Applications¶

The Applications service deploys and runs workloads on Kubernetes clusters. You define a workload once as a reusable, versioned template (a container image or a Helm chart), then deploy it as an instance onto one cluster, or as a fleet instance onto every cluster of a fleet. The platform rolls the workload out, tracks its status and applies later changes for you.

graph TD
    A[Template<br/>reusable, versioned definition] -->|Instantiate| B[Instance]
    A -->|Instantiate| E[Fleet instance]
    B --> C[One cluster]
    E --> D[Every cluster of a fleet]

Concept	What it is
Template	A container image or a Helm chart, with its configuration. Belongs to a project and is versioned.
Marketplace	The catalog of public applications (published by the platform operator) and your projects' own templates.
Cluster	A Kubernetes cluster applications deploy to: one you created in Kubernetes, or one you registered.
Fleet	A group of clusters in the same project.
Instance	One deployment of a template on one cluster.
Fleet instance	One deployment of a template on every cluster of a fleet.

Everything is under APPLICATIONS in the sidebar: Cluster (Clusters, Fleets), Marketplace, Instances and Fleet Instances. Lists follow the Project picker in the header.

Get started¶

Have a cluster. Kubernetes clusters you create appear under Clusters by themselves. To use another cluster, register it.
Pick an application. Open Marketplace and choose a public application, or create your own template.
Deploy it. On the application's page, click Instantiate. See Deploy an application.
Follow it under Instances or Fleet Instances, where you manage it.

Application clusters¶

An application cluster is a Kubernetes cluster that applications deploy to. Its capabilities tell the platform what the cluster offers apps: a load balancer, an ingress controller, Gateway API, storage classes and its network plugin. Templates rely on them to expose apps and to fill in placeholders.

Kubernetes clusters you create¶

Every cluster you create in Kubernetes is added to Clusters in the same project, with an MKS Cluster badge. It becomes a deployment target once its control plane is up. Until then it shows Pending, and instances you deploy to it wait and deploy by themselves when it is ready. You manage it from Kubernetes: it can't be edited or deleted here, and deleting the Kubernetes cluster removes it and disconnects the instances on it.

These clusters are added without capabilities, and you can't add any. What that means for your apps:

Container apps can use Load balancer if the Kubernetes cluster has a load balancer (LB on; see Clusters without a load balancer). HTTP ingress and Gateway API routes are not created.
Helm charts that use the Ingress host, Ingress class name, Storage class or Cluster CNI placeholders end in Missing capabilities. The cluster may still have storage classes (with Storage (CSI) on): a chart that leaves its storage class unset uses the cluster's default class.

Register a cluster yourself when your apps need ingress, Gateway API or the placeholders above.

Register a cluster¶

On Clusters, click Create Cluster, then:

Enter the cluster's Name, its Project (fixed afterwards) and its Kubeconfig.

Turn on each capability the cluster supports:

Capability	What you provide	What it enables
Load balancer	Optional annotations	Exposing apps through a load balancer.
Ingress	A Base host, optionally an ingress class and annotations	HTTP ingress for container apps; the Ingress host and Ingress class name placeholders.
Gateway API	A Gateway name and Base hostname, optionally the gateway's namespace	Gateway API routes for container apps.
Storage	One or more storage classes with their access modes; mark at most one as default	The Storage class placeholder (uses the default).
Networking	The Network plugin (CNI), for example `cilium`	The Cluster CNI placeholder.

Review and click Register cluster.

The kubeconfig must work from the platform:

The cluster's API must be reachable from the platform.
Credentials must be inline in the file: a token or a client certificate. Kubeconfigs that rely on an exec plugin, an auth provider or files on disk don't work.
Its user needs the rights to create everything your apps install, including namespaces. Charts can install any kind of object, so a cluster-admin kubeconfig is the simplest choice.

The platform checks only that the kubeconfig is well formed; it doesn't connect to the cluster when you register it. A kubeconfig that can't reach the cluster or lacks rights shows up as failed deployments. The kubeconfig is stored and never shown again.

Edit or delete a cluster¶

Edit lets you rename the cluster, change its capabilities, and paste a new kubeconfig to replace the stored one (leave it empty to keep it).
Delete removes the cluster from its fleets and disconnects every instance on it: the workloads keep running on the cluster, so clean them up there if you no longer need them.

Cluster statuses¶

Status	Meaning
Pending	Waiting for its kubeconfig. A cluster created in Kubernetes stays here until its control plane is up.
Provisioning	The platform is storing its access details.
Active	Ready for deployments.
Error	Storing its access details failed. Edit it with a correct kubeconfig, or delete it and register it again.
Deleting	Being deleted.

Deploy to Active clusters, or to ones in Pending or Provisioning, where the instance waits. A deployment to a cluster in Error doesn't wait and fails.

Templates¶

A template belongs to one project, and that project's members can deploy it. There are two types:

Container: one container image, with its ports, resources and environment variables.
Helm chart: a chart from a Helm repository, with your own values. The values editor is for chart values, not for Kubernetes manifests.

Create a template¶

On Marketplace, click Create Template, choose Container or Helm chart, and fill in:

Basic information: the project, a name, and optionally a description and Marketplace settings.
Repository: the image or chart and how to pull it (see below).
For a container, its resources, network and environment variables. For a chart, its values and placeholders.
Review and click Create template.

Templates you create are Private to their project. Only the platform operator publishes Public applications.

Define a container¶

Image. Enter the image reference, for example docker.io/library/nginx:1.27. For a private registry, choose Private and enter a username and a password or access token. Prefer a read-only access token.

Resources. Set the CPU limit (1–16 CPUs) and Memory limit (512 MiB–16 GiB). By default half of each limit is reserved as the request; turn on Set requests and limits separately to set requests yourself (each at most its limit). If your platform operator has enabled them, you can also set temporary storage (1–100 GiB, lost when the container restarts) and GPUs (1–4).

Network. List each port the container listens on, with its protocol (TCP or UDP). A port marked Public is exposed outside the cluster through a load balancer; the others are reachable only inside the cluster. Then choose how outside traffic reaches the container:

Option	What it does	Needs
Load balancer	Gives the public ports an external IP.	A load balancer on the cluster.
HTTP ingress	Routes web traffic by path (default `/`, matched as a prefix) to a target port, or to the first port.	The cluster's Ingress capability.
Gateway API	Routes web traffic through an HTTPRoute. Without hostnames, one is generated from the cluster's base hostname; without route rules, everything under `/` goes to the container.	The cluster's Gateway API capability.

Public ports and Load balancer go together: marking a port public turns the load balancer on, and with the load balancer on at least one port must be public. HTTP ingress and Gateway API need neither. On a cluster without the matching capability, the ingress or route is simply not created.

Environment variables. Each is a unique name and a value. They are stored as plain configuration, with no Kubernetes secret or config map references, so don't put sensitive values in them.

Define a Helm chart¶

Chart. Enter the Chart name (for example wordpress), the Chart repository URL (for example https://charts.bitnami.com/bitnami) and the exact Chart version. Repository access works as for containers.

Values. Change the chart's values in either or both of two ways:

a values YAML with only the keys you change, for example replicas: 2;
set values: single key and value pairs, as helm --set does.

The chart's own values decide its resources and networking.

Placeholders¶

Placeholders keep one chart portable: each cluster fills them in with its own values at deployment. Add them under Helm set values > Placeholders: give the chart value's key (for example ingress.host) and choose what it is replaced with.

Replaced with	Filled in with	The cluster needs
Ingress host	`<instance ID>.<Base host>`, also shown as the instance's Access URL	Ingress
Ingress class name	The cluster's ingress class	Ingress with an ingress class
Storage class	The cluster's default storage class	Storage with a default
Cluster CNI	The cluster's network plugin	Networking
Cluster name	The cluster's name	Nothing
App instance ID	The instance's ID	Nothing

If the cluster can't fill in a placeholder, the app isn't deployed and the instance shows Missing capabilities. Add the capability to the cluster and Sync the instance, or deploy to a cluster that has it.

Marketplace settings¶

Optional fields that control how the template appears in the Marketplace: icon URL, category and subcategory, tags, changelog, and homepage and documentation URLs (URLs must start with http:// or https://).

Edit a template¶

Open the template in the Marketplace and click Edit. The tabs follow the wizard; the project can't be changed.

A new version is created only when the application itself changes: the image or chart, values, resources, ports, networking, environment variables or changelog. Changing the name, description, icon, category, tags, URLs or Marketplace settings doesn't create one. Instances stay on their version until you run Update Version.
Stored registry credentials are kept if you leave them blank. Changing the image, or the chart, its values or set values, needs them again. Switching the repository access to Public clears them.

Delete a template¶

Click Delete on the template's page and type its name. This is irreversible, and refused while any instance or fleet instance still uses the template.

Marketplace¶

The Marketplace lists public applications and your projects' private templates. Filter by name, public or private, category, type (Helm or Container) and tags; the header Project picker scopes the private templates.

	Public application	Private template
Published by	The platform operator	Members of its project
Deploys to	A project you choose	The template's project
Edit and delete	No	Yes

An application's page shows its details, its links and a Versions list with changelogs. Current marks the latest version, which is the one Instantiate deploys.

Deploy an application¶

On the application's page, click Instantiate:

Choose the project (public applications only), then One cluster and a cluster, or A cluster fleet and a fleet. Only the project's clusters and fleets are offered.
Optionally name the instance. Unnamed instances are listed as Unnamed instance with a short ID.
Optionally, under Advanced options, add settings on top of the template's: chart values and set values for a Helm chart, or environment variables (overriding same-named ones) for a container. For a fleet, set them for every cluster and, if needed, per cluster.

The instance always deploys the template's latest version. Deploying a container needs a cluster that can run the platform's container apps; if the chosen cluster can't, the deployment is refused with The selected location cannot run this application right now: pick another cluster or contact your platform operator.

Manage instances¶

Open Instances and click an instance to see its status, configuration and Action History. Status Details says why something failed, and the page shows how to reach the app once it runs.

Day-2 operations¶

Action	What it does
Sync	Re-applies the deployment to retry or reconcile it.
Edit Parameters	Changes the instance's own values or environment variables on top of its template's, and updates the running instance.
Update Version	Moves the instance to a newer version of its template, replacing its workloads.
Cancel action	In Action History, stops an action that is still running.

These work while the instance is Active, Degraded or Missing capabilities, and need its cluster to be Active. In Error or Pending, only delete is possible. While a change is in progress, wait for it to finish.

Any project member with the permissions can manage the project's instances. An instance marked View only was created by the platform, for example by your platform operator: you can see it but not change it.

Instance statuses¶

Each instance has a status and a separate readiness (Ready, Not ready, Unknown, Missing capabilities or N/A) that says whether its workloads are up.

Status	Meaning	What you can do
Pending	Waiting for its cluster to be ready.	Wait, or delete it.
Queued, Processing, Creating, Updating	A deployment or change is running.	Wait.
Active	Deployed and running.	Everything.
Degraded	The last change failed, but it keeps running.	Check Status Details, then Sync.
Missing capabilities	A placeholder couldn't be filled in, so nothing was deployed.	Add the capability to the cluster and Sync, or deploy to another cluster.
Error	Deploying or changing it failed.	Delete it.
Deleting, Detaching	Being deleted or disconnected.	Wait.
Detached	No longer managed by the platform, still running on its cluster.	Clean up on the cluster if needed.

Disconnect or delete¶

Disconnect is the platform's detach for applications: the platform stops managing the instance but leaves its workloads running on the cluster. While it runs, the instance shows Detaching, then Detached. Delete removes the workloads too. The Delete dialog has a Disconnect only switch, and Disconnect opens the same dialog with it on.

	Disconnect	Delete
On the platform	No longer managed	Removed
On the cluster	Workloads keep running; clean up yourself if needed	Everything is removed, data is lost
Reversible	No	No

Disconnect is useful when the cluster is no longer reachable and a normal delete can't finish. An instance in Error can only be deleted. You confirm either by typing the instance name.

Cluster fleets¶

A fleet groups clusters of one project so a single fleet instance deploys an app to all of them. Open APPLICATIONS > Cluster > Fleets.

Create a fleet with Create Fleet: a name, an optional description and the project.
Add clusters with Add New Cluster, where you select the full set of clusters the fleet should have. Only the fleet's project's clusters are offered.
Remove a cluster with the delete icon next to it.
Delete a fleet with its delete icon. The clusters stay registered. Delete or disconnect its fleet instances first.

Fleet membership drives deployments

Adding a cluster to a fleet deploys every fleet instance of the fleet to it. Removing a cluster deletes those deployments from it; the cluster itself stays registered and running.

Fleet instances¶

A fleet instance deploys a template to every cluster of a fleet, one deployment per cluster. Create one with Instantiate > A cluster fleet; the fleet needs at least one cluster. Its page shows the rollout summary, each cluster's deployment under Clusters Status, and Action History.

Its settings and version are fixed. To change them, delete it and instantiate again.
Sync re-applies it to every cluster; Sync Cluster to one.
Its per-cluster deployments are managed only through it. They don't appear under Instances.
A deployment over quota shows Quota exceeded and deploys by itself once quota frees up; Sync Cluster retries sooner.
Delete works as for instances, including Disconnect only, but deployments in Error can only be deleted. Deployments with an action in progress are skipped: delete again once those finish.

Quotas¶

Clusters you register, fleets, templates, fleet instances and deployed applications (one per cluster) count against your organization's quotas. Clusters added from Kubernetes don't. A single-cluster deployment over the limit is refused; in a fleet, only the clusters over the limit wait.

Permissions¶

All are project permissions; see Application Orchestration Permissions.

Task	Permission
Create, edit (any change, including a new version) or delete a template	`meo_application_template_create`, `_patch`, `_delete`
Deploy to one cluster	`meo_application_instance_create`
Sync, Edit Parameters, Update Version, cancel an action	`meo_application_instance_update`
Delete or disconnect an instance	`meo_application_instance_delete`
Deploy to a fleet; sync or cancel on a fleet instance; delete or disconnect it	`meo_application_clusterfleetinstance_create`, `_patch`, `_delete`
Register, edit or delete a cluster	`meo_application_cluster_create`, `_patch`, `_delete`
Create a fleet, change its clusters, delete it	`meo_application_clusterfleet_create`, `_patch`, `_delete`
Remove a single cluster from a fleet	`meo_application_clusterfleet_removecluster`

Troubleshooting¶

Symptom	What to do
Saving a container template fails with a load balancer error	Load balancer is on but no port is Public, or the reverse. Make them agree.
An instance shows Missing capabilities	Add what the placeholder needs to the cluster and Sync, or deploy to another cluster. On a cluster marked MKS Cluster, register a cluster with the capability instead.
Deployments to a registered cluster fail	Check the kubeconfig: reachable API, inline credentials, enough rights. Replace it with Edit.
The selected location cannot run this application right now	The cluster can't run container apps. Pick another cluster, or contact your platform operator.
A template or fleet can't be deleted	Delete its instances or fleet instances first.