# Helm chart for Digital.ai Release Assistant

## Prerequisites

- Kubernetes 1.20+
- Helm 3.2.0+

## Minimal configuration for the K3D cluster

To install the chart with the release name `dai-assistant`:

```shell
helm dependency update .
helm install dai-assistant . -n digitalai --create-namespace
```

On finish of the last command you will see information about helm release.

### Minimal configuration for the AWS cluster

Run helm release `dai-assistant` installation with creation of the namespace:
```shell
helm dependency update .
helm install dai-assistant . -n digitalai --create-namespace
```

On finish of the last command you will see information about helm release.

### Minimal configuration for the OpenShift cluster (AWS)

Run helm release `dai-assistant` installation with creation of the namespace:
```shell
helm dependency update .
helm install dai-assistant . -n digitalai --create-namespace
```

On finish of the last command you will see information about helm release.

## Uninstalling the Chart

To uninstall/delete the `dai-assistant` release:

```shell
helm delete dai-assistant -n digitalai
```
The command removes all the Kubernetes components associated with the chart and deletes the release.

To delete all resources with one command (if in the namespace is only release-assistant installed) you can delete namespace with:
```shell
kubectl delete namespace digitalai
```

### Basic Configuration Example

```yaml
ingress:
  enabled: true
  hostname: "ingress hostname, e.g. release-assistant.local"
  tls:
    enabled: true
  ingressClassName: "ingress class name, e.g. nginx"
config:
  appName: "application_name"
  appEnv: "staging"
  release:
    baseUrl: "url_to_release_server"
  releaseMcp:
    serverUrl: "url_to_release_mcp_server"
  oidc:
    issuer: "Issuer URL for the OAuth provider, e.g. https://identity.staging.digital.ai/auth/realms/company"
    jwksUrl: "JWKS URL for the OAuth provider, e.g. https://identity.staging.digital.ai/auth/realms/company/protocol/openid-connect/certs"
    clientId: "client_id_for_oidc"
    clientSecret:
      valueFrom:
        secretKeyRef:
          name: release-assistant-secret
          key: oidcClientSecret
  db:
    urlSuffix: "url_suffix_for_db_connection, e.g. postgresql://postgres:5432/dai_assistant"
    username:
      valueFrom:
        secretKeyRef:
          name: release-assistant-secret
          key: dbUsername
    password:
      valueFrom:
        secretKeyRef:
          name: release-assistant-secret
          key: dbPassword
  aiLlm:
    baseUrl: "url_to_ai_llm, e.g. https://api.openai.com"
    model: "model_name_for_ai_llm"
  release-mcp-helm-chart:
    config:
      appName: "application_name"
      release:
        baseUrl: "url_to_release_server"
        authType: "bearer_token"
      mcp:
        environment: "staging"
      oauth:
        enabled: true
        issuer: "Issuer URL for the OAuth provider, e.g. https://identity.staging.digital.ai/auth/realms/company"
        jwksUrl: "JWKS URL for the OAuth provider, e.g. https://identity.staging.digital.ai/auth/realms/company/protocol/openid-connect/certs"
        audience: "OAuth audience for token validation, e.g. dai-release-mcp"
        usernameClaim: "OAuth claim to use for username, e.g. preferred_username"
```

## Parameters

### Global parameters

| Name                      | Description                                   | Value |
| ------------------------- | --------------------------------------------- | ----- |
| `global.imageRegistry`    | Global Docker image registry override         | `""`  |
| `global.imagePullSecrets` | Global Docker image pull secrets              | `[]`  |
| `global.storageClass`     | Global Storage Class for dynamic provisioning | `""`  |

### Release Assistant configuration parameters

| Name                                                | Description                                                                                                              | Value                                        |
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------- |
| `replicaCount`                                      | Number of deployment replicas                                                                                            | `1`                                          |
| `image.registry`                                    | Docker image registry                                                                                                    | `docker.io`                                  |
| `image.repository`                                  | Docker image repository                                                                                                  | `xebialabsearlyaccess/dai-release-assistant` |
| `image.tag`                                         | Docker image tag                                                                                                         | `{{ .Chart.AppVersion }}`                    |
| `image.pullPolicy`                                  | Docker image pull policy                                                                                                 | `IfNotPresent`                               |
| `commonLabels`                                      | Labels to add to all deployed resources                                                                                  | `{}`                                         |
| `commonAnnotations`                                 | Annotations to add to all deployed resources                                                                             | `{}`                                         |
| `deploymentLabels`                                  | Labels to add to the deployment                                                                                          | `{}`                                         |
| `deploymentAnnotations`                             | Annotations to add to the deployment                                                                                     | `{}`                                         |
| `podLabels`                                         | Labels to add to the pod                                                                                                 | `{}`                                         |
| `podAnnotations`                                    | Annotations to add to the pod                                                                                            | `{}`                                         |
| `priorityClassName`                                 | Name of the priority class to be used by the deployment                                                                  | `""`                                         |
| `schedulerName`                                     | Use an alternate scheduler, e.g. "stork".                                                                                | `""`                                         |
| `podAffinityPreset`                                 | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`                                      | `""`                                         |
| `podAntiAffinityPreset`                             | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`                                 | `soft`                                       |
| `nodeAffinityPreset.type`                           | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`                                | `""`                                         |
| `nodeAffinityPreset.key`                            | Node label key to match Ignored if `affinity` is set.                                                                    | `""`                                         |
| `nodeAffinityPreset.values`                         | Node label values to match. Ignored if `affinity` is set.                                                                | `[]`                                         |
| `affinity`                                          | Affinity for pod assignment. Evaluated as a template                                                                     | `{}`                                         |
| `nodeSelector`                                      | Node labels for pod assignment. Evaluated as a template                                                                  | `{}`                                         |
| `tolerations`                                       | Tolerations for pod assignment. Evaluated as a template                                                                  | `[]`                                         |
| `topologySpreadConstraints`                         | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]`                                         |
| `podSecurityContext.enabled`                        | Enable Release Assistant pod's Security Context                                                                          | `false`                                      |
| `podSecurityContext.runAsUser`                      | Set Release Assistant pod's Security Context runAsUser                                                                   | `10001`                                      |
| `podSecurityContext.fsGroup`                        | Set Release Assistant pod's Security Context fsGroup                                                                     | `10001`                                      |
| `containerSecurityContext.enabled`                  | Enabled Release Assistant containers' Security Context                                                                   | `true`                                       |
| `containerSecurityContext.runAsNonRoot`             | Set Release Assistant container's Security Context runAsNonRoot                                                          | `false`                                      |
| `containerSecurityContext.allowPrivilegeEscalation` | Set Release Assistant container's Security Context allowPrivilegeEscalation                                              | `false`                                      |
| `containerSecurityContext.readOnlyRootFilesystem`   | Mounts the container's root filesystem as read-only                                                                      | `true`                                       |
| `containerSecurityContext.capabilities`             | Set Release Assistant container's Security Context capabilities                                                          |                                              |
| `containerSecurityContext.seccompProfile`           | Set Release Assistant container's Security Context seccompProfile                                                        |                                              |
| `hostAliases`                                       | Deployment pod host aliases                                                                                              | `[]`                                         |
| `dnsPolicy`                                         | DNS Policy for pod                                                                                                       | `""`                                         |
| `dnsConfig`                                         | DNS Configuration pod                                                                                                    | `{}`                                         |
| `hostNetwork`                                       | Set to true to use host network                                                                                          | `false`                                      |
| `terminationGracePeriodSeconds`                     | Default duration in seconds k8s waits for container to exit before sending kill signal.                                  | `30`                                         |
| `diagnosticMode.enabled`                            | Enable diagnostic mode (all probes will be disabled and the command will be overridden)                                  | `false`                                      |
| `diagnosticMode.command`                            | Command to override all containers in the deployment                                                                     | `["sleep"]`                                  |
| `diagnosticMode.args`                               | Args to override all containers in the deployment                                                                        | `["infinity"]`                               |
| `command`                                           | Override default container command (useful when using custom images)                                                     | `[]`                                         |
| `args`                                              | Override default container args (useful when using custom images)                                                        | `[]`                                         |
| `lifecycleHooks`                                    | Overwrite livecycle for the Release Assistant container(s) to automate configuration before or after startup             | `{}`                                         |
| `extraEnvVars`                                      | Extra environment variables to add to Release Assistant pods                                                             | `[]`                                         |
| `extraEnvVarsCM`                                    | Name of existing ConfigMap containing extra environment variables                                                        | `""`                                         |
| `extraEnvVarsSecret`                                | Name of existing Secret containing extra environment variables (in case of sensitive data)                               | `""`                                         |
| `readinessProbe.enabled`                            | Enable readinessProbe                                                                                                    | `true`                                       |
| `readinessProbe.initialDelaySeconds`                | Initial delay seconds for readinessProbe                                                                                 | `20`                                         |
| `readinessProbe.periodSeconds`                      | Period seconds for readinessProbe                                                                                        | `10`                                         |
| `readinessProbe.timeoutSeconds`                     | Timeout seconds for readinessProbe                                                                                       | `10`                                         |
| `readinessProbe.failureThreshold`                   | Failure threshold for readinessProbe                                                                                     | `5`                                          |
| `readinessProbe.successThreshold`                   | Success threshold for readinessProbe                                                                                     | `1`                                          |
| `livenessProbe.enabled`                             | Enable livenessProbe                                                                                                     | `true`                                       |
| `livenessProbe.initialDelaySeconds`                 | Initial delay seconds for livenessProbe                                                                                  | `10`                                         |
| `livenessProbe.periodSeconds`                       | Period seconds for livenessProbe                                                                                         | `30`                                         |
| `livenessProbe.timeoutSeconds`                      | Timeout seconds for livenessProbe                                                                                        | `10`                                         |
| `livenessProbe.failureThreshold`                    | Failure threshold for livenessProbe                                                                                      | `5`                                          |
| `livenessProbe.successThreshold`                    | Success threshold for livenessProbe                                                                                      | `1`                                          |
| `resources.enabled`                                 | Enable resource requests/limits                                                                                          | `true`                                       |
| `resources.limits.memory`                           | Memory limit                                                                                                             | `2Gi`                                        |
| `resources.requests.memory`                         | Memory request                                                                                                           | `2Gi`                                        |
| `resources.requests.cpu`                            | CPU request                                                                                                              | `250m`                                       |

### Service parameters

| Name                  | Description                                                 | Value       |
| --------------------- | ----------------------------------------------------------- | ----------- |
| `service.type`        | Kubernetes service type (ClusterIP, NodePort, LoadBalancer) | `ClusterIP` |
| `service.port`        | Service port                                                | `8090`      |
| `service.annotations` | Service annotations                                         | `{}`        |
| `service.labels`      | Service labels                                              | `{}`        |

### Ingress parameters

| Name                  | Description            | Value                     |
| --------------------- | ---------------------- | ------------------------- |
| `ingress.enabled`     | Enable ingress         | `false`                   |
| `ingress.hostname`    | Ingress hostname       | `release-assistant.local` |
| `ingress.annotations` | Ingress annotations    | `{}`                      |
| `ingress.tls.enabled` | Enable TLS for ingress | `false`                   |
| `ingress.path`        | Ingress path           | `/`                       |

### Release Assistant application parameters

| Name                                       | Description                                                      | Value                                                                                   |
| ------------------------------------------ | ---------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| `config.existingConfigMap`                 | Name of existing ConfigMap with release-ai-assistant-config.yaml | `""`                                                                                    |
| `config.existingSecret`                    | Name of existing Secret with DB and OpenAI credentials           | `""`                                                                                    |
| `config.appName`                           | Application name                                                 | `dai-release-assistant`                                                                 |
| `config.appEnv`                            | Application environment                                          | `staging`                                                                               |
| `config.release.baseUrl`                   | Digital.ai Release server base URL                               | `http://localhost:5516`                                                                 |
| `config.releaseMcp.serverUrl`              | Release MCP server URL                                           | `""`                                                                                    |
| `config.oidc.issuerUri`                    | OIDC issuer URL                                                  | `https://identity.staging.digital.ai/auth/realms/company`                               |
| `config.oidc.jwkSetUri`                    | OIDC JWKS URL                                                    | `https://identity.staging.digital.ai/auth/realms/company/protocol/openid-connect/certs` |
| `config.oidc.clientId`                     | OIDC client ID                                                   | `nil`                                                                                   |
| `config.oidc.clientSecret`                 | OIDC client secret                                               | `nil`                                                                                   |
| `config.db.urlSuffix`                      | Database URL suffix                                              | `postgresql://postgres:5432/dai_assistant`                                              |
| `config.db.username`                       | Database username                                                | `nil`                                                                                   |
| `config.db.password`                       | Database password                                                | `nil`                                                                                   |
| `config.management.tracingEndpointEnabled` | Enable tracing endpoint in management configuration              | `false`                                                                                 |
| `config.otel.tracingExportEnabled`         | Enable OpenTelemetry tracing export                              | `false`                                                                                 |
| `config.otel.loggingExportEnabled`         | Enable OpenTelemetry logging export                              | `false`                                                                                 |
| `config.otel.metricsExportEnabled`         | Enable OpenTelemetry metrics export                              | `false`                                                                                 |
| `config.otel.tracesEndpoint`               | OpenTelemetry traces endpoint                                    | `http://otel-collector:4318/v1/traces`                                                  |
| `config.otel.metricsEndpoint`              | OpenTelemetry metrics endpoint                                   | `http://otel-collector:4318/v1/metrics`                                                 |
| `config.otel.logsEndpoint`                 | OpenTelemetry logs endpoint                                      | `http://otel-collector:4318/v1/logs`                                                    |
| `config.aiLlm.profile`                     | AI LLM profile name                                              | `llm`                                                                                   |
| `config.aiLlm.baseUrl`                     | AI LLM base URL                                                  | `https://api.openai.com`                                                                |
| `config.aiLlm.chatModel`                   | AI LLM chat model name                                           | `gpt-4o`                                                                                |
| `config.openai.apiKey`                     | OpenAI API key                                                   | `nil`                                                                                   |
| `config.security.auditLogEnabled`          | Enable security audit logging                                    | `false`                                                                                 |

### ServiceAccount parameters

| Name                    | Description                        | Value   |
| ----------------------- | ---------------------------------- | ------- |
| `serviceAccount.create` | Whether to create a ServiceAccount | `false` |
| `serviceAccount.name`   | Name of the ServiceAccount         | `""`    |

### Release MCP subchart parameters

| Name                                                | Description                                       | Value                                                                                   |
| --------------------------------------------------- | ------------------------------------------------- | --------------------------------------------------------------------------------------- |
| `release-mcp-helm-chart.install`                    | Enable installing release-mcp-helm-chart subchart | `false`                                                                                 |
| `release-mcp-helm-chart.config.release.baseUrl`     | Digital.ai Release server base URL                | `http://localhost:5516`                                                                 |
| `release-mcp-helm-chart.config.mcp.environment`     | MCP environment name                              | `staging`                                                                               |
| `release-mcp-helm-chart.config.oauth.enabled`       | Enable OAuth authentication                       | `true`                                                                                  |
| `release-mcp-helm-chart.config.oauth.issuer`        | OAuth issuer URL                                  | `https://identity.staging.digital.ai/auth/realms/company`                               |
| `release-mcp-helm-chart.config.oauth.jwksUrl`       | OAuth JWKS URL for token verification             | `https://identity.staging.digital.ai/auth/realms/company/protocol/openid-connect/certs` |
| `release-mcp-helm-chart.config.oauth.audience`      | OAuth audience for token validation               | `dai-release-mcp`                                                                       |
| `release-mcp-helm-chart.config.oauth.usernameClaim` | OAuth claim to use for username                   | `preferred_username`                                                                    |
