Moyai on-prem · delivered by Ankra

From a Moyai commit to any customer site

Handover from Ankra to Moyai · 3 November 2026

Moyai merges, Ankra builds, scans and stores a scanned, immutable release. Each customer gets one pull-only robot account and installs that exact release on-prem, or mirrors it into an air-gapped site. No customer ever touches Moyai's source, cloud or CI.

A Moyai commit goes through Ankra Pipelines (test, build, scan, gate) into the Ankra registry. Across the trust boundary, customer sites log in with a pull-only robot account and pull from the registry, directly on-prem or by mirroring into an air-gapped registry.MOYAI · BUILT AND STORED BY ANKRACUSTOMER SITES · ANY INFRASTRUCTURETRUST BOUNDARYCommitmerge to maineasterisland repoPipelinetestbuildscangateRegistryeasterislandsha-38a390fmoyai-harborsha-70b5ee5Helm chartsoci:// · nextRobotpull-only login1 per customerexpires · revocableOn-premHelm or Ankrapulls directlyAir-gappedmirror one releaseinto a localregistrypushpublishpullloginA Moyai commit goes through Ankra Pipelines into the Ankra registry; customer sites pull from it with a pull-only robot account.MOYAI · BUILT BY ANKRACUSTOMER SITESTRUST BOUNDARYCommitmerge to mainPipelinetestbuildscangateRegistryeasterislandsha-38a390fmoyai-harborsha-70b5ee5Helm chartsoci:// · nextRobotpull-only login1 per customerOn-premHelm or Ankrapulls directlyAir-gappedmirror oncelocal registrypushpublishpulllogin
Moyai ships on every mergeCustomer pulls with its robot loginOnly robot logins cross the trust boundary

1 · Moyai ships

Every merge becomes a release

Ankra Pipelines tests, builds, scans (Trivy, Semgrep, Checkov) and blocks on findings. What passes lands in Moyai's private registry with an immutable sha- tag, next to its Helm chart.

2 · Customer gets access

One robot per customer

Moyai issues a pull-only login with one command. It reaches Moyai's registry and nothing else, expires on a date, and is revoked in one command.

Robot account guide →

3 · Customer installs

On-prem or air-gapped

Connected sites install straight from the registry, with Helm or with Ankra. Air-gapped sites mirror one release once, then install from their own registry.

Helm guide →   Ankra profile →

What the customer brings

Moyai's release carries Moyai only. The site provides the platform around it: production dependencies →

Status

Link in the chainStateOwner
Commit → pipeline → registry (images)Live every Moyai serviceAnkra
Helm chart in the registryNext one pipeline stage to addMoyai, Ankra helps
Robot accounts for customersReady issue on requestMoyai
Air-gapped bundle (chart + image list per release)NextMoyai, Ankra helps
On-prem trace-lake settings confirmedNextMoyai