Deploy targets

A deploy target is a place your applications can run. Targets belong to your organization and are managed in org settings; each deployment runs on exactly one target. Forginate supports two kinds.

Kind 1: Your own Kubernetes cluster (deploy agent)

Run your apps on infrastructure you already own. You install a lightweight Forginate deploy agent in your Kubernetes cluster, and it connects outbound to Forginate over a WebSocket.

Why outbound-only matters

The agent dials out; Forginate never dials in. That means:

• No inbound firewall holes. You don't expose your cluster's API server or open any ports to the internet.
• No cluster credentials leave your network. Forginate holds no kubeconfig for your cluster — only the agent, running inside it, can act on it.
• The agent authenticates with an enrollment key and heartbeats regularly; if heartbeats stop, the target shows as degraded in the UI.

Setting one up

1. In org settings, create a deploy target of the Kubernetes kind and give it a name (e.g. acme-corp-prod).
2. Forginate mints an enrollment key and shows it once — copy it immediately. It is stored only as a hash, like a password; if you lose it, rotate it.
3. Install the agent in your cluster with that key, following the instructions shown on the target.
4. When the agent connects, the target shows as live and can accept deployments.

Managing a Kubernetes target

• Rotate key — mints a new enrollment key (again shown once) and disconnects any agent using the old one. Re-install/restart the agent with the new key.
• Rename / instructions — update the target's name or the standing instructions deployment planning should honor for this target.
• Remove — deprovisions the target; the agent is told to stand down.

Copy the key when you see it

The enrollment key is displayed exactly once at creation (and once per rotation). There is no way to view it again later — only to rotate it.

Kind 2: Forginate-managed AWS account

Don't have infrastructure? Forginate can vend a dedicated AWS account for your organization and run your apps there:

• The account is created under Forginate's AWS organization and dedicated to you — your workloads don't share an account with anyone else's.
• Apps are deployed to ECS Fargate — serverless containers, no servers for you to patch or manage.
• Each app gets a public IP, so it's reachable as soon as it's running.
• Application logs go to CloudWatch and are surfaced directly in the Forginate UI — you request recent logs from the deployment page without ever opening the AWS console.

You don't need an AWS account of your own, and you never handle AWS credentials. Create a target of the AWS kind, and once the account is provisioned it accepts deployments like any other target.

Choosing between them

	Kubernetes agent	AWS account
You need	A Kubernetes cluster	Nothing
Infra control	Full — it's your cluster	Managed by Forginate
Network posture	Outbound-only agent, no inbound exposure	Public IP per app
Logs/metrics	Via the agent	Via CloudWatch, surfaced in-app
Good for	Teams with existing infra, private networking, data-locality needs	Getting to a live URL with zero ops

An organization can have multiple targets of both kinds — for example a managed AWS target for staging and your own cluster for production.

Availability and permissions

• Deploy kinds can be individually enabled or disabled at the platform level; if a kind is unavailable to your org, creation of that kind is rejected.
• Viewing targets is open to any org member; creating, editing, rotating keys, and removing targets require owner or admin.

Next

• Deployments — running an app on a target.