Skip to main content
BYOC allows you to run Suga on your own Kubernetes infrastructure while using the Suga dashboard for management. You get full control over where applications run while maintaining Suga’s simplicity.
BYOC is part of an Enterprise agreement and is set up with our team. It is not something you enable yourself from the dashboard. This page describes how it works and what your cluster needs. To talk through it for your environment, contact us.

​
BYOC vs Suga Cloud

​
Prerequisites

  • Kubernetes 1.24+ with cluster-admin access
  • LoadBalancer support - Cloud provider integration or MetalLB for bare metal
  • Default storage class - Must support ReadWriteOnce access mode for volumes
  • Outbound internet access - To pull container images and connect to Suga API
Suga automatically installs Envoy Gateway (Gateway API) and manages TLS certificates and DNS records during cluster initialization. You don’t need to set these up.

​
Supported Platforms

GKE, EKS, AKS, self-managed, on-premises, DigitalOcean, Linode, Civo, and other K8s providers.

​
Architecture

  • Direct API Connection - Suga connects directly to your Kubernetes API server (no agent installed)
  • Encrypted Credentials - Your cluster credentials are stored encrypted in Suga’s database
  • Standard K8s API - All operations use the Kubernetes REST API
  • Your Infrastructure - Workloads and data run entirely in your cluster

​
Setup

1

Add BYOC Cluster

Go to Cluster in the left sidebar and connect your cluster.Follow the guided setup to provide your cluster credentials. The UI will walk you through entering your API server URL and authentication details.
2

Verify Connection

After adding, the dashboard should show “Connected” with a green indicator. Suga will automatically initialize the cluster with Envoy Gateway and required components.
Need help connecting your cluster? Contact support for assistance.

​
Namespaces

Suga creates one namespace per environment, named suga- followed by the environment’s ID:
The name is not derived from the environment’s display name, so an environment called “production” does not get a suga-production namespace. Find the ID in the environment’s dashboard URL.

​
Direct Cluster Access

With BYOC, you have full kubectl access. Set the namespace to the environment you want:

​
Security Considerations

  • Use a dedicated ServiceAccount with least-privilege permissions where possible
  • Rotate credentials periodically
  • Suga stores credentials encrypted at rest (AES-256-GCM)
  • All API communication is TLS-encrypted
Implement network policies to restrict traffic between namespaces. See Kubernetes documentation for examples.
Apply Pod Security Standards to Suga namespaces:
Suga stores secrets as Kubernetes Secrets. For enhanced security, use External Secrets Operator with your vault solution or enable Kubernetes encryption at rest.

​
Cost

Suga Platform: Pricing for BYOC has not been set. Contact us for details. Your Infrastructure: Kubernetes cluster costs depend on your cloud provider. Typical range: $100-1500+/month depending on size.