Deploying Genesis - Kubernetes on AWS

# Option A: Pull and unpack the OCI chart locally
helm pull oci://registry-1.docker.io/genesiscomputingai/genesis --version <chart-version> --untar

# Option B: Extract the Helm chart archive provided by Genesis
tar -xzf genesis-<version>.tgz

# Navigate to the chart directory
cd genesis

# Genesis EKS Deployment Values

# Container image (Genesis will provide the repository URL)
image:
  repository: <container-registry-url>/genesis  # Replace with URL provided by Genesis
  tag: v1.18.2  # Example GA pin; use the version provided by Genesis
  pullPolicy: IfNotPresent

# Genesis EKS helper scripts enable ECR and inject the registry/token at deploy time
ecr:
  enabled: true
  registry: ""

# Image pull secrets (if the container registry requires authentication)
# Genesis will provide instructions if credentials are needed
# imagePullSecrets:
#   - name: genesis-registry-credentials

# Secrets
secrets:
  # Master encryption key (REQUIRED on first install unless
  # existingSecretGenesisMasterKey or config.extraEnv.GENESIS_MASTER_KEY_REF)
  genesisMasterKey: ""  # Generate: python -c "import secrets; print(secrets.token_hex(32))"

# Non-sensitive configuration
config:
  sqliteDbPath: "/app/.genesis/db/genesis.db"
  logLevel: "INFO"
  logsFormat: "json"
  authEnabled: "true"
  authProvider: "proxy"  # For ingress-based authentication
  
  # Standard AWS SDK region for the pod. The LLM provider is configured
  # after install through the config API, not here.
  extraEnv:
    AWS_REGION: "us-east-1"
    AWS_DEFAULT_REGION: "us-east-1"

# Recommended for IaC-managed Genesis settings
genesisConfig:
  content: ""  # Set with --set-file genesisConfig.content=genesis-config.yaml
  existingConfigMap: ""  # Or reference a pre-created ConfigMap, not both

# Resource requests
resources:
  requests:
    cpu: "2000m"
    memory: "6Gi"
  limits: {}  # No limits by default

# Optional Vertical Pod Autoscaler (VPA)
vpa:
  enabled: false
  updateMode: "Off"  # "Off", "Initial", or "Auto"
  controlledResources:
    - cpu
    - memory
  minAllowed:
    cpu: "500m"
    memory: "2Gi"
  maxAllowed:
    cpu: "8000m"
    memory: "32Gi"

# Persistent storage
persistence:
  storageClassName: ""  # Uses cluster default (gp2/gp3)
  size: 50Gi  # Kubernetes uses binary units (Gi = Gibibytes)
  accessMode: ReadWriteOnce

# Service configuration
service:
  type: ClusterIP
  ports:
    fastapi: 8080
    flask: 8082
    streamlit: 8501

# Ingress configuration
ingress:
  enabled: true
  className: "alb"  # For AWS Load Balancer Controller, or "nginx" for NGINX
  
  # For AWS Load Balancer Controller
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
    alb.ingress.kubernetes.io/ssl-redirect: "443"
    alb.ingress.kubernetes.io/healthcheck-path: "/api/health"
    alb.ingress.kubernetes.io/healthcheck-protocol: "HTTP"
    alb.ingress.kubernetes.io/healthcheck-port: "8080"
    # For HTTPS, add certificate ARN:
    # alb.ingress.kubernetes.io/certificate-arn: "arn:aws:acm:region:account:certificate/cert-id"
  
  hosts:
    - host: genesis.yourdomain.com  # Replace with your domain
      paths:
        - path: /
          pathType: Prefix
          port: 8080
  
  # TLS configuration (if using HTTPS)
  tls: []

# Optional: agent sandbox execution in Kubernetes pods
sandbox:
  enabled: true
  defaultBackend: "eks"

# Optional extra Kubernetes resources rendered as separate YAML documents
extraManifests: []

# Install using Helm
helm install genesis ./genesis -f genesis-values.yaml

# Or if deploying from chart directory
helm install genesis . -f genesis-values.yaml

# Check namespace
kubectl get namespace genesis

# Check StatefulSet
kubectl get statefulset -n genesis

# Check pod status
kubectl get pods -n genesis -w

# Check persistent volume claim
kubectl get pvc -n genesis

# Check service
kubectl get svc -n genesis

# Check ingress
kubectl get ingress -n genesis

# View pod logs
kubectl logs -n genesis genesis-0 --follow

umask 077
set -o pipefail   # json.tool must not mask a failed curl
GENESIS_URL=https://genesis.yourdomain.com
BODY=$(mktemp "${TMPDIR:-/tmp}/genesis-llm-body.XXXXXX.json")
CURL_CONFIG=$(mktemp "${TMPDIR:-/tmp}/genesis-curl.XXXXXX")
trap 'rm -f "$BODY" "$CURL_CONFIG"' EXIT
chmod 600 "$BODY" "$CURL_CONFIG"

# With authEnabled: "true", every call needs a bearer token for a user holding
# access_config_panel. read -rs keeps it out of shell history. Drop these lines
# and --config only on an auth-disabled pod.
read -rsp 'Genesis access token: ' GENESIS_TOKEN && echo
printf 'header = "Authorization: Bearer %s"\n' "$GENESIS_TOKEN" > "$CURL_CONFIG"
unset GENESIS_TOKEN

# IRSA deployments use "auth_mode": "iam_role" and omit aws_bearer_token.
cat > "$BODY" <<'JSON'
{"provider": "bedrock",
 "auth_mode": "api_key",
 "endpoint_mode": "default",
 "aws_bearer_token": "<aws-bearer-token-bedrock>",
 "aws_region": "us-east-1",
 "aws_account_id": "<aws-account-id>",
 "test_connection": true}
JSON
curl -sS --fail-with-body --config "$CURL_CONFIG" \
  -X POST -H 'Content-Type: application/json' --data @"$BODY" \
  "$GENESIS_URL/api/config/llm-providers/other" | python3 -m json.tool

curl -sS --fail-with-body --config "$CURL_CONFIG" \
  -X POST -H 'Content-Type: application/json' -d '{"force": true}' \
  "$GENESIS_URL/api/config/llm-providers/litellm_bedrock/activate" | python3 -m json.tool

curl -sS --fail-with-body --config "$CURL_CONFIG" \
  -X PUT -H 'Content-Type: application/json' \
  -d '{"provider": "litellm_bedrock", "use_defaults": true, "activate_provider": true}' \
  "$GENESIS_URL/api/config/models/main/assignments" | python3 -m json.tool