> ## Documentation Index
> Fetch the complete documentation index at: https://veridical-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-hosted Kubernetes

> Install the digest-pinned enterprise chart

Prerequisites:

* Kubernetes with NetworkPolicy and a `gvisor` RuntimeClass or an approved
  equivalent;
* customer PostgreSQL, Redis-compatible queue, object storage, and secret
  backend;
* WorkOS connectivity or a contracted approved identity route;
* an immutable Veridical image digest and deployment-bound license;
* Vault KV v2 or GCP Secret Manager for provider credentials.

```bash theme={null}
helm lint ./product/enterprise/helm/veridical -f values.production.yaml
helm template veridical ./product/enterprise/helm/veridical \
  -n veridical -f values.production.yaml > rendered.yaml
helm upgrade --install veridical ./product/enterprise/helm/veridical \
  -n veridical --create-namespace \
  -f values.production.yaml --atomic --wait --timeout 15m
```

The chart uses non-root, read-only containers; drops all capabilities; forbids
privilege escalation, host paths, and Docker socket mounts; applies
default-deny NetworkPolicy; and pins the worker to the isolated pool.

For GKE Workload Identity, set the service-account annotation and
`global.serviceAccount.automountToken: true`. Vault-only installations keep the
token disabled.