Self-Hosted Installation for Helm

The HiddenLayer AI Security Platform: Self-Hosted/Air-Gapped can be installed on Bring Your Own Kubernetes cluster. The platform is packaged as a Helm chart.

• The AI Security Platform: Self-Hosted/Air-Gapped can also be deployed using an Embedded Cluster.

​

Before You Begin

Before deploying the AI Security Platform: Self-Hosted/Air-Gapped, make sure you understand the Prerequisites.

​

Installing

1. Sign in to the registry.
   • Username: The email address on your HiddenLayer license.
   • Password: Your license ID.
   helm registry login registry.hiddenlayer.ai \
     --username <your-email> --password <license-id>
   
   • Both values are shown in the Enterprise Portal. Signing in this way is also what entitles the install to pull container images. The chart configures image pulls automatically from your license, so you do not need to create an image pull secret.
2. Create a values file.
   • Create a config.yaml containing your configuration. Any value you leave out takes its default; the endpoints you collected in Infrastructure prerequisites go here. Omitting a whole block — database, kafka, redis, opensearch — deploys the in-cluster copy of that component instead.
   • Anything in <angle brackets> is a value you must supply.
   • Note: If you provisioned one or more GPU nodes (which is recommended), then change gpu.enabled to true in the example below.
   global:
       # DNS name the platform is served on
       hostname: platform.example.com
   
       ingress:
           enabled: true
           tls: true
           ingressClassName: nginx
   
       database:
           host: platform.abc123.us-east-1.rds.amazonaws.com
           user: postgres
           password: <PASSWORD>
           # must match the instance's cron.database_name
           name: postgres
   
       kafka:
           brokers: b-1.msk.example.com:9092,b-2.msk.example.com:9092
   
       redis:
           host: platform.abc123.cache.amazonaws.com
           port: 6379
   
       opensearch:
           url: https://search-platform.us-east-1.es.amazonaws.com
   
       # set to true only on clusters with prepared GPU nodes
       gpu:
           enabled: false
   
       k8s:
           # StorageClass used for any persistent volume the platform requests;
           # unset uses the cluster default
           storageClass: gp3
           # node placement — see "What the cluster must provide"
           scheduling:
           cpu:
               affinity: {}
               tolerations: []
           gpu:
               affinity: {}
               tolerations: []
   
   fusionauth:
       # a second domain, not the platform one — see Infrastructure prerequisites
       opensearch:
           url: https://search-fusionauth.us-east-1.es.amazonaws.com
   
   platform:
       # initial console administrator
       email: admin@example.com
       password: <CONSOLE_ADMIN_PASSWORD>
   
   • Values you supply here are stored in the cluster in a ConfigMap and are included in support bundles.
     • Anyone who can read that namespace, or who receives a support bundle, can read these credentials.
     • Restrict access to the platform namespace accordingly, and prefer credentials scoped to this platform over shared ones.
3. Install the AI Security Platform.
   helm install hl-installer \
     oci://registry.hiddenlayer.ai/aisec-platform/stable/distro-enterprise-platform-installer \
     --namespace hiddenlayer --create-namespace \
     --version 26.9.2-5a76dfb
     -f config.yaml
   
   • Take <channel> and <version> from the Enterprise Portal. They reflect what your license entitles you to.
   • The Helm release completes as soon as the installer job is created. The platform itself is deployed by that job, which takes several minutes.
   You must have administrator access to the cluster to run the helm command.
4. Verify the installation.
   kubectl -n hiddenlayer get jobs
   kubectl -n hiddenlayer logs -f job/<installer-job-name>
   kubectl -n hiddenlayer get pods
   
   • The installer job is removed automatically a short time after it completes, so capture its logs if you need them.
   • When every pod is running, browse to the hostname you configured and sign in with the console administrator credentials from your values file.