Installation

ISE is self-hosted. It deploys to a Kubernetes cluster with Helm, where a single chart is the whole deployment definition — API, background workers, scheduler, frontend, and the database migration job.

Prerequisites

• A Kubernetes cluster with an ingress controller. ISE can monitor the cluster it runs in; the break-glass account exists precisely so an outage there doesn’t lock you out.
• PostgreSQL — provisioned in-cluster for staging, or a managed instance for production. ISE holds all its state here.
• Redis/Valkey for the task queue and sessions. The chart can run a Valkey instance for you (valkey.enabled), or point at your own.
• An Entra ID app registration for OIDC sign-in (Authorization Code + PKCE), plus the Entra groups you will map to ISE roles.
• An AI provider key (Anthropic or OpenAI). Optional at install — a provider with no key simply cannot be selected, and scheduled AI stays a no-op until one is set.

Configure

Environment differences are values files only — never divergent templates. The settings that matter at install:

secrets:
  values:
    databaseUrl: postgresql+psycopg://…
    redisUrl: redis://…
    sessionRedisUrl: redis://…
    publicBaseUrl: https://ise.example.com
    entraTenantId: …
    entraClientId: …
    entraClientSecret: …
    entraGroupRoles: … # Entra group → ISE role mapping
    anthropicApiKey: … # or openaiApiKey

ingress:
  enabled: true
  className: traefik
  host: ise.example.com

tls:
  enabled: true

Two credentials deserve special care:

• The credential key-encryption key (a base64-encoded 32-byte value) encrypts every integration credential ISE stores. Deliver it as a secret, keep it somewhere you can recover it from, and back it up with the database — a restore without it yields undecryptable credentials.
• The break-glass password hash. The break-glass account lives outside Entra ID for exactly one scenario: Entra is broken and it may be the incident you’re working. Set a strong credential, store the hash, and expect an audit event and alert on every use.

Hosted deployments are always Entra-authenticated — the development auth stub cannot be enabled by the chart.

Install

helm upgrade --install ise ./helm -n ise --create-namespace -f values-production.yaml

Migrations run automatically as a pre-upgrade hook before the new application version starts, so schema and code never disagree. Images are pulled by immutable tag, and deploys are performed by CI rather than by hand.

What you get: the API, Celery workers (queues for sync, AI, and actions), the Beat scheduler, the frontend, and — optionally — Valkey.

First sign-in

1. Browse to your publicBaseUrl and sign in with Entra ID. Your ISE role comes from your Entra group membership; access is granted and revoked there, not in ISE.
2. Verify the break-glass path works before you need it, then leave it alone.
3. Go to Settings → Integrations and connect your first system. DataDog and Kubernetes are the usual starting pair — one observability source and one imperative system.
4. Watch the Overview screen populate as the first sync completes.

Next steps

• Upgrading — and the backup you must take first.
• Roles & access — mapping Entra groups to ISE roles.
• The core loop — what ISE does once state is flowing.