=CURITY_LICENSE_KEY="<License>"
Deploy Toucan by running the following command:
# upgrade: The command to upgrade the Toucan Stack Helm charts.
# --install: And install the Toucan Stack Helm charts if they are not already installed.
# --namespace: The namespace to deploy the Toucan Stack Helm charts in.
# toucan-stack: The name of the deployment.
# oci://quay.io/toucantoco/charts/toucan-stack: The Helm chart to deploy.
# --values: The path to the values file, which overrides the default configuration for the Toucan Stack Helm charts.
helm upgrade --install toucan-stack oci://quay.io/toucantoco/charts/toucan-stack \
--namespace toucan \
--values values.minikube.yaml
To get the Admin password, run the following command:
kubectl get secret --namespace toucan toucan-stack-auth -o jsonpath='{.data.toucan-admin-password}' | base64 --decode
Since this deployment uses a private CA, you need to add the CA certificate to your browser's certificate store.
Fetch the CA certificate from the cluster and add it to your browser's certificate store:
kubectl get secret --namespace toucan demo.toucantoco.test-cert -o jsonpath='{.data.tls\.crt}' | base64 --decode > demo.toucantoco.test.crt
And import the file demo.toucantoco.test.crt
into your browser's certificate store. See this guide.
Navigate to https://demo.toucantoco.test in your browser to access Toucan.
Login with the Admin credentials. Enter [email protected]
for the username. For the password, use the one you got from the previous step.
What's next?
Now that you have a working Toucan deployment, you might be interested in configuring this environment for production use. Feel free to check out:
⚙️Configure email notifications⚙️Configure HTTPS🔑Configure OIDC authentication⚙️Tuning resources⚙️Configure persistenceLast updated
Was this helpful?