What organisations ask before licensing Tersane.

Bahriya Tersane is a catalogue of production Helm charts and operators for the services that applications depend on, such as databases, caches and identity, and for the workload shapes your own applications are deployed with. It is licensed to your organisation, per year, for installation on your own premises.

Tersane is developed and supported by Mamluk, and its charts are the charts that run the managed services on bahriya.cloud, Mamluk's own public cloud.

Kubernetes is the system on which modern applications and their supporting services run. A Helm chart is a package that installs one such service, for example a MySQL database, together with every setting it needs, and upgrades it later in a controlled way.

Because a chart is delivered as readable files, your engineers and your security team can review exactly what will be installed before it is installed. Every setting your organisation changes is kept in one file under your own version control, so the installation can be audited and repeated.

Tersane is a commercial licence. The software the charts run, such as MySQL, Valkey, Keycloak, Memcached and ClamAV, is open-source software that keeps its upstream name and remains under its publisher's own licence. Mamluk builds a small number of images itself, such as those for MySQL and Valkey, and copies the others unchanged from their publishers.

What the Tersane licence provides is the charts, the images served from Mamluk's registry, their updates and security patches, and support, together with the deployment topologies and high-availability modes the charts offer. These include the mysql chart's standard mode, a primary with optional asynchronous read replicas, and its high-availability mode, a Group Replication cluster of three or more members with automatic failover; the valkey chart's standalone, Sentinel and cluster modes, the second with automatic failover and the third sharded across several primaries; and the keycloak chart's replicas, which form one cluster on separate nodes.

Infrastructure your organisation controls. That includes your own data centres and your organisation's own accounts with a cloud provider, including an in-country cloud. Tersane runs inside your clusters and is operated by your organisation; Mamluk does not host it for you.

Yes. EKS, AKS and GKE are certified as conformant by the Cloud Native Computing Foundation, and Tersane is licensed for any conformant Kubernetes distribution, including in your organisation's own cloud accounts, at the price for distributions other than BKE. Mamluk supports the charts there; the Kubernetes service itself remains supported by its provider.

The charts install there with the same changes as on any other distribution: name one of your provider's storage classes, name your ingress class or install Kong where you use its features, install cert-manager where a chart requests certificates, and either install Calico with its API server or turn the mysql and valkey charts' network policies off and apply your own. Whether a provider's built-in network policy serves Calico's resources varies by provider and configuration, so check it before installing. Your cluster's nodes must be able to reach Mamluk's image registry, or a registry of your own to which you have copied the images.

Not yet. Support for OpenShift is planned and is on Tersane's roadmap, but it is not available today.

The mysql and valkey charts apply their network policy, by default, through Calico's API, which OpenShift's default network does not serve. The policy can be turned off, but the charts do not yet offer a standard Kubernetes NetworkPolicy in its place. Several charts also run containers under fixed user identities, some of them set in the charts' templates rather than in their values, which OpenShift's default security context constraint refuses. Support for OpenShift will be announced on this site when the charts provide for both.

Rancher and Tanzu are certified as conformant Kubernetes distributions by the Cloud Native Computing Foundation, and Tersane is licensed for any conformant distribution. The same changes apply as on any cluster other than BKE: Calico with its API server, or the charts' network policies turned off; a storage class your cluster provides, named in the charts' values; your ingress class, or Kong where you use its features; and cert-manager where a chart requests certificates. Running Tersane without BKE sets out each one.

Yes. The charts run inside your perimeter. In your own data centre, Tersane runs on the Bahriya Kubernetes Engine, which installs on physical or virtual servers, or on any other conformant Kubernetes distribution you operate there.

Yes, wherever your organisation operates a conformant Kubernetes cluster in its own account: on the provider's own Kubernetes service, if it is certified as conformant, or on BKE or another distribution installed on the provider's virtual machines. If the cluster is BKE, the BKE price applies; otherwise, the price for other distributions applies.

Yes. Your organisation may copy the images into a registry of its own, for its own licensed use, and run Tersane on a network with no route to the internet. From a connected machine, using your organisation's credentials, your team downloads the charts and copies the images they use into a registry inside your network, then sets each chart's images to that registry in the values file you keep.

Once installed, the charts' services need no connection outside your network, with one exception: in the clamav chart, ClamAV's signature updater downloads new virus signatures from ClamAV's publisher. On a network with no route to the internet, turn the updater off by setting CLAMAV_NO_FRESHCLAMD in the chart's extraEnv; the chart has no setting for a signature mirror of your own, so the signatures are then not updated. Note that the Bahriya Kubernetes Engine itself cannot yet be installed without internet access: it needs outbound access to a short list of hosts during installation and upgrade.

Two outbound connections over HTTPS, both for downloads. The machine that installs and upgrades releases needs to reach Mamluk's chart repository, tersane.maml.uk. Every node of your cluster needs to reach Mamluk's image registry, 1x.ax, to pull the images the charts run, unless you copy the images into a registry of your own.

Nothing in your cluster connects to Mamluk for any other purpose. Access and credentials describes both. Separately from Mamluk, the clamav chart's signature updater downloads virus signatures from ClamAV's publisher, and a chart reaches any backup storage or other service your team names in its values.

Each chart's documentation states the oldest Kubernetes version it supports, under its prerequisites, with the exception of the clamav chart, whose documentation does not yet state one. The keycloak chart also refuses to install on an older version. On BKE, the charts are built on the Kubernetes version and components that BKE pins in each release.

Per organisation, per year, for installation on infrastructure your organisation controls. The licence does not grow with your clusters, nodes or processor cores. It includes the Tersane catalogue, with the deployment topologies and high-availability modes the charts offer, chart updates, upgrade compatibility, security patches and ticketed support. Convoys are licensed separately.

The price with BKE is published on the licensing page; on any other conformant Kubernetes distribution, the price is on request. BKE is licensed separately, per cluster, at the price published on bke.bahriya.cloud.

Convoys are priced separately: the Compliance and Assurance Convoy's price is published on the licensing page, and every other Convoy is priced on request.

Yes. The licence is for your organisation and does not change with the number of clusters, so every cluster your organisation runs on its own infrastructure is covered, whatever its purpose.

One legal entity, together with the subsidiaries it wholly owns, using Tersane for its own operations. A group whose companies are separately owned or regulated, or an organisation that runs services for other organisations, should contact Mamluk to agree the licence that fits.

Tersane does not offer a self-service trial. The documentation is public and describes every chart in full, and an evaluation licence for a fixed period can be arranged on request. The Bahriya Kubernetes Engine offers a 14-day trial licence, issued from the Mamluk console.

On the end date, access to the chart repository and to every Tersane image ends, and no further updates, security patches or support are delivered.

The licence then requires you to remove the Tersane charts, and any copies of Tersane images in your own registries, within 30 days of the end date. Your data remains yours throughout: use those 30 days to export it, or to move it to other software, before the charts are removed.

Renewing restores access. Your image tokens are restored unchanged if the licence is renewed within 30 days of its end date; after that, renewal requires new image tokens, created in the Mamluk console.

Tersane is licensed by Mamluk LLC-FZ, Meydan Free Zone, Dubai, United Arab Emirates, and priced in US dollars. The licence terms are provided with the quotation, so that your legal and procurement teams can review them before the licence is agreed. To start the process, contact Mamluk.

A Convoy is an optional addition to Tersane for one industry or one requirement, licensed separately. Tersane is complete without one. A Convoy builds on the charts Tersane provides, is installed and upgraded in the same way, and, like Tersane, runs inside your perimeter. See Convoys.

Three are described today.

• The Banking Convoy, which is experimental, is an app marketplace for existing digital banking platforms.
• The Compliance and Assurance Convoy, which is experimental, tunes a cluster to the technical controls regulators require and records the evidence. NCA ECC is available; regimes for Qatar, the Saudi Central Bank and the United Arab Emirates are expected in 2027.
• The Identity Verification Convoy, which is also coming soon, will run identity verification entirely inside your own cluster.

Yes. A Convoy runs on Tersane, and Tersane runs on BKE or on your own distribution; each Convoy requires a Tersane licence.

The Compliance and Assurance Convoy needs Kubernetes 1.36 or later, which BKE provides from 2.2.0; on another distribution, the cluster must be at that version or later. It reads certain facts about the platform that BKE records from 2.3.0. On an earlier BKE version or another distribution, it reports the checks that depend on those facts as not evaluated, never as failed, and your team evidences those controls by other means.