---
title: "Connected Install"
description: "Install the Guardian Platform from hosted charts and runtime images."
source: "Guardian Platform"
---
Use a connected install when the cluster can reach the chart and image registries.

For a stable version with a verified `cloudsmith-delivery.json`, install from Cloudsmith `eqtylab/prod` with an entitlement token from EQTY Lab. The original release manifest retains GHCR source references; the delivery manifest records the Cloudsmith destinations. Until delivery is verified, keep using the existing GHCR installation path. See [Release Manifest](./release-manifest.mdx#cloudsmith-delivery).

For Cloudsmith, add the native Helm repository at `https://dl.cloudsmith.io/basic/eqtylab/prod/helm/charts/` as `cloudsmith-prod`, using username `token` and your entitlement token as the password. Install `cloudsmith-prod/guardian-platform` with an explicit chart version. The Kubernetes image pull secret still uses `docker.cloudsmith.io` with username `eqtylab/prod`. Apply the package's `values-cloudsmith.yaml` after your environment values. Upstream images keep their existing registries.

Add the repository with the entitlement token loaded into `CLOUDSMITH_ENTITLEMENT_TOKEN` (Helm 3.20 or later):

```bash
printf '%s' "$CLOUDSMITH_ENTITLEMENT_TOKEN" | helm repo add cloudsmith-prod \
  https://dl.cloudsmith.io/basic/eqtylab/prod/helm/charts/ \
  --username token --password-stdin
helm repo update cloudsmith-prod
```

With the `secrets.yaml` from [Chart Values](./chart-values.mdx) (`global.secrets.create: true`), the chart creates the image pull secret from its `imageRegistry` block, so set its password to the entitlement token. With pre-created secrets instead, create the pull secret before installing:

```bash
kubectl create namespace guardian   # skip if it exists
kubectl create secret docker-registry platform-image-pull-secret \
  --docker-server=docker.cloudsmith.io \
  --docker-username=eqtylab/prod \
  --docker-password="$CLOUDSMITH_ENTITLEMENT_TOKEN" \
  --namespace guardian
```

Install the delivered chart version, with `values-cloudsmith.yaml` last:

```bash
helm upgrade --install guardian-platform \
  cloudsmith-prod/guardian-platform \
  --version <chart-version> \
  --namespace guardian \
  --create-namespace \
  --values values.yaml \
  --values secrets.yaml \
  --values values-cloudsmith.yaml
```

## Install Flow

1. Review the release manifest for chart version, image tags, image digests, and supported Kubernetes version.
2. Confirm prerequisites, including DNS, TLS, identity provider settings, database, storage, keys, and registry access.
3. Prepare customer values and secrets for the selected identity provider and infrastructure.
4. Install or upgrade the Guardian Platform Helm chart with the release version recorded in the manifest.
5. Verify service readiness, ingress routes, sign-in, project access, attachment storage, and certificate workflows.

## Validation Checks

- Guardian loads at the customer domain.
- Sign-in works through the configured identity provider.
- Auth Service, Governance Service, and Integrity Service report ready.
- A project owner can access or create a project.
- Attachment, report, indicator, and certificate workflows are tested according to the customer rollout plan.

## After Install

Record the chart version, values revision, release manifest, and validation evidence. Keep secrets out of ticket comments and shared documentation.

## Related

- [Prerequisites](./prerequisites.mdx) — the infrastructure and registry access to confirm first
- [Release Manifest](./release-manifest.mdx) — how to read the chart version, image tags, and digests to install
- [Helm Deployment](./helm-deployment.mdx) — the namespace, install, and verification commands step by step
- [Air-Gapped Install](./airgap-install.mdx) — the install path when the cluster cannot reach the registries
- [Deployment Troubleshooting](./troubleshooting.mdx) — first checks when the install or a validation check fails