> ## Documentation Index
> Fetch the complete documentation index at: https://docs.webdock.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Bring your own infrastructure

> Connect your own Kubernetes cluster, Vercel team or turboSMTP account to Webdock.

BYOK connects infrastructure or provider accounts you control to your Webdock workspace. Your provider continues to bill you directly. Webdock's permissions determine which resources it can inspect or manage; connecting an account does not transfer ownership to Webdock.

<Columns cols={2}>
  <Card title="Kubernetes and k3s" icon="server" href="/guides/byok-kubernetes">Connect an existing cluster and manage permitted workloads.</Card>
  <Card title="Vercel" icon="cloud" href="/guides/byok-vercel">Authorize a team and choose the projects available to Webdock.</Card>
  <Card title="turboSMTP" icon="envelope" href="/guides/byok-mail">Use your own sending account with workspace-scoped Mail keys.</Card>
  <Card title="Automate with MCP" icon="plug" href="/developers/byok">Discover BYOK tools, revision checks and recovery behavior.</Card>
</Columns>

## Permissions before connection

A platform operator enables each provider separately in the customer's **Your infrastructure → Selfservice permissions** controls. All provider switches are disabled by default. Workspace owners and administrators can use enabled connections; they cannot grant themselves platform privileges.

| Control | What it allows |
| - | - |
| Own Kubernetes clusters | Register clusters within the configured maximum |
| Allowed namespaces | Limit visible namespaced inventory and workload operations |
| Manage existing applications | Permit the supported workload actions in allowed namespaces |
| Own Vercel team | Connect a verified customer team and select projects |
| Own turboSMTP account | Connect a customer sending account |
| Maximum sender domains | Limit new registrations through Webdock; existing domains and provider sending limits remain separate |

Read-only customer preview cannot make these changes. A provider grant, workspace membership or hosting scope alone is insufficient: Webdock rechecks the current combination on each action.

## Connection lifecycle

A registration record is not a working connection. Complete agent enrollment or provider authorization, then inspect the last verification and inventory timestamps. Refresh stale data before making changes.

Disabling a permission blocks further use through Webdock. Disconnecting or revoking a connection does not delete provider resources. Keep provider-side access and backups under your control; revoke provider credentials separately when they should no longer work outside Webdock.

<Note>BYOK does not provide a blanket availability, backup or data-residency guarantee. Supply location evidence for clusters and verify actual deployment regions. A provider's global management services remain distinct from its workload location.</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.