Skip to main content

​
Licenses

During Onboarding
  • Username and Password
    • A username and password are provided during onboarding and is used to authenticate to HiddenLayer registries when downloading product images.
  • License IDs
    • License IDs are provided during onboarding and are used as the registry password when downloading HiddenLayer products.
    • The AI Security Platform: Self-Hosted/Air-Gapped install now bundles Runtime Security and AI Attack Simulation.

​
Hostname

  • A hostname for the HiddenLayer AI Security Platform.
    • Example: http://server1.test.hiddenlayer.com.

​
Supported Cloud Providers

The AI Security Platform installation has been tested on AWS cloud infrastructure. The installation should work with other cloud providers.

​
Compute

The following compute information is for the Embedded Cluster installation of the AI Security Platform. For a Helm installation, see the Helm Prerequisites.

​
Self-Hosted

The embedded cluster installation of the Self-Hosted platform requires three nodes, one per role: a controller, a worker, and a GPU worker.
  • Linux-based operating system (The following are verified installations.)
    • RHEL 9.8 / Rocky 9.8
    • AWS Deep Learning AMI (AWS DLAMI) with Ubuntu 22.04 LTS
  • x86_64 (ARM64 is not supported)
  • The controllers, workers, and GPU workers require the following minimum specifications:
CUDA GPU required for Runtime SecurityThe Self-Hosted deployment scheduler request is nvidia.com/gpu, so the GPU worker must have a GPU with CUDA cores. Non-CUDA cards cannot satisfy the scheduler request.The NVIDIA GPU Operator (which configures and manages GPUs on Kubernetes) ships with the Embedded Cluster install. A “GPU node availability” preflight warns when no node labeled node.kubernetes.io/group=gpu advertises an allocatable nvidia.com/gpu.Examples: T4, A10, L4, L40, RTX PRO 4500, and RTX PRO 6000.
Also Consider:
  • The number of controllers and workers depends on your organization’s high availability (HA) requirements.
  • The minimum for deployment is one controller node, one worker node, and one GPU worker node.
    • Note: This is not high availability.
  • Roles are placed by hard node affinity on node.kubernetes.io/group; a role with no node gets pods that never schedule.
  • aidr-genai is the only workload requesting nvidia.com/gpu, one device per replica — so N Runtime Security Replicas needs N GPU instances, on a card of compute capability ≥ 7.5.
  • A GPU worker is required for production environments. A CPU-only option is possible, but not recommended for production environments due to significantly slower performance. Please contact your HiddenLayer representative for more information.
Notes
  • Do not run Kubernetes on the Linux system where the Airgapped AISec Platform is installed.
    • Kubernetes is installed as part of the Airgapped AISec Platform installation.
  • The Airgapped AISec Platform is not supported as a container deployment.
    • Example: ECS
  • The minimum specifications listed are based off validation performed by HiddenLayer. Node sizing and infrastructure specifications are dependent on workload needs.
  • Performance will vary based on resources. Typically, the more resources the better the performance.

​
Tools

The following tools are required for the controller and worker nodes.
  • systemd
  • curl

​
Services

The below services are required for the Platform to be deployed and to function as expected.

​
Network

For complete functionality, the following ports need to be open and allow ingress on the Linux systems where the Airgapped AISec Platform is installed.
  • Ports 443, 80, and 30000 are required for the AI Security Platform Console.
  • The other ports listed allow functionality between the Console and the worker nodes.

​
Outbound (all TCP 443)

Joining nodes do not need outbound access. They fetch the installer binary from the controller on port 30000.

​
Other Requirements

  • Ensure Network Time Protocol (NTP) is enabled and the system clock is synchronized.