Install on GKE with Helm

This guide installs the CodeIntegrity dashboard, MCP gateway, token vault, sandbox runtime, PostgreSQL databases, and a public GKE Gateway.

The initial deployment uses HTTP for evaluation. Configure HTTPS before using OAuth-protected MCP servers.

Before you begin

You need:

A GKE cluster with Gateway API enabled
gcloud and kubectl
Helm 3.17 or newer
OpenSSL, Perl, and cURL
codeintegrity-pull-key.json from CodeIntegrity

Use the latest Helm release. Helm enabled OCI support by default in 3.8, and the --take-ownership flag used below was added in 3.17.

Run the commands in this guide from Bash or Zsh.

Remove an existing deployment

Skip this section for a new installation or an upgrade.

These commands permanently delete the existing CodeIntegrity deployment and all data stored in its Kubernetes namespaces.

CONTEXT="$(kubectl config current-context)"
printf 'This permanently deletes CodeIntegrity from %s.\n' "$CONTEXT"
read -r -p "Type the full context name to continue: " CONFIRM_CONTEXT
test "$CONFIRM_CONTEXT" = "$CONTEXT" || exit 1

helm uninstall codeintegrity -n codeintegrity --ignore-not-found
helm uninstall agent-sandbox -n agent-sandbox-system --ignore-not-found
kubectl delete namespace codeintegrity agent-sandbox-system --ignore-not-found
kubectl wait --for=delete namespace/codeintegrity --timeout=15m
kubectl wait --for=delete namespace/agent-sandbox-system --timeout=15m

Install CodeIntegrity

Check Helm and connect to GKE

Confirm your Helm version and the cluster where you want to install CodeIntegrity:

helm version --short
CONTEXT="$(kubectl config current-context)"
printf 'Target context: %s\n' "$CONTEXT"
read -r -p "Type the full context name to continue: " CONFIRM_CONTEXT
test "$CONFIRM_CONTEXT" = "$CONTEXT" || exit 1
kubectl get storageclass
kubectl get gatewayclass gke-l7-global-external-managed

Continue when Helm reports version 3.17 or newer, the context is correct, and the last two commands return a storage class and the GKE Gateway class.

Download the Helm charts

From the directory containing codeintegrity-pull-key.json, create an installation directory and sign in to the CodeIntegrity registry:

mkdir -p codeintegrity-install
cp codeintegrity-pull-key.json codeintegrity-install/
cd codeintegrity-install

base64 < codeintegrity-pull-key.json | tr -d '\n' | \
  helm registry login us-central1-docker.pkg.dev \
    -u _json_key_base64 \
    --password-stdin

Download the latest charts:

rm -rf agent-sandbox-chart codeintegrity-chart

helm pull \
  oci://us-central1-docker.pkg.dev/orchestrator-prod-492817/codeintegrity/charts/agent-sandbox \
  --untar --untardir agent-sandbox-chart

helm pull \
  oci://us-central1-docker.pkg.dev/orchestrator-prod-492817/codeintegrity/charts/codeintegrity \
  --untar --untardir codeintegrity-chart

cp codeintegrity-chart/codeintegrity/values.onpremise.yaml values.yaml

Configure CodeIntegrity

The chart includes the complete values.yaml below. The previous step copied it into your installation directory. You can also copy this example into values.yaml:

global:
  imageTag: ""
  webAppUrl: http://localhost:3000
  mcpGatewayUrl: http://localhost:8080

imagePullSecret:
  username: _json_key_base64
  password: replace-with-base64-encoded-pull-key

secrets:
  internalApiToken: replace-with-internal-api-token
  sandboxProxyToken: replace-with-sandbox-proxy-token
  tokenvaultEncryptionKey: replace-with-32-byte-vault-encryption-key
  betterAuthSecret: replace-with-better-auth-secret
  geminiApiKey: replace-with-gemini-api-key
  googleClientSecret: ""
  microsoftClientSecret: ""
  dashboardIdpClientSecret: ""

postgres:
  dashboard:
    password: replace-with-dashboard-postgres-password
  gateway:
    password: replace-with-gateway-postgres-password
  tokenvault:
    password: replace-with-tokenvault-postgres-password

gateway:
  replicas: 1
  auth:
    issuer: ""
    jwksUrl: ""

sandbox:
  runtime:
    replicas: 6

dashboard:
  google:
    clientId: ""
  microsoft:
    clientId: ""
    tenantId: ""
  idp:
    issuer: ""
    clientId: ""
    scopes: openid profile email
    roleClaim: role

gkeGateway:
  enabled: true
  healthCheckPolicy: true

Generate the required secrets and save them in values.yaml:

perl -0pi -e "
  s#replace-with-base64-encoded-pull-key#$(base64 < codeintegrity-pull-key.json | tr -d '\n')#;
  s#replace-with-internal-api-token#$(openssl rand -base64 32 | tr -d '\n')#;
  s#replace-with-sandbox-proxy-token#$(openssl rand -base64 32 | tr -d '\n')#;
  s#replace-with-32-byte-vault-encryption-key#$(openssl rand -hex 16)#;
  s#replace-with-better-auth-secret#$(openssl rand -base64 32 | tr -d '\n')#;
  s#replace-with-gemini-api-key#\"\"#;
  s#replace-with-dashboard-postgres-password#$(openssl rand -base64 32 | tr -d '\n')#;
  s#replace-with-gateway-postgres-password#$(openssl rand -base64 32 | tr -d '\n')#;
  s#replace-with-tokenvault-postgres-password#$(openssl rand -base64 32 | tr -d '\n')#;
" values.yaml

chmod 600 values.yaml
if grep -Eq 'replace-with-[a-z]' values.yaml; then
  echo "values.yaml still contains required placeholders"
  exit 1
fi

Store values.yaml securely. You need the same file to upgrade the deployment and recover encrypted credentials.

Install Agent Sandbox

helm upgrade --install agent-sandbox \
  agent-sandbox-chart/agent-sandbox \
  --namespace agent-sandbox-system \
  --create-namespace \
  --wait --timeout 10m

Install CodeIntegrity

This deployment creates the GKE Gateway that provides the public address.

helm upgrade --install codeintegrity \
  codeintegrity-chart/codeintegrity \
  --namespace codeintegrity \
  --create-namespace \
  -f values.yaml \
  --take-ownership \
  --wait --timeout 10m

Set the public address

Wait for GKE to assign an IP address, then save it in values.yaml:

kubectl wait --for=condition=Programmed gateway/codeintegrity-route \
  -n codeintegrity --timeout=15m

IP="$(kubectl get gateway codeintegrity-route -n codeintegrity \
  -o jsonpath='{.status.addresses[0].value}')"
test -n "$IP" || { echo "Gateway external IP is not ready"; exit 1; }

perl -0pi -e \
  "s#webAppUrl: .*#webAppUrl: http://${IP}#; s#mcpGatewayUrl: .*#mcpGatewayUrl: http://${IP}#" \
  values.yaml

Apply the public address:

helm upgrade --install codeintegrity \
  codeintegrity-chart/codeintegrity \
  --namespace codeintegrity \
  --create-namespace \
  -f values.yaml \
  --take-ownership \
  --wait --timeout 10m

Verify the deployment

Wait up to 10 minutes for the public endpoint:

IP="$(kubectl get gateway codeintegrity-route -n codeintegrity \
  -o jsonpath='{.status.addresses[0].value}')"

for attempt in {1..60}; do
  curl -fsS "http://$IP/api/health" && break
  sleep 10
done

curl -fsS "http://$IP/api/health"
printf '\nOpen http://%s\n' "$IP"

A healthy deployment returns:

{"status":"ok","database_ok":true,"schema_ok":true}

Open the printed URL and create your account.

Try your gateway

In the dashboard:

Open MCP Servers and add a server from the catalog (for example DeepWiki, which needs no credentials).
Open MCP Gateways, create a gateway, and select the server you just added. The gateway status becomes Active within a few seconds.
Open API Keys and create a key. Copy it immediately — it is shown only once.

Then call the gateway's MCP endpoint with your key (replace <slug> with your gateway's slug and <key> with the copied key):

IP="$(kubectl get gateway codeintegrity-route -n codeintegrity \
  -o jsonpath='{.status.addresses[0].value}')"

curl -fsS "http://$IP/mcp/<slug>" \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'

A valid key returns the gateway's initialize response (server info and capabilities); a missing or revoked key returns 401. Your tools are available as search and execute_code on the same endpoint with any MCP client.

Configure HTTPS for OAuth (optional)

Skip this section if you are evaluating CodeIntegrity over HTTP without OAuth-protected MCP servers. OAuth requires HTTPS and a stable hostname. Replace app.example.com with your hostname.

Reserve a static IP

DOMAIN=app.example.com

gcloud compute addresses create codeintegrity-ip --global --ip-version=IPV4
STATIC_IP="$(gcloud compute addresses describe codeintegrity-ip \
  --global --format='value(address)')"
printf 'Create an A record for %s pointing to %s\n' "$DOMAIN" "$STATIC_IP"

Create the certificate

DOMAIN=app.example.com

gcloud certificate-manager dns-authorizations create codeintegrity-dns-auth \
  --domain="$DOMAIN"
gcloud certificate-manager dns-authorizations describe codeintegrity-dns-auth \
  --format='value(dnsResourceRecord.name, dnsResourceRecord.data)'

gcloud certificate-manager certificates create codeintegrity-cert \
  --domains="$DOMAIN" \
  --dns-authorizations=codeintegrity-dns-auth
gcloud certificate-manager maps create codeintegrity-cert-map
gcloud certificate-manager maps entries create codeintegrity-cert-map-entry \
  --map=codeintegrity-cert-map \
  --certificates=codeintegrity-cert \
  --hostname="$DOMAIN"

Create the DNS records

Create the CNAME printed by the DNS authorization command and the A record printed by the static IP command.

Update values.yaml

Set these values, replacing app.example.com with your hostname:

global:
  webAppUrl: https://app.example.com
  mcpGatewayUrl: https://app.example.com

gkeGateway:
  enabled: true
  staticIpName: codeintegrity-ip
  publicHost: app.example.com
  certificateMapName: codeintegrity-cert-map
  healthCheckPolicy: true

Apply and verify HTTPS

helm upgrade --install codeintegrity \
  codeintegrity-chart/codeintegrity \
  --namespace codeintegrity \
  --create-namespace \
  -f values.yaml \
  --take-ownership \
  --wait --timeout 10m

When the certificate becomes active, verify the public endpoint:

DOMAIN=app.example.com
curl -fsS "https://$DOMAIN/api/health"

If you created MCP gateways before changing the hostname, open MCP Gateways and save each gateway once. This updates its connection URL and OAuth callback.

Upgrade CodeIntegrity

Run this from your codeintegrity-install directory. Your registry credentials from the install are reused, and values.yaml stays as-is.

rm -rf agent-sandbox-chart codeintegrity-chart && \
helm pull oci://us-central1-docker.pkg.dev/orchestrator-prod-492817/codeintegrity/charts/agent-sandbox --untar --untardir agent-sandbox-chart && \
helm pull oci://us-central1-docker.pkg.dev/orchestrator-prod-492817/codeintegrity/charts/codeintegrity --untar --untardir codeintegrity-chart && \
kubectl apply -f agent-sandbox-chart/agent-sandbox/crds/ && \
helm upgrade --install agent-sandbox agent-sandbox-chart/agent-sandbox \
  --namespace agent-sandbox-system --wait --timeout 10m && \
helm upgrade --install codeintegrity codeintegrity-chart/codeintegrity \
  --namespace codeintegrity -f values.yaml --take-ownership --wait --timeout 10m

MCP traffic pauses for a few seconds while the gateway restarts. Data, API keys, and audit history are preserved automatically. Access policies and named API-key server assignments are not carried over — recreate them after the upgrade.

Verify with curl -fsS http://<your-address>/api/health — it should report database_ok and schema_ok as true.

Before you begin

Remove an existing deployment

Install CodeIntegrity

Check Helm and connect to GKE

Download the Helm charts

Configure CodeIntegrity

Install Agent Sandbox

Install CodeIntegrity

Set the public address

Verify the deployment

Try your gateway

Configure HTTPS for OAuth (optional)

Reserve a static IP

Create the certificate

Create the DNS records

Update values.yaml

Apply and verify HTTPS

Upgrade CodeIntegrity

On this page