> ## Documentation Index > Fetch the complete documentation index at: https://docs.hiddenlayer.ai/llms.txt > Use this file to discover all available pages before exploring further. # Prerequisites - Embedded Cluster ## Licenses **During Onboarding** * Username and Password * A username and password are provided during onboarding and is used to authenticate to HiddenLayer registries when downloading product images. * License IDs * License IDs are provided during onboarding and are used as the registry password when downloading HiddenLayer products. * The AI Security Platform: Self-Hosted/Air-Gapped install now bundles Runtime Security and AI Attack Simulation. | Product | License ID | | ------------------------------------------------------------------------- | ------------------------------- | | AI Security Platform (includes Runtime Security and AI Attack Simulation) | AI Security Platform License ID | ## Hostname * A hostname for the HiddenLayer AI Security Platform. * Example: `http://server1.test.hiddenlayer.com`. ## Supported Cloud Providers The AI Security Platform installation has been tested on AWS cloud infrastructure. The installation should work with other cloud providers. ## Compute The following compute information is for the Embedded Cluster installation of the AI Security Platform. For a Helm installation, see the [Helm Prerequisites](/docs/products/selfhosted/selfhosted_platform_helm_prerequisites). ### Self-Hosted The embedded cluster installation of the Self-Hosted platform requires three nodes, one per role: a controller, a worker, and a GPU worker. * Linux-based operating system (The following are verified installations.) * RHEL 9.8 / Rocky 9.8 * AWS Deep Learning AMI (AWS DLAMI) with Ubuntu 22.04 LTS * x86\_64 (ARM64 is not supported) * The controllers, workers, and GPU workers require the following minimum specifications: **CUDA GPU required for Runtime Security** The Self-Hosted deployment scheduler request is `nvidia.com/gpu`, so the GPU worker must have a GPU with CUDA cores. Non-CUDA cards cannot satisfy the scheduler request. The NVIDIA GPU Operator (which configures and manages GPUs on Kubernetes) ships with the Embedded Cluster install. A "GPU node availability" preflight warns when no node labeled `node.kubernetes.io/group=gpu` advertises an allocatable `nvidia.com/gpu`. Examples: T4, A10, L4, L40, RTX PRO 4500, and RTX PRO 6000. | Resource | Controller | Worker | GPU Worker | | -------------------- | ------------------------------ | ------------------------------- | ----------------------------------------- | | vCPU minimum | 8 | 16 | 8 | | RAM minimum | 16 GB | 32 GB | 32 GB | | Disk minimum | 200 GB | 200 GB | 200 GB | | GPU | - | - | Compute Capability ≥ 7.5 | | Examples (using AWS) | r5.4xlarge - 16vCPU and 128 GB | r5.4xlarge - 16 vCPU and 128 GB | g4dn.2xlarge - 8vCPU, 32 GB, and Tesla T4 | **Also Consider**: * The number of controllers and workers depends on your organization's high availability (HA) requirements. * The minimum for deployment is one controller node, one worker node, and one GPU worker node. * **Note**: This is not high availability. * Roles are placed by hard node affinity on `node.kubernetes.io/group`; a role with no node gets pods that never schedule. * `aidr-genai` is the only workload requesting `nvidia.com/gpu`, one device per replica — so `N` **Runtime Security Replicas** needs `N` GPU instances, on a card of **compute capability ≥ 7.5**. * A GPU worker is required for production environments. A CPU-only option is possible, but not recommended for production environments due to significantly slower performance. Please contact your HiddenLayer representative for more information. **Notes** * Do not run Kubernetes on the Linux system where the Airgapped AISec Platform is installed. * Kubernetes is installed as part of the Airgapped AISec Platform installation. * The Airgapped AISec Platform is not supported as a container deployment. * Example: ECS * The minimum specifications listed are based off validation performed by HiddenLayer. Node sizing and infrastructure specifications are dependent on workload needs. * Performance will vary based on resources. Typically, the more resources the better the performance. ## Tools The following tools are required for the controller and worker nodes. * systemd * curl ## Services The below services are required for the Platform to be deployed and to function as expected. * For a detailed example of services, see [Example AWS](/docs/products/selfhosted/selfhosted_platform_example_aws). | Service | Service Type | Requirements | | ----------------------- | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Apache Kafka | Event Streaming | | | OpenSearch - Platform | Event/report indexing and query | | | OpenSearch - FusionAuth | Search indexes for the identity provider | | | PostgreSQL | Database | | | Redis | In-Memory Data Structure Store | | ## Network For complete functionality, the following ports need to be open and allow ingress on the Linux systems where the Airgapped AISec Platform is installed. * Ports 443, 80, and 30000 are required for the AI Security Platform Console. * The other ports listed allow functionality between the Console and the worker nodes. | Port | Protocol | Reaches | Direction - Source > Destination (inbound) | | ------------ | -------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 443 | TCP | Platform Console and API client calls | End users > Load balancer > Controller and worker | | 80 | TCP | Redirect to 443 | End users > Load balancer > Controller and worker | | 30000 | TCP | Admin Console | Operators and every joining node > Controller | | 6443 | TCP | Kubernetes API | Every node and operators running `kubectl` off-host > Controller | | 9443 | TCP | k0s API (on the controller) | Joining node > Controller | | 10250, 9200 | TCP | kubelet and node metrics (on every node) | Controller > Every node | | 51820 | UDP | Calico Wireguard (overlay data path) | Node > Node, every pair, both ways | | 4789 | UDP | VXLAN (open only if you disable Wireguard) | Node > Node, every pair, both ways | | 2380 | TCP | etcd peers | Controller > Controller, on a multi-controller cluster only | | 10249, 10256 | TCP | `kube-proxy` metrics and healthz. | No rule opened here. Both bind `*:` on the controller,measured. `kube-proxy` is a DaemonSet, so the same is expected elsewhere and was not checked. Nothing in this topology scrapes them across nodes. | | 9091 | TCP | `calico-node` metrics. | No rule opened here. Same as above. Measured on the controller. | ### Outbound (all TCP 443) | When | Destination | Purpose | How to avoid it | | ----------------------------- | ------------------------------- | ----------------------------- | ------------------------------------------------------------------- | | Before install | `updates.hiddenlayer.ai` | Download the installer bundle | Take the bundle on media from HiddenLayer. | | Before install, GPU node only | `developer.download.nvidia.com` | NVIDIA driver packages | Bake the driver into the node image, or mirror the CUDA repository. | | At runtime, optional | `api.openai.com` | Attack Simulation evaluations | Leave the OpenAI key blank; the rest of the platform is unaffected. | Joining nodes do not need outbound access. They fetch the installer binary from the controller on port 30000. ## Other Requirements * Ensure Network Time Protocol (NTP) is enabled and the system clock is synchronized.