### Install OpenCTI Helm Chart from Repository

Source: https://github.com/devops-ia/helm-opencti/blob/main/README.md

Installs the OpenCTI Helm chart from the added chart repository. Replace `[RELEASE_NAME]` with your desired release name.

```bash
helm install [RELEASE_NAME] opencti/opencti
```

--------------------------------

### Install OpenCTI with Gateway API

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Installs OpenCTI using Helm, specifying a values file for Gateway API configuration. Ensure the namespace 'opencti' exists before running.

```bash
helm install opencti ./charts/opencti \
  --namespace opencti \
  --values charts/opencti/docs/examples/values-gateway-test.yaml \
  --timeout 10m \
  --wait
```

--------------------------------

### Complete Helm Chart Configuration Example

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

A comprehensive example of a values.yaml file for deploying OpenCTI in a CI environment. It configures server, worker, and connector components, including environment variables, secrets, resource limits, and autoscaling.

```yaml
replicaCount: 1
fullnameOverride: <release-name>

strategy:
  type: Recreate

# OpenCTI Server Configuration
env:
  APP__ADMIN__EMAIL: admin@opencti.io
  APP__BASE_PATH: "/"
  APP__HEALTH_ACCESS_KEY: f93747ff-2ea1-4717-900c-9df20b8e4429
  APP__TELEMETRY__METRICS__ENABLED: false
  APP__GRAPHQL__PLAYGROUND__ENABLED: false
  APP__GRAPHQL__PLAYGROUND__FORCE_DISABLED_INTROSPECTION: true

  ## OPENSEARCH
  ELASTICSEARCH__ENGINE_SELECTOR: opensearch
  ELASTICSEARCH__URL: http://<release-name>-opensearch:9200

  ## STORAGE
  MINIO__ENDPOINT: <release-name>-minio

  ## MESSAGE QUEUE
  RABBITMQ__HOSTNAME: <release-name>-rabbitmq
  RABBITMQ__PORT_MANAGEMENT: 15672
  RABBITMQ__PORT: 5672
  RABBITMQ__USERNAME: user

  ## CACHE
  REDIS__HOSTNAME: <release-name>-redis
  REDIS__MODE: single
  REDIS__PORT: 6379

envFromSecrets:
  APP__ADMIN__PASSWORD:
    name: <release-name>-credentials
    key: APP__ADMIN__PASSWORD
  APP__ADMIN__TOKEN:
    name: <release-name>-credentials
    key: APP__ADMIN__TOKEN
  MINIO__ACCESS_KEY:
    name: opencti-<release-name>-minio
    key: rootUser
  MINIO__SECRET_KEY:
    name: opencti-<release-name>-minio
    key: rootPassword
  RABBITMQ__PASSWORD:
    name: opencti-<release-name>-rabbitmq
    key: rabbitmq-password

secrets:
  - name: credentials
    data:
      APP__ADMIN__PASSWORD: iraLehfJu1NRnQgwIBeH
      APP__ADMIN__TOKEN: b1976749-8a53-4f49-bf04-cafa2a3458c1


testConnection: true

readyChecker:
  enabled: true
  retries: 30
  timeout: 5
  services:
  - name: opensearch
    port: 9200
  - name: minio
    port: 9000
  - name: rabbitmq
    port: 5672
  - name: redis
    port: 6379

# Probes Configuration
livenessProbe:
  enabled: false

readinessProbe:
  enabled: false

startupProbe:
  enabled: false

lifecycle:
  preStop:
    exec:
      command: ["sh", "-c", "sleep 5"]

terminationGracePeriodSeconds: 20

# Service Configuration
service:
  type: ClusterIP
  port: 80
  targetPort: 4000
  protocol: TCP
  portName: http
  appProtocol: HTTP
  externalTrafficPolicy: Local
  internalTrafficPolicy: Local
  publishNotReadyAddresses: false
  sessionAffinity: None
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  trafficDistribution: PreferClose
  labels:
    environment: production
  extraPorts:
    - name: grpc
      port: 9000
      targetPort: 9000
      protocol: TCP
      appProtocol: GRPC

# Resource Management
resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "1Gi"
    cpu: "500m"

# Autoscaling
autoscaling:
  enabled: true
  minReplicas: 1
  maxReplicas: 3
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80

# Topology Spread Constraints
topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: kubernetes.io/os
    whenUnsatisfiable: DoNotSchedule
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: opencti

# OpenCTI Worker Configuration
worker:
  enabled: true

  env:
    WORKER_TELEMETRY_ENABLED: false
    WORKER_PROMETHEUS_TELEMETRY_PORT: 14270

  readyChecker:
    enabled: true
    retries: 30
    timeout: 5

  lifecycle:
    preStop:
      exec:
        command: ["sh", "-c", "sleep 5"]

  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 512Mi

  strategy:
    type: Recreate

  terminationGracePeriodSeconds: 20

  networkPolicy:
    enabled: true
    ingress:
      - from:
          - namespaceSelector:
              matchLabels:
                name: opencti
        ports:
          - protocol: TCP
            port: 4000

  autoscaling:
    enabled: true
    minReplicas: 1
    maxReplicas: 3
    targetCPUUtilizationPercentage: 70
    targetMemoryUtilizationPercentage: 80

  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: kubernetes.io/os
      whenUnsatisfiable: DoNotSchedule
      labelSelector:
        matchLabels:
          app.kubernetes.io/name: opencti
          app.kubernetes.io/component: worker

  dnsConfig:
    nameservers:
      - 1.1.1.1
      - 8.8.8.8
    searches: []
    options:
      - name: ndots
        value: "2"

  dnsPolicy: ClusterFirst

# OpenCTI Connectors Configuration
connectorsGlobal:
  env:
    CONNECTOR_EXPOSE_METRICS: true

connectors:
  - name: opencti
    enabled: true
    replicas: 1

    resources:
      requests:
        memory: 128Mi
        cpu: 50m
      limits:
        memory: 256Mi

```

--------------------------------

### Install Envoy Gateway Controller

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Install the Envoy Gateway controller using Helm. This command deploys the controller into a dedicated namespace.

```bash
helm install eg oci://docker.io/envoyproxy/gateway-helm \
  --version v1.2.1 \
  --namespace envoy-gateway-system \
  --create-namespace
```

--------------------------------

### Example CI Test Command with Chart Testing

Source: https://github.com/devops-ia/helm-opencti/blob/main/TESTING.md

This is an example command for running CI tests using the Chart Testing tool, typically used in CI/CD pipelines.

```bash
ct lint-and-install --config ct.yaml
```

--------------------------------

### Install OpenCTI Helm Chart (Repository Mode)

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/README.md

Install the OpenCTI Helm chart from the added repository. This command deploys all associated Kubernetes components for the release.

```console
helm install [RELEASE_NAME] opencti/opencti
```

--------------------------------

### Install OpenCTI Helm Chart (OCI Mode)

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/README.md

Install the OpenCTI Helm chart using OCI format from GitHub Container Registry. Replace `[version]` with the desired chart version.

```console
helm install [RELEASE_NAME] oci://ghcr.io/devops-ia/helm-opencti/opencti --version=[version]
```

--------------------------------

### Install Helm Chart in Test Namespace

Source: https://github.com/devops-ia/helm-opencti/blob/main/TESTING.md

Installs the OpenCTI Helm chart into a dedicated test namespace. Ensure the namespace is created first.

```bash
kubectl create namespace opencti-test
helm install opencti-test charts/opencti --namespace opencti-test
```

--------------------------------

### Install OpenCTI Helm Chart from OCI Registry

Source: https://github.com/devops-ia/helm-opencti/blob/main/README.md

Installs the OpenCTI Helm chart using OCI artifacts. Specify the desired chart version using the `--version` flag. Replace `[RELEASE_NAME]` and `[version]` accordingly.

```bash
helm install [RELEASE_NAME] oci://ghcr.io/devops-ia/helm-opencti/opencti --version=[version]
```

--------------------------------

### Configure Frontend and Ingestion Clusters

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration-clustering-mode.md

Configure the replica counts for the frontend and ingestion clusters when clustering is enabled. This example sets both to their minimum recommended values.

```yaml
clustering:
  frontend:
    enabled: true
    replicaCount: 2
  ingestion:
    enabled: true
    replicaCount: 3
```

--------------------------------

### OpenCTI Server Deployment Init Containers for Readiness Checks

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/examples.md

Example of `initContainers` in `deployment.yaml` that implement the readiness checks using `nc` command. This configuration dynamically builds the service address and checks connectivity.

```yaml
      initContainers:
      {{- if .Values.readyChecker.enabled }}
        {{- range $service := .Values.readyChecker.services }}
        - name: ready-checker-{{ $service.name }}
          {{- if $.Values.global.imageRegistry }}
          image: "{{ $.Values.global.imageRegistry }}/{{ $.Values.readyChecker.repository }}:{{ $.Values.readyChecker.tag }}"
          {{- else }}
          image: {{ $.Values.readyChecker.repository }}:{{ $.Values.readyChecker.tag }}
          {{- end }}
          imagePullPolicy: {{ $.Values.readyChecker.pullPolicy }}
          command:
            - 'sh'
            - '-c'
            - |
              RETRY=0;
              until [ $RETRY -eq {{ $.Values.readyChecker.retries }} ];
              do
                ADDRESS="{{ if $service.address }}{{ $service.address }}{{ else }}{{ $.Values.fullnameOverride | default $.Release.Name }}-{{ $service.name }}{{ end }}";
                if nc -zv $ADDRESS {{ $service.port }}; then
                  echo "Service {{ $service.name }} with address $ADDRESS:{{ $service.port }} is ready";
                  exit 0;
                fi;
                echo "[$RETRY/{{ $.Values.readyChecker.retries }}] waiting for service {{ $service.name }} with address $ADDRESS:{{ $service.port }} to become ready";
                sleep {{ $.Values.readyChecker.timeout }};
                RETRY=$(($RETRY + 1));
                if [ $RETRY -eq {{ $.Values.readyChecker.retries }} ]; then
                  echo "Service {{ $service.name }} with address $ADDRESS:{{ $service.port }} is not ready";
                  exit 1;
                fi;
              done
          {{- end }}
        {{- end }}
        {{- with .Values.initContainers }}
          {{- toYaml . | nindent 8 }}
        {{- end }}
```

--------------------------------

### Verify Gateway API CRDs Installation

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Check that the Gateway and HTTPRoute CRDs have been successfully installed and are in the ESTABLISHED state.

```bash
kubectl get crd gateways.gateway.networking.k8s.io httproutes.gateway.networking.k8s.io
```

--------------------------------

### Check Pod Status

Source: https://github.com/devops-ia/helm-opencti/blob/main/TESTING.md

Verify that all pods within the 'opencti-test' namespace are running after installation.

```bash
kubectl get pods -n opencti-test
```

--------------------------------

### Configure Readiness Checker for Services

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/examples.md

Configure `readyChecker` to ensure dependent services are running before OpenCTI starts. Specify image details, retry attempts, and timeouts.

```yaml
readyChecker:
  # -- Enable or disable ready-checker
  enabled: true
  # -- Repository of the image
  repository: busybox
  # -- Pull policy for the image
  pullPolicy: IfNotPresent
  # -- Overrides the image tag
  tag: latest
  # -- Number of retries before giving up
  retries: 30
  # -- Timeout for each check
  timeout: 5
  # -- List services
  services:
  # - name: service_name
  #   port: service_port
  #   address: service_address  # (Optional) This parameter is optional. If
  #   not specified, the address for the check will be automatically
  #   determined assuming the service was installed using a subchart. It is
  #   useful to specify it when the service is provisioned differently (e.g.,
  #   an S3 bucket created in the Cloud or an Elasticsearch instance outside
  #   the Kubernetes cluster). The address can be an IP address or a DNS name.
  - name: elasticsearch
    port: 9200
    address: 172.0.0.1
  - name: minio
    port: 9000
  - name: rabbitmq
    port: 5672
  - name: redis-master
    port: 6379
```

--------------------------------

### Configure RabbitMQ Password in StatefulSet

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/examples.md

This example demonstrates how to configure the RabbitMQ password for a StatefulSet by referencing a secret key. The `valueFrom.secretKeyRef` mechanism securely injects the password as an environment variable.

```yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: opencti-ci-rabbitmq
  namespace: "default"
  ...
    env:
    ...
      - name: RABBITMQ_PASSWORD
        valueFrom:
          secretKeyRef:
            name: opencti-ci-credentials
            key: RABBITMQ__PASSWORD
```

--------------------------------

### Configure OpenSearch Helm Chart Values with Security

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Configuration for deploying OpenSearch with security enabled, including defining internal users. This example shows how to set up the admin user with a hashed password.

```yaml
opensearch:
  enabled: true
  fullnameOverride: <release-name>-opensearch

  opensearchJavaOpts: "-Xmx512M -Xms512M"
  singleNode: true

  securityConfig:
    config:
      data:
        internal_users.yml: |-
          admin:
            hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
            reserved: true
            backend_roles:
            - "admin"
            description: "Demo admin user"

  persistence:
    enabled: false
```

--------------------------------

### OpenCTI Connector Global Environment Variables

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Set global environment variables for all OpenCTI connectors. This example enables metrics exposure.

```yaml
connectorsGlobal:
  env:
    CONNECTOR_EXPOSE_METRICS: true
```

--------------------------------

### Configure Kubernetes Probes

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Set up Kubernetes liveness, readiness, and startup probes for comprehensive health monitoring. Adjust initial delay and period seconds as needed.

```yaml
livenessProbe:
  enabled: true
  httpGet:
    path: /health
    port: 4000
  initialDelaySeconds: 60
  periodSeconds: 30

readinessProbe:
  enabled: true
  httpGet:
    path: /health
    port: 4000
  initialDelaySeconds: 30
  periodSeconds: 10

startupProbe:
  enabled: true
  httpGet:
    path: /health
    port: 4000
  initialDelaySeconds: 30
  periodSeconds: 10
  failureThreshold: 30
```

--------------------------------

### Show All Configurable Options

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration-clustering-mode.md

Use this command to display all available configuration options for the OpenCTI Helm chart, including comments.

```console
helm show values opencti/opencti
```

--------------------------------

### Check OpenCTI Pod Logs for Initialization Issues

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Troubleshoots OpenCTI pods stuck in the Init state by checking the logs of the 'ready-checker' container.

```bash
kubectl logs -n opencti -l app.kubernetes.io/name=opencti -c ready-checker
```

--------------------------------

### Get OpenCTI Gateway IP

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Retrieves the external IP address assigned to the OpenCTI Gateway by OrbStack.

```bash
GW_IP=$(kubectl get gateway opencti-gw-test-gateway -n opencti \
  -o jsonpath='{.status.addresses[0].value}')
echo "Gateway IP: $GW_IP"
```

--------------------------------

### Basic Connector Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/examples.md

Configure a MISP connector with essential settings like name, enabled status, replicas, image repository, and environment variables.

```yaml
connectors:
# https://github.com/OpenCTI-Platform/connectors/tree/master/external-import/misp
- name: sample-misp
  enabled: true
  replicas: 1
  image:
    repository: opencti/connector-misp
  serviceAccount:
    create: true
  readyChecker:
    enabled: true
    retries: 30
    timeout: 10
  env:
    CONNECTOR_CONFIDENCE_LEVEL: "XXXX"
    CONNECTOR_ID: "XXXX"
    CONNECTOR_LOG_LEVEL: "XXXX"
    CONNECTOR_NAME: "XXXX"
    CONNECTOR_SCOPE: "XXXX"
    CONNECTOR_TYPE: "XXXX"
    CONNECTOR_UPDATE_EXISTING_DATA: "XXXX"
    MISP_CREATE_INDICATORS: "XXXX"
    MISP_CREATE_OBJECT_OBSERVABLES: "XXXX"
    MISP_CREATE_OBSERVABLES: "XXXX"
    MISP_CREATE_REPORTS: "XXXX"
    MISP_CREATE_TAGS_AS_LABELS: "XXXX"
    MISP_DATETIME_ATTRIBUTE: "XXXX"
    MISP_ENFORCE_WARNING_LIST: "XXXX"
    MISP_INTERVAL: "XXXX"
    MISP_REFERENCE_URL: "XXXX"
    MISP_REPORT_TYPE: "XXXX"
    MISP_SSL_VERIFY: "XXXX"
    MISP_URL: "XXXX"
  envFromSecrets:
    MISP_KEY:
      name:  my-secret-credentials
      key: MISP_KEY
  resources:
    requests:
      memory: 128Mi
      cpu: 100m
    limits:
      memory: 128Mi
```

--------------------------------

### OpenCTI Pod Labels

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Assign labels to OpenCTI pods for organization and selection. This example sets the component label to 'connector'.

```yaml
podLabels:
  app.kubernetes.io/component: connector
```

--------------------------------

### Remove /etc/hosts Entry

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Execute this command to remove the specific entry for 'opencti.local' from your /etc/hosts file, which might have been added during setup.

```bash
sudo sed -i '' '/opencti.local/d' /etc/hosts
```

--------------------------------

### Configure Basic MinIO Helm Chart Values

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Basic configuration for deploying MinIO using its Helm chart. This includes enabling the chart, setting root user credentials, and defining resource requests and limits.

```yaml
minio:
  enabled: true
  fullnameOverride: <release-name>-minio

  rootUser: minio
  rootPassword: uxLSbJGZzzhZxXUFgdAl

  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 512Mi

  persistence:
    enabled: false
```

--------------------------------

### OpenCTI Lifecycle Pre-Stop Hook

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Define a pre-stop hook for OpenCTI pods to gracefully shut down. This example executes a sleep command before termination.

```yaml
lifecycle:
  preStop:
    exec:
      command: ["sh", "-c", "sleep 5"]
```

--------------------------------

### Describe HTTPRoute for Troubleshooting

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Troubleshoots HTTPRoute acceptance issues by describing the specific HTTPRoute resource in the OpenCTI namespace.

```bash
kubectl describe httproute opencti-gw-test -n opencti
```

--------------------------------

### Check All OpenCTI Pods Ready

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Ensures all pods within the OpenCTI namespace are in a 'Ready' state, indicating a successful deployment of OpenCTI services.

```bash
kubectl get pods -n opencti
```

--------------------------------

### Enable Ingress and Autoscaling

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/UPGRADE-v1-to-v2.md

Configure ingress for your domain and enable autoscaling with specified replica counts.

```yaml
ingress:
  enabled: true
  hosts:
    - host: your-opencti-domain.com
      paths:
        - path: /
          pathType: ImplementationSpecific

# Keep all other v2 features
autoscaling:
  enabled: true
  minReplicas: 1
  maxReplicas: 5
```

--------------------------------

### Install Gateway API CRDs

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Apply the standard Gateway API Custom Resource Definitions (CRDs) to your Kubernetes cluster. These are necessary for using Gateway API resources.

```bash
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml
```

--------------------------------

### Expose OpenCTI Server using Gateway API

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Configure the Gateway API to expose the OpenCTI server. This requires CRDs to be installed and specifies parent references, hostnames, and routing rules.

```yaml
gateway:
  enabled: true
  parentRefs:
    - name: my-gateway
      namespace: default
  hostnames:
    - demo.mydomain.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
```

--------------------------------

### OpenCTI Connector Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/UPGRADE-v1-to-v2.md

Sets up the OpenCTI connector, specifying its name, image, readiness probes, resource limits, and environment variables for identification, naming, scope, type, and logging.

```yaml
# Connector configuration (connects to frontend)
connectorsGlobal:
  env:
    CONNECTOR_EXPOSE_METRICS: true

connectors:
  - name: opencti
    enabled: true
    replicas: 1

    image:
      repository: opencti/connector-opencti
      pullPolicy: IfNotPresent

    readyChecker:
      enabled: true
      retries: 30
      timeout: 5

    resources:
      requests:
        memory: 256Mi
        cpu: 100m
      limits:
        memory: 512Mi
        cpu: 250m

    env:
      CONNECTOR_ID: "your-connector-id"  # Generate a unique UUID
      CONNECTOR_NAME: "OpenCTI-Cluster"
      CONNECTOR_SCOPE: "marking-definition,identity,location"
      CONNECTOR_TYPE: EXTERNAL_IMPORT
      CONNECTOR_LOG_LEVEL: info

    lifecycle:
      preStop:
        exec:
          command: ["sh", "-c", "sleep 5"]

    terminationGracePeriodSeconds: 20

```

--------------------------------

### Verify OpenCTI Deployment with kubectl

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/UPGRADE-v1-to-v2.md

After upgrading, use these kubectl commands to verify that all OpenCTI pods are running and that services are accessible. The `kubectl port-forward` command allows you to test application accessibility locally.

```bash
# Verify all pods are running
kubectl get pods -l app.kubernetes.io/name=opencti

# Check services are accessible
kubectl get svc -l app.kubernetes.io/name=opencti

# Test application accessibility
kubectl port-forward svc/your-release-name-server 8080:80 &
curl -f http://localhost:8080/health
```

--------------------------------

### Configure Autoscaling for Frontend and Ingestion

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/UPGRADE-v1-to-v2.md

Enable and configure autoscaling for both frontend and ingestion components. Set minimum and maximum replicas, and define the target CPU utilization percentage for scaling decisions.

```yaml
# Stress test configuration
clustering:
  frontend:
    autoscaling:
      enabled: true
      minReplicas: 2
      maxReplicas: 10
      targetCPUUtilizationPercentage: 50  # Lower threshold for testing

  ingestion:
    autoscaling:
      enabled: true
      minReplicas: 3
      maxReplicas: 15
      targetCPUUtilizationPercentage: 50  # Lower threshold for testing
```

--------------------------------

### OpenCTI Ready Checker Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Configure the readiness probe for OpenCTI pods. This includes enabling the checker, setting the number of retries, and the timeout duration.

```yaml
readyChecker:
  enabled: true
  retries: 30
  timeout: 5
```

--------------------------------

### Create OpenCTI Namespace and Envoy GatewayClass

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Create the namespace for OpenCTI and apply a GatewayClass resource that registers Envoy Gateway as the controller. The Gateway resource itself is managed by the Helm chart.

```bash
kubectl create namespace opencti

kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
EOF
```

--------------------------------

### Test Web Interface Access

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/UPGRADE-v1-to-v2.md

Forward the frontend service port to your local machine to test the web interface. Verify login, dashboard loading, data visualization, user management, and configuration access.

```bash
# Test web interface access
kubectl port-forward svc/your-release-name-frontend 8080:80 &

# Open browser and verify:
# * Login functionality
# * Dashboard loading
# * Data visualization
# * User management
# * Configuration access
```

--------------------------------

### Configure Ready Checker

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Enable and configure the ready checker for all OpenCTI dependencies. Specify the number of retries and timeout duration.

```yaml
readyChecker:
  enabled: true
  retries: 30
  timeout: 5
  services:
  - name: opensearch
    port: 9200
  - name: minio
    port: 9000
  - name: rabbitmq
    port: 5672
  - name: redis
    port: 6379
```

--------------------------------

### Configure Basic OpenSearch Helm Chart Values

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Basic configuration for deploying OpenSearch as a single node with security disabled. This includes enabling the chart, setting Java heap options, and defining resource requests and limits.

```yaml
opensearch:
  enabled: true
  fullnameOverride: <release-name>-opensearch

  opensearchJavaOpts: "-Xmx512M -Xms512M"
  singleNode: true

  config:
    opensearch.yml: |
      plugins.security.disabled: true

  resources:
    requests:
      memory: "512Mi"
      cpu: "250m"
    limits:
      memory: "1Gi"
      cpu: "500m"

  persistence:
    enabled: false
```

--------------------------------

### OpenCTI Server Basic Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Configure essential server environment variables for OpenCTI. This includes setting up admin credentials, base path, session cookies, health access keys, and enabling/disabling telemetry and GraphQL playground.

```yaml
env:
  APP__ADMIN__EMAIL: admin@opencti.io
  APP__ADMIN__PASSWORD: test
  APP__ADMIN__TOKEN: b1976749-8a53-4f49-bf04-cafa2a3458c1
  APP__BASE_PATH: "/"
  APP__SESSION_COOKIE: "true"
  APP__HEALTH_ACCESS_KEY: f93747ff-2ea1-4717-900c-9df20b8e4429
  APP__TELEMETRY__METRICS__ENABLED: false
  APP__GRAPHQL__PLAYGROUND__ENABLED: false
  APP__GRAPHQL__PLAYGROUND__FORCE_DISABLED_INTROSPECTION: true
  ...
```

--------------------------------

### Configure Pod Disruption Budgets

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration-clustering-mode.md

Set up Pod Disruption Budgets (PDBs) for frontend and ingestion clusters to maintain availability during voluntary disruptions.

```yaml
clustering:
  frontend:
    podDisruptionBudget:
      enabled: true
      maxUnavailable: 1
  ingestion:
    podDisruptionBudget:
      enabled: true
      maxUnavailable: 2
```

--------------------------------

### Run Helm Lint

Source: https://github.com/devops-ia/helm-opencti/blob/main/TESTING.md

Use this command to check the OpenCTI Helm chart for any syntax issues.

```bash
helm lint charts/opencti
```

--------------------------------

### Default Service Account Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/examples.md

Enable ServiceAccount creation using the default naming convention without specifying a custom name.

```yaml
...
connectors:
- name: sample-misp
  enabled: true
  replicas: 1
  serviceAccount:
    create: true
```

--------------------------------

### Upgrade Helm Chart

Source: https://github.com/devops-ia/helm-opencti/blob/main/TESTING.md

Tests the upgrade process of the OpenCTI Helm chart from a previous version to the current one within the specified namespace.

```bash
helm upgrade opencti-test charts/opencti --namespace opencti-test
```

--------------------------------

### OpenCTI Deployment Strategy

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Define the deployment strategy for OpenCTI. 'Recreate' ensures that old pods are completely terminated before new ones are created.

```yaml
strategy:
  type: Recreate
```

--------------------------------

### Basic RabbitMQ Helm Chart Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Configure basic settings for the RabbitMQ Helm chart, including enabling the service, setting resource requests and limits, and authentication credentials.

```yaml
rabbitmq:
  enabled: true
  fullnameOverride: <release-name>-rabbitmq

  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 512Mi

  auth:
    username: user
    password: K4we4CUebaRpISxWnMJn
    erlangCookie: b25c953e-2193-4b8e-9f3b-9a3a5ba76d75

  clustering:
    enabled: false

  networkPolicy:
    enabled: false

  persistence:
    enabled: false
```

--------------------------------

### Expose OpenCTI Server using Ingress

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Enable and configure Ingress resources to expose the OpenCTI server. Specify hostnames and paths for external access.

```yaml
ingress:
  enabled: true
  hosts:
    - host: demo.mydomain.com
      paths:
        - path: /
          pathType: Prefix
```

--------------------------------

### Configure Global and Frontend Metrics

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/UPGRADE-v1-to-v2.md

Enable global telemetry metrics and configure Prometheus scraping for the frontend service. This includes setting the scrape interval, path, and applying metric relabeling rules.

```yaml
# Global metrics configuration
env:
  APP__TELEMETRY__METRICS__ENABLED: true
  APP__TELEMETRY__METRICS__EXPORTER_PROMETHEUS: 14269

# Frontend metrics
clustering:
  frontend:
    serviceMonitor:
      enabled: true
      interval: 30s
      path: /metrics
      scrapeTimeout: 10s
      metricRelabelings:
        - sourceLabels: [__name__]
          regex: 'opencti_frontend_(.+)'
          targetLabel: 'frontend_metric'
      relabelings:
        - sourceLabels: [__meta_kubernetes_pod_name]
          targetLabel: 'pod'
```

--------------------------------

### Kubernetes Init Container for Service Readiness Check

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/examples.md

This init container uses busybox to check if a service is available on a specific port. It retries up to 30 times with a 5-second delay.

```yaml
initContainers:
        - name: ready-checker-elasticsearch
          image: busybox:latest
          imagePullPolicy: IfNotPresent
          command:
            - 'sh'
            - '-c'
            - |
              RETRY=0;
              until [ $RETRY -eq 30 ];
              do
                ADDRESS="172.0.0.1";
                if nc -zv $ADDRESS 9200; then
                  echo "Service elasticsearch with address $ADDRESS:9200 is ready";
                  exit 0;
                fi;
                echo "[$RETRY/30] waiting for service elasticsearch with address $ADDRESS:9200 to become ready";
                sleep 5;
                RETRY=$(($RETRY + 1));
                if [ $RETRY -eq 30 ]; then
                  echo "Service elasticsearch with address $ADDRESS:9200 is not ready";
                  exit 1;
                fi;
              done
```

```yaml
initContainers:
        - name: ready-checker-minio
          image: busybox:latest
          imagePullPolicy: IfNotPresent
          command:
            - 'sh'
            - '-c'
            - |
              RETRY=0;
              until [ $RETRY -eq 30 ];
              do
                ADDRESS="opencti-ci-minio";
                if nc -zv $ADDRESS 9000; then
                  echo "Service minio with address $ADDRESS:9000 is ready";
                  exit 0;
                fi;
                echo "[$RETRY/30] waiting for service minio with address $ADDRESS:9000 to become ready";
                sleep 5;
                RETRY=$(($RETRY + 1));
                if [ $RETRY -eq 30 ]; then
                  echo "Service minio with address $ADDRESS:9000 is not ready";
                  exit 1;
                fi;
              done
```

```yaml
initContainers:
        - name: ready-checker-rabbitmq
          image: busybox:latest
          imagePullPolicy: IfNotPresent
          command:
            - 'sh'
            - '-c'
            - |
              RETRY=0;
              until [ $RETRY -eq 30 ];
              do
                ADDRESS="opencti-ci-rabbitmq";
                if nc -zv $ADDRESS 5672; then
                  echo "Service rabbitmq with address $ADDRESS:5672 is ready";
                  exit 0;
                fi;
                echo "[$RETRY/30] waiting for service rabbitmq with address $ADDRESS:5672 to become ready";
                sleep 5;
                RETRY=$(($RETRY + 1));
                if [ $RETRY -eq 30 ]; then
                  echo "Service rabbitmq with address $ADDRESS:5672 is not ready";
                  exit 1;
                fi;
              done
```

```yaml
initContainers:
        - name: ready-checker-redis-master
          image: busybox:latest
          imagePullPolicy: IfNotPresent
          command:
            - 'sh'
            - '-c'
            - |
              RETRY=0;
              until [ $RETRY -eq 30 ];
              do
                ADDRESS="opencti-ci-redis-master";
                if nc -zv $ADDRESS 6379; then
                  echo "Service redis-master with address $ADDRESS:6379 is ready";
                  exit 0;
                fi;
                echo "[$RETRY/30] waiting for service redis-master with address $ADDRESS:6379 to become ready";
                sleep 5;
                RETRY=$(($RETRY + 1));
                if [ $RETRY -eq 30 ]; then
                  echo "Service redis-master with address $ADDRESS:6379 is not ready";
                  exit 1;
                fi;
              done
```

--------------------------------

### Generate and Verify Helm Template Output

Source: https://github.com/devops-ia/helm-opencti/blob/main/TESTING.md

This command generates the Kubernetes manifests from the Helm chart and allows for verification of the template output.

```bash
helm template opencti charts/opencti --debug
```

--------------------------------

### Configure Health Checks

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration-clustering-mode.md

Configure liveness, readiness, and startup probes for OpenCTI components to ensure service availability and proper startup.

```yaml
livenessProbe:
  enabled: true
  initialDelaySeconds: 180
  periodSeconds: 30

readinessProbe:
  enabled: true
  initialDelaySeconds: 30
  periodSeconds: 10

startupProbe:
  enabled: true
  initialDelaySeconds: 180
  failureThreshold: 30
```

--------------------------------

### MinIO Configuration for OpenCTI

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Configure MinIO for object storage used by OpenCTI. Set root credentials, resource limits, and persistence options.

```yaml
minio:
  fullnameOverride: opencti-<release-name>-minio

  rootUser: minio
  rootPassword: uxLSbJGZzzhZxXUFgdAl

  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 512Mi

  persistence:
    enabled: false
```

--------------------------------

### Add OpenCTI Helm Repository

Source: https://github.com/devops-ia/helm-opencti/blob/main/README.md

Adds the OpenCTI Helm chart repository to your local Helm configuration. Ensure you run `helm repo update` afterwards to fetch the latest chart information.

```bash
helm repo add opencti https://devops-ia.github.io/helm-opencti
helm repo update
```

--------------------------------

### Basic Redis Helm Chart Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Configure basic settings for the Redis Helm chart, including enabling the service, setting resource requests and limits, and extra arguments for customization.

```yaml
redis:
  enabled: true
  fullnameOverride: <release-name>-redis

  resources:
    requests:
      memory: 256Mi
      cpu: 50m
    limits:
      memory: 256Mi

  extraArgs:
    - --maxmemory=256mb
    - --proactor_threads=1
    - --num_shards=1
```

--------------------------------

### Deploy OpenCTI with Clustering Values

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration-clustering-mode.md

Upgrade your OpenCTI deployment using Helm, applying your custom clustering configuration values from a specified file.

```bash
helm upgrade opencti . -f your-clustering-values.yaml
```

--------------------------------

### Describe Gateway and Check Envoy Logs

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Troubleshoots issues where the Gateway has no assigned address by describing the Gateway resource and checking the logs of the Envoy Gateway deployment.

```bash
kubectl describe gateway opencti-gw-test-gateway -n opencti
kubectl logs -n envoy-gateway-system deploy/envoy-gateway
```

--------------------------------

### Wait for Envoy Gateway Deployment

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Monitor the deployment status of the Envoy Gateway controller to ensure it is ready before proceeding.

```bash
kubectl rollout status deployment/envoy-gateway -n envoy-gateway-system
```

--------------------------------

### Add OpenCTI Helm Repository

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/README.md

Add the OpenCTI Helm chart repository to your Helm configuration and update local repository cache.

```console
helm repo add opencti https://devops-ia.github.io/helm-opencti
helm repo update
```

--------------------------------

### Upgrade to v2 (Single Mode) with Helm

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/UPGRADE-v1-to-v2.md

Use this command to upgrade your OpenCTI Helm release to version 2.x.x while maintaining a single-node architecture. Ensure you have added and updated the Helm repository first. The `--wait` flag ensures the upgrade completes before proceeding, and `--timeout` sets a maximum duration for the upgrade.

```bash
# Add the updated Helm repository
helm repo add opencti https://devops-ia.github.io/helm-opencti
helm repo update

# Upgrade to v2 without enabling clustering
helm upgrade your-release-name opencti/opencti \
  --version 2.x.x                              \
  -f your-existing-values.yaml                 \
  --wait                                       \
  --timeout 600s
```

--------------------------------

### Verify Kubernetes Cluster Reachability

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Use this command to ensure kubectl is correctly configured and can communicate with your Kubernetes cluster.

```bash
kubectl cluster-info
```

--------------------------------

### Configure MinIO Server envFromSecrets

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Configure the OpenCTI server to read MinIO access key and secret key from a Kubernetes secret. This is used for authenticating with MinIO.

```yaml
envFromSecrets:
  MINIO__ACCESS_KEY:
    name: <release-name>-credentials
    key: root-user
  MINIO__SECRET_KEY:
    name: <release-name>-credentials
    key: root-password
```

--------------------------------

### Configure Autoscaling

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Enable and configure horizontal pod autoscaling for OpenCTI based on CPU and memory utilization.

```yaml
autoscaling:
  enabled: true
  minReplicas: 1
  maxReplicas: 3
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80
```

--------------------------------

### Custom Connector Image Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/examples.md

Use a custom container image by specifying the repository and tag.

```yaml
connectors:
- name: sample-misp
  enabled: true
  replicas: 1
  image:
    repository: my-private-repo/connector-misp-sample
    tag: "6.2.15"
  ...
```

--------------------------------

### Verify Service Exposure

Source: https://github.com/devops-ia/helm-opencti/blob/main/TESTING.md

Check if the services for OpenCTI are exposed correctly within the 'opencti-test' namespace.

```bash
kubectl get svc -n opencti-test
```

--------------------------------

### Configure Ingestion Metrics

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/UPGRADE-v1-to-v2.md

Enable Prometheus scraping for the ingestion service, specifying the scrape interval, path, and metric relabeling rules to differentiate ingestion metrics.

```yaml
# Ingestion metrics
clustering:
  ingestion:
    serviceMonitor:
      enabled: true
      interval: 30s
      path: /metrics
      scrapeTimeout: 10s
      metricRelabelings:
        - sourceLabels: [__name__]
          regex: 'opencti_ingestion_(.+)'
          targetLabel: 'ingestion_metric'
```

--------------------------------

### Configure ElasticSearch Helm Chart Values

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Basic configuration for deploying ElasticSearch using the ECK (Elastic Cloud on Kubernetes) chart. This includes enabling the chart, setting up the Elasticsearch instance, and defining resource requests and limits.

```yaml
eck-stack:
  enabled: true

  eck-elasticsearch:
    fullnameOverride: <release-name>-elasticsearch
    http:
      tls:
        selfSignedCertificate:
          disabled: true
    nodeSets:
      - name: default
        count: 1
        config:
          node.roles: ["master", "data", "ingest"]
          node.store.allow_mmap: false
        podTemplate:
          spec:
            containers:
              - name: elasticsearch
                resources:
                  requests:
                    cpu: "500m"
                    memory: "2Gi"
                  limits:
                    memory: "2Gi"
            volumes:
              - name: elasticsearch-data
                emptyDir: {}
```

--------------------------------

### Configure Topology Spread Constraints

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration-clustering-mode.md

Distribute pods across nodes using topology spread constraints to enhance resilience and availability.

```yaml
clustering:
  frontend:
    topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: DoNotSchedule
  ingestion:
    topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: DoNotSchedule
```

--------------------------------

### Configure DNS Settings

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Set custom DNS nameservers and search domains for improved network connectivity within the OpenCTI deployment. Use 'ClusterFirst' for default Kubernetes DNS resolution.

```yaml
dnsConfig:
  nameservers:
    - 1.1.1.1
    - 8.8.8.8
  searches: []
  options:
    - name: ndots
      value: "2"
dnsPolicy: ClusterFirst
```

--------------------------------

### Configure Resource Limits

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Define resource requests and limits for CPU and memory for OpenCTI components to ensure stable operation.

```yaml
resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "1Gi"
    cpu: "500m"
```

--------------------------------

### Update Ingress for Frontend Cluster

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration-clustering-mode.md

Configure the ingress to point to the frontend cluster. Replace 'your-opencti-domain.com' with your actual domain.

```yaml
clustering:
  frontend:
    ingress:
      enabled: true
      hosts:
        - host: your-opencti-domain.com
```

--------------------------------

### Port Forward for Platform Accessibility

Source: https://github.com/devops-ia/helm-opencti/blob/main/TESTING.md

This command forwards traffic from your local machine to the OpenCTI service, allowing you to access the platform UI and test its accessibility.

```bash
kubectl port-forward svc/opencti-test 8080:8080 -n opencti-test
```

--------------------------------

### Configure Gateway API for Frontend Cluster

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration-clustering-mode.md

Alternatively, use the Gateway API for ingress if your cluster supports it. Ensure the parentRefs and hostnames are correctly configured for your environment.

```yaml
clustering:
  frontend:
    gateway:
      enabled: true
      parentRefs:
        - name: my-gateway
          namespace: default
      hostnames:
        - your-opencti-domain.com
```

--------------------------------

### Custom Service Account Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/examples.md

Create and use a specific ServiceAccount for the connector by providing its name and enabling creation.

```yaml
...
connectors:
- name: sample-misp
  enabled: true
  replicas: 1
  serviceAccount:
    create: true
    name: test
    automountServiceAccountToken: true # false by default
```

--------------------------------

### Configure RabbitMQ Environment Variables

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Set environment variables for RabbitMQ connection details in the server block. Ensure to replace placeholders like <release-name>.

```yaml
env:
...
  RABBITMQ__HOSTNAME: <release-name>-rabbitmq
  RABBITMQ__PORT_MANAGEMENT: 15672
  RABBITMQ__PORT: 5672
  RABBITMQ__USERNAME: user
  RABBITMQ__PASSWORD: ChangeMe
```

--------------------------------

### Enable Service Monitor for Metrics

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration-clustering-mode.md

Enable service monitors for both frontend and ingestion clusters to expose metrics for monitoring.

```yaml
clustering:
  frontend:
    serviceMonitor:
      enabled: true
  ingestion:
    serviceMonitor:
      enabled: true
```

--------------------------------

### Configure Server Block with Secret References

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Use `envFromSecrets` to load RabbitMQ password and Erlang cookie from a Kubernetes secret into the server's environment variables.

```yaml
envFromSecrets:
  RABBITMQ__PASSWORD:
    name: <release-name>-credentials
    key: rabbitmq-password
  RABBITMQ__ERLANGCOOKIE:
    name: <release-name>-credentials
    key: rabbitmq-erlang-cookie
```

--------------------------------

### Test Frontend Accessibility

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/UPGRADE-v1-to-v2.md

Temporarily expose the frontend service to your local machine to test its accessibility and health endpoint. Ensure the frontend is reachable and responding.

```bash
# Test frontend accessibility
kubectl port-forward svc/your-release-name-frontend 8080:80 &
curl -f http://localhost:8080/health
```

--------------------------------

### OpenSearch Configuration for OpenCTI

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/configuration.md

Enable and configure OpenSearch for OpenCTI. This includes setting resource requests and limits, persistence, and custom OpenSearch configuration.

```yaml
opensearch:
  enabled: true
  fullnameOverride: opencti-<release-name>-opensearch

  nodeGroup: ""
  opensearchJavaOpts: "-Xmx512M -Xms512M"
  singleNode: true

  config:
    opensearch.yml: |
      plugins.security.disabled: true

  resources:
    requests:
      memory: "512Mi"
      cpu: "250m"
    limits:
      memory: "1Gi"
      cpu: "500m"

  persistence:
    enabled: false
```

--------------------------------

### Prometheus Metrics Configuration

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/examples.md

Enable Prometheus metric scraping for connectors by setting `CONNECTOR_EXPOSE_METRICS` to true and configuring ServiceMonitor options.

```yaml
connectors:
- name: sample-misp
  enabled: true
  serviceMonitor:
    enabled: true
    interval: 30s
    scrapeTimeout: 10s
  env:
    ...
    CONNECTOR_EXPOSE_METRICS: true
    ...
```

--------------------------------

### Add Gateway IP to /etc/hosts

Source: https://github.com/devops-ia/helm-opencti/blob/main/charts/opencti/docs/guides/gateway-api-usage.md

Adds an entry to the /etc/hosts file to map the Gateway IP to 'opencti.local', enabling browser access without DNS configuration.

```bash
echo "$GW_IP opencti.local" | sudo tee -a /etc/hosts
```