FusionAuth
1. Overview
The FusionAuth add-on deploys an instance of the FusionAuth authentication and authorization platform inside an environment, with a dedicated PostgreSQL database. It covers SSO, MFA, user management, and OAuth2/OIDC.
Use it when the product needs a complete identity provider (login, sign-up, MFA, SSO) without building that layer from scratch.
Catalog tags: Auth, SSO, OAuth2.
2. Prerequisites
- A squad and an environment already selected on the Add-ons screen.
- If you're going to configure email sending (invitations, password reset), an available SMTP server.
3. Deploy Step-by-Step
The FusionAuth deploy wizard has 4 steps:
Step 1 — General
| Field | Required | Description |
|---|---|---|
| Add-on Name | Yes | Name of the add-on within the environment. Lowercase letters, numbers, and hyphens only (3 to 63 characters). Example: my-fusionauth. |
| Enable Elasticsearch | No | Enables Elasticsearch as FusionAuth's search engine (used for advanced user searches). Off by default. |
| Allowed Origins (CORS) | No | Domains allowed to call the FusionAuth API, comma-separated, or * to allow all. |
| Session Timeout | No | Time (in minutes) until the session expires. Default: 60. |
| Public access (Admin Panel Visibility) | No | When on, anyone with the URL can access FusionAuth's admin panel. On by default. |
Step 2 — Admin User
Defines the account used for the first login to the FusionAuth panel after deployment.
| Field | Required | Description |
|---|---|---|
| Admin Email | Yes | Email of the initial admin user. |
| Password | Yes | Password of the initial admin user. |
Step 3 — Email (SMTP)
Optional configuration for sending emails (invitations, account verification, password reset).
| Field | Required | Description |
|---|---|---|
| Configure SMTP | No | Turns email sending via SMTP on/off. If off, FusionAuth doesn't send transactional emails. |
| SMTP Host | If SMTP is on | SMTP server address (e.g. smtp.example.com). |
| Port | If SMTP is on | SMTP server port. Default: 587. |
| Username | If SMTP is on | Authentication user on the SMTP server. |
| Password | If SMTP is on | Authentication password on the SMTP server. |
| Security | If SMTP is on | Connection security protocol (e.g. TLS). |
| From Address | If SMTP is on | Email address used as sender (e.g. noreply@example.com). |
Step 4 — FusionAuth Resources
Defines the resources allocated to the FusionAuth instance and to its dedicated PostgreSQL database.
FusionAuth
| Field | Default | Maximum |
|---|---|---|
| Memory | 1Gi | 2Gi |
| CPU | 500m | 2000m |
Database Resources (PostgreSQL)
| Field | Default | Maximum |
|---|---|---|
| Memory | 256Mi | 2Gi |
| CPU | 250m | 2000m |
| Disk Size | 10Gi | 20Gi |
Clicking Deploy Add-on starts the deployment. The add-on then appears on the environment's My Add-ons tab.
4. After Deployment
TODO: describe where to find the FusionAuth admin panel URL after deployment, and how to access/generate API credentials (API keys) to integrate applications via OAuth2/OIDC.
5. FAQ
Can public access to the admin panel be turned off after deployment?
TODO: confirm whether Public access can be changed after deployment.
Can the FusionAuth PostgreSQL database be accessed directly? TODO: confirm whether there's direct access to the dedicated database or if it's for FusionAuth's exclusive use.