---
title: "Deployment Process"
description: "The order of steps for deploying the Guardian Platform, from prerequisites to a verified install."
source: "Guardian Platform"
---
Deploy the platform by working through these steps in order. Each links the page that covers it; pick one provider per category and mix them freely.

## Step 1: Check Prerequisites

Confirm the cluster, deployment host, and registry access in [Prerequisites](./prerequisites.mdx). Then clone the [deployment repository](https://github.com/eqtylab/deployment) at your platform version, which the later steps run its charts and scripts from, and create the release namespace:

```bash
git clone --branch platform/v<version> https://github.com/eqtylab/deployment.git
kubectl create namespace guardian
```

## Step 2: Set Up the Domain and TLS

Install the ingress controller and cert-manager, create the DNS record, and create the certificate issuer: [Domain and TLS](./domain-and-tls.mdx).

## Step 3: Provision Storage and Keys

Object storage, one of:

- [AWS S3 Bucket](./aws-s3-bucket.mdx)
- [Azure Storage Account](./azure-storage-account.mdx)
- [Google Cloud Storage Bucket](./google-cloud-storage-bucket.mdx)

Key management, one of:

- [AWS KMS](./aws-kms.mdx)
- [Azure Key Vault](./azure-key-vault.mdx)

Auth Service also supports Google Cloud KMS and OpenBao Transit, configured in [Chart Values](./chart-values.mdx); see [Key Configuration](../auth-service/key-configuration.mdx#supported-key-providers).

For a managed database instead of the bundled PostgreSQL, also see [External Database](./external-database.mdx).

## Step 4: Prepare Values and Secrets

Generate `values.yaml`, `secrets.yaml`, and the identity provider bootstrap file with [guardctl](./guardctl.mdx), or write them from [Chart Values](./chart-values.mdx). Fill in the values from step 3.

## Step 5: Configure the Identity Provider

Run the provider's bootstrap chart, or follow its manual setup, then add the client IDs and secrets it produces to the files from step 4. The platform services need them at startup.

- [Auth0](./auth0.mdx)
- [Microsoft Entra ID](./microsoft-entra-id.mdx)
- [Keycloak](./keycloak.mdx)

## Step 6: Install

Install the chart with [Helm Deployment](./helm-deployment.mdx), from Cloudsmith with [Connected Install](./connected-install.mdx) for a delivered version, or with [Air-Gapped Install](./airgap-install.mdx) when the cluster can't reach the registries.

## Step 7: Verify

Run the checks in [Helm Deployment](./helm-deployment.mdx#verify-deployment), then the [validation checks](./connected-install.mdx#validation-checks), and sign in as the platform admin. Then set up [Observability](./observability.mdx) and [Backup and Restore](./backup-and-restore.mdx).

## Platform Architecture

The Guardian Platform uses the [Guardian Platform Helm Chart](https://github.com/eqtylab/deployment/tree/main/charts/guardian-platform) to orchestrate services on Kubernetes. The platform uses a microservices architecture:

- **Guardian** - User interface for managing governance processes
- **Governance Service** - API endpoints that drive governance processes
- **Integrity Service** - API endpoints for data integrity and auditability
- **Auth Service** - Authentication and authorization service
- **PDFGen** (`eqty-pdfgen`) - Renders and signs project policy reports
- **Gateway Stack** _(optional)_ - LLM Gateway and Control Plane for gateway agent governance
- **PostgreSQL** - Shared database across all services

The Helm chart has an `enabled` flag for each component if you wish to deploy only part of the platform.

## Customization

The platform can be customized for your deployment, including the Guardian title (`appTitle`), display timezone (`displayTimezone`), feature flags, and infrastructure scaling. Refer to the [Chart Values documentation](./chart-values.mdx) and individual [chart repositories](https://github.com/eqtylab/deployment/tree/main/charts) for all available options.

## Related

- [Prerequisites](./prerequisites.mdx) — the deployment host, network access, and cloud resources to prepare
- [Authentication](./authentication.mdx) — choosing between the identity providers
- [Object Storage](./object-storage.mdx) — choosing the storage provider
- [Key Management](./key-management.mdx) — choosing the key provider
- [External Database](./external-database.mdx) — replacing the bundled PostgreSQL with a managed instance