> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiddenlayer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-Hosted Installation for Helm

The HiddenLayer AI Security Platform: Self-Hosted/Air-Gapped can be installed on Bring Your Own Kubernetes cluster. The platform is packaged as a Helm chart.

* The AI Security Platform: Self-Hosted/Air-Gapped can also be deployed using an [Embedded Cluster](/docs/products/selfhosted/selfhosted_platform_embedded_install).

## Before You Begin

Before deploying the AI Security Platform: Self-Hosted/Air-Gapped, make sure you understand the [Prerequisites](/docs/products/selfhosted/selfhosted_platform_helm_prerequisites).

## Installing

1. Sign in to the registry.

   * **Username**: The email address on your HiddenLayer license.
   * **Password**: Your license ID.

   ```
   helm registry login registry.hiddenlayer.ai \
     --username <your-email> --password <license-id>
   ```

   * Both values are shown in the Enterprise Portal. Signing in this way is also what entitles the install to pull container images. The chart configures image pulls automatically from your license, so you do not need to create an image pull secret.

2. Create a values file.

   * Create a `config.yaml` containing your configuration. Any value you leave out takes its default; the endpoints you collected in Infrastructure prerequisites go here. Omitting a whole block — `database`, `kafka`, `redis`, `opensearch` — deploys the in-cluster copy of that component instead.
   * Anything in `<angle brackets>` is a value you must supply.
   * **Note**: If you provisioned one or more GPU nodes (which is recommended), then change `gpu.enabled` to `true` in the example below.

   ```yaml theme={null}
   global:
       # DNS name the platform is served on
       hostname: platform.example.com

       ingress:
           enabled: true
           tls: true
           ingressClassName: nginx

       database:
           host: platform.abc123.us-east-1.rds.amazonaws.com
           user: postgres
           password: <PASSWORD>
           # must match the instance's cron.database_name
           name: postgres

       kafka:
           brokers: b-1.msk.example.com:9092,b-2.msk.example.com:9092

       redis:
           host: platform.abc123.cache.amazonaws.com
           port: 6379

       opensearch:
           url: https://search-platform.us-east-1.es.amazonaws.com

       # set to true only on clusters with prepared GPU nodes
       gpu:
           enabled: false

       k8s:
           # StorageClass used for any persistent volume the platform requests;
           # unset uses the cluster default
           storageClass: gp3
           # node placement — see "What the cluster must provide"
           scheduling:
           cpu:
               affinity: {}
               tolerations: []
           gpu:
               affinity: {}
               tolerations: []

   fusionauth:
       # a second domain, not the platform one — see Infrastructure prerequisites
       opensearch:
           url: https://search-fusionauth.us-east-1.es.amazonaws.com

   platform:
       # initial console administrator
       email: admin@example.com
       password: <CONSOLE_ADMIN_PASSWORD>
   ```

   * Values you supply here are stored in the cluster in a `ConfigMap` and are included in support bundles.

     * Anyone who can read that namespace, or who receives a support bundle, can read these credentials.
     * Restrict access to the platform namespace accordingly, and prefer credentials scoped to this platform over shared ones.

3. Install the AI Security Platform.

   ```sh theme={null}
   helm install hl-installer \
     oci://registry.hiddenlayer.ai/aisec-platform/stable/distro-enterprise-platform-installer \
     --namespace hiddenlayer --create-namespace \
     --version 26.9.2-5a76dfb
     -f config.yaml
   ```

   * Take `<channel>` and `<version>` from the Enterprise Portal. They reflect what your license entitles you to.
   * The Helm release completes as soon as the installer job is created. The platform itself is deployed by that job, which takes several minutes.

   <Note>
     You must have administrator access to the cluster to run the helm command.
   </Note>

4. Verify the installation.

   ```
   kubectl -n hiddenlayer get jobs
   kubectl -n hiddenlayer logs -f job/<installer-job-name>
   kubectl -n hiddenlayer get pods
   ```

   * The installer job is removed automatically a short time after it completes, so capture its logs if you need them.
   * When every pod is running, browse to the hostname you configured and sign in with the console administrator credentials from your values file.