> ## Documentation Index
> Fetch the complete documentation index at: https://daily-ms-pcc-self-hosted.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-Hosted Region Requirements

> Cluster, platform, network egress, and node requirements for a Pipecat Cloud self-hosted region, with sizing guidance for platform components.

export const registryHost = "registry.pipecat.daily.co";

export const cliMinVersion = "1.2.0";

export const productNameSingular = "self-hosted region";

Before registering a {productNameSingular}, make sure your cluster, network, and workstation meet the requirements below.

## Kubernetes cluster

* **A conforming Kubernetes cluster, version 1.29 or later.** Any distribution works — managed (EKS, GKE, AKS, OKE) or self-managed. The [reference architectures](/enterprise/reference/aws-eks) for AWS EKS and Oracle OKE are proven layouts.
* **cgroup v2 on the nodes that run agents.** Per-session CPU and memory metrics are sampled from the node's cgroup filesystem, which must be the unified (v2) hierarchy — the default on recent distributions (Amazon Linux 2023, Ubuntu 22.04+, RHEL 9+). On cgroup v1 nodes, sessions run normally but resource metrics are unavailable and the dashboard says so; see [Session metrics](/enterprise/logs#session-metrics).
* **Nodes for the architectures you intend to run.** Agents are scheduled on `amd64` or `arm64` nodes according to the architecture each deployment declares. Provide nodes for one or both, and [declare what the region supports](/enterprise/sizing#architecture) when you register it.
* **A namespace for agents that permits privileged pods.** The package creates a workloads namespace (`pipecat-agents` by default) labeled `pod-security.kubernetes.io/enforce: privileged`, because agent pods currently mount a host path to read cgroup metrics. If you create the namespace yourself (for example, from a GitOps pipeline), apply that label; the install refuses to proceed without a usable namespace.

## Platform prerequisites

Two cluster-scoped components must be installed before the region package, because the package's own resources depend on their APIs being present:

* **[cert-manager](https://cert-manager.io/)** (tested with v1.18) — issues and renews the region's certificates.
* **[trust-manager](https://cert-manager.io/docs/trust/trust-manager/)** (tested with v0.24) — distributes the Pipecat Cloud trust anchor into the region.

Install both with their CRDs (`crds.enabled=true` for cert-manager) and wait for them to be ready before installing the region package. The package checks for their CRDs at install time and fails with a clear message if either is missing.

## Network

A {productNameSingular} needs **outbound** access only. Nothing connects inbound to your cluster unless you choose to expose a WebSocket endpoint.

| Destination                                   | Port | Purpose                                                                                                     |
| --------------------------------------------- | ---- | ----------------------------------------------------------------------------------------------------------- |
| `api.pipecat.daily.co`                        | 443  | Region registration, enrollment, and automatic certificate renewal                                          |
| `region-gateway.pipecat.daily.co`             | 8443 | The Region gateway: the persistent, mutually authenticated connection between your region and Pipecat Cloud |
| {registryHost}                                | 443  | Pulling the region package and the platform component images                                                |
| Your AI service providers                     | 443  | Whatever your agents call (STT, LLM, TTS, and so on)                                                        |
| Your telephony or WebSocket clients (inbound) | 443  | Only if you [expose a WebSocket endpoint](/enterprise/websockets)                                           |

Egress through NAT is fine; no static IP addresses are required. Agent pods also need to reach the broker and, if enabled, the log store you configure.

## Sizing the platform components

The platform components run in a system namespace (`pipecat-system` by default) with these defaults:

| Component                    | Replicas | Request per replica |
| ---------------------------- | -------- | ------------------- |
| Session activation service   | 2        | 1 vCPU, 1 GiB       |
| Deployment operator          | 2        | 1 vCPU, 2 GiB       |
| Region agent                 | 2        | small               |
| Autoscaler                   | 1        | small               |
| Bundled broker and log store | 1 each   | development-grade   |

Plan roughly **6 vCPU and 8 GiB** for the platform at default replica counts, on nodes with at least 4 allocatable vCPU. Several components request a full vCPU each, so nodes with 2 vCPU fit at most one of them and a `helm install --wait` will time out with pods left pending.

Capacity for the agents themselves comes on top of this. Size it from your expected concurrency and the [resources you assign per agent](/enterprise/sizing) — a voice agent typically needs 0.5 vCPU and 1 GiB. A dedicated, autoscaled node pool for agent pods, as in the [EKS reference architecture](/enterprise/reference/aws-eks), keeps platform and agent capacity independent.

## Supporting services

The package bundles a single-replica broker and, optionally, a single-node log store. Both are intended for evaluation only. A production region provides:

* **A Valkey- or Redis-compatible broker** with TLS and password authentication, reachable from the cluster. The platform uses it for session activation and autoscaling signals.
* **An OpenSearch cluster** for agent logs — only if you [enable the log store](/enterprise/logs).

## Your workstation

* The Pipecat CLI with the `pipecatcloud` plugin, version {cliMinVersion} or later, [logged in](/api-reference/cli/cloud/auth) to an organization that has self-hosted regions enabled.
* `helm` 3.8 or later (for OCI registry support) and `kubectl`, configured for the target cluster.