Deploying Genesis - Kuberenetes on Azure

# Option A: Pull and unpack the OCI chart locally
helm pull oci://registry-1.docker.io/genesiscomputingai/genesis --version <chart-version> --untar

# Option B: Extract the Helm chart archive provided by Genesis
tar -xzf genesis-<version>.tgz

# Navigate to the chart directory
cd genesis

# Genesis AKS Deployment Values

# Container image (Genesis will provide the repository URL)
image:
  repository: <container-registry-url>/genesis  # Replace with URL provided by Genesis
  tag: v1.18.2  # Example GA pin; edge bundles use edge
  pullPolicy: IfNotPresent

# Genesis AKS helper scripts enable ECR and inject the registry/token at deploy time
ecr:
  enabled: true
  registry: ""

# Image pull secrets (if the container registry requires authentication)
# Genesis will provide instructions if credentials are needed
# imagePullSecrets:
#   - name: genesis-registry-credentials

# Secrets
secrets:
  # Master encryption key (REQUIRED on first install unless
  # existingSecretGenesisMasterKey or config.extraEnv.GENESIS_MASTER_KEY_REF)
  genesisMasterKey: ""  # Generate: python -c "import secrets; print(secrets.token_hex(32))"

# Non-sensitive configuration
config:
  sqliteDbPath: "/app/.genesis/db/genesis.db"
  logLevel: "INFO"
  logsFormat: "json"
  authEnabled: "true"
  authProvider: "proxy"  # For ingress-based authentication
  
  # The LLM provider is not configured here. Configure it after install
  # through the config API or Config -> AI Providers.

# Recommended for IaC-managed Genesis settings
genesisConfig:
  content: ""  # Set with --set-file genesisConfig.content=genesis-config.yaml
  existingConfigMap: ""  # Or reference a pre-created ConfigMap, not both

# Resource requests
resources:
  requests:
    cpu: "2000m"
    memory: "6Gi"
  limits: {}  # No limits by default

# Persistent storage
persistence:
  storageClassName: ""  # Uses cluster default (managed-csi or managed-premium)
  size: 50Gi  # Kubernetes uses binary units (Gi = Gibibytes)
  accessMode: ReadWriteOnce

# Service configuration
service:
  type: ClusterIP
  ports:
    fastapi: 8080
    flask: 8082
    streamlit: 8501

# Ingress configuration
ingress:
  enabled: true
  className: "azure/application-gateway"  # For Application Gateway, or "nginx" for NGINX
  
  # For Application Gateway Ingress Controller
  annotations:
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    appgw.ingress.kubernetes.io/health-probe-path: "/api/health"
    appgw.ingress.kubernetes.io/health-probe-interval: "30"
    appgw.ingress.kubernetes.io/health-probe-timeout: "10"
    appgw.ingress.kubernetes.io/health-probe-unhealthy-threshold: "3"
    # For HTTPS, configure certificate in Application Gateway
    # appgw.ingress.kubernetes.io/appgw-ssl-certificate: "<certificate-name>"
  
  hosts:
    - host: genesis.yourdomain.com  # Replace with your domain
      paths:
        - path: /
          pathType: Prefix
          port: 8080
  
  # TLS configuration (if using HTTPS)
  tls: []

# Optional extra Kubernetes resources rendered as separate YAML documents
extraManifests: []

# Install using Helm
helm install genesis ./genesis -f genesis-values.yaml

# Or if deploying from chart directory
helm install genesis . -f genesis-values.yaml

# Check namespace
kubectl get namespace genesis

# Check StatefulSet
kubectl get statefulset -n genesis

# Check pod status
kubectl get pods -n genesis -w

# Check persistent volume claim
kubectl get pvc -n genesis

# Check service
kubectl get svc -n genesis

# Check ingress
kubectl get ingress -n genesis

# View pod logs
kubectl logs -n genesis genesis-0 --follow

umask 077
set -o pipefail   # json.tool must not mask a failed curl
GENESIS_URL=https://genesis.yourdomain.com
BODY=$(mktemp "${TMPDIR:-/tmp}/genesis-llm-body.XXXXXX.json")
CURL_CONFIG=$(mktemp "${TMPDIR:-/tmp}/genesis-curl.XXXXXX")
trap 'rm -f "$BODY" "$CURL_CONFIG"' EXIT
chmod 600 "$BODY" "$CURL_CONFIG"

# With authEnabled: "true", every call needs a bearer token for a user holding
# access_config_panel. read -rs keeps it out of shell history. Drop these lines
# and --config only on an auth-disabled pod.
read -rsp 'Genesis access token: ' GENESIS_TOKEN && echo
printf 'header = "Authorization: Bearer %s"\n' "$GENESIS_TOKEN" > "$CURL_CONFIG"
unset GENESIS_TOKEN

cat > "$BODY" <<'JSON'
{"endpoint_name": "genesis-azureopenai-1",
 "api_key": "<azure-openai-api-key>",
 "full_endpoint_url": "https://<resource-name>.openai.azure.com/",
 "api_version": "2025-04-01-preview",
 "model_deployment_name": "<chat-deployment-name>",
 "embedding_deployment_name": "<embedding-deployment-name>",
 "test_connection": true}
JSON
curl -sS --fail-with-body --config "$CURL_CONFIG" \
  -X POST -H 'Content-Type: application/json' --data @"$BODY" \
  "$GENESIS_URL/api/config/llm-providers/azure" | python3 -m json.tool

# Note the two naming spaces: the card is "azure", the llm type is "azureopenai".
curl -sS --fail-with-body --config "$CURL_CONFIG" \
  -X POST -H 'Content-Type: application/json' -d '{"force": true}' \
  "$GENESIS_URL/api/config/llm-providers/azureopenai/activate" | python3 -m json.tool

curl -sS --fail-with-body --config "$CURL_CONFIG" \
  -X PUT -H 'Content-Type: application/json' \
  -d '{"provider": "azureopenai", "use_defaults": true, "activate_provider": true}' \
  "$GENESIS_URL/api/config/models/main/assignments" | python3 -m json.tool

az identity create --resource-group <resource-group> --name genesis-identity

# Get the identity's principal ID
PRINCIPAL_ID=$(az identity show --resource-group <resource-group> --name genesis-identity --query principalId -o tsv)

# Grant "Cognitive Services User" role on Azure OpenAI resource
az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role "Cognitive Services User" \
  --scope /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<azure-openai-resource-name>

az login --identity
az cognitiveservices account keys list \
  --name <azure-openai-resource-name> \
  --resource-group <resource-group> \
  --query key1 -o tsv