271: Setting Up Platform Infrastructure¶

Where this course fits¶

This is the first course in your Platform Administrator setup path.

1. This course — physical architecture, cluster provisioning, and user management
2. 272: Setting Up Assets and Data Streams Quickly — model setup with asset types, assets, semantics, and data streams
3. Connect data and enforce quality — connectors, data quality, and guardrails (coming soon)

Part 1: How Kelvin is Physically Set Up¶

1.1 The two-layer architecture¶

Kelvin is built on two distinct layers: the Cloud and the Edge. Understanding what lives where is the foundation of everything else in this course.

The Cloud is the Kelvin Platform itself. Kelvin hosts and manages it. It provides the UI, the API, data storage, and the orchestration layer that manages your clusters.

The Edge is the compute layer that runs close to your assets. It is a Cluster — one or more computers running the Kelvin edge runtime. The edge runs SmartApps, AI engines, and Connections. It handles asset communication and keeps data flowing even when the internet connection is interrupted.

Your Assets sit below the edge. These are your industrial machines, PLCs, sensors, or external systems. They communicate with the edge cluster using industrial protocols (Modbus TCP, OPC-UA, serial Modbus, and so on) or over IP.

1.2 Does the edge have to be on-premise?¶

No. "Edge" refers to where your cluster runs, not whether it is physical hardware.

If your assets communicate over IP (they are IIoT-compliant), your cluster can run as a virtual machine in the cloud. The edge and the Kelvin Cloud simply become two cloud-based services talking to each other.

1.3 What runs on the edge?¶

The main things you will deploy to a cluster are Connections (which collect data from your assets) and SmartApps (which process and act on that data, including any AI engines). Both are managed from the Kelvin UI once your cluster is running.

Every cluster also starts a small set of background edge services automatically — including Edge Sync for data synchronisation, a local Edge UI/API for on-site management, and an MQTT Broker for internal communication. These run transparently and do not require setup on your part.

For full documentation on managing edge services, visit:

• Kelvin Edge Services
• Cluster Concepts

Part 2: Setting Up the Physical Infrastructure¶

2.1 Choosing your provisioning type¶

Kelvin gives you four ways to provision a cluster. The right choice depends on your environment, your team's skills, and whether you need to scale to multiple nodes.

For most Platform Administrators, K3S is the correct choice. Kelvin installs and manages Kubernetes for you. You only need Ubuntu Server to get started.

Use Docker for lightweight single-node setups or development environments. It cannot be scaled to multiple nodes later.

Use Kubernetes (BYO) or a managed cloud option (EKS / AKS / GKE) only if your organisation already runs Kubernetes infrastructure and you need to integrate Kelvin into it.

2.2 Operating system¶

For on-premise and VM deployments, use Ubuntu Server 22.04 LTS or newer. Kelvin's software is tested on LTS releases only.

At a minimum, install the command-line server only. You do not need a graphical user interface.

You can download Ubuntu Server at https://ubuntu.com/download/server.

2.3 Firewall configuration¶

If your cluster is in a restricted network environment, you need to open specific ports. There are two phases: installation and ongoing operations.

During installation, open outbound access to the domains shown in the Installation phase above. Once installation completes, you can close all of them except nexus.kelvininc.com and registry.kelvin.ai.

After installation, keep the following open permanently.

Asset communication ports (Modbus TCP, OPC-UA, etc.) are vendor-specific. Check your asset documentation.

For the complete firewall and hardware requirements, visit:

• Edge Requirements

2.4 Provisioning your cluster¶

The provisioning process is the same for all cluster types. You register the cluster in the Kelvin UI first, then run the installation script on your edge system.

For K3S (recommended):

1. In the Kelvin UI, go to Orchestration and click Register Cluster.
2. Select K3S as the cluster type.
3. Give the cluster a display name. The Name ID is generated automatically.
4. Click Register. Kelvin generates an installation script.
5. Copy the script and run it in the terminal of your edge system.
6. Kelvin installs Kubernetes, configures the cluster, and registers it with the Kelvin Platform automatically.

The entire process takes around ten minutes depending on your internet speed.

For cloud deployments (EKS / AKS / GKE):

Set up your Kubernetes cluster first using your cloud provider's tools. Then follow the same Register Cluster flow in the Kelvin UI and select the Kubernetes option. Kelvin only installs its management pods onto your existing cluster — it does not touch the Kubernetes infrastructure itself.

2.5 Adding and managing nodes¶

Once your first cluster is running, you can add nodes to increase capacity. Each additional node you add runs SmartApps and Connections, distributing the workload.

For step-by-step guides, visit:

• Setup Architectures
• Provision a K3S Cluster
• Provision a Cloud Cluster
• Provision a Docker Cluster
• Add a Node

Part 3: Setting Up Platform Users and Permissions¶

Users in this context means access to the Kelvin Platform — the UI, the API, and the Administration area. This is separate from cluster infrastructure (covered in Part 2) and from SmartApp-level logic. A user with Kelvin Platform access can log in, view assets, manage configurations, and perform actions based on the permissions you assign.

3.1 Authentication options¶

Kelvin supports two ways to authenticate Platform users. You choose one for your installation.

Keycloak is Kelvin's built-in identity provider. You manage users, groups, and passwords directly from Keycloak and the Kelvin UI. This is the default option for most installations.

SSO (Single Sign-On) connects Kelvin to your organisation's existing identity provider. Users log in with the credentials they already have. Kelvin supports Microsoft Azure AD and Google Workspace. SSO is configured with help from the Kelvin team.

3.2 Setting up Platform users with Keycloak¶

If you are using the built-in Keycloak option, follow this order.

Step 1: Create groups before creating users.

Groups hold a standard set of roles. It is much faster to assign a user to a group than to assign roles individually. Create groups that match your organisational structure before adding any users.

Common groups to start with:

Step 2: Create users and assign them to groups.

Each user needs a username (usually their email address) and an initial password. Assign them to the appropriate group. The group's roles apply immediately.

Step 3: Configure password policies.

Set a password policy that matches your organisation's security requirements. You can enforce minimum length, complexity, and expiry periods.

Step 4: Optionally enable Two-Factor Authentication (2FA).

2FA is not enabled by default. Users can set it up themselves from their personal account page. If your security policy requires it, you can make it mandatory.

3.3 Understanding roles and permissions¶

Kelvin uses a layered access control system. Once your groups and users are set up, you can fine-tune what each user can see and do.

Top-level roles control which area of the Kelvin UI a user can access.

Role-Based Access Control (RBAC) provides granular permissions per resource type. You can allow or deny create, read, update, and delete actions on Assets, Data Streams, Applications, and more.

Attribute-Based Access Control (ABAC) lets you write YAML-based policies that restrict access to specific resources by name or attribute. For example, you can allow a group to read only Assets that belong to a specific asset type.

# Example ABAC policy: allow read access to wells asset type only
actions:
  - read
condition:
  match:
    any:
      of:
        - expr: R.attr.asset_type_name == "wells"

For full documentation on access control, visit:

• User Authentication
• User Access Rights
• RBAC
• ABAC
• Manage Groups

3.4 Ongoing user management¶

Once users are live, you will occasionally need to reset passwords, update group memberships, or disable accounts.

Quick Reference¶

Quick Quiz¶

Summary¶

You now have a complete picture of how to stand up a new Kelvin installation: the physical architecture, how to choose and provision a cluster, what firewall rules to apply, and how to manage users and their access rights.

The key things to remember:

• The Edge is a Kelvin Cluster — it can be physical hardware or a cloud VM depending on how your assets communicate. SmartApps and AI engines run here, not in the cloud.
• K3S is the recommended cluster type for most installations — Kelvin manages Kubernetes for you
• For restricted networks, open the installation firewall ports first, then close them after, leaving only nexus.kelvininc.com permanently open
• Create Groups before creating Users in Keycloak — it saves significant time at scale
• RBAC handles role-level access; ABAC adds resource-level policy filtering on top

For full documentation, visit:

• Cluster Concepts
• Setup Architectures
• Edge Requirements
• Provision a K3S Cluster
• Kelvin Edge Services
• User Authentication
• RBAC
• ABAC

Good luck and Happy Learning !