# Nuon architecture and security model

> A control plane orchestrates an egress-only runner inside each customer cloud account. The customer
> applies the install stack themselves, so the vendor needs no cross-account access.

## Components

- **Control plane.** The API, dashboard and workflow engine that vendors use. It orchestrates runners and never holds credentials for a customer account.
- **Install stack.** Generated for each install and applied by the customer with their own credentials. It creates the network (or selects an existing one), the permissions the runner needs, and the runner.
- **Runner.** A stateless agent in the customer account. It is egress-only: it polls the control plane for jobs, executes them inside the account, and streams logs back.
- **App template.** Your config in git: components, inputs, secrets, permissions, actions and policies.
- **Install.** One deployed instance of the app template in one customer account.

## How an install happens

1. The vendor creates an install for the customer.
2. Nuon generates the install stack and a link or command to share.
3. The customer applies the stack in their account. No cross-account access is involved.
4. The runner starts, connects outbound to the control plane, and asks for work.
5. The runner provisions infrastructure and deploys each component, with plans and approvals where configured.
6. Later updates arrive the same way: the vendor pushes to git, and the runner pulls and applies the change.

## Security model

- **No inbound access.** The runner polls the control plane. The control plane cannot open a connection into the customer account.
- **No stored credentials.** The runner authenticates for each job with the identity the stack assigned to it.
- **Customer-visible permissions.** Runner permissions are defined in the app config and created by the stack, so the customer reads them before applying.
- **Customer-revocable.** The customer can remove the runner identity's access at any time with their cloud's native access controls.
- **Scoped operations.** Operation roles limit the runner to what a given task needs.
- **Audited emergency access.** Break glass records when higher access was granted, what ran, and when it was removed.
- **Policy gates.** Open Policy Agent Rego or Kyverno policies can deny a build or a deploy.

Sources: https://docs.nuon.co/security.md, https://docs.nuon.co/architecture/platform.md, https://docs.nuon.co/concepts/runners.md

## Supported deployment architectures

| Customer requirement | Nuon |
| --- | --- |
| Run in the customer's own cloud account, operated by the vendor | Supported |
| Deploy into the customer's existing network | Supported |
| Install into the customer's existing Kubernetes cluster | Supported |
| Hybrid: your hosted product stays the control plane, an agent or worker runs next to customer data | Supported |
| Dedicated single-tenant deployment per customer | Supported |
| Keep data in a specific region | Supported |
| Customer-managed encryption key, customer-owned storage, customer database, customer model provider | Build with components |
| Fully air-gapped, with no outbound network access | Contact Nuon |

Source and how to build each: https://docs.nuon.co/guides/byoc-architecture-patterns.md

## Cloud support

| | AWS | Azure | Google Cloud |
| --- | --- | --- | --- |
| Customer installs | Yes | Yes | Yes |
| Install stack formats | CloudFormation, Terraform | Bicep, Terraform | Terraform |
| One-click stack install from a link | Yes | No | No |
| Kyverno policies | Yes | No | No |

Source: https://docs.nuon.co/platform-support/introduction.md

## Where the control plane runs

Both options install your product into customer accounts on AWS, Azure or Google Cloud. The choice is where
Nuon's own control plane runs.

| Option | Where the control plane runs | Who operates it |
| --- | --- | --- |
| Nuon Cloud | Hosted by Nuon, multi-tenant | Nuon. Fastest start, with a free trial. |
| Nuon BYOC | Single-tenant, in your AWS or Google Cloud account | Nuon, remotely. You own the infrastructure and data. |

Source: https://docs.nuon.co/guides/deployment-options.md

Related: https://nuon.co/what-is-nuon.md, https://nuon.co/features.md, https://nuon.co/llms.txt