> For the complete documentation index, see [llms.txt](https://v2.dataos.info/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://v2.dataos.info/operate/dataos-operator/create-tenants/deploy-stacks.md).

# Deploy Stacks

Deploy the Lakehouse MRuntime Stack, the Data Product MCP server, and its OAuth broker for a Tenant.

Once the Data Plane and Compute are attached to the Tenant, deploy the required Stacks:

* Lakehouse MRuntime
* Data Product MCP server
* OAuth broker for the Data Product MCP server

A Tenant is deployment-ready only after all required Stacks have been deployed successfully and are healthy.

{% hint style="warning" %}
**Tenants created before August release** need to be migrated to the new Tenant definition. Reach out to SRE to get yours upgraded.
{% endhint %}

<details>

<summary>Prerequisites</summary>

* [Attach the Data Plane and Compute](/operate/dataos-operator/create-tenants.md#attach-compute) complete
* DataOS CLI initialized for the Tenant

Navigate to `dataos-component-install/` (or your equivalent root) before applying Stacks.

</details>

## Lakehouse mruntime

The `lakehouse-mruntime` Stack is part of Tenant readiness: it must be active in the Tenant before anyone can create a Lakehouse, because the Lakehouse Spark Cluster runs on it as its runtime.

Its manifest and version are environment-specific and are not published here. Ask your DataOS representative for the manifest and the version to apply.

Confirm it is present and active before continuing:

```bash
dataos-ctl develop stack versions
```

The output should list `lakehouse-mruntime` in an active state.

## MCP Server

Deploy a **Data Product MCP server** for Data Product tooling on the Instance.

{% hint style="info" %}
The MCP Server is deployed only once, for the first Tenant. Every Tenant after that uses the existing deployment.
{% endhint %}

```bash
# Service: set tenant and compute for your environment
TENANT_ID=qa COMPUTE_NAME=qa-compute \
  dataos-ctl resource apply -f installs/instance-platform-shell/artifacts/dataproduct-mcp-service.yaml
```

{% hint style="info" %}
Before you apply, update `TENANT_ID` and `COMPUTE_NAME` to match your environment.
{% endhint %}

## MCP Broker to enable OAuth

Deploy the broker so clients can authenticate to the MCP server through OAuth.

{% hint style="info" %}
Before you apply, update `TENANT_ID` and `COMPUTE_NAME` in the commands below to match your environment.
{% endhint %}

{% stepper %}
{% step %}
**Collect the four required values**

* **`JWT_PRIVATE_KEY_B64`.** Generate a key and base64-encode it as a single line:

  ```bash
  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out /tmp/mcp-broker-key.pem
  base64 < /tmp/mcp-broker-key.pem | tr -d '\n'
  ```
* **`FORWARD_AUTH_SHARED_SECRET`.** Generate a random secret:

  ```bash
  openssl rand -base64 48
  ```
* **`UPSTREAM_CLIENT_ID`** and **`UPSTREAM_CLIENT_SECRET`.** The `client_id` and `client_secret` of a dedicated confidential **Heimdall OIDC client**. These are not generated locally: request them from whoever administers Heimdall for this Instance.

{% hint style="warning" %}
The Heimdall OIDC client's registered redirect URI must be `https://<dataOsFqdn>/mcp/api/v1/oauth/callback`. OAuth fails if it does not match.
{% endhint %}
{% endstep %}

{% step %}
**Apply the broker Secret**

```bash
TENANT_ID=qa COMPUTE_NAME=qa-compute \
  dataos-ctl resource apply -f installs/instance-platform-shell/artifacts/broker-secret.yaml
```

{% endstep %}

{% step %}
**Apply the broker**

```bash
TENANT_ID=qa COMPUTE_NAME=qa-compute \
  dataos-ctl resource apply -f installs/instance-platform-shell/artifacts/mcp-broker.yaml
```

{% endstep %}
{% endstepper %}

{% hint style="warning" %}
Treat `JWT_PRIVATE_KEY_B64`, `FORWARD_AUTH_SHARED_SECRET`, and the Heimdall client secret as sensitive credentials. Do not commit them to Git. Delete the generated key file (`/tmp/mcp-broker-key.pem`) once it is encoded and stored.
{% endhint %}

## Checkpoint

The `lakehouse-mruntime` Stack is active, and the MCP Server and MCP Broker resources apply successfully and report ready or healthy status.

{% hint style="success" %}
Next: [Hand off Tenant](/operate/dataos-operator/create-tenants/hand-off-tenant.md#confirm-the-tenant-is-ready).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://v2.dataos.info/operate/dataos-operator/create-tenants/deploy-stacks.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.