Architecture
One set of modules runs as a single binary at the edge or as replicated services on Kubernetes. Dependency injection swaps the infrastructure underneath; the product stays the same.
- Runs as
- Single binary · Container · Industrial Edge · Kubernetes
- Scales on
- Kubernetes, with Helm
- Swapped at boot
- Storage · Messaging · MQTT · Historian · Search
- Applies to
- 3.0
How Context Engine Is Built
This page describes Context Engine, the MaestroHub product you run today (see What MaestroHub is for the three products). Context Engine is a set of modules: authentication, authorization, connectors, the pipeline engine and scheduler, the unified namespace, audit and more. Each module asks for what it needs through a port (a system store, an event stream, a historian, an MQTT broker) and never names the technology behind it. At boot, the deployment shape decides which adapter fills each port.
Switch between the two shapes below. The modules do not move; the box around them and everything underneath them changes.
Platform
Data and automation
Apps and AI
Operations
Everything in one process. The modules, an embedded message bus, an embedded MQTT broker and an embedded historian. One file to download, one port to open. The same build ships as a container and as a Siemens Industrial Edge app.
Single binary. Every module runs in one process with an embedded message bus, MQTT broker and historian. You download one file, run it, and everything works, with no infrastructure to set up. The same build ships as a container and as a Siemens Industrial Edge app. This is how most teams start. What one such machine stores and executes, measured on three machine sizes, is on Sizing and performance.
Kubernetes. Each module becomes its own service with its own replicas, installed with Helm. Services talk through a NATS cluster, and data lives in PostgreSQL and TimescaleDB, which you can scale, replicate and back up on their own. The MQTT broker is built into UNS: every UNS replica serves MQTT, the replicas are linked by a direct mutual-TLS mesh, and persistent sessions are kept in NATS JetStream, so they survive the replica they were on.
Everything you build in one shape works in the other. Pipelines, dashboards, connections and configuration carry over. Start on your laptop, move to Kubernetes later, with no rework. The shape is a deployment choice, not an edition: Foundation and Enterprise are licences, described on Editions.
Where each shape sits in a plant, from one binary next to a line to a namespace that spans every site, is drawn level by level on Deployment scenarios.
Fleet Manager: one place for many deployments
An optional, separate instance that manages all your MaestroHub deployments from one dashboard. You need it only when you run more than one deployment; a single deployment manages all of its sites natively.
Every MaestroHub instance, whether it runs as a single binary or on Kubernetes, sends a heartbeat to the Fleet Manager every few seconds over HTTPS. Heartbeats carry the version, health, resource usage (CPU, memory, disk) and per-workspace execution metrics (pipeline runs, success rates, throughput), and each reply carries the instance's licence. Commands from Fleet Manager wait in a queue that the instance polls. Every connection is opened by the instance. Fleet Manager never connects to your instances, so no inbound ports need to be opened on your factory network.
From a single dashboard, you can:
- Distribute licenses. One master license key is automatically split into per-instance entitlements. No manual activation per factory.
- Distribute configuration. SSO settings (OIDC, SAML, LDAP) and system-level config are set once in Fleet Manager, and every instance picks them up on its next command poll.
- Monitor fleet health. See which instances are healthy, degraded, or offline. Drill into per-workspace metrics across your entire fleet.
- See workspace use across the fleet. Every instance has at least one workspace, created at first boot, and can create more as its licence allows. Fleet Manager shows how many each instance uses. MaestroHub itself is licensed per site, one factory location; see Licensing and trial.
If the link to Fleet Manager drops, the instance keeps working on its last licence for a grace period (7 days by default), then falls back to its local licence file or, without one, the evaluation. It keeps retrying the link the whole time.