CLM
Automate certificate lifecycle management including issuance, discovery, renewal, and deployment, across public and private trust CAs. Assess, prioritize, and plan your migration to quantum-safe encryption with the Quantum Trust Hub add-on module.
PKI
Provision, govern and scale private trust certificates with a Post Quantum ready cloud based Enterprise PKI-as-a-Service.
Code Signing
Secure software, firmware, and containers with a comprehensive enterprise code signing solution.
SSH
Control SSH access and key rotation at scale with an SSH key lifecycle management solution.
KUBE
Unify DevOps and Security teams by managing certificates with a Kubernetes-native certificate lifecycle management solution.
DDI
Manage domain registration, renewal, decommissioning, and other security controls with an end-to-end domain lifecycle management solution.
ADC
Automate and orchestrate application delivery infrastructure at scale with an ADC lifecycle automation platform.
Platform
Manage policy and automation across all of the products and modules in the AVX ONE platform.
AVX Setup
Get detailed instructions for setting up AVX ONE in on-premises or SaaS deployments.
- AppViewX On-Prem Setup Guides
  - Install, Upgrade, and Maintenance Guide
    - Platform Overview
    - System Requirements and Prerequisites
    - AppViewX Installation
      All AppViewX installation is performed through the Interactive UI a full-screen terminal wizard launched by running ./install.sh. There is no separate manual CLI installation path. The wizard collects all configuration, validates prerequisites on all target nodes, and deploys the platform automatically.
    - Upgrade AppViewX
    - AppViewX Patch Management
    - Auto Remediation Configuration
      Auto Remediation is installed as part of the AppViewX application installation. After installation, administrators and Support Engineers configure and operate the monitoring platform from the AppViewX Interactive IU. A separate standalone Auto Remediation installer is not the primary customer configuration path.
    - MongoSync Setup and Operations
      This guide provides setup, configuration, initial sync, operations, monitoring, and troubleshooting guidance for AppViewX MongoSync based DR replication.
    - AppViewX Utility Reference
    - Installing ELK Components
    - Enabling the Insight Module
    - Platform Administration and Operations
    - External Certificate for Kubernetes
    - Dynamic API's Addition Script
    - Kubernetes Architecture and Deployment Model
    - Disaster Recovery Plan
    - Troubleshooting
    - Appendix A: appviewx.conf Reference
    - Appendix B: Security Placeholder Reference
    - Appendix C: Glossary
    - Whitelisting UI Access Hosts (On-Premise Deployments)
      AppViewX Web UI is typically accessed via Istio ingress (NodePort) and/or a Load Balancer URL. This topic explains how to whitelist the hostnames/IPs (URLs) that are allowed to access the AppViewX Web UI in on-premise deployments.
    - Uninstalling AppViewX
    - Troubleshooting
    - Disable Kex Algorithm Guide
    - Migrating CentOS to Ubuntu/RHEL
    - Upgrading RHEL to v8.10/v9.4
    - Upgrading Ubuntu 20.04 to Ubuntu 22.04
    - Upgrading Ubuntu 22.04 to Ubuntu 24.04
    - OS Patching on Ubuntu for Multi-Node Environment
- AppViewX SaaS Setup Guides
- Managed Kubernetes
- OpenShift Deployment with ArgoCD
- MSP Portal User Guide
- AppViewX Windows Gateway Setup
- AppViewX on ServiceNow Guides
- AppViewX Supported Integrations
- Support
- Glossary
Artifacts
Review new features, fixes, and security advisories with official AppViewX release documentation.

Kubernetes Architecture and Deployment Model

This chapter provides a technical reference for the Kubernetes deployment model underlying the AppViewX platform.

Component Topology


Category	Key Services	Description
Core Platform	config-server, platform-core, platform- gateway, platform-web, platform- queue	Central business logic, REST API gateway, web UI, and async task processing.
Subsystems	policy-engine, ssh-server, code-signing, kube-clm, subsystem-sync	Module-specific logic for PKI, SSH, code signing, Kubernetes CLM.
Vendor Integrations	~50+ avx vendor * plugins	Device-specific connectors for ADC vendors, CA systems, and cloud providers.
Python Sandboxes	avx python sandbox*	Isolated execution environments for custom workflow scripts.
Infrastructure	MongoDB, Redis, OpenBao	Primary data store, caching, and secret management.
Service Mesh	Istio base, istiod, gateway	mTLS, traffic management, circuit-breaking, and observability.
Maintenance Jobs	avx-dbmigration, crypt-migration-job	Database schema and cryptographic migration Jobs.

Kubernetes Resource Types


Resource	Usage
Deployment	Core platform microservices (~100+ workloads).
StatefulSet	MongoDB replica set, Redis Sentinel, OpenBao HA.
DaemonSet	NodeLocalDNS, log shipping agents.
Job	DB migrations, crypto migrations.
HorizontalPodAutoscaler	Auto-scaling for aggregator and sync services.
Service	ClusterIP / Headless services for inter-pod communication.
Gateway / VirtualService	Istio traffic routing with timeouts and retries.
DestinationRule	Istio circuit-breaking and load balancing policies.
ConfigMap	Platform properties, avx-common-config.
Secret	TLS certificates, Vault secret IDs, credentials.
PersistentVolumeClaim	Backup staging, stateful service storage.
ServiceAccount	Per-plugin RBAC identity.
ClusterRole/Binding	Cluster-level resource access for platform operations.
NetworkPolicy	Zero-trust traffic segmentation (default-deny model).
PodDisruptionBudget	Availability guarantees for Redis and OpenBao.
PriorityClass	Scheduling priority for critical pods.

Service Mesh (Istio)


Feature	Configuration	Purpose
mTLS	PeerAuthentication STRICT	All pod-to-pod traffic requires mutual certificate auth.
VirtualService	Per-plugin Helm template	HTTP route rules, timeouts, and retry config per service.
DestinationRule	Per-plugin Helm template	Circuit-breaking, connection pool limits, load balancing.
Gateway	istio-ingressgateway	External traffic entry into the platform namespace.
Secret TTL	ISTIO SECRET TTL in appviewx.conf	Rotation interval for Istio mTLS certificates.

Stateful Services


Service	HA Configuration	Key CLI Operations
MongoDB	Replica Set: 1 primary + secondaries + optional arbiter	--db-backup, --db-restore, --set-db-cache-size, --mongo- replicaset-reconfiguration
Redis	Sentinel mode with DC-aware failover	--setup-redis-dc-priority priority
OpenBao	HA mode (appviewx openbao ha chart)	--vault-backup, --vault-restore, --vault-sync-status, --kek enable\|disable

AppViewX