Self-Hosted vs Managed
There are two ways to run flex.plane: self-hosted on your own infrastructure, or as a managed SaaS service. Both options give you the same platform capabilities. The difference is who runs the management plane.
Self-hosted
You deploy and operate the flex.plane management plane yourself. This means running a Kubernetes cluster (the "management cluster") that hosts the orchestrator, portal, identity provider, and mesh control server.
Choose self-hosted when:
- Data sovereignty matters. Your management plane stays entirely within your network. No data leaves your infrastructure.
- Air-gapped environments. You operate in environments with no internet access or strict outbound restrictions.
- Full control. You manage upgrades, scaling, and configuration on your own schedule.
- Custom identity. You want to run your own Zitadel instance or integrate with an existing one.
What you need:
- A Kubernetes cluster (1.27+) for the management plane. A lightweight setup like k3s works fine.
- Helm 3.12+ and kubectl 1.27+ on your workstation.
- DNS records pointing to your ingress controller.
See Prerequisites for the full requirements, then follow the installation guides for Identity and Platform.
Managed (SaaS)
flex.plane runs the management plane for you in the cloud. Your on-premise Proxmox nodes connect to the managed platform through the encrypted WireGuard mesh network. No Kubernetes cluster required on your side.
Choose managed when:
- Small team. You do not want to operate a Kubernetes management cluster.
- Fast start. Sign up, install the agent on your nodes, and you are running.
- Automatic updates. The management plane is always on the latest version.
- Distributed nodes. Your Proxmox nodes are spread across locations and you want a single control plane without hosting it yourself.
How it works:
- Sign up for a tenant at
<tenant>.flexplane.io. - Install the flex.plane agent on each Proxmox node using the provided join token.
- The agent connects to the managed platform via the WireGuard mesh.
- All communication between your nodes and the management plane is encrypted end-to-end.
Your nodes remain on your infrastructure. Only management traffic (API calls, status updates) flows over the mesh. VM data, storage, and network traffic stay local to your nodes.