### Unleash Helm Chart Values (YAML)

Source: https://docs.kindo.ai/installation-and-deployment-guide

Example configuration values for deploying the Unleash feature flagging system using a Helm chart. This includes settings for an external PostgreSQL database and environment variables for admin user setup and API tokens. It is crucial to customize these values extensively for your specific environment, especially sensitive information like passwords and API tokens.

```yaml
# unleash-values.yaml (Example - customize extensively)
# PostgreSQL connection (if using external DB)
# database:
#   enabled: false # Disable built-in Postgres
# externalDatabase:
#   enabled: true
#   driver: postgres
#   user: unleash_user
#   password: "YOUR_UNLEASH_DB_PASSWORD"
#   database: unleash_db
#   host: your-postgres-host.example.com
#   port: 5432
#   ssl: require # or prefer/allow/disable
#   secretName: unleash-db-credentials # K8s secret with DB password

# Admin user setup
env:
  - name: UNLEASH_DEFAULT_ADMIN_USERNAME
    value: "admin" # Or choose a different username
  - name: UNLEASH_DEFAULT_ADMIN_PASSWORD
    value: "YOUR_SECURE_UNLEASH_ADMIN_PASSWORD" # Set a strong password
  - name: INIT_ADMIN_API_TOKENS
    value: "*:*.YOUR_SECURE_ADMIN_API_TOKEN" # Generate a secure token
  - name: INIT_CLIENT_API_TOKENS
    value: "default:development.YOUR_SECURE_CLIENT_API_TOKEN" # Generate a secure token


```

--------------------------------

### Clone and Prepare Presidio Helm Chart (Bash)

Source: https://docs.kindo.ai/installation-and-deployment-guide

Clones the Presidio repository from GitHub, copies the Helm chart locally, and prepares a values file for installation. This sets up the necessary files for deploying Presidio using Helm.

```bash
# Clone the Presidio repository (needed for the Helm chart source)
git clone <https://github.com/microsoft/presidio.git>

# Copy the chart locally (adjust path if structure changed)
cp -rp presidio/docs/samples/deployments/k8s/charts/presidio ./presidio-helm

# Prepare values file (check payload/helm-values/presidio for overrides)
# Create presidio-values.yaml based on defaults and Kindo requirements

# Install Presidio
helm install presidio ./presidio-helm \
  -n presidio \
  --create-namespace \
  -f presidio-values.yaml # Use your prepared values file
```

--------------------------------

### Install Nginx Ingress Controller with Helm

Source: https://docs.kindo.ai/installation-and-deployment-guide

Installs the Nginx Ingress controller using Helm. This component manages external access to services within the Kubernetes cluster. It requires Helm to be installed and configured for Helm repositories. The output is a deployed Ingress controller service.

```bash
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

helm install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx \
  --create-namespace \
  --set controller.service.type=LoadBalancer # Or NodePort/ClusterIP depending on your env
# Add other necessary configurations via --set or a values file
```

--------------------------------

### Create and Navigate to Kindo Applications Directory

Source: https://docs.kindo.ai/docs/04-applications-deployment

Shell commands to create a new directory for Kindo applications deployment, navigate into it, and copy example values files.

```bash
mkdir -p my-kindo-deployment/kindo-applications
cd my-kindo-deployment/kindo-applications
cp -r ../../application-values ./values
```

--------------------------------

### Cerbos Helm Chart Installation Configuration

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Provides a minimal example of a `cerbos-values.yaml` file for configuring the Cerbos Helm chart. Key parameters include `replicaCount` and potential ingress settings. Customize this file based on the specific requirements and documentation for the Cerbos chart in the Kindo registry.

```YAML
# cerbos-values.yaml (Minimal example - customize as needed)
# Add necessary configurations, e.g., replicaCount, resources
replicaCount: 2
# Ingress might be needed if accessed directly, often it's cluster-internal
```

--------------------------------

### Terraform Initialization and Validation

Source: https://docs.kindo.ai/docs/04-applications-deployment

Commands to initialize Terraform providers and validate the configuration. This is the first step in the deployment process to ensure the infrastructure setup is correct.

```bash
# Initialize providers
terraform init

# Verify configuration
terraform validate
```

--------------------------------

### Install cert-manager with Helm

Source: https://docs.kindo.ai/installation-and-deployment-guide

Installs cert-manager using Helm to automate the management and issuance of TLS certificates in Kubernetes. This is essential for securing ingress endpoints. Requires Helm and adds the Jetstack Helm repository. The output is a deployed cert-manager instance with CRDs installed.

```bash
helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.13.3 # Use a recent, stable version \
  --set installCRDs=true
```

--------------------------------

### Copy Helm Values Files for Kindo Peripheries

Source: https://docs.kindo.ai/docs/03-peripheries-deployment

Shell commands to copy example Helm values files from a parent directory into the current working directory. This setup is required before configuring the kindo-peripheries module.

```bash
# In your kindo-base directory  
# Copy values files from example  
cp -r ../../peripheries-values ./values  
cp ../../feature_flags.json .  
  
# Your directory structure should now include:  
# kindo-base/  
# ├── values/  
# │ ├── alb-ingress.yaml  
# │ ├── external-secrets-operator.yaml  
# │ ├── presidio.yaml  
# │ ├── unleash.yaml  
# │ └── unleash-edge.yaml  
# ├── feature_flags.json  
# ├── main.tf # Contains all modules  
# ├── secrets.tf # Secret generation and configuration  
# ├── provider.tf # Provider configuration  
# ├── variables.tf  
# ├── outputs.tf  
# └── terraform.tfvars

```

--------------------------------

### Verify Prerequisites with Shell Commands

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Shell commands to verify AWS and Terraform setup, EKS cluster access, and Helm installation. These commands help ensure the environment is correctly configured before deployment.

```shell
# Verify AWS and Terraform setup
aws sts get-caller-identity
terraform --version
# Verify EKS cluster access
aws eks update-kubeconfig --name <cluster-name> --region <region>
kubectl get nodes
# Verify Helm installation
helm version
```

--------------------------------

### Verify AWS CLI and Terraform Setup

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Commands to verify the installation and configuration of AWS CLI and Terraform. Ensures the correct versions are installed and credentials are set up properly for deployment.

```bash
aws --version
aws sts get-caller-identity
terraform --version
```

--------------------------------

### Configure Unleash Helm Chart Values

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Example values file for deploying Unleash using a Helm chart. It covers PostgreSQL connection details (if using an external database) and environment variables for setting up admin credentials and API tokens.

```yaml
# unleash-values.yaml (Example - customize extensively)
# PostgreSQL connection (if using external DB)
# database:
#   enabled: false # Disable built-in Postgres
# externalDatabase:
#   enabled: true
#   driver: postgres
#   user: unleash_user
#   password: "YOUR_UNLEASH_DB_PASSWORD"
#   database: unleash_db
#   host: your-postgres-host.example.com
#   port: 5432
#   ssl: require # or prefer/allow/disable
#   secretName: unleash-db-credentials # K8s secret with DB password

# Admin user setup
env:
  - name: UNLEASH_DEFAULT_ADMIN_USERNAME
    value: "admin" # Or choose a different username
  - name: UNLEASH_DEFAULT_ADMIN_PASSWORD
    value: "YOUR_SECURE_UNLEASH_ADMIN_PASSWORD" # Set a strong password
  - name: INIT_ADMIN_API_TOKENS
    value: "*:*.YOUR_SECURE_ADMIN_API_TOKEN" # Generate a secure token
  - name: INIT_CLIENT_API_TOKENS
    value: "default:development.YOUR_SECURE_CLIENT_API_TOKEN" # Generate a secure token

```

--------------------------------

### Terraform Variables Configuration Example (terraform.tfvars)

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Provides an example of a terraform.tfvars file, specifying concrete values for the defined variables. It includes project details, AWS region, cluster name, S3 bucket names, and optional feature flags. This file is crucial for customizing the deployment to specific environments.

```hcl
project = "kindo"
environment = "prod"
region = "us-west-2"
availability_zone_names = ["us-west-2a", "us-west-2b", "us-west-2c"]
vpc_cidr_base = "10.0.0.0/16"
cluster_name = "kindo-prod-cluster"
s3_uploads_bucket_name = "kindo-prod-uploads-xyz123" # Must be globally unique
s3_audit_logs_bucket_name = "kindo-prod-audit-logs-xyz123" # Must be globally unique

# Optional features
enable_client_vpn = false # Set to true if you need VPN access
vpn_users = [] # Add usernames if enable_client_vpn is true
syslog_enabled = false # Set to true for enhanced logging
enable_ses = true
base_domain = "example.com"
create_public_zone = true
```

--------------------------------

### Troubleshoot Unleash Database Connection

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Guides users through troubleshooting Unleash startup failures related to database connectivity. It includes checking Unleash pod logs and verifying database connectivity from a temporary debug pod.

```shell
# Check Unleash pod logs
kubectl logs -n unleash deployment/unleash
# Verify database connectivity from a debug pod
kubectl run -it --rm postgres-client --image=postgres:14 --namespace=unleash -- /bin/bash
psql -h <postgres-host> -U <postgres-user> -d unleash
```

--------------------------------

### Install Services using Helm

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Generic template for installing a Kindo service using its Helm chart from the OCI registry. Requires specifying release name, chart version, namespace, and a custom values file.

```bash
helm install <release-name> oci://registry.kindo.ai/kindo-helm/<service-chart-name> \\
  --version <chart-version> \\
  --namespace <service-namespace> \\
  --create-namespace # If namespace doesn't exist yet \\
  -f <your-values-file-for-the-service.yaml>
```

--------------------------------

### Troubleshoot Pod Startup Issues

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Provides commands to diagnose and resolve issues with Kubernetes pods that are failing to start. It includes checking pod status, describing failing pods, and retrieving pod logs.

```bash
# Check pod status
kubectl get pods -n <namespace>
# Get detailed information about a failing pod
kubectl describe pod -n <namespace> <pod-name>
# Check pod logs
kubectl logs -n <namespace> <pod-name>
```

--------------------------------

### Configure ClusterSecretStore or SecretStore (YAML)

Source: https://docs.kindo.ai/installation-and-deployment-guide

Defines how External Secrets Operator (ESO) connects to your secrets backend (e.g., AWS, Vault, GCP, Azure). This example shows a generic structure with commented-out configurations for AWS Secrets Manager and HashiCorp Vault. You must replace placeholders with your specific provider details and authentication method.

```yaml
# example-secret-store.yaml
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore # Or SecretStore for namespaced access
metadata: 
  name: my-secret-backend # Choose a descriptive name
spec:
  provider:
    # --- Configuration specific to your backend provider ---
    # Example for AWS Secrets Manager (using IRSA):
    # aws:
    #   service: SecretsManager
    #   region: us-west-2
    #   auth:
    #     jwt:
    #       serviceAccountRef:
    #         name: default # Adjust if ESO runs with a different SA
    #         namespace: external-secrets
    # Example for HashiCorp Vault (using K8s Auth):
    # vault:
    #   server: "<https://vault.example.com>"
    #   path: "secret"
    #   version: "v2"
    #   auth:
    #     kubernetes:
    #       mountPath: "kubernetes"
    #       role: "external-secrets"
    #       serviceAccountRef:
    #         name: default # Adjust if ESO runs with a different SA
    #         namespace: external-secrets
    # --- Add your provider's configuration here ---


```

--------------------------------

### Install Presidio using Helm Chart

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Installs the Presidio service using a locally copied Helm chart. This command specifies the installation namespace, the creation of the namespace if it does not exist, and the use of a prepared `presidio-values.yaml` file for configuration. Ensure the `presidio-values.yaml` file is correctly configured.

```Bash
# Prepare values file (check payload/helm-values/presidio for overrides)
# Create presidio-values.yaml based on defaults and Kindo requirements

# Install Presidio
helm install presidio ./presidio-helm \
  -n presidio \
  --create-namespace \
  -f presidio-values.yaml # Use your prepared values file
```

--------------------------------

### Terraform Initialization and Provider Verification

Source: https://docs.kindo.ai/docs/infra-deployment

Initializes the Terraform working directory and verifies the installed Terraform version and providers. This is the first step in any Terraform deployment.

```bash
terraform init

terraform version
terraform providers
```

--------------------------------

### Unleash Ingress Configuration (YAML)

Source: https://docs.kindo.ai/installation-and-deployment-guide

Configures Ingress settings for Unleash, including hostname, TLS, and annotations for cert-manager. This allows external access to the Unleash UI via a specified domain.

```yaml
ingress:
  enabled: true
  className: nginx # Match your ingress controller class
  annotations:
    # Use annotations for your cert-manager ClusterIssuer
    cert-manager.io/cluster-issuer: letsencrypt-prod
    # Add any other ingress annotations needed for your environment
    # (e.g., load balancer settings, IP allowlists)
  hosts:
    - host: unleash.yourcompany.com # Replace with your desired hostname
      paths:
        - path: /
          pathType: ImplementationSpecific
  tls:
  - secretName: unleash-tls # cert-manager will create this
    hosts:
      - unleash.yourcompany.com # Replace with your desired hostname
```

--------------------------------

### Application Configuration JSON Structure Example

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Illustrates the expected JSON format for application configurations generated by the system. This includes common settings like database URLs, storage credentials, encryption keys, and environment modes. This structure is essential for ensuring applications can correctly parse and utilize their configurations.

```json
{
  "DATABASE_URL": "postgresql://username:password@hostname:5432/database",
  "REDIS_URL": "redis://username:password@hostname:6379",
  "AWS_ACCESS_KEY": "AKIAIOSFODNN7EXAMPLE",
  "AWS_SECRET_KEY": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "AWS_BUCKET": "kindo-uploads-prod",
  "AWS_REGION": "us-west-2",
  "KEY_ENCRYPTION_KEY": "base64encodedkey",
  "NEXTAUTH_SECRET": "nextauthsecretvalue",
  "UNLEASH_API_KEY": "unleashclienttoken",
  "NODE_ENV": "production"
}
```

--------------------------------

### Terraform: Cerbos Configuration

Source: https://docs.kindo.ai/docs/04-applications-deployment

Sets up the Cerbos policy engine using Helm. The configuration includes enabling installation, specifying the chart version, namespace, and dynamically generating Helm values.

```terraform
# --- Cerbos --- #
cerbos = {
install = var.enable_cerbos
helm_chart_version = var.cerbos_chart_version
namespace = "cerbos"
create_namespace = true # Create namespace automatically
values_content = var.cerbos_values_content != "" ? var.cerbos_values_content : templatefile("${path.module}/values/cerbos.yaml", {
domain_name = local.domain_name
replica_count = var.cerbos_replica_count
environment_name = local.environment
project_name = local.project
})
dynamic_helm_sets = merge({
"replicaCount" = tostring(var.cerbos_replica_count)
}, var.cerbos_helm_sets)
sensitive_helm_sets = merge({
"secretRef.name" = format(local.secret_pattern, local.project, local.environment, "cerbos")
}, var.cerbos_sensitive_helm_sets)
}
}
}

```

--------------------------------

### Install Unleash using Helm Chart

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Installs or upgrades the Unleash application using its Helm chart. It includes adding the Helm repository, updating repositories, and performing the upgrade with a specified values file and namespace. Ensure the correct chart version and values file are used for your environment.

```Bash
helm repo add unleash <https://docs.getunleash.io/helm-charts>
helm repo update

helm upgrade --install unleash unleash/unleash \
  --version 5.4.3 # Use a specific chart version for consistency \
  --namespace unleash \
  --create-namespace \
  -f unleash-values.yaml
```

--------------------------------

### Install Cerbos using Helm Chart

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Installs the Cerbos authorization service using its Helm chart from the Kindo registry. This command specifies the chart source, version, namespace, creation of the namespace if it doesn't exist, and the use of a custom values file for configuration.

```Bash
# Pull is optional but good practice to check availability
# helm pull oci://registry.kindo.ai/kindo-helm/cerbos --version <chart-version>

helm install cerbos oci://registry.kindo.ai/kindo-helm/cerbos \
  --version <specify-chart-version> \
  --namespace cerbos \
  --create-namespace \
  -f cerbos-values.yaml
```

--------------------------------

### Terraform State Management and Plan (Bash)

Source: https://docs.kindo.ai/docs/infra-deployment

Commands for inspecting Terraform state, listing all resources, showing specific resource details, and checking for infrastructure drift. Requires Terraform to be installed and initialized.

```bash
# Check all resources  
terraform state list

# Inspect specific resource  
terraform state show module.kindo_infra.aws_eks_cluster.this

# Check for drift  
terraform plan -var-file="../shared.tfvars" -var-file="terraform.tfvars"
```

--------------------------------

### Example API Environment Template (env)

Source: https://docs.kindo.ai/docs/secrets-management-deployment

An example of an environment template file for the 'api' service. It demonstrates how to use double-brace syntax {{variable}} for placeholders that will be substituted with actual infrastructure outputs and generated secrets.

```env
# Storage Configuration
AWS_ACCESS_KEY={{storage.access_key}}
AWS_BUCKET={{storage.bucket_name}}
AWS_REGION={{storage.region}}
AWS_SECRET_KEY={{storage.secret_key}}

# Database Configuration
DATABASE_URL={{postgres.kindo_db_connection_string}}

# Redis Configuration 
REDIS_URL={{redis.connection_string}}

# Message Queue
RABBITMQ_URL={{rabbitmq.connection_string}}

# Feature Flags
UNLEASH_URL=http://unleash-edge.unleash.svc.cluster.local:3063/api/
UNLEASH_API_KEY={{unleash.client_token}}

# Authentication
NEXTAUTH_SECRET={{secrets.nextauthsecret}}
KEY_ENCRYPTION_KEY={{secrets.kek}}

# Service URLs (internal cluster communication)
LITELLM_URL=http://litellm.litellm.svc.cluster.local:4000/v1
CREDITS_SERVICE_URL=http://credits.credits.svc.cluster.local

# Application Settings
NODE_ENV=production
PORT=8000
```

--------------------------------

### Install Nginx Ingress Controller using Helm

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Installs the Nginx Ingress controller in Kubernetes using Helm. It requires Helm v3.8.0+ and assumes access to the specified Helm repository. The controller manages external access and can be configured with different service types like LoadBalancer.

```Bash
helm repo add ingress-nginx <https://kubernetes.github.io/ingress-nginx>
helm repo update

helm install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx \
  --create-namespace \
  --set controller.service.type=LoadBalancer # Or NodePort/ClusterIP depending on your env
# Add other necessary configurations via --set or a values file
```

--------------------------------

### Configure Next.js Frontend Deployment

Source: https://docs.kindo.ai/docs/04-applications-deployment

Sets up the deployment configuration for the Next.js frontend. This includes enabling installation, specifying the Helm chart version, defining the namespace, and managing values content. It supports both direct value input and template-based generation, along with dynamic and sensitive Helm settings for scaling and secrets.

```Terraform
next = {
install = var.enable_next
helm_chart_version = var.next_chart_version
namespace = "next" # Use dedicated namespace
create_namespace = true # Create namespace automatically
values_content = var.next_values_content != "" ? var.next_values_content : templatefile("${path.module}/values/next.yaml", {
domain_name = local.domain_name
replica_count = var.next_replica_count
environment_name = local.environment
project_name = local.project
})
dynamic_helm_sets = merge({
"replicaCount" = tostring(var.next_replica_count)
}, var.next_helm_sets)
sensitive_helm_sets = merge({
"secretRef.name" = format(local.secret_pattern, local.project, local.environment, "next")
}, var.next_sensitive_helm_sets)
}
```

--------------------------------

### Configure LiteLLM Service Deployment

Source: https://docs.kindo.ai/04-applications-deployment

Configures the LiteLLM service deployment using Terraform, specifying installation status, Helm chart version, and namespace. It handles values content, dynamically sets replica counts, and configures sensitive Helm values for secrets.

```Terraform
litellm = {
 install = var.enable_litellm
 helm_chart_version = var.litellm_chart_version
 namespace = "litellm"
 create_namespace = true # Create namespace automatically
 values_content = var.litellm_values_content != "" ? var.litellm_values_content : templatefile("${path.module}/values/litellm.yaml", {
 domain_name = local.domain_name
 replica_count = var.litellm_replica_count
 environment_name = local.environment
 project_name = local.project
 })
 dynamic_helm_sets = merge({
 "replicaCount" = tostring(var.litellm_replica_count)
 }, var.litellm_helm_sets)
 sensitive_helm_sets = merge({
 "secretRef.name" = format(local.secret_pattern, local.project, local.environment, "litellm")
 }, var.litellm_sensitive_helm_sets)
 }
```

--------------------------------

### Configure LiteLLM Deployment

Source: https://docs.kindo.ai/docs/04-applications-deployment

Configures the LiteLLM service deployment, including its installation status, Helm chart version, and namespace. It allows for custom values to be supplied directly or generated from a template, ensuring proper configuration of replica counts and secret references via dynamic and sensitive Helm sets.

```Terraform
litellm = {
install = var.enable_litellm
helm_chart_version = var.litellm_chart_version
namespace = "litellm"
create_namespace = true # Create namespace automatically
values_content = var.litellm_values_content != "" ? var.litellm_values_content : templatefile("${path.module}/values/litellm.yaml", {
domain_name = local.domain_name
replica_count = var.litellm_replica_count
environment_name = local.environment
project_name = local.project
})
dynamic_helm_sets = merge({
"replicaCount" = tostring(var.litellm_replica_count)
}, var.litellm_helm_sets)
sensitive_helm_sets = merge({
"secretRef.name" = format(local.secret_pattern, local.project, local.environment, "litellm")
}, var.litellm_sensitive_helm_sets)
}
```

--------------------------------

### Configure API Service Deployment

Source: https://docs.kindo.ai/docs/04-applications-deployment

Defines the deployment configuration for the API service. It includes settings for installation, Helm chart version, namespace, and custom values. The values can be provided directly or generated from a template file, incorporating dynamic and sensitive Helm settings for replica counts and secret references.

```Terraform
api = {
install = var.enable_api
helm_chart_version = var.api_chart_version
namespace = "api" # Use dedicated namespace for each application
create_namespace = true # Create namespace automatically
values_content = var.api_values_content != "" ? var.api_values_content : templatefile("${path.module}/values/api.yaml", {
domain_name = local.domain_name
replica_count = var.api_replica_count
environment_name = local.environment
project_name = local.project
})
dynamic_helm_sets = merge({
"replicaCount" = tostring(var.api_replica_count)
}, var.api_helm_sets)
sensitive_helm_sets = merge({
"secretRef.name" = format(local.secret_pattern, local.project, local.environment, "api")
}, var.api_sensitive_helm_sets)
}
```

--------------------------------

### Configure Llama Indexer Deployment

Source: https://docs.kindo.ai/docs/04-applications-deployment

Defines the configuration for the Llama Indexer service. This includes parameters for installation, Helm chart version, and the dedicated namespace. It supports flexible values management through direct input or template files, and configures Helm sets for replica count and secret management.

```Terraform
llama_indexer = {
install = var.enable_llama_indexer
helm_chart_version = var.llama_indexer_chart_version
namespace = "llama-indexer"
create_namespace = true # Create namespace automatically
values_content = var.llama_indexer_values_content != "" ? var.llama_indexer_values_content : templatefile("${path.module}/values/llama-indexer.yaml", {
domain_name = local.domain_name
replica_count = var.llama_indexer_replica_count
environment_name = local.environment
project_name = local.project
})
dynamic_helm_sets = merge({
"replicaCount" = tostring(var.llama_indexer_replica_count)
}, var.llama_indexer_helm_sets)
sensitive_helm_sets = merge({
"secretRef.name" = format(local.secret_pattern, local.project, local.environment, "llama-indexer")
}, var.llama_indexer_sensitive_helm_sets)
}
```

--------------------------------

### Initialize and Apply Terraform Configuration

Source: https://docs.kindo.ai/docs360-terraform-installation

These commands demonstrate the standard Terraform workflow for initializing a project, planning changes, and applying them to create or update infrastructure. This includes running `terraform init`, `terraform plan`, and `terraform apply`.

```Bash
terraform init
terraform plan -out=secrets.tfplan
terraform apply secrets.tfplan
```

--------------------------------

### Clone Presidio Repository and Prepare Helm Chart

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Clones the Presidio GitHub repository to access its Helm chart samples. It then copies the relevant chart files locally to `./presidio-helm` for customization and installation. This step is necessary to prepare the Presidio deployment using Helm.

```Bash
# Clone the Presidio repository (needed for the Helm chart source)
git clone <https://github.com/microsoft/presidio.git>

# Copy the chart locally (adjust path if structure changed)
cp -rp presidio/docs/samples/deployments/k8s/charts/presidio ./presidio-helm
```

--------------------------------

### Create ExternalSecret for Kindo Services (YAML)

Source: https://docs.kindo.ai/installation-and-deployment-guide

Defines an ExternalSecret resource, which instructs the External Secrets Operator (ESO) to fetch secrets from an external backend (like Vault or AWS Secrets Manager) and create a Kubernetes Secret. This example shows a generic template that needs customization for each Kindo service, including namespace, secret names, and the key/path in the external backend.

```yaml
# api-external-secret.yaml (Example for 'api' service)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata: 
  name: api-env-secret # Name of the K8s secret to create
  namespace: api # Namespace where the service will run
spec:
  refreshInterval: "1h" # How often to check for updates
  secretStoreRef:
    name: my-secret-backend # Must match the name of your SecretStore/ClusterSecretStore
    kind: ClusterSecretStore # Or SecretStore
  target:
    name: api-env-secret # K8s secret name - must match metadata.name
    creationPolicy: Owner
    template:
      type: Opaque
      # Optional: engineVersion: v2 # for Vault KV v2
      # Optional: metadata:
      # 					 labels/annotations for the k8s secret
  dataFrom:
  - extract:
    	 key: path/to/your/api/secret/in/backend # The key/path in your backend (e.g., kindo/api/env)
    	 # Optional: conversionStrategy: Default # Use 'Unicode' if backend stores plain text
    	 # Optional: decodingStrategy: None # Use 'Base64' if backend stores base64
```

--------------------------------

### Initialize and Apply Terraform Configuration

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

This section covers the essential Terraform commands to initialize the project, create an execution plan, and apply the infrastructure configuration. The deployment process can take a significant amount of time, and progress can be monitored in the terminal.

```bash
terraform init
terraform plan -out=infra.tfplan
terraform apply infra.tfplan
```

--------------------------------

### Terraform Initialization and Validation

Source: https://docs.kindo.ai/04-applications-deployment

Commands to initialize Terraform providers and validate the configuration syntax. These are the first steps in the Terraform deployment process.

```bash
terraform init

terraform validate
```

--------------------------------

### Install External Secrets Operator (ESO) with Helm

Source: https://docs.kindo.ai/installation-and-deployment-guide

Installs the External Secrets Operator (ESO) using Helm. ESO synchronizes secrets from external secret management systems into native Kubernetes Secrets. This requires Helm and the External Secrets Helm repository. The command creates the operator in the `external-secrets` namespace.

```bash
helm repo add external-secrets https://charts.external-secrets.io
helm repo update

helm install external-secrets external-secrets/external-secrets \
  -n external-secrets \
  --create-namespace
# Use --version if a specific version is required
```

--------------------------------

### Override Configuration Values Example (Python/Terraform)

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Demonstrates how to override specific configuration values for 'api' and 'next' applications using a dictionary structure. This is useful for environment-specific settings or temporary adjustments. The example shows overriding 'LOG_LEVEL', 'NODE_ENV', and 'NEXT_PUBLIC_FEATURE_FLAG'.

```python
override_values = {
    "api": {
        "LOG_LEVEL": "debug",
        "NODE_ENV": "production"
    },
    "next": {
        "NEXT_PUBLIC_FEATURE_FLAG": "true"
    }
}
```

```terraform
override_values = {
  api = {
    "LOG_LEVEL" = "debug"
    "NODE_ENV" = "production"
  },
  next = {
    "NEXT_PUBLIC_FEATURE_FLAG" = "true"
  }
}
```

--------------------------------

### Login to Kindo Helm Registry

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Logs into the Kindo Helm registry using the `helm registry login` command. This is a prerequisite for pulling or installing Helm charts from the private Kindo registry. You will be prompted for your username and password/token.

```Bash
# You will be prompted for username and password/token
helm registry login registry.kindo.ai
```

--------------------------------

### Login to Kindo Helm Registry

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Logs into the private OCI registry for Kindo Helm charts. This is a prerequisite for pulling and deploying charts.

```bash
helm registry login registry.kindo.ai
```

--------------------------------

### Apply Kubernetes Registry Secret (Bash)

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

These bash commands demonstrate how to create a Kubernetes namespace if it doesn't exist and then apply the `kindo-registry-secret.yaml` manifest to that namespace. This process should be repeated for every namespace where a Kindo service will be deployed.

```bash
kubectl create namespace api # Example
kubectl apply -f kindo-registry-secret.yaml -n api

kubectl create namespace litellm # Example
kubectl apply -f kindo-registry-secret.yaml -n litellm

# Repeat for all required namespaces...
```

--------------------------------

### Verify EKS Cluster Access (Bash)

Source: https://docs.kindo.ai/docs/infra-deployment

Commands to update kubeconfig and verify access to the EKS cluster. Requires AWS CLI and kubectl to be installed and configured.

```bash
# Update kubeconfig  
aws eks update-kubeconfig --name $(terraform output -raw cluster_name) --region $(terraform output -raw aws_region) --profile $(terraform output -raw aws_profile)

# Verify cluster access  
kubectl get nodes  
kubectl get namespaces
```

--------------------------------

### Terraform EKS Cluster Customization Variables

Source: https://docs.kindo.ai/docs360-terraform-installation

Example Terraform variables for customizing EKS cluster settings, including Kubernetes version and API endpoint access.

```hcl
cluster_version = "1.29"
cluster_endpoint_public_access = false
cluster_endpoint_private_access = true
```

--------------------------------

### Ingress Configuration for ALB

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Example ingress configuration snippet for applications, utilizing the ALB Ingress Controller. It specifies TLS settings, annotations for ALB integration, and health check paths.

```yaml
# Example from values/api.yaml
ingress:
  defaults:
    tls: true
    tlsSecretName: ""
  annotations:
    kubernetes.io/ingress.class: "alb"
    alb.ingress.kubernetes.io/target-type: "ip"
    alb.ingress.kubernetes.io/healthcheck-path: /healthcheck
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS-1-2-2017-01
```

--------------------------------

### List Certificates and Certificate Requests

Source: https://docs.kindo.ai/docs/03-peripheries-deployment

Commands to list all certificates and certificate requests managed by cert-manager across all namespaces.

```bash
kubectl get certificates -A
kubectl get certificaterequests -A
```

--------------------------------

### Terraform Outputs for Peripheries Components

Source: https://docs.kindo.ai/docs/03-peripheries-deployment

These Terraform outputs provide information about the deployed periphery components, including their installation status and enabled features like ExternalDNS and OpenTelemetry Collector.

```terraform
output "peripheries_components" {
 description = "List of deployed periphery components"
 value = {
 alb_ingress_installed = true
 cert_manager_installed = true
 external_secrets_operator_installed = true
 unleash_installed = true
 unleash_edge_installed = true
 presidio_installed = true
 external_dns_enabled = var.enable_external_dns
 otel_collector_enabled = var.enable_otel_collector_cr
 }
}

output "unleash_credentials" {
 description = "Unleash admin credentials"
 value = {
 username = "admin"
 password = local.unleash_admin_password
 url = "https://unleash.${local.domain_name}"
 }
 sensitive = true
}

output "unleash_tokens" {
 description = "Unleash tokens for different applications"
 value = {
 admin_token = local.unleash_admin_token
 client_token = local.unleash_client_token
 frontend_token = local.unleash_frontend_token
 }
 sensitive = true
}

```

--------------------------------

### External Secrets Operator Configuration

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Example configuration snippet for the External Secrets Operator, demonstrating how to enable secret retrieval from AWS Secrets Manager and mount it as a Kubernetes Secret for application environment variables.

```yaml
# Example from values/api.yaml
externalSecrets:
  enabled: true
  secretStoreName: "aws-secrets-manager"
  secretStoreKind: "ClusterSecretStore"
  refreshInterval: "30s"
  secretKey: "${project_name}-${environment_name}/api-app-config"
  name: "api-env"
  targetName: "api-env"
```

--------------------------------

### Monitor Application Logs with Kubectl

Source: https://docs.kindo.ai/docs/04-applications-deployment

Shows how to retrieve logs for API and frontend applications using `kubectl logs`. It specifies the namespace, label selector, and the number of recent lines to display.

```bash
# API logs
kubectl logs -n api -l app.kubernetes.io/name=api --tail=50

# Frontend logs
kubectl logs -n next -l app.kubernetes.io/name=next --tail=50
```

--------------------------------

### Terraform: Audit Log Exporter Configuration

Source: https://docs.kindo.ai/docs/04-applications-deployment

Configures the audit log exporter service using Helm. It includes settings for installation, chart version, namespace, and customizes Helm values through variables and templates.

```terraform
# --- Audit Log Exporter --- #
audit_log_exporter = {
install = var.enable_audit_log_exporter
helm_chart_version = var.audit_log_exporter_chart_version
namespace = "audit-log-exporter"
create_namespace = true # Create namespace automatically
values_content = var.audit_log_exporter_values_content != "" ? var.audit_log_exporter_values_content : templatefile("${path.module}/values/audit-log-exporter.yaml", {
domain_name = local.domain_name
replica_count = var.audit_log_exporter_replica_count
environment_name = local.environment
project_name = local.project
})
dynamic_helm_sets = merge({
"replicaCount" = tostring(var.audit_log_exporter_replica_count)
}, var.audit_log_exporter_helm_sets)
sensitive_helm_sets = merge({
"secretRef.name" = format(local.secret_pattern, local.project, local.environment, "audit-log-exporter")
}, var.audit_log_exporter_sensitive_helm_sets)
}
```

--------------------------------

### Kubernetes CLI: Get Current Context

Source: https://docs.kindo.ai/docs360-terraform-installation

This command retrieves the currently active Kubernetes context from the kubectl configuration. This is often used to automate setting the correct context for tools like Terraform.

```bash
kubectl config current-context
```

--------------------------------

### Deploy Kindo Applications Module

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Defines the deployment of Kindo applications using a Terraform module. It includes basic configuration, Kubernetes connection details, Helm registry credentials, and enables specific Kindo services.

```terraform
module "kindo_applications" {
  source = "path/to/kindo-applications"

  # Basic configuration
  project = var.project
  environment = var.environment
  domain = "your-domain.com"

  # Kubernetes configuration
  kubernetes_host = "<your Kubernetes API endpoint>"
  kubernetes_token = "<your Kubernetes token>" # Optional
  kubernetes_cluster_ca_certificate = var.cluster_ca_cert

  # Helm registry access
  registry_username = var.kindo_registry_username
  registry_password = var.kindo_registry_password

  # Application configuration
  api_enabled = true
  next_enabled = true
  litellm_enabled = true
  llama_indexer_enabled = true
  credits_enabled = true
  external_sync_enabled = true
  external_poller_enabled = true
  audit_log_exporter_enabled = true
  cerbos_enabled = true

  # Helm values - either files or direct content
  api_values_content = file("${path.module}/values/api.yaml")
  next_values_content = file("${path.module}/values/next.yaml")

  # Reference to secrets created by External Secrets Operator
  api_secret_ref_name = "api-config"
  next_secret_ref_name = "next-config"
}
```

--------------------------------

### Shell Commands for Kindo Deployment Initialization

Source: https://docs.kindo.ai/docs360-terraform-installation

These shell commands are used to initialize a new directory for Kindo deployment and manage local Terraform module references. The first command creates and navigates into a new directory, while the subsequent commands show how to either copy or create symbolic links for local Terraform modules.

```shell
# Create a new directory for your Kindo deployment:
mkdir kindo-deployment && cd kindo-deployment

# Organize local module paths:
# Create a modules directory or use symbolic links
mkdir -p modules
cp -r /path/to/payload/modules/kindo-infra modules/
# or
ln -s /path/to/payload/modules/kindo-infra modules/
```

--------------------------------

### Terraform: External Poller Configuration

Source: https://docs.kindo.ai/docs/04-applications-deployment

Configures the external poller service using Helm. It specifies installation status, chart version, namespace, and dynamically generates Helm values based on input variables and templates.

```terraform
external_poller = {
install = var.enable_external_poller
helm_chart_version = var.external_poller_chart_version
namespace = "external-poller"
create_namespace = true # Create namespace automatically
values_content = var.external_poller_values_content != "" ? var.external_poller_values_content : templatefile("${path.module}/values/external-poller.yaml", {
domain_name = local.domain_name
replica_count = var.external_poller_replica_count
environment_name = local.environment
project_name = local.project
})
dynamic_helm_sets = merge({
"replicaCount" = tostring(var.external_poller_replica_count)
}, var.external_poller_helm_sets)
sensitive_helm_sets = merge({
"secretRef.name" = format(local.secret_pattern, local.project, local.environment, "external-poller")
}, var.external_poller_sensitive_helm_sets)
}
```

--------------------------------

### Terraform Configuration for Kindo Applications

Source: https://docs.kindo.ai/docs/04-applications-deployment

Terraform configuration file (main.tf) defining required providers (AWS, Helm, Kubectl, Time), version constraints, and local variables. It also includes a commented-out backend configuration for S3 state storage.

```hcl
terraform {
required_version = ">= 1.11.0"

required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
helm = {
source = "hashicorp/helm"
version = "2.17.0"
}
kubectl = {
source = "gavinbunney/kubectl"
version = ">= 1.14.0"
}
time = {
source = "hashicorp/time"
version = ">= 0.9.0"
}
}

# Configure your state backend - Optional
# For production, uncomment and configure the S3 backend:
# backend "s3" {
# bucket = "my-terraform-state-bucket"
# key = "kindo/applications/terraform.tfstate"
# region = "us-east-1"
# 
# dynamodb_table = "terraform-state-lock"
# encrypt = true
# }
}

locals {
# Core application settings
project = var.project_name
environment = var.environment_name
domain_name = var.domain_name

# Secret naming pattern (for External Secrets Operator)
secret_pattern = "%s-%s/%s-app-config"
}

# Deploy Kindo Applications
module "kindo_applications" {
source = "../../modules/kindo-applications" # Adjust path as needed

# Don't wait for resources to be healthy
helm_wait = false
helm_atomic = false

# Helm registry credentials (from shared.tfvars)
registry_url = var.registry_url
registry_username = var.registry_username
registry_password = var.registry_password

# Application configurations
applications_config = {

```

--------------------------------

### Create Kubernetes Image Pull Secret (YAML)

Source: https://docs.kindo.ai/installation-and-deployment-guide

Defines a Kubernetes Secret of type 'kubernetes.io/dockerconfigjson' used for pulling images from a private registry. Placeholders for registry URL and credentials need to be replaced.

```yaml
# Replace placeholders with your Kindo registry URL and credentials.
# Example structure (actual content will vary based on registry and credentials):
# apiVersion: v1
# kind: Secret
# metadata:
#   name: kindo-registry-secret
#   namespace: <your-namespace>
# type: kubernetes.io/dockerconfigjson
# data:
#   .dockerconfigjson: <base64-encoded-json-string>
```

--------------------------------

### Troubleshoot Ingress or Network Issues

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Guides on diagnosing and fixing issues related to Kubernetes ingress and network accessibility. It includes checking ingress configuration, ALB controller logs, and load balancer target group health.

```bash
# Check the ingress configuration
kubectl describe ingress -n <namespace> <name>
# Check the ALB Ingress Controller logs
kubectl logs -n kube-system deployment/aws-load-balancer-controller
# Check the load balancer's target groups
aws elbv2 describe-target-groups --region <region>
aws elbv2 describe-target-health --target-group-arn <target-group-arn> --region <region>
```

--------------------------------

### Prisma Database Migration Deployment

Source: https://docs.kindo.ai/docs/04-applications-deployment

Executes database migrations using Prisma for the API deployment. This command ensures the database schema is up-to-date with the application requirements.

```bash
kubectl exec -n api deployment/api -- npx prisma migrate deploy --schema /app/backend/api/node_modules/.prisma/client/schema.prisma
```

--------------------------------

### Troubleshoot Ingress Problems with kubectl

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Kubernetes commands to troubleshoot ingress controller issues. Employs `kubectl get ingress` to list ingresses and `kubectl describe ingress` to examine the configuration and status of a specific ingress resource.

```bash
kubectl get ingress -A
kubectl describe ingress -n kindo <ingress-name>
```

--------------------------------

### Terraform Initialization and Provider Verification

Source: https://docs.kindo.ai/infra-deployment

Commands to initialize the Terraform project and verify the installed providers. `terraform init` downloads necessary plugins, and `terraform providers` lists the configured providers for the current project.

```Bash
# Initialize Terraform
terraform init

# Verify providers
terraform version
terraform providers
```

--------------------------------

### Troubleshoot External Secrets Issues with kubectl

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Kubernetes commands for diagnosing issues with external secrets. Uses `kubectl get externalsecret` to list all external secrets and `kubectl describe externalsecret` to inspect a specific external secret.

```bash
kubectl get externalsecret -A
kubectl describe externalsecret -n kindo <externalsecret-name>
```

--------------------------------

### Terraform Plan Deployment

Source: https://docs.kindo.ai/docs/04-applications-deployment

Generates a Terraform execution plan, specifying the configuration files to use. It's crucial to review the plan for namespace creation, secret references, ingress configuration, and resource allocations before applying.

```bash
# Plan with all configuration files
terraform plan -var-file="../../shared.tfvars" -var-file="terraform.tfvars"

# Review the plan carefully:
# - Check namespace creation
# - Verify secret references
# - Confirm ingress configuration
# - Review resource allocations
```

--------------------------------

### Terraform Configuration for PostgreSQL RDS Instance

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

Example Terraform variable assignments for customizing a PostgreSQL RDS instance. This includes settings for instance class, allocated storage, multi-AZ deployment, deletion protection, and backup retention period.

```hcl
postgres_instance_class = "db.t3.medium"
postgres_allocated_storage = 50
postgres_multi_az = true
postgres_deletion_protection = true
postgres_backup_retention_period = 14
```

--------------------------------

### Update Terraform TFvars for API Keys

Source: https://docs.kindo.ai/docs/docs360-terraform-installation

This example shows how to update the `terraform.tfvars` file to include the external API keys. It provides placeholders for sensitive information and notes the security implications of storing keys directly in the file for production environments.

```HCL
# API Keys
anthropic_api_key = "your-anthropic-api-key"
openai_api_key = "your-openai-api-key"
merge_api_key = "" # Optional, leave empty if not used
merge_webhook_security = "" # Optional, leave empty if not used
```

--------------------------------

### Configure Credits Service Deployment

Source: https://docs.kindo.ai/04-applications-deployment

Defines the Terraform configuration for the Credits service, controlling its installation, Helm chart version, and namespace. It supports custom or templated values and manages dynamic and sensitive Helm set values.

```Terraform
credits = {
 install = var.enable_credits
 helm_chart_version = var.credits_chart_version
 namespace = "credits"
 create_namespace = true # Create namespace automatically
 values_content = var.credits_values_content != "" ? var.credits_values_content : templatefile("${path.module}/values/credits.yaml", {
 domain_name = local.domain_name
 replica_count = var.credits_replica_count
 environment_name = local.environment
 project_name = local.project
 })
 dynamic_helm_sets = merge({
 "replicaCount" = tostring(var.credits_replica_count)
 }, var.credits_helm_sets)
 sensitive_helm_sets = merge({
 "secretRef.name" = format(local.secret_pattern, local.project, local.environment, "credits")
 }, var.credits_sensitive_helm_sets)
 }
```

--------------------------------

### Apply ClusterIssuer configuration

Source: https://docs.kindo.ai/docs/installation-and-deployment-guide

Applies the ClusterIssuer configuration defined in the 'letsencrypt-issuer.yaml' file to the Kubernetes cluster using kubectl.

```Bash
kubectl apply -f letsencrypt-issuer.yaml
```

--------------------------------

### External Secrets Operator Values Configuration

Source: https://docs.kindo.ai/docs/03-peripheries-deployment

This YAML configuration template for the External Secrets Operator sets up the necessary parameters for its deployment, including CRD installation, service account creation with an IAM role ARN, and webhook port.

```yaml
# Template receives role_arn variable
installCRDs: true

serviceAccount:
 create: true
 name: external-secrets
 annotations:
 eks.amazonaws.com/role-arn: "${role_arn}"

webhook:
 port: 9443

certController:
 create: true

```