Enterprise Core Operations

Konduo Enterprise Core overlays license control, HA, advanced audit, external authentication, the MCP gateway, anomaly analysis, relationship analysis, Analysis Workspaces, and compliance checks on top of Community Core. Shared resource and plugin contracts stay in CE; Enterprise-only behavior is connected through overlay and contribution points.

Main Responsibilities

1. Gate Enterprise availability through license status. A valid Enterprise license enables the complete edition; quotas and HA claims are enforced separately and there are no per-feature license entitlements.
2. Protect HA write paths through PostgreSQL-backed leader election and membership.
3. Expose MCP catalog, resource, and tool endpoints as read-oriented operator interfaces.
4. Connect anomaly rules, correlation analysis, relationship graphs, and log evidence to resource workflows.
5. Compose related-resource metric panels in Analysis Workspaces for time exploration, presentation, and RCA evidence review.
6. Surface external auth providers, audit logs, API server logs, and compliance checks in Enterprise settings.

Operations Flow

• Check license and HA status before relying on Enterprise-only capabilities.
• Keep a local administrator account when registering external auth providers, and validate login gates separately from RBAC mapping.
• Restrict MCP through API key or OAuth scopes, and confirm resource/tool descriptors remain read-oriented.
• Link metric sources, log sources, and relation evidence so anomaly analysis has enough context.
• In Analysis Workspaces, confirm that panels and RCA evidence expose only currently readable resources, and distinguish fixed-window behavior from live-window refresh.
• For releases, verify CE base version, EE patch suffix, manual image, and license bootstrap artifacts together.

Initial Administrator Provisioning

Konduo does not create a known default administrator password in production. After migration and reference-data seeding, a new database reports setup_required from /readyz until an operator runs the one-time bootstrap command. Supply the password through stdin or a mode-0600 file, never as a command-line argument.

For local development:

task db:postgres:up
task db:seed
printf '%s\n' "$INITIAL_ADMIN_PASSWORD" | task backend:admin:bootstrap
task run

For Docker Compose, run the command with the same Enterprise backend image and environment:

printf '%s\n' "$INITIAL_ADMIN_PASSWORD" | \
  docker compose --env-file docker/compose.release.env \
  -f docker/compose.yml run --rm -T backend \
  admin-bootstrap --username admin --password-stdin

Kubernetes deployments use a one-shot Job with the same database and encryption settings as the backend. Mount the initial password from a Secret into a memory-backed volume and run admin-bootstrap --username admin --password-file /run/konduo-bootstrap/password. Delete the Job and Secret after the state becomes complete.

The first login must change the password. Re-running bootstrap after completion does not change the account. A later recovery_required state must use the approved password-reset or verified-backup recovery procedure, not bootstrap.

Boundary

• Enterprise behavior belongs in enterprise/ overlays, patches, and contributions, not directly in CE.
• MCP descriptors, anomaly rules, HA, license, advanced security, and advanced analytics docs belong in EE sources.
• State-changing workflows must keep their RBAC, audit, and confirmation boundaries; MCP descriptors should not bypass them.

Related Documents

• enterprise/docs/manual-source-contract.md
• enterprise/docs/manual/analysis-workspace/en/index.md
• enterprise/docs/editions/plugin-boundary.md
• enterprise/docs/auth-provider-architecture.md
• enterprise/docs/instance-relations-contract.md
• enterprise/docs/runbooks/release-readiness-checklist.md
• backend/docs/administrator-bootstrap.md