Cloud-managed data platforms are the default assumption in most vendor documentation, but a significant number of Japanese enterprises. Particularly in financial services and manufacturing. Operate under security policies that require data to remain in their own facilities. Deploying a data mesh on-premise introduces a set of constraints that are worth understanding before you start.
The typical on-premise environment in Japan ¶
Most large Japanese enterprises that run on-premise infrastructure use co-location facilities in Tokyo or Osaka, or operate their own server rooms. The hardware is typically a mix of bare-metal servers and VMware virtualisation, with Kubernetes adoption growing but not yet universal. Network connectivity between sites is usually handled by MPLS circuits rather than public internet, which affects how a distributed query router needs to be configured.
Containerisation and the Helm chart approach ¶
Packaging the platform as a Docker image with a Helm chart makes deployment consistent across environments. The Helm chart handles the configuration of the query router, the permission engine, and the connector registry. Values that differ between environments. Database connection strings, TLS certificates, resource limits. Are passed in through a values file that the client's infrastructure team controls. This keeps the platform binary identical between cloud and on-premise deployments.
Network considerations for query routing ¶
A data mesh query router needs to reach every source system it serves. In an on-premise environment, this means the router must be deployed on a network segment that has access to all source databases. In environments where databases are on separate VLANs with strict firewall rules, this requires coordination with the network team before deployment. The typical setup is a dedicated query-router node on a management VLAN with outbound rules to each source database port.
Security and certificate management ¶
On-premise deployments in Japanese enterprises typically require mutual TLS between the query router and source databases, and between the query router and client applications. Certificate management is the most common source of friction during onboarding. We recommend using an internal CA that the client's security team already manages, rather than introducing a new CA. The Meshblend deployment guide includes a section on configuring mutual TLS with common Japanese enterprise CA setups.
If your security policy requires on-premise deployment, the on-premise deployment package includes a setup guide written for Japanese IT infrastructure teams. The most common questions we get about this are covered in the most common questions we get.