Wayreeve

From zero to traffic in three steps

Install Wayreeve Gateway in your own VPC, connect it to Wayreeve Cloud and point your apps at it. Prompts and responses stay in your environment.

  1. Install Wayreeve Gateway
  2. Connect it to Wayreeve Cloud
  3. Connect your apps

We send the image and your Wayreeve Cloud account when your pilot starts.

Step 1

Install Wayreeve Gateway in your VPC

This puts Wayreeve inside your own network, where your apps can reach it and your data never leaves your control. One installer does the work and checks the result.

What you need

A Kubernetes cluster with encrypted storage, and the Wayreeve image we send when your pilot starts.

Full requirements
  • Kubernetes 1.29+ (EKS, AKS, GKE or other) with a CNI that enforces NetworkPolicy.
  • A default StorageClass with encrypted volumes. The database is one SQLite file on a 20 GiB volume.
  • Optional: a secret store (AWS Secrets Manager, GCP Secret Manager or Azure Key Vault) through External Secrets Operator. Without one, the installer generates a Kubernetes Secret.
  • The Wayreeve image, by digest. We send it when your pilot starts.

Wayreeve runs as a single pod with one database file. Size the node and volume for that pod.

Already run Kubernetes?

Run the installer on your cluster. It checks your tools, sets up a locked-down space for Wayreeve, installs it, connects it to Wayreeve Cloud and confirms it is healthy.

Show the command 
deploy/install.sh --image <registry>/wayreeve@sha256:<digest> \
  --cp-url https://console.<domain> \
  --enrollment-token-file ./enrollment-token.txt

Checks kubectl and helm, creates the namespace with Pod Security restricted, generates the secret key and workspace token, installs the chart, waits for readiness and runs helm test. Every gateway enrolls with Wayreeve Cloud, so --cp-url and the token are required (step 2). Add --dry-run to print the Helm arguments only.

Starting from scratch?

Our recipes build everything on AWS, Google Cloud or Azure: the network, the cluster, encryption keys, backups and a secrets store. Then they run the installer for you.

Show the commands 
# AWS: VPC, EKS, KMS, S3 backups, Secrets Manager, Bedrock endpoint
cd deploy/recipes/aws/terraform && cp terraform.tfvars.example terraform.tfvars  # edit it
cd - && ENROLLMENT_TOKEN_FILE=./enrollment-token.txt deploy/recipes/aws/create-cluster.sh \
  -- --cp-url https://console.<domain> --image <registry>/wayreeve@sha256:<digest>

# GCP: same pattern; add --no-gateway to create no public endpoint
ENROLLMENT_TOKEN_FILE=./enrollment-token.txt deploy/recipes/gcp/create-cluster.sh \
  -- --cp-url https://console.<domain> --image <registry>/wayreeve@sha256:<digest>

# Azure: needs --host and a PKCS#12 certificate
ENROLLMENT_TOKEN_FILE=./enrollment-token.txt deploy/recipes/azure/create-cluster.sh \
  --host <your-data-plane-host> --tls-pfx ./queue.pfx \
  -- --cp-url https://console.<domain> --image <registry>/wayreeve@sha256:<digest>

Already have a cluster? Use install-existing.sh in the same folder. Everything after -- goes to install.sh.

Open the console

Reach the console securely from your own machine and create the owner account with the one-time access token the installer generated.

Show the commands 
kubectl -n wayreeve port-forward svc/wayreeve 4318:4318   # then open http://127.0.0.1:4318
kubectl -n wayreeve get secret <app-secret> -o jsonpath='{.data.access-token}' | base64 -d | pbcopy

Create the owner account with the workspace access token. The installer prints the exact secret name.

Step 2

Connect it to Wayreeve Cloud

Wayreeve Cloud issues your licence and the signed terms feed. Your gateway calls it outbound; it never calls in.

  1. Sign in at https://console.<domain>Your org admin account comes from a one-time invite link (valid 7 days).
  2. Enrollment tokens → New enrollment tokenGive it a label and an expiry, then Create token. It is shown once. Save it to enrollment-token.txt.
  3. Run step 1 with --cp-url and the tokenOn start, the gateway generates its own key pair, enrolls with the one-time token and ignores the token afterwards.
  4. Check both sidesWayreeve Cloud: the deployment appears under Deployments. Wayreeve Gateway: the Overview page shows the licence, edition, last sync and terms catalog version (Feed v…).
  5. Delete the enrollment token SecretThe installer names it.

Allow the egress

NetworkPolicy matches IP ranges. Add Wayreeve Cloud's published addresses to networkPolicy.egressAllowCIDRs, TCP 443 only.

Air-gapped

node server/controlplane-cli.ts offline-request --out request.jws

Send us request.jws (a public key and a signature, nothing secret). Wayreeve Cloud registers it (Register an air-gapped deployment) and issues an offline licence. Set it as WAYREEVE_LICENSE_FILE. It works on that installation only.

Good to know

We set up your Wayreeve Cloud account when your pilot starts. If Wayreeve Cloud is ever unreachable, inference keeps working.

Step 3

Connect your apps

  1. Add a provider connectionConsole: Providers → Connect a provider (OpenAI, Anthropic, OpenAI-compatible). Bedrock, Vertex and Azure connections are created through the API, keyless with cloud workload identity:
curl https://<your-data-plane>/api/connections \
  -H "Authorization: Bearer $WAYREEVE_ACCESS_TOKEN" -H "Content-Type: application/json" \
  -d '{"name":"Vertex us-east5","kind":"vertex",
       "settings":{"project":"<gcp-project>","location":"us-east5",
                   "auth":{"source":"workload_identity"}}}'
# Bedrock: "kind":"bedrock", "settings":{"region":"us-east-1","auth":{"source":"web_identity"}}
# Azure:   "kind":"azure_openai", "auth":{"source":"workload_identity", ...}
  1. Add a model and grant the connectionModels → Add model on that connection. On Providers, grant the connection to the projects that may use it. Ungranted models answer 403 connection_not_granted.
  2. Set data classesData classes ships with public, internal, confidential, pci and phi. Edit their rules or add a class with New class.
  3. Create a project and a keyNew project, then Access & limits → Create API key. The key is shown once.
  4. Change the base URL in your existing codeOpenAI SDK: https://<your-data-plane>/v1. Anthropic SDK: https://<your-data-plane>.

Before

from openai import OpenAI
client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])
client.chat.completions.create(model="gpt-…", messages=msgs)

After

from openai import OpenAI
client = OpenAI(base_url="https://<your-data-plane>/v1",
                api_key=os.environ["WAYREEVE_API_KEY"],
                default_headers={"X-Wayreeve-Data-Class": "phi"})
client.chat.completions.create(model="<your-model-id>", messages=msgs)

The class can also come from the key or the project default. A request can narrow it, never widen it. If no permitted route exists, you get 403 data_class_not_permitted naming the rule and its source.

Get the image and an enrollment token

Both come with a pilot, along with the pilot guide and proposed success criteria.

Request a pilot