EQTY LabDocs

Deployment Process

The order of steps for deploying the Guardian Platform, from prerequisites to a verified install.

View as Markdown

Deploy the platform by working through these steps in order. Each links the page that covers it; pick one provider per category and mix them freely.

Step 1: Check Prerequisites

Confirm the cluster, deployment host, and registry access in Prerequisites. Then clone the deployment repository at your platform version, which the later steps run its charts and scripts from, and create the release namespace:

bash
git clone --branch platform/v<version> https://github.com/eqtylab/deployment.git
kubectl create namespace guardian

Step 2: Set Up the Domain and TLS

Install the ingress controller and cert-manager, create the DNS record, and create the certificate issuer: Domain and TLS.

Step 3: Provision Storage and Keys

Object storage, one of:

Key management, one of:

Auth Service also supports Google Cloud KMS and OpenBao Transit, configured in Chart Values; see Key Configuration.

For a managed database instead of the bundled PostgreSQL, also see External Database.

Step 4: Prepare Values and Secrets

Generate values.yaml, secrets.yaml, and the identity provider bootstrap file with guardctl, or write them from Chart Values. Fill in the values from step 3.

Step 5: Configure the Identity Provider

Run the provider’s bootstrap chart, or follow its manual setup, then add the client IDs and secrets it produces to the files from step 4. The platform services need them at startup.

Step 6: Install

Install the chart with Helm Deployment, from Cloudsmith with Connected Install for a delivered version, or with Air-Gapped Install when the cluster can’t reach the registries.

Step 7: Verify

Run the checks in Helm Deployment, then the validation checks, and sign in as the platform admin. Then set up Observability and Backup and Restore.

Platform Architecture

The Guardian Platform uses the Guardian Platform Helm Chart to orchestrate services on Kubernetes. The platform uses a microservices architecture:

  • Guardian - User interface for managing governance processes
  • Governance Service - API endpoints that drive governance processes
  • Integrity Service - API endpoints for data integrity and auditability
  • Auth Service - Authentication and authorization service
  • PDFGen (eqty-pdfgen) - Renders and signs project policy reports
  • Gateway Stack (optional) - LLM Gateway and Control Plane for gateway agent governance
  • PostgreSQL - Shared database across all services

The Helm chart has an enabled flag for each component if you wish to deploy only part of the platform.

Customization

The platform can be customized for your deployment, including the Guardian title (appTitle), display timezone (displayTimezone), feature flags, and infrastructure scaling. Refer to the Chart Values documentation and individual chart repositories for all available options.