Install the GitOps Runtime in your on-premises environments with Helm to create and manage Argo CD applications and deployments.

Tunnel-based access mode is not supported for GitOps on-premises installations.

title:"Architecture"

description:"Codefresh platform andruntime architecture"

description:"Codefresh platform andRuntime architecture"

group:installation

toc:true

GitOps Clients include the UI and the GitOps CLI.

The UI provides a unified, enterprise-wide view of deployments (runtimes, clusters, and applications), and CI/CD operations (Delivery Pipelines, workflows, and deployments) in the same location.

The Codefresh CLI includes commands to installhybrid runtimes, add external clusters, and manageruntimes and clusters.

The UI provides a unified, enterprise-wide view of deployments (Runtimes, clusters, and applications), and CI/CD operations (Delivery Pipelines, workflows, and deployments) in the same location.

The Codefresh CLI includes commands to installHybrid GitOps Runtimes, add external clusters, and manageRuntimes and clusters.

The sections that follow show detailed views of the GitOps Runtime architecture for the different installation options, and descriptions of the GitOps Runtime components.

*[Hosted GitOpsruntime architecture](#hosted-gitops-runtime-architecture)

*[Hosted GitOpsRuntime architecture](#hosted-gitops-runtime-architecture)

For Hosted GitOps, the GitOps Runtime is installed on a_Codefresh-managed cluster_ in the Codefresh platform.

* Hybrid GitOpsruntime architecture:

* Hybrid GitOpsRuntime architecture:

For Hybrid GitOps, the GitOps Runtime is installed on a_customer-managed cluster_ in the customer environment. The Hybrid GitOps Runtime can be tunnel- or ingress-based:

*[Tunnel-based](#tunnel-based-hybrid-gitops-runtime-architecture)

*[Ingress-based](#ingress-based-hybrid-gitops-runtime-architecture)

<br>

In the hosted environment, the Codefresh Runtime is installed on a K8s cluster managed by Codefresh.

{% include

max-width="100%"

%}

Tunnel-based Hybrid GitOps runtimes use tunneling instead of ingress controllers to control communication between the GitOps Runtime in the customer cluster and the Codefresh GitOps Platform. Tunnel-based runtimes are optimal when the cluster with the GitOps Runtime is not exposed to the internet.

Tunnel-based Hybrid GitOps Runtimes use tunneling instead of ingress controllers to control communication between the GitOps Runtime in the customer cluster and the Codefresh GitOps Platform. Tunnel-based runtimes are optimal when the cluster with the GitOps Runtime is not exposed to the internet.

Tunnel-based access mode is not supported for GitOps on-premises installations.

Note: Tunnel-based architecture is not supported for on-prem instances.

%}

Ingress-basedruntimes use ingress controllers to control communication between the GitOps Runtime in the customer cluster and the Codefresh GitOps Platform. Ingress-basedruntimes are optimal when the cluster with the GitOps Runtime is exposed to the internet.

Ingress-basedRuntimes use ingress controllers to control communication between the GitOps Runtime in the customer cluster and the Codefresh GitOps Platform. Ingress-basedRuntimes are optimal when the cluster with the GitOps Runtime is exposed to the internet.

lightbox="true"

file="/images/runtime/architecture/arch-hybrid-ingress.png"

url="/images/runtime/architecture/arch-hybrid-ingress.png"

alt="Ingress-based Hybrid GitOpsruntime architecture"

caption="Ingress-based Hybrid GitOpsruntime architecture"

alt="Ingress-based Hybrid GitOpsRuntime architecture"

caption="Ingress-based Hybrid GitOpsRuntime architecture"

max-width="100%"

%}

It receives requests from the the Tunnel Client (tunnel-based) or the ingress controller (ingress-based), and forwards the request URLs to the Application Proxy, and webhooks directly to the Event Sources.

The Request Routing Service is available fromruntime version 0.0.543 and higher.

Olderruntime versions are not affected as there is complete backward compatibility, and the ingress controller continues to route incoming requests.

The Request Routing Service is available fromRuntime version 0.0.543 and higher.

OlderRuntime versions are not affected as there is complete backward compatibility, and the ingress controller continues to route incoming requests.

Applies only to_tunnel-based_ Hybrid GitOps Runtimes.

The customer environment that communicates with the GitOps Runtime and Codefresh, generally includes:

* Ingress controller for ingress-based Hybridruntimes

* Ingress controller for ingress-based HybridGitOps Runtimes

The ingress controller is configured on the same Kubernetes cluster as the GitOps Runtime, and implements the ingress traffic rules for the GitOps Runtime.

See[Ingress controller requirements]({{site.baseurl}}/docs/installation/gitops/monitor-manage-runtimes/#ingress-controller).

* Managed clusters

Managed clusters are external clusters registered to provisioned Hosted or Hybrid GitOpsruntimes for application deployment.

Managed clusters are external clusters registered to provisioned Hosted or Hybrid GitOpsRuntimes for application deployment.

Hosted GitOps requires you to connect at least one external K8s cluster as part of setting up the Hosted GitOps environment.

Hybrid GitOps allow you to add external clusters after provisioning theruntimes.

See[Add external clusters toruntimes]({{site.baseurl}}/docs/installation/gitops/managed-cluster/).

Hybrid GitOps allow you to add external clusters after provisioning theRuntimes.

See[Add external clusters toRuntimes]({{site.baseurl}}/docs/installation/gitops/managed-cluster/).

* Organizational systems

Organizational Systems include the customer's tracking, monitoring, notification, container registries, Git providers, and other systems. They can be entirely on-premises or in the public cloud.

Either the ingress controller (ingress hybrid environments), or the Tunnel Client (tunnel-based hybrid environments), forwards incoming events to the GitOps Application Proxy.