> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/system-requirements.md).
# System requirements
Supported operating systems, CPU, memory and disk per deployment shape, supported database platforms, and the component versions OpenIAM ships.
Everything needed to provision for an OpenIAM deployment, in one place. Use this when raising an infrastructure request or answering a platform question; the build pages assume a host already meets it.
## At a glance
| | RPM, single node | RPM, three nodes |
| -------------------- | ------------------------------------------------ | ----------------------------------------------------- |
| **Hosts** | 1 | 3, identically specified |
| **CPU per host** | 8 vCPU | 8 vCPU |
| **Memory per host** | 48 GB non-production
62 GB production
| 48 GB non-production
62 GB production
|
| **Disk per host** | 80 GB non-production
200 GB production
| 80 GB non-production
200 GB production
|
| **Operating system** | Enterprise Linux 9 or 10 | Enterprise Linux 9 or 10 |
| **Database** | Local or remote | Remote, or a database cluster on the same three hosts |
| **Platform** | Bare metal, any hypervisor, or a cloud instance | Bare metal, any hypervisor, or cloud instances |
A Kubernetes deployment is sized differently — 32 GB of memory for non-production or 40 GB for production, 8 CPU and 80 GB of storage, as totals across the nodes running it. See [*Prepare the cluster*](/installation/kubernetes/prepare-the-cluster.md).
These are the figures the platform is provisioned against. Sizing beyond them — for a specific user population, batch profile or transaction rate — is covered in the [Solution Architecture and Design Guide](/solution-architecture/deployment/sizing.md)'s sizing page.
## Supported and validated
**Supported** means the platform is built for it and OpenIAM stands behind it. **Validated** means this release has been exercised on it. Prefer a validated combination where you have the choice.
| Area | Supported | Validated in this release |
| --------------------- | ---------------------------------------------- | ----------------------------------------------------------------------- |
| Operating system, RPM | Enterprise Linux 9 and 10 | Enterprise Linux 9 |
| Cloud images, RPM | Red Hat, Rocky, AlmaLinux 9 and 10 | Enterprise Linux 9 images on AWS and Azure |
| Database engines | MariaDB, MySQL, PostgreSQL, SQL Server, Oracle | MariaDB and PostgreSQL |
| Managed databases | Amazon RDS, Azure Database | RDS for MariaDB and PostgreSQL; Azure Database for MySQL and PostgreSQL |
| Search tier | OpenSearch, Elasticsearch | OpenSearch |
| Kubernetes | Any conformant cluster | Amazon EKS and Azure AKS |
| Kubernetes route | Terraform, Helm | Terraform on EKS and AKS |
| Deployment shape | Single node, three nodes, Kubernetes | All three, single-zone |
### Kubernetes versions
**The Terraform routes set the cluster version for you**, from the shipped configuration:
| Provider | Version the shipped configuration deploys |
| ---------- | -------------------------------------------------- |
| Amazon EKS | `kubernetes.aws.eks_version` in `terraform.tfvars` |
| Azure AKS | `kubernetes.aks.version` in `terraform.tfvars` |
**On a cluster you already run**, match those values. They are the versions this release's configuration is built against, and they are the ones to quote if you raise a case.
Anything not listed as validated is supported on the same terms as the rest of the product; it has not been exercised in this release's testing. Raise it with your account team before committing to it in production.
## Operating system
| | Supported |
| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Distribution** | Enterprise Linux 9 or Enterprise Linux 10, and the compatible rebuilds |
| **Architecture** | x86-64 |
| **Swap** | Disabled |
| **SELinux** | **Single node: enforcing or permissive**, both supported — the installation sets the contexts, ports and booleans the platform needs. **Three nodes: disabled**, required by the clustered cache — see [*Prepare the hosts*](/installation/rpm/rpm-ha/prepare-the-hosts.md) |
| **fapolicyd** | Supported — rules are installed automatically when the service is active |
| **FIPS and STIG crypto policies** | Supported. The installation detects the active crypto policy and installs the additional rules the bundled runtime needs, including access to a compliant temporary directory. No manual step is required |
Confirm the version with:
{% code overflow="wrap" %}
```bash
grep PLATFORM_ID /etc/os-release
```
{% endcode %}
## CPU
**8 vCPU per host**, for both RPM shapes.
OpenIAM runs its application services as separate processes, so the platform benefits from core count more than from clock speed. Eight is the provisioning figure for a node running the full platform; dedicated connector hosts and separated console nodes need less, and the architecture guide gives per-role figures for each topology.
## Memory
| Environment | Per host |
| ------------------------------ | -------: |
| Non-production and development | 48 GB |
| Production | 62 GB |
Swap must be disabled. OpenIAM's memory settings are sized for a host that does not swap, and the installation confirms this before it begins.
## Disk
| Environment | Free space on `/` |
| ------------------------------ | ----------------: |
| Non-production and development | 80 GB |
| Production | 200 GB |
This covers the platform, its bundled components, and working space. Database storage is additional and sized from your population and audit retention — see the architecture guide's sizing page.
**OpenIAM installs into `/usr/local/openiam`, on the root filesystem, and the free-space requirement is against `/`.** You can install onto a separate partition — see [*Install on a separate partition*](/installation/rpm/rpm-single-node/separate-partition.md) — which changes where the deployment grows. Size `/` to the figure above either way.
## Database
OpenIAM runs against five database platforms. Choose one at installation; the choice is fixed for the life of the deployment.
| Platform | Supported versions | Notes |
| ------------------------ | ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **MariaDB** | 10.6 and later | Version 11.8.8 can be installed on the platform host by the installer, or supply your own server. 11.8.8 is an LTS release with community support to June 2028, and is the version used across all installation types |
| **MySQL** | 8.0 and later | Supply your own server |
| **PostgreSQL** | 13 and later | Supply your own server |
| **Microsoft SQL Server** | 2019 and later | Supply your own server |
| **Oracle Database** | 19c and later, including 21c and 23ai | Supply your own server. Connect by SID or by service name |
**All eight OpenIAM schemas are hosted on one database server.**
**Managed database services are supported on AWS and Azure**, and the installation includes handling for the privilege model those services use. [*Managed databases*](/installation/rpm/cloud/managed-databases.md) covers which service for which engine, and the parameters to set before you install.
The database account used for installation needs permission to create databases, create users and grant privileges. See [*Use a remote database*](/installation/rpm/rpm-single-node/use-a-remote-database.md).
{% hint style="warning" %}
**MariaDB 11.6.2 and later enable `innodb_snapshot_isolation` by default**, and the bundled 11.8.8 is inside that range — so this applies to a default installation as well as to your own recent MariaDB server.
Under concurrent load a transaction writing a row that changed after its read view was taken fails with error 1020, `Record has changed since last read in table '…'; try restarting transaction`, instead of proceeding silently as older versions did. Nothing is committed; the transaction rolls back.
OpenIAM retries these rolled-back write conflicts automatically, so no action is needed to make the platform work. Expect the errors to appear in service logs under load, and treat them as retried conflicts rather than data problems. Disabling snapshot isolation on the server is not the recommended fix.
{% endhint %}
## Java
OpenIAM ships and uses its own OpenJDK 21 runtime, installed under the OpenIAM directory. **You do not need a system JVM**, and OpenIAM does not use one if present — so the platform is unaffected by Java version changes elsewhere on the host.
## Components installed with OpenIAM
The installation deploys and configures these for you. No separate licences, downloads or administration are required to get running.
| Component | Version | Role |
| ------------------ | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| OpenJDK | 21 | Runtime for the platform services |
| Apache Cassandra | 4.0 | Storage behind the entitlement graph |
| JanusGraph | 1.1 | Entitlement graph |
| RabbitMQ | 4.1 | Message broker |
| Erlang | 26 on EL9, 27 on EL10 | RabbitMQ runtime |
| Redis | 8.2 on EL9, 8.6 on EL10 | Distributed cache |
| OpenSearch | 2.19 | Search and audit indexing |
| Elasticsearch | 7.17 | Alternative search tier |
| HashiCorp Vault | 1.20 | Secret store |
| HashiCorp Consul | 1.20 | Secret store backend |
| Apache HTTP Server | 2.4 | Reverse proxy, with the OpenIAM module |
| Apache Tomcat | Embedded, current | Servlet container for the six user interfaces. Each interface is a self-contained web application with Tomcat built in — there is no separate Tomcat to install or administer |
| nginx | Current release | Interface router behind the reverse proxy |
| Flyway | 10.22 | Database schema management |
| MariaDB | 11.8.8 | Optional local database. LTS, community support to June 2028 |
| Prometheus | 3.5 | Optional metrics collection |
| Grafana Enterprise | 12.2 | Optional dashboards |
Search: choose **OpenSearch or Elasticsearch** at installation on a single-node deployment. OpenSearch is the default and is what the three-node build uses.
## Network
* **Outbound HTTPS to `download.openiam.com`** during installation. A single-node deployment can be installed with no outbound access at all — see [*Obtain the software*](/installation/obtain-the-software.md). On a three-node build, only the first host needs it for the OpenIAM components: it retrieves them once and distributes them to the other two.
* **Outbound HTTPS to your OS vendor's package repositories** from every host. The three-node build installs packages on each of them.
* **The ports for your shape** — [*single node*](/installation/rpm/rpm-single-node/ports.md) or [*three nodes*](/installation/rpm/rpm-ha/ports.md). A single-node deployment exposes two ports to users — 80 and 443; the three-node shape adds inter-node ports.
* **A resolvable fully qualified hostname per host.** For the three-node shape, each host must resolve and reach the other two by the configured names.
* **Synchronised clocks.** The tiers exchange time-sensitive messages and certificate validation depends on accurate time.
* **IPv4.** IPv6 is disabled on the host during installation.
## Client browsers
The Webconsole and SelfService interfaces run in current versions of Chrome, Edge, Firefox and Safari.
## Related
* [*What you need*](/installation/what-you-need.md) — the pre-flight checklist
* [*Ports — single node*](/installation/rpm/rpm-single-node/ports.md) and [*Ports — three nodes*](/installation/rpm/rpm-ha/ports.md)
* [Solution Architecture and Design Guide](/solution-architecture/solution-architecture.md) — topology selection, sizing, and the platform support matrix for managed cloud services
*Applies to OpenIAM 2026.8.1.*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.openiam.com/installation/system-requirements.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.