Skip to main content
By default every deployment runs on slipway’s managed infrastructure — you don’t configure anything. Bring your own Kubernetes (BYOK) runs your deployments on your own cluster instead, so your workloads, images, logs, and secrets stay inside your network. Slipway reaches your cluster through an agent you install with Helm. The agent connects outbound to the slipway control plane over a single secure connection and does all the work — builds, deploys, ingress, snapshots, logs, and shells — from inside your cluster.
Slipway never receives a kubeconfig and never holds your cluster credentials. The only secret it stores is the agent’s outbound auth token (hashed). Because the connection is outbound-only, private and firewalled clusters work without any inbound access.
BYOK is plan-gated — registering a cluster needs a plan that includes it. Clusters you registered before a downgrade keep working.

​
Prerequisites

Your cluster needs these already installed (the slipway chart doesn’t add them):
  • An ingress controller (e.g. Traefik).
  • cert-manager with an issuer for wildcard TLS, and reflector to mirror the cert into tenant namespaces.
  • A CSI snapshot controller, if you use named volumes.

​
Set it up

  1. Register the cluster on the Clusters page. Slipway mints a one-time agent token and returns the exact helm command to run. The token is shown once.
  2. Install the agent by running that command. It installs BuildKit, an in-cluster registry, and the agent. The cluster flips from pending to ready once the agent’s first connection lands.
  3. Point an environment at it — set the cluster on an environment, or as your org’s default target. New deployments for that environment then build and run in your cluster.

​
Registry authentication

The chart’s in-cluster registry accepts unauthenticated pulls from inside your cluster by default. Since the cluster is yours alone, that is usually fine. To require authentication anyway, set registry.auth.tokenCert in the chart values to the public certificate of slipway’s registry token signer (available from support). The registry then only serves clients carrying tokens minted by the slipway control plane, scoped to your organization’s images.

​
Domains

By default slipway assigns each BYOK cluster a subdomain under its own zone and provisions DNS and TLS for you — nothing to set up. To serve apps from a domain you own instead, register the cluster with your own apps domain, or claim the domain under Domains and bind it to the cluster (slipway then shows the DNS record to add). A domain is bound to one cluster at a time.