Skip to main content
This guide is focused on Kubernetes deployment. If you are evaluating the platform, you also have a Docker Compose option available. Check out the Evaluate Chainloop Platform guide.
This is a deployment preview of an unified Helm Chart, for the current stable deployment guide please refer to this other guide

​
Introduction

This documentation is for the proprietary Chainloop Platform. If you are looking for the Open Source Evidence Store documentation, please refer to the Chainloop Evidence Store guide
The Chainloop platform has two top-level components: Chainloop Evidence Store and Chainloop Platform. Both components are deployed using one unified Helm Chart called chainloop-ee (Chainloop Enterprise Edition). Once deployed, for example in an AWS Kubernetes cluster, it could look like this: Chainloop Platform

​
Retrieve Private OCI Registry credentials.

To pull the Helm Charts and container images you’ll need to authenticate with a private OCI registry managed. If you don’t have them yet, please contact the Chainloop team. Once you get the creds, you can give it a try by authenticating locally and pulling the latest version of both Helm Charts. 
# Authenticate locally
$ docker login -u [username] -p [creds] chainloop.azurecr.io
# Chainloop Enterprise Edition Chart
$ helm fetch oci://chainloop.azurecr.io/chart/chainloop-ee
$ ls chainloop-*
  chainloop-ee-0.326.0.tgz

​
Configure credentials for deployment

You have two options to consume the provided Helm Charts and container images in your Kubernetes cluster:

​
Option 1: Pull images and Chart directly from Private Azure Registry

To pull the images, you’ll need to store these credentials as a K8s secret in the cluster where you will deploy the Helm Charts. Later, they will be referenced in the Helm charts as imagePullSecrets. 
$ kubectl create secret docker-registry regcred-azure \
    --docker-server=https://chainloop.azurecr.io \
    --docker-username=[your-username] \
    --docker-password=[your credentials]

​
Option 2: Relocate Helm Chart and images to your own registry

Both charts are compatible with relocation processes performed by the Helm Relocation Plugin. This means that you can easily import the Helm Charts and Container images provided by the Chainloop team into your registry, even behind the firewall. This is a two-step process (wrap -> unwrap)
  • Pull all the container images and Helm chart and wrap them in an intermediate tarball.
  • If needed, transfer that tarball to your air-gap environment via an offline medium
  • Unwrap the tarball and push container images, update the Helm Chart with new image references, and push it to the target registry.
For example, to relocate from Azure to your own Harbor registry. 
helm dt wrap oci://chainloop.azurecr.io/chart/chainloop-ee

# 🎉  Helm chart wrapped into "chainloop-ee-0.326.0.wrap.tgz"
# Now you can take the tarball to an air-gapped environment and unwrap it like this

helm dt unwrap chainloop-ee-0.326.0.wrap.tgz oci://my-repo.harbor.io --yes

#  Unwrapping Helm chart "chainloop-ee-0.326.0.wrap.tgz"
#    ✔  All images pushed successfully
#    ✔  Helm chart successfully pushed
#
# 🎉  Helm chart unwrapped successfully: You can use it now by running "helm install oci://my-repo.harbor.io/chainloop-platform --generate-name"
The relocated Helm Charts will be ready to be used, pointing to the images also relocated to the end registry.

​
Deploy and Configure in Kubernetes

​
Step 1 - Deploy Platform Chart

Please refer to Chart Readme file that can be found on the chart tarball that can be pulled like this. 
helm fetch oci://chainloop.azurecr.io/chart/chainloop-ee
Next steps:
  • Do an end-to-end run of our getting started guide to test the platform
  • Optionally, configure the platform to enhance it with additional features following the steps below

​
Step 2 (optional) - Setup SMTP configuration

To enable email notifications, you need to configure the SMTP settings in the Chainloop Platform backend Helm chart values.yaml file like this:
Platform Chart values.yaml
backend:
  smtp:
    host: smtp.example.com # SMTP server hostname
    port: 587 # SMTP server port
    user: the-user # SMTP server username
    password: REDACTED # SMTP server password
    from: "Chainloop Notifications <[email protected]>" # From email address
Without this configuration, the Chainloop platform will not be able to send email notifications for events such as weekly summaries, or org invitations.

​
Step 3 (optional) - Configure users auto-onboarding

This step allows automatically onboarding users to specific organizations and user groups. Follow this guide to configure Chainloop Platform for auto-provisioning.

​
Step 4 (optional) - Restrict organization creation

This step allows restricting organization creation to specific users. Follow this guide to configure Chainloop Platform for restricting organization creation.

​
Step 5 (optional) - Configure Keyless attestation for GitLab

​
1 - Configure Federated Authentication in Controlplane

Then you’ll update the Chainloop Vault controlplane Helm chart values.yaml file like this
Chainloop Chart values.yaml
controlplane:
  # enable federated authentication for the attestation
  federatedAuthentication:
    enabled: true
    # Example: http://chainloop-platform-backend.platform-prod.svc.cluster.local/machine-identity/verify-token
    url: [your chainloop platform backend hostname]/machine-identity/verify-token

​
2 - Enable GitLab AuthN and AuthZ in backend

To support GitLab keyless attestation, the platform backend needs to be configured to be able to:
  • 2.1 - Authenticate the incoming tokens
  • 2.2 - Enable authorization, which means
    • Allow the user to onboard GitLab repositories
    • Authorize the incoming tokens against the onboarded repositories
To configure both things, you need to 2.1 - First, add a machine identity issuer, this is used
Platform Chart values.yaml
backend:
  # Support verification of gitlab tokens
  machineIdentityIssuers:
    - url: [your gitlab instance URL] # i.e https://gitlab.com or your self-hosted instance
      type: ISSUER_TYPE_GITLAB # do not change this
2.2 Configure GitLab OAuth2 application. Note that you’ll need to create one with read_api permissions in your GitLab instance
Platform Chart values.yaml
backend:
    oauth2Providers:
        - id: gitlab # do not change this
          url: [your gitlab instance URL] # i.e https://gitlab.com or your self-hosted instance
          client_id: REDACTED
          client_secret: REDACTED
          type: ISSUER_TYPE_GITLAB # do not change this

​
Step 6 (optional) - Expose MCP server

To enable access to Chainloop Model Context Protocol (MCP) server, you need to update the Chainloop platform chart values.yaml to expose the MCP server through an ingress, like any other resource
Platform Chart values.yaml
backend:
  mcpIngress:
    enabled: true
    hostname: [your-mcp-hostname]
    tls: true
This will expose the MCP server at https://[your-mcp-hostname]/sse for example https://mcp.app.chainloop.dev/sse