Skip to main content
This is a deployment preview. Current stable deployment guide is here Chainloop Platform
This documentation is for the proprietary Chainloop Platform. If you are looking for the Open Source Evidence Store documentation, please refer to the Chainloop Evidence Store guide

​
Introduction

The Chainloop platform has two top-level components: Chainloop Evidence Store and Chainloop Platform. These are deployed using one unified helm chart. Chainloop Evidence Store Chainloop Platform
  • The source code of the server components is the property of Chainloop Inc.
  • The Helm Chart can be found here oci://chainloop.azurecr.io/chart/chainloop-platform
  • It’s comprised of three server-side components, a backend, a frontend and a nats.io server.
The Chainloop platform components are meant to extend and enhance the capabilities of Chainloop OSS evidence store, and hence, they require access to a running instance of Chainloop Evidence Store.

​
Retrieve Private OCI Registry credentials.

To pull the Helm Charts and container images you’ll need to authenticate with a private OCI registry managed. If you don’t have them yet, please contact the Chainloop team. Once you get the creds, you can give it a try by authenticating locally and pulling the latest version of both Helm Charts. 
# Authenticate locally
$ docker login -u [username] -p [creds] chainloop.azurecr.io
# Chainloop Platform Chart
$ helm fetch oci://chainloop.azurecr.io/chart/chainloop-platform
$ ls chainloop-*
  chainloop-platform-0.12.0.tgz

​
Configure credentials for deployment

You have two options to consume the provided Helm Charts and container images in your Kubernetes cluster:

​
Option 1: Pull images and Chart directly from Private Azure Registry

To pull the images, you’ll need to store these credentials as a K8s secret in the cluster where you will deploy the Helm Charts. Later, they will be referenced in the Helm charts as imagePullSecrets. 
$ kubectl create secret docker-registry regcred-azure \
    --docker-server=https://chainloop.azurecr.io \
    --docker-username=[your-username] \
    --docker-password=[your credentials]

​
Option 2: Relocate Helm Chart and images to your own registry

Both charts are compatible with relocation processes performed by the Helm Relocation Plugin. This means that you can easily import the Helm Charts and Container images provided by the Chainloop team into your registry, even behind the firewall. This is a two-step process (wrap -> unwrap)
  • Pull all the container images and Helm chart and wrap them in an intermediate tarball.
  • If needed, transfer that tarball to your air-gap environment via an offline medium
  • Unwrap the tarball and push container images, update the Helm Chart with new image references, and push it to the target registry.
For example, to relocate from Azure to your own Harbor registry. 
helm dt wrap oci://chainloop.azurecr.io/chart/chainloop-platform

# 🎉  Helm chart wrapped into "chainloop-platform-0.11.0.wrap.tgz"
# Now you can take the tarball to an air-gapped environment and unwrap it like this

helm dt unwrap chainloop-platform-0.11.0.wrap.tgz oci://my-repo.harbor.io --yes

#  Unwrapping Helm chart "chainloop-platform-0.11.0.wrap.tgz"
#    ✔  All images pushed successfully
#    ✔  Helm chart successfully pushed
#
# 🎉  Helm chart unwrapped successfully: You can use it now by running "helm install oci://my-repo.harbor.io/chainloop-platform --generate-name"
The relocated Helm Charts will be ready to be used, pointing to the images also relocated to the end registry.

​
Deploy and Configure in Kubernetes

The Chainloop platform has two top-level components: Chainloop Evidence Store and Chainloop Platform. We have created one unified helm chart to simplify installation process. This is an example of a final and more detailed picture of how both Chainloop Evidence Store and Chainloop platform could look in AWS, leveraging AWS services such as RDS or AWS Secret Manager. Chainloop Platform

​
Step 1 - Deploy Platform Chart

Please refer to Chart Readme file that can be found on the chart tarball that can be pulled like this. 
helm fetch oci://chainloop.azurecr.io/chart/chainloop-platform
For more details on configuring each component, refer to their respective Readme files in the Helm Charts.

​
Step 2 - Custom Contracts

Now you should be able to update your contracts with policies and policy groups from the Chainloop Platform like this.
Example Contract file
# This is a Chainloop Workflow Contract file
# That attaches policies and groups from the Chainloop Platform just by referencing them by name
apiVersion: chainloop.dev/v1
kind: Contract
metadata:
  name: example-contract
spec:
  policies:
    attestation:
      - ref: source-commit
    materials:
      - ref: sbom-ntia
  policyGroups:
    - ref: sbom-quality
You can learn more about how to use policies here.

​
Step 3 (optional) - Configure Secret Manager in platform Chart

To enable notifications integrations, you must configure the secret manager to be able to store and retrieve secrets. The configuration is similar to the one you have already setup in the Chainloop Chart.
Platform Chart values.yaml
secretsBackend:
    # Example of AWS Secret Manager
    # similar to https://github.com/chainloop-dev/chainloop/tree/main/deployment/chainloop#use-aws-secrets-manager
    backend: awsSecretManager
    awsSecretManager:
        accessKey: REDACTED
        secretKey: REDACTED
        region: us-east-1

​
Step 4 (optional) - Setup SMTP configuration

To enable email notifications, you need to configure the SMTP settings in the Chainloop Platform backend Helm chart values.yaml file like this:
Platform Chart values.yaml
backend:
  smtp:
    host: smtp.example.com # SMTP server hostname
    port: 587 # SMTP server port
    user: the-user # SMTP server username
    password: REDACTED # SMTP server password
    from: "Chainloop Notifications <[email protected]>" # From email address
Without this configuration, the Chainloop platform will not be able to send email notifications for events such as weekly summaries, or org invitations.

​
Step 5 (optional) - Configure users auto-onboarding

This step allows automatically onboarding users to specific organizations and user groups. Follow this guide to configure Chainloop Platform for auto-provisioning.

​
Step 6 (optional) - Restrict organization creation

This step allows restricting organization creation to specific users. Follow this guide to configure Chainloop Platform for restricting organization creation.

​
Step 7 (optional) - Configure Keyless attestation for GitLab

​
1 - Configure Federated Authentication in Controlplane

Then you’ll update the Chainloop Vault controlplane Helm chart values.yaml file like this
Chainloop Chart values.yaml
controlplane:
  # enable federated authentication for the attestation
  federatedAuthentication:
    enabled: true
    # Example: http://chainloop-platform-backend.platform-prod.svc.cluster.local/machine-identity/verify-token
    url: [your chainloop platform backend hostname]/machine-identity/verify-token

​
2 - Enable GitLab AuthN and AuthZ in backend

To support GitLab keyless attestation, the platform backend needs to be configured to be able to:
  • 2.1 - Authenticate the incoming tokens
  • 2.2 - Enable authorization, which means
    • Allow the user to onboard GitLab repositories
    • Authorize the incoming tokens against the onboarded repositories
To configure both things, you need to 2.1 - First, add a machine identity issuer, this is used
Platform Chart values.yaml
backend:
  # Support verification of gitlab tokens
  machineIdentityIssuers:
    - url: [your gitlab instance URL] # i.e https://gitlab.com or your self-hosted instance
      type: ISSUER_TYPE_GITLAB # do not change this
2.2 Configure GitLab OAuth2 application. Note that you’ll need to create one with read_api permissions in your GitLab instance
Platform Chart values.yaml
backend:
    oauth2Providers:
        - id: gitlab # do not change this
          url: [your gitlab instance URL] # i.e https://gitlab.com or your self-hosted instance
          client_id: REDACTED
          client_secret: REDACTED
          type: ISSUER_TYPE_GITLAB # do not change this

​
Step 8 (optional) - Expose MCP server

To enable access to Chainloop Model Context Protocol (MCP) server, you need to update the Chainloop platform chart values.yaml to expose the MCP server through an ingress, like any other resource
Platform Chart values.yaml
backend:
  mcpIngress:
    enabled: true
    hostname: [your-mcp-hostname]
    tls: true
This will expose the MCP server at https://[your-mcp-hostname]/sse for example https://mcp.app.chainloop.dev/sse