Installing Nezal

One Helm chart, one command, about fifteen minutes from nothing to a developer opening their first environment. Nezal runs entirely inside your cluster: after the install pulls its images, it makes no outbound call of any kind.

Before you start

• Kubernetes 1.28 or newer. Any conformant distribution — k3s, OpenShift, a sovereign-cloud managed offering, or kind on a laptop for an evaluation.
• An ingress controller, and a wildcard DNS record pointing at it. Preview environments are subdomains, so *.dev.example.internal must resolve.
• Helm 3.
• A default StorageClass, unless you turn persistence off for a trial.

You do not need a licence key, an account, or to talk to anybody. The install below is complete and free for one developer.

Install

helm install nezal oci://registry-1.docker.io/nezal/nezal --version 0.2.0 \
  --namespace nezal-system --create-namespace \
  --set ingress.domain=dev.example.internal \
  --set api.bootstrap.token=$(openssl rand -hex 16)

Three values matter on a first install:

Watch it come up:

kubectl -n nezal-system get pods -w
helm test nezal -n nezal-system      # confirms the API answers from inside the cluster

First sign-in

Open https://nezal.dev.example.internal — or, without ingress:

kubectl -n nezal-system port-forward svc/nezal-api 8080:8080

Sign in with the bootstrap token. The dashboard shows a free install: one developer, every feature. Configure SSO when you are ready (Settings → Security); once OIDC or SAML is configured and the API restarts, the bootstrap token stops working.

Connect a repository and get an environment

1. Applications → Connect repository. Give it a Git URL and a credential. Nezal reads the repository and proposes the application definition — Helm charts, Kustomize, plain manifests or docker-compose — showing which file each conclusion came from.

2. Promote a baseline. This is the shared copy of the whole application that every environment routes back to.

3. Download the CLI from Downloads in the dashboard — the binaries are served by your own installation, so there is nothing to fetch from the internet:

   curl -fsSL https://nezal.dev.example.internal/downloads/nezal-linux-amd64 -o nezal
   chmod +x nezal
   sudo mv nezal /usr/local/bin/
   

4. Create an environment:

   nezal login --server https://nezal.dev.example.internal
   nezal up --name my-feature --ref feat/my-branch
   

   Nezal diffs the branch against the baseline, redeploys only the services that changed, and prints a preview URL.

Getting a licence

A free install is one developer with every feature and no key to request. To add developers, email [email protected]. A licence is USD 1,000 per month, invoiced annually as USD 12,000 per year, for unlimited developers across every cluster you run.

What comes back is a signed file, not an account — paste it into Admin → Licence. It is verified locally against a public key compiled into the operator, so it works in a sealed room and nothing is sent anywhere to check it.

A licence runs for one year. When it lapses there is a 30-day grace period in which everything keeps working, and you are warned from 30 days before expiry by email, a Prometheus gauge, a Kubernetes Event, the dashboard and the CLI. After the grace period the install returns to one developer: nothing is deleted, no running environment is stopped or scaled down, previews stay open and the audit log stays exportable. Renewing restores every seat on the next request.

What to read next

• Administration — SSO, RBAC, quotas and policy, SIEM forwarding, backups, disaster recovery, upgrades.
• Security whitepaper — what a security team will ask.
• Controls mapping — NCA ECC, SAMA CSF and ISO 27001.
• Sizing — measured numbers, and what they do not support.

If the cluster cannot reach Docker Hub

Nezal pulls its images once, at install time, and then talks to nothing outside your network. If even that first pull is impossible, mirror the images into your own registry and set global.imageRegistry:

helm install nezal oci://registry-1.docker.io/nezal/nezal --version 0.2.0 \
  --set global.imageRegistry=registry.example.internal/mirror \
  --namespace nezal-system --create-namespace

kubectl get pods -n nezal-system -o jsonpath='{..image}' lists everything an install pulls. For a site with no internet path at all, contact [email protected]: there is a packaged offline bundle, and it is worth doing together the first time.