EQTY LabDocs

Connected Install

Install the Guardian Platform from hosted charts and runtime images.

View as Markdown

Use a connected install when the cluster can reach the chart and image registries.

For a stable version with a verified cloudsmith-delivery.json, install from Cloudsmith eqtylab/prod with an entitlement token from EQTY Lab. The original release manifest retains GHCR source references; the delivery manifest records the Cloudsmith destinations. Until delivery is verified, keep using the existing GHCR installation path. See Release Manifest.

For Cloudsmith, add the native Helm repository at https://dl.cloudsmith.io/basic/eqtylab/prod/helm/charts/ as cloudsmith-prod, using username token and your entitlement token as the password. Install cloudsmith-prod/guardian-platform with an explicit chart version. The Kubernetes image pull secret still uses docker.cloudsmith.io with username eqtylab/prod. Apply the package’s values-cloudsmith.yaml after your environment values. Upstream images keep their existing registries.

Add the repository with the entitlement token loaded into CLOUDSMITH_ENTITLEMENT_TOKEN (Helm 3.20 or later):

bash
printf '%s' "$CLOUDSMITH_ENTITLEMENT_TOKEN" | helm repo add cloudsmith-prod \
  https://dl.cloudsmith.io/basic/eqtylab/prod/helm/charts/ \
  --username token --password-stdin
helm repo update cloudsmith-prod

With the secrets.yaml from Chart Values (global.secrets.create: true), the chart creates the image pull secret from its imageRegistry block, so set its password to the entitlement token. With pre-created secrets instead, create the pull secret before installing:

bash
kubectl create namespace guardian   # skip if it exists
kubectl create secret docker-registry platform-image-pull-secret \
  --docker-server=docker.cloudsmith.io \
  --docker-username=eqtylab/prod \
  --docker-password="$CLOUDSMITH_ENTITLEMENT_TOKEN" \
  --namespace guardian

Install the delivered chart version, with values-cloudsmith.yaml last:

bash
helm upgrade --install guardian-platform \
  cloudsmith-prod/guardian-platform \
  --version <chart-version> \
  --namespace guardian \
  --create-namespace \
  --values values.yaml \
  --values secrets.yaml \
  --values values-cloudsmith.yaml

Install Flow

  1. Review the release manifest for chart version, image tags, image digests, and supported Kubernetes version.
  2. Confirm prerequisites, including DNS, TLS, identity provider settings, database, storage, keys, and registry access.
  3. Prepare customer values and secrets for the selected identity provider and infrastructure.
  4. Install or upgrade the Guardian Platform Helm chart with the release version recorded in the manifest.
  5. Verify service readiness, ingress routes, sign-in, project access, attachment storage, and certificate workflows.

Validation Checks

  • Guardian loads at the customer domain.
  • Sign-in works through the configured identity provider.
  • Auth Service, Governance Service, and Integrity Service report ready.
  • A project owner can access or create a project.
  • Attachment, report, indicator, and certificate workflows are tested according to the customer rollout plan.

After Install

Record the chart version, values revision, release manifest, and validation evidence. Keep secrets out of ticket comments and shared documentation.