Installation Guide

This guide installs the complete Bud platform, the application plus its in-cluster dependencies (PostgreSQL, ClickHouse, Kafka, MongoDB, Valkey, SeaweedFS, Keycloak, Dapr, cert-manager), into an existing Kubernetes cluster using ArgoCD. ArgoCD pulls every chart from the OCI registry (registry.bud.studio/charts), so you do not need access to the source repository. Your configuration lives in a GitOps repo you own. This page contains every file that repo needs, written for an environment called production on bud.example.com.

Already run managed databases (Azure Database for PostgreSQL, Cosmos DB, external Kafka/ClickHouse, etc.) and want a single Helm install instead of in-cluster dependencies? Follow the Deployment Guide, it installs only the bud chart pointed at your external services.

How it works

The config repo has three moving parts:

apps/
└── <environment>.yaml        # bootstrap "app of apps": points ArgoCD at appsets/
appsets/
└── <environment>.yaml        # one ApplicationSet listing every component
values/
└── <component>/
    ├── values.budruntime.yaml       # shared Bud baseline, the same for every environment
    ├── values.<environment>.yaml    # your public overlay: domain, ingress, storage
    └── secrets.<environment>.yaml   # SOPS-encrypted credentials
.sops.yaml                    # age recipients: who can decrypt which secrets files

You apply one object by hand, the bootstrap Application in apps/<environment>.yaml. It syncs appsets/<environment>.yaml, and that ApplicationSet generates one ArgoCD Application per component, named <environment>-<component>.

Components

Component	Namespace	Chart	Version
`argocd`	`argocd`	`registry.bud.studio/charts/argocd`	`0.1.1`
`dapr`	`dapr-system`	`dapr` (upstream `dapr.github.io/helm-charts`)	`1.18.4`
`kafka`	`kafka`	`registry.bud.studio/charts/kafka`	`0.1.1`
`mongodb`	`mongodb`	`registry.bud.studio/charts/mongodb`	`0.1.1`
`cert-manager`	`cert-manager`	`registry.bud.studio/charts/cert-manager`	`0.1.3`
`kyverno`	`kyverno`	`registry.bud.studio/charts/kyverno`	`0.0.2`
`clickhouse`	`clickhouse`	`registry.bud.studio/charts/clickhouse`	`0.1.1`
`postgres`	`postgres`	`registry.bud.studio/charts/postgres`	`0.1.1`
`seaweedfs`	`seaweedfs`	`registry.bud.studio/charts/seaweedfs`	`0.1.2`
`valkey`	`valkey`	`valkey` (upstream `registry-1.docker.io/cloudpirates`)	`0.21.4`
`keycloak`	`keycloak`	`registry.bud.studio/charts/keycloak`	`0.2.1`
`bud`	`bud`	`registry.bud.studio/charts/bud` (the platform)	`1.3.0`
`opensandbox`	`opensandbox-system`	`registry.bud.studio/charts/opensandbox`	`0.0.1`

ArgoCD manages itself as the argocd component, so after the bootstrap the ArgoCD install is upgraded the same way as everything else.

How value files are layered

Each generated Application joins two sources: the OCI chart, and your Git repo mounted as $values for the value files (the templatePatch at the bottom of the ApplicationSet). Each component lists its value files in order; later files win. For example, postgres:

- name: postgres
  namespace: postgres
  repoURL: registry.bud.studio/charts
  chart: postgres
  targetRevision: "0.1.1"
  valueFiles:
    - "example.minimal.yaml"                                  # inside the chart
    - "$values/values/postgres/values.budruntime.yaml"        # shared baseline
    - "$values/values/postgres/values.minimal.budruntime.yaml"
    - "$values/values/postgres/secrets.production.yaml"       # SOPS-encrypted

Paths without $values/ (such as example.minimal.yaml) resolve inside the chart itself: ready-made minimal profiles shipped with each dependency chart.
values.budruntime.yaml, values.yaml and the values.minimal*.yaml profiles are the shared, environment-neutral baseline. Do not edit them per environment.
values.<environment>.yaml is your public overlay.
secrets.<environment>.yaml is SOPS-encrypted.

Secrets stay encrypted in Git. The argocd chart bakes helm-secrets + sops + age into the ArgoCD repo-server, and the age private key is supplied through the chart’s sopsAgeKeys value. ArgoCD therefore decrypts every secrets.<environment>.yaml in-cluster, and nothing is stored in plaintext.

TLS profiles

TLS mode	cert-manager values	Kyverno
Self-signed (this guide)	`values.budruntime.yaml` + `values.selfsigned-ca.yaml`: a `selfsigned-ca` ClusterIssuer is the ingress-shim default, and trust-manager publishes the CA bundle	Included: `values.inject-ca.yaml` injects the CA into Bud pods so services trust each other’s certificates
Imported internal CA	`values.budruntime.yaml` + `values.<environment>.yaml` + `secrets.<environment>.yaml` (the CA key material)	Included
Public ACME	`values.budruntime.yaml` + `values.<environment>.yaml`	Omitted
Terminated upstream (LB/WAF)	cert-manager omitted	Omitted

See Self-signed or internal-CA TLS for how the CA profiles work.

Syncs are manual by default. The ApplicationSet sets syncPolicy.automated.enabled: false (with selfHeal: true), deliberate for production: a Git push never changes a cluster until someone syncs. Flip it to true if you want hands-off reconciliation. Either way, the addon charts install operators (CloudNativePG, Strimzi, Altinity, Percona, …) whose CRDs must exist before the database custom resources apply, so expect a few Applications to show Degraded/Progressing on the first sync and converge on a retry.

Prerequisites

Requirement	Notes
Kubernetes 1.25+	With a `StorageClass` for PVCs
`kubectl`, `helm` 3.8+	Helm must support OCI registries
Ingress controller	This guide uses Traefik (`ingress.className: traefik`); set your class in the overlays
Registry credentials	A read-only robot account for `registry.bud.studio`, used for both chart and image pulls (request one from your Bud Ecosystem contact)
A private Git repo	Holds your configuration; ArgoCD needs read access
`sops`, `age`	Only for the manual path; `budctl` handles encryption itself

Option A, Install with `budctl` (recommended)

budctl generates the repo described in Option B for you: it writes the shared values and your environment’s files, generates coordinated credentials for every component, encrypts each secret file with SOPS, and commits the result to your repo. Run the guided installer:

curl -fsSL https://get.budecosystem.com/install.sh | sh

For a non-interactive preview of what it would generate:

budctl install --plan --no-prompt \
  --repo https://github.com/example-org/bud-foundry-config.git \
  --environment production \
  --domain bud.example.com \
  --ingress-class nginx \
  --storage-class standard \
  --tls self-signed \
  --registry-user robot \
  --registry-password "$BUD_REGISTRY_PASSWORD" \
  --admin-email admin@example.com

For an environment named production, budctl writes:

apps/production.yaml and appsets/production.yaml
values/<component>/values.production.yaml
SOPS-encrypted values/<component>/secrets.production.yaml
a production rule in .sops.yaml

OpenSandbox is included by default. The --tls mode decides whether cert-manager and Kyverno are added (see TLS profiles). Bud Studio is the only optional add-on. Then continue at Verify.

Option B, Install manually

Use this path when you can’t run budctl. You create the repo by hand from the files on this page. Replace production with your environment name, bud.example.com with your domain, and https://github.com/example-org/bud-foundry-config.git with your repo.

Step 1, Create your config repo

helm registry login registry.bud.studio -u 'robot$yourname'
# password prompt, quote the username so the shell does not expand the $

mkdir bud-foundry-config && cd bud-foundry-config
git init -b main
git remote add origin git@github.com:example-org/bud-foundry-config.git   # your private repo
mkdir -p apps appsets values/{argocd,bud,cert-manager,clickhouse,dapr,kafka,keycloak,kyverno,mongodb,opensandbox,postgres,seaweedfs,valkey}

.gitignore, the age key and installer state must stay out of Git:

*.agekey
install-state.age
install-state.age.*
*.pem

Do not add a broad secrets*.yaml ignore rule: the encrypted secret files must be committed, or ArgoCD silently installs without the credentials.

apps/production.yaml is the bootstrap “app of apps”, a single Application that tells ArgoCD to apply your ApplicationSet from Git:

apps/production.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: bootstrap
  namespace: argocd
spec:
  project: default
  source:
    repoURL: "https://github.com/example-org/bud-foundry-config.git"
    targetRevision: "main"
    path: appsets
    directory:
      include: "production.yaml"
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd
  syncPolicy:
    syncOptions:
      - CreateNamespace=true
      - Prune=confirm
    automated:
      enabled: false
      selfHeal: true

appsets/production.yaml lists every component, its chart, version and value files. Drop the kyverno element, and adjust the cert-manager value files, if you are not using a self-signed or internal CA (see TLS profiles).

appsets/production.yaml

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: production
  namespace: argocd
spec:
  goTemplate: true
  goTemplateOptions: ["missingkey=error"]
  generators:
    - list:
        elements:
          - name: argocd
            namespace: argocd
            repoURL: registry.bud.studio/charts
            chart: argocd
            targetRevision: "0.1.1"
            valueFiles:
              - "$values/values/argocd/secrets.production.yaml"
              - "$values/values/argocd/values.budruntime.yaml"
              - "$values/values/argocd/values.production.yaml"
          - name: dapr
            namespace: dapr-system
            repoURL: https://dapr.github.io/helm-charts
            chart: dapr
            targetRevision: "1.18.4"
            valueFiles:
              - "$values/values/dapr/values.yaml"
          - name: kafka
            namespace: kafka
            repoURL: registry.bud.studio/charts
            chart: kafka
            targetRevision: "0.1.1"
            valueFiles:
              - "example.minimal.yaml"
              - "$values/values/kafka/values.budruntime.yaml"
              - "$values/values/kafka/secrets.production.yaml"
          - name: mongodb
            namespace: mongodb
            repoURL: registry.bud.studio/charts
            chart: mongodb
            targetRevision: "0.1.1"
            valueFiles:
              - "example.minimal.yaml"
              - "$values/values/mongodb/values.budruntime.yaml"
              - "$values/values/mongodb/secrets.production.yaml"
          - name: cert-manager
            namespace: cert-manager
            repoURL: registry.bud.studio/charts
            chart: cert-manager
            targetRevision: "0.1.3"
            valueFiles:
              - "$values/values/cert-manager/values.budruntime.yaml"
              - "$values/values/cert-manager/values.selfsigned-ca.yaml"
          - name: kyverno
            namespace: kyverno
            repoURL: registry.bud.studio/charts
            chart: kyverno
            targetRevision: "0.0.2"
            valueFiles:
              - "$values/values/kyverno/values.inject-ca.yaml"
              - "$values/values/kyverno/values.budruntime.yaml"
          - name: clickhouse
            namespace: clickhouse
            repoURL: registry.bud.studio/charts
            chart: clickhouse
            targetRevision: "0.1.1"
            valueFiles:
              - "example.minimal.yaml"
              - "$values/values/clickhouse/values.budruntime.yaml"
              - "$values/values/clickhouse/secrets.production.yaml"
          - name: postgres
            namespace: postgres
            repoURL: registry.bud.studio/charts
            chart: postgres
            targetRevision: "0.1.1"
            valueFiles:
              - "example.minimal.yaml"
              - "$values/values/postgres/values.budruntime.yaml"
              - "$values/values/postgres/values.minimal.budruntime.yaml"
              - "$values/values/postgres/secrets.production.yaml"
          - name: seaweedfs
            namespace: seaweedfs
            repoURL: registry.bud.studio/charts
            chart: seaweedfs
            targetRevision: "0.1.2"
            valueFiles:
              - "example.minimal.yaml"
              - "$values/values/seaweedfs/values.budruntime.yaml"
              - "$values/values/seaweedfs/values.production.yaml"
              - "$values/values/seaweedfs/secrets.production.yaml"
          - name: valkey
            namespace: valkey
            repoURL: registry-1.docker.io/cloudpirates
            chart: valkey
            targetRevision: "0.21.4"
            valueFiles:
              - "$values/values/valkey/values.yaml"
              - "$values/values/valkey/values.minimal.yaml"
              - "$values/values/valkey/values.budruntime.yaml"
              - "$values/values/valkey/secrets.production.yaml"
          - name: keycloak
            namespace: keycloak
            repoURL: registry.bud.studio/charts
            chart: keycloak
            targetRevision: "0.2.1"
            valueFiles:
              - "$values/values/keycloak/values.budruntime.yaml"
              - "$values/values/keycloak/values.production.yaml"
              - "$values/values/keycloak/secrets.production.yaml"
          - name: bud
            namespace: bud
            repoURL: registry.bud.studio/charts
            chart: bud
            targetRevision: "1.3.0"
            valueFiles:
              - "$values/values/bud/values.production.yaml"
              - "$values/values/bud/secrets.production.yaml"
          - name: opensandbox
            namespace: opensandbox-system
            repoURL: registry.bud.studio/charts
            chart: opensandbox
            targetRevision: "0.0.1"
            valueFiles:
              - "$values/values/opensandbox/secrets.production.yaml"
  template:
    metadata:
      name: "production-{{.name}}"
    spec:
      project: production
      destination:
        server: https://kubernetes.default.svc
        namespace: "{{.namespace}}"
      syncPolicy:
        syncOptions:
          - CreateNamespace=true
          - ServerSideApply=true
        automated:
          enabled: false
          selfHeal: true
  templatePatch: |
    spec:
      sources:
        - repoURL: {{ .repoURL | quote }}
          chart: {{ .chart | quote }}
          targetRevision: {{ .targetRevision | quote }}
          helm:
            releaseName: "{{.name}}"
            valueFiles:
              {{- .valueFiles | toYaml | nindent 12 }}
        - repoURL: "https://github.com/example-org/bud-foundry-config.git"
          targetRevision: "main"
          ref: values

The shared baseline. These files are the same for every environment: node affinity toward bud.studio/control-plane nodes, the users and databases Bud expects in each datastore, the Keycloak realm and clients, and the SeaweedFS buckets. The passwords in them are placeholders that your secrets.production.yaml files override.

values/argocd/values.budruntime.yaml

global:
  affinity:
    nodeAffinity:
      type: soft
      matchExpressions:
        - key: bud.studio/control-plane
          operator: In
          values:
            - "true"

values/dapr/values.yaml

enabled: true
global:
  ha:
    enabled: false
dapr_scheduler:
  securityContext:
    fsGroup: null
  ha: true
  cluster:
    storageSize: "1Gi"
    storageClassName: ""
dapr_placement:
  fsGroup: null
  ha: true
  volumeclaims:
    storageClassName: ""

values/kafka/values.budruntime.yaml

users:
  bud:
    password: "bud"
    spec: {}

strimzi-kafka-operator:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"
affinity:
  nodeAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 75
        preference:
          matchExpressions:
            - key: bud.studio/control-plane
              operator: In
              values:
                - "true"

values/mongodb/values.budruntime.yaml

users:
  bud_novu:
    db: bud_novu
    password: bud_novu
    roles:
      - name: dbOwner
        db: bud_novu
psmdb-operator:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"
affinity:
  nodeAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 75
        preference:
          matchExpressions:
            - key: bud.studio/control-plane
              operator: In
              values:
                - "true"

values/cert-manager/values.budruntime.yaml

trust-manager:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"

cert-manager:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"
  webhook:
    affinity:
      nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 75
            preference:
              matchExpressions:
                - key: bud.studio/control-plane
                  operator: In
                  values:
                    - "true"
  cainjector:
    affinity:
      nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 75
            preference:
              matchExpressions:
                - key: bud.studio/control-plane
                  operator: In
                  values:
                    - "true"
  startupapicheck:
    affinity:
      nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 75
            preference:
              matchExpressions:
                - key: bud.studio/control-plane
                  operator: In
                  values:
                    - "true"

values/kyverno/values.budruntime.yaml

kyverno:
  crds:
    migration:
      nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 75
            preference:
              matchExpressions:
                - key: bud.studio/control-plane
                  operator: In
                  values:
                    - "true"
  webhooksCleanup:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"
  admissionController:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"
  backgroundController:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"
  cleanupController:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"
  reportsController:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"

values/clickhouse/values.budruntime.yaml

users:
  bud:
    password: "bud"
    databases:
      - name: bud_eval
      - name: bud_gateway
      - name: metrics
        extraArgs: "ENGINE = Replicated('/clickhouse/databases/{uuid}', '{shard}', '{replica}')"
    grants:
      - ALL ON metrics.*
      - SELECT(path) ON system.zookeeper
      # Required by budmetrics' migrate_clickhouse.py:detect_replicated_mode()
      # so its topology probe succeeds instead of falling back to "default to
      # replicated". The chart-side fix above makes the script's auto-detect
      # cosmetic in production, but on single-node deployments without these
      # grants the script would mis-detect and try to emit Replicated DDL.
      - SELECT(cluster, replica_num) ON system.clusters
      - SELECT(macro, substitution) ON system.macros

altinity-clickhouse-operator:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"

affinity:
  nodeAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 75
        preference:
          matchExpressions:
            - key: bud.studio/control-plane
              operator: In
              values:
                - "true"

keeper:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"

values/postgres/values.budruntime.yaml

users:
  seaweedfs:
    password: "seaweedfs"
    databases:
      - seaweedfs
  keycloak:
    password: "keycloak"
    databases:
      - keycloak
  bud:
    password: "bud"
    databases:
      - budask
      - budapp
      - budcluster
      - budmetrics
      - budmodel
      - budsim
      - budeval
      - budevent
      - buddoc
      - budprompt
      - budcodeinterpreter
      - mcpgateway
      - budpipeline
      - onyx
      - budagent

poolers:
  pooler-rw-txn:
    instances: 2
    type: rw
    pgbouncer:
      poolMode: transaction
      parameters:
        max_client_conn: "1000"
        server_idle_timeout: "120"
        log_connections: "0"
        log_disconnections: "0"
    template:
      metadata:
        labels:
          app: pooler-txn
      spec:
        containers: []
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 100
                podAffinityTerm:
                  topologyKey: kubernetes.io/hostname
                  labelSelector:
                    matchLabels:
                      app: pooler-txn
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 75
                preference:
                  matchExpressions:
                    - key: bud.studio/control-plane
                      operator: In
                      values:
                        - "true"
  pooler-rw:
    template:
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
              - weight: 75
                preference:
                  matchExpressions:
                    - key: bud.studio/control-plane
                      operator: In
                      values:
                        - "true"
cloudnative-pg:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"
affinity:
  nodeAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 75
        preference:
          matchExpressions:
            - key: bud.studio/control-plane
              operator: In
              values:
                - "true"

values/postgres/values.minimal.budruntime.yaml

poolers:
  pooler-rw-txn:
    instances: 1

values/seaweedfs/values.budruntime.yaml

ingress:
  enabled: true
  https: true
  host: s3.bud.lan

identity:
  bud:
    accessKey: "bud"
    secretKey: "bud"

policy:
  bud:
    identities:
      - bud
    statements:
      - effect: Allow
        actions:
          - "s3:*"
        resources:
          - "bud-novu"
          - "bud-novu/*"
          - "bud-model-info"
          - "bud-model-info/*"
          - "bud-models-registry"
          - "bud-models-registry/*"
          - "bud-eval-artifacts"
          - "bud-eval-artifacts/*"
          - "bud-terraform-state"
          - "bud-terraform-state/*"

buckets:
  bud-novu:
    reclaimPolicy: Delete
    versioning: "Off"
    objectLock: false
    anonymousRead: false
    quota:
      size: 1Gi
      enforce: true
  bud-model-info:
    reclaimPolicy: Delete
    versioning: "Off"
    objectLock: false
    anonymousRead: false
    quota:
      size: 1Gi
      enforce: true
  bud-models-registry:
    reclaimPolicy: Delete
    versioning: "Off"
    objectLock: false
    anonymousRead: false
    quota:
      size: 60Gi
      enforce: true
  bud-eval-artifacts:
    reclaimPolicy: Delete
    versioning: "Off"
    objectLock: false
    anonymousRead: false
    quota:
      size: 10Gi
      enforce: true
  bud-terraform-state:
    reclaimPolicy: Retain
    versioning: Enabled
    objectLock: false
    anonymousRead: false
    quota:
      size: 1Gi
      enforce: true

affinity:
  nodeAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 75
        preference:
          matchExpressions:
            - key: bud.studio/control-plane
              operator: In
              values:
                - "true"
seaweedfs-operator:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 75
          preference:
            matchExpressions:
              - key: bud.studio/control-plane
                operator: In
                values:
                  - "true"

values/valkey/values.yaml

enabled: true
architecture: "replication"
replicaCount: 3
affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - podAffinityTerm:
          topologyKey: kubernetes.io/hostname
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: "valkey"
        weight: 100
metrics:
  enabled: false
persistence:
  enabled: true
  size: "1Gi"
sentinel:
  # only creates master srv when sentinel is disabled
  enabled: false
auth:
  enabled: true
  password: "valkey"

values/valkey/values.minimal.yaml

replicaCount: 1

values/valkey/values.budruntime.yaml

config:
  extraConfig:
    - "notify-keyspace-events KEA"
resources:
  limits:
    memory: 1Gi
affinity:
  nodeAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 75
        preference:
          matchExpressions:
            - key: bud.studio/control-plane
              operator: In
              values:
                - "true"

values/keycloak/values.budruntime.yaml

ingress:
  enabled: true
  https: true
  host: auth.bud.lan

image: registry.bud.studio/runtime/keycloak-budtheme:0.2.2
imagePullSecrets:
  - name: registry.bud.studio

affinity:
  nodeAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 75
        preference:
          matchExpressions:
            - key: bud.studio/control-plane
              operator: In
              values:
                - "true"

realms:
  keycloak-bud-keycloak-realm:
    clients:
      budadmin-web:
        enabled: true
        protocol: openid-connect
        directAccessGrantsEnabled: true
        standardFlowEnabled: true
        implicitFlowEnabled: false
        publicClient: false
        serviceAccountsEnabled: false
        secret: budadmin-web
        attributes:
          post.logout.redirect.uris: https://admin.bud.lan
        protocolMappers:
          - config:
              access.token.claim: "true"
              id.token.claim: "false"
              included.client.audience: budadmin-web
            name: aud-budadmin-web
            protocol: openid-connect
            protocolMapper: oidc-audience-mapper
        redirectUris:
          - https://app.bud.lan/auth/redirect/callback
        webOrigins:
          - +
      budcustomer-web:
        attributes:
          post.logout.redirect.uris: https://admin.bud.lan##https://customer.bud.lan##https://playground.bud.lan
        directAccessGrantsEnabled: true
        enabled: true
        implicitFlowEnabled: false
        protocol: openid-connect
        protocolMappers:
          - config:
              access.token.claim: "true"
              id.token.claim: "false"
              included.client.audience: budcustomer-web
            name: aud-budcustomer-web
            protocol: openid-connect
            protocolMapper: oidc-audience-mapper
        publicClient: false
        redirectUris:
          - https://app.bud.lan/auth/redirect/callback
          # Customer-app root: allow-lists KEYCLOAK_CUSTOMER_ACTION_REDIRECT_URI so the
          # hosted invite/reset "set password" flow can redirect a CLIENT user back into
          # the customer portal on completion (else Keycloak rejects the redirect_uri).
          - https://customer.bud.lan/*
        secret: budcustomer-web
        serviceAccountsEnabled: false
        standardFlowEnabled: true
        webOrigins:
          - +
      budplayground-web:
        attributes:
          post.logout.redirect.uris: https://playground.bud.lan
        directAccessGrantsEnabled: true
        enabled: true
        implicitFlowEnabled: false
        protocol: openid-connect
        protocolMappers:
          - config:
              access.token.claim: "true"
              id.token.claim: "false"
              included.client.audience: budplayground-web
            name: aud-budplayground-web
            protocol: openid-connect
            protocolMapper: oidc-audience-mapper
        publicClient: false
        redirectUris:
          - https://app.bud.lan/auth/redirect/callback
        secret: budplayground-web
        serviceAccountsEnabled: false
        standardFlowEnabled: true
        webOrigins:
          - +
      mcp-gateway:
        attributes:
          post.logout.redirect.uris: https://admin.bud.lan##https://customer.bud.lan##https://playground.bud.lan
        directAccessGrantsEnabled: true
        enabled: true
        implicitFlowEnabled: false
        protocol: openid-connect
        protocolMappers:
          - config:
              access.token.claim: "true"
              id.token.claim: "false"
              included.client.audience: mcp-gateway
            name: aud-mcp-gateway
            protocol: openid-connect
            protocolMapper: oidc-audience-mapper
        publicClient: false
        redirectUris:
          - https://app.bud.lan/auth/redirect/callback
        secret: mcp-gateway
        serviceAccountsEnabled: false
        standardFlowEnabled: true
        webOrigins:
          - +
      # budapp-admin: confidential service-account client for provisioning. secret is a placeholder, override it in secrets.<environment>.yaml.
      budapp-admin:
        enabled: true
        protocol: openid-connect
        secret: budapp-admin
        publicClient: false
        serviceAccountsEnabled: true
        standardFlowEnabled: false
        directAccessGrantsEnabled: false
        implicitFlowEnabled: false
    spec:
      enabled: true
      realm: bud-keycloak
      loginTheme: bud
      sslRequired: external
      accessTokenLifespan: 1800
      ssoSessionIdleTimeout: 604800
      ssoSessionMaxLifespan: 604800

      # Forgot-password + email login; self-registration off.
      loginWithEmailAllowed: true
      duplicateEmailsAllowed: false
      resetPasswordAllowed: true
      registrationAllowed: false

      # Realm SMTP is configured per environment (needs real creds):
      # add smtpServer to values.<environment>.yaml plus its secrets. Absent here so an
      # env without SMTP doesn't inherit a broken placeholder.

      roles:
        realm:
          - name: super_admin
          - name: admin
          - name: user

      users:
        - enabled: true
          username: root
          email: root@example.com
          emailVerified: true
          firstName: Root
          lastName: Admin
          realmRoles:
            - super_admin
          credentials:
            - temporary: false
              type: password
              value: root@example.com

        # budapp-admin service-account role mapping (CRD has no serviceAccountClientRoles field, so it lives here).
        - enabled: true
          username: service-account-budapp-admin
          serviceAccountClientId: budapp-admin
          clientRoles:
            realm-management:
              - manage-users
              - view-users

The cert-manager and Kyverno CA files, values/cert-manager/values.selfsigned-ca.yaml and values/kyverno/values.inject-ca.yaml, are listed in full under Self-signed or internal-CA TLS.

Step 2, Generate an age key and wire up SOPS

Generate a keypair for the environment (and optionally one per admin):

age-keygen -o production.agekey
# Public key: age1...

# .sops.yaml
keys:
  - &machine_production age1yourpublickey...
creation_rules:
  - path_regex: '.*secrets\.production\.yaml$'
    key_groups:
      - age:
          - *machine_production

The private key is handed to ArgoCD through the argocd chart’s sopsAgeKeys value, itself stored SOPS-encrypted:

cat > values/argocd/secrets.production.yaml <<EOF
sopsAgeKeys: |
  AGE-SECRET-KEY-1YOURPRIVATEKEY...
EOF
sops encrypt -i values/argocd/secrets.production.yaml

From then on, every secrets.*.yaml your ApplicationSet references is decrypted transparently by the repo-server’s helm-secrets wrapper.

Step 3, Environment values

Your public overlays. The shared baseline already carries the defaults, so these stay small. values/argocd/values.production.yaml sets the ArgoCD hostname, registers your repo, and creates the AppProject the ApplicationSet targets (the projects key must match spec.template.spec.project):

values/argocd/values.production.yaml

argo-cd:
  configs:
    cm:
      url: https://argocd.bud.example.com
global:
  domain: argocd.bud.example.com
ingress:
  className: traefik
  enabled: true
  host: argocd.bud.example.com
  isTraefik: true
projects:
  production:
    clusterResourceWhitelist:
      - group: "*"
        kind: "*"
    destinations:
      - namespace: "*"
        server: https://kubernetes.default.svc
    sourceRepos:
      - "*"
repo:
  enabled: true
  url: https://github.com/example-org/bud-foundry-config

values/bud/values.production.yaml is the platform’s cluster config; everything else falls back to chart defaults. global.ingress.hosts.root is the only host you set: every service sub-host (admin., app., auth., s3., …) derives from it. ingress.https: internal means cert-manager issues the certificates and they terminate in-cluster; use external when an upstream LB/WAF terminates TLS, or disabled for plain HTTP.

values/bud/values.production.yaml

externalServices:
  oidc:
    url: https://auth.bud.example.com/realms/bud-keycloak
  s3:
    endpoint: s3.bud.example.com
    secure: true
global:
  ingress:
    hosts:
      root: bud.example.com
ingress:
  className: traefik
  https: internal
  isTraefik: true
microservices:
  budapp:
    redirectFlow:
      clientsByHost:
        budadmin:
          hosts:
            - '{{ include "bud.ingress.hosts.budadmin" . }}'
          allowedReturnUrlOrigins:
            - '{{ include "bud.ingress.url.budadmin" . }}'
        budcustomer:
          hosts:
            - '{{ include "bud.ingress.hosts.budcustomer" . }}'
          allowedReturnUrlOrigins:
            - '{{ include "bud.ingress.url.budcustomer" . }}'
        budplayground:
          hosts:
            - '{{ include "bud.ingress.hosts.budplayground" . }}'
          allowedReturnUrlOrigins:
            - '{{ include "bud.ingress.url.budplayground" . }}'
storage:
  budmodelRegistry:
    className: standard
    size: 300Gi

See the Helm Configuration Reference for the full option list. Optional services (buddoc, askbud, budpipeline, …) can be trimmed with microservices.<name>.enabled: false for a smaller footprint. values/keycloak/values.production.yaml sets the auth host and the redirect and logout URIs of the frontend clients:

values/keycloak/values.production.yaml

ingress:
  className: traefik
  enabled: true
  host: auth.bud.example.com
  https: true
  isTraefik: true
realms:
  keycloak-bud-keycloak-realm:
    clients:
      budadmin-web:
        attributes:
          post.logout.redirect.uris: https://admin.bud.example.com
        redirectUris:
          - https://app.bud.example.com/auth/redirect/callback
        webOrigins:
          - "+"
      budcustomer-web:
        attributes:
          post.logout.redirect.uris: https://admin.bud.example.com##https://customer.bud.example.com##https://playground.bud.example.com
        redirectUris:
          - https://app.bud.example.com/auth/redirect/callback
          - https://customer.bud.example.com/*
        webOrigins:
          - "+"
      budplayground-web:
        attributes:
          post.logout.redirect.uris: https://playground.bud.example.com
        redirectUris:
          - https://app.bud.example.com/auth/redirect/callback
        webOrigins:
          - "+"
      mcp-gateway:
        attributes:
          post.logout.redirect.uris: https://admin.bud.example.com##https://customer.bud.example.com##https://playground.bud.example.com
        redirectUris:
          - https://app.bud.example.com/auth/redirect/callback
        webOrigins:
          - "+"

values/seaweedfs/values.production.yaml sets the S3 host and sizes the model-registry bucket to match storage.budmodelRegistry.size:

values/seaweedfs/values.production.yaml

buckets:
  bud-models-registry:
    quota:
      size: 300Gi
ingress:
  className: traefik
  enabled: true
  host: s3.bud.example.com
  https: true
  isTraefik: true

You only edit a handful of values. The bud chart’s defaults already point the application at the in-cluster databases this guide deploys (pooler-rw.postgres, clickhouse-clickhouse.clickhouse, mongodb-rs0.mongodb, valkey-master.valkey). Leave the externalServices.*.host keys at their defaults, those are only changed for the managed-database path in the Deployment Guide.

Step 4, Secrets

Every secrets.production.yaml the ApplicationSet references must exist: argocd (from Step 2), kafka, mongodb, clickhouse, postgres, seaweedfs, valkey, keycloak, bud and opensandbox (plus cert-manager for an imported CA). For the datastores and Keycloak, override the placeholder passwords from the shared baseline: the users.*.password entries (postgres, clickhouse, kafka, mongodb), identity.bud.accessKey/secretKey (seaweedfs), auth.password (valkey), and the Keycloak client secrets and root user credentials. For values/bud/secrets.production.yaml, the per-key reference, what each secret is for and how to generate it, lives in the deployment guide; the set is the same regardless of install method:

Registry pull credentials
Per-service secrets you must change (admin login, AES_KEY_HEX, PASSWORD_SALT, redirect-flow session/client secrets, RSA keypair, Dapr crypto keys, Novu secrets)
OIDC identity provider

Encrypt each file before committing:

sops encrypt -i values/bud/secrets.production.yaml   # repeat for each file

Credentials must agree across components. Because the databases run in-cluster, the Postgres password in values/bud/secrets.production.yaml must match the one in values/postgres/secrets.production.yaml, and likewise for ClickHouse, Kafka, MongoDB, Valkey, SeaweedFS and the Keycloak client secrets. A mismatch shows up as backend pods failing to connect after they start. budctl generates these coordinated values for you.

Self-signed or internal-CA TLS

A public ACME issuer needs publicly resolvable hosts, so air-gapped and internal deployments issue certificates from a CA of their own instead. This takes two charts: cert-manager (with trust-manager) to issue the certificates and publish a trust bundle, and kyverno to inject that bundle into the platform’s pods. Without the injection the services do not trust the new CA, and calls between them fail on certificate verification. values/cert-manager/values.selfsigned-ca.yaml creates a 10-year self-signed root, an issuer that signs from it, and a trust-manager Bundle that distributes the root to workloads:

values/cert-manager/values.selfsigned-ca.yaml

trust-manager:
  enabled: true

cert-manager:
  ingressShim:
    defaultIssuerName: selfsigned-ca

certificates:
  selfsigned-ca:
    isCA: true
    duration: 87600h # 10 years
    renewBefore: 720h # 3 days
    subject:
      organizations:
        - selfsigned-ca
    commonName: selfsigned-ca
    secretName: selfsigned-ca-root
    privateKey:
      algorithm: ECDSA
      size: 256
    issuerRef:
      name: selfsigned
      kind: ClusterIssuer
      group: cert-manager.io

issuers:
  selfsigned:
    selfSigned: {}
  selfsigned-ca:
    ca:
      secretName: selfsigned-ca-root

bundles:
  ca-pemstore:
    sources:
      - useDefaultCAs: true
      - secret:
          name: "selfsigned-ca-root"
          key: "tls.crt"
    target:
      configMap:
        key: "cafebabe-ca.pem"
      additionalFormats:
        pkcs12:
          key: "cafebabe-ca.p12"
          password: ""

The two issuers are deliberate: selfsigned exists only to sign the root Certificate, and selfsigned-ca (backed by that root) is what actually issues the leaf certificates. The Bundle writes the public roots plus your own root into a ca-pemstore ConfigMap in every namespace; Kyverno mounts it into pods (see below), so nothing in the platform has to learn the certificate individually. Clients outside the cluster (browsers, curl) will not trust these certificates until you distribute the root from the selfsigned-ca-root secret to their trust stores. values/kyverno/values.inject-ca.yaml defines a Kyverno ClusterPolicy that mutates every pod created in the bud and bud-* namespaces: it mounts the ca-pemstore ConfigMap at /etc/ssl/certs/cafebabe-ca.pem and sets the environment variables each runtime (OpenSSL, Node.js, Python, pip, curl, git) uses to find a CA bundle:

values/kyverno/values.inject-ca.yaml

# Inject the trust-manager CA bundle into Bud workloads when budctl uses the
# bundled self-signed issuer. This policy is not selected for ACME or externally
# terminated TLS installations.
clusterPolicies:
  inject-ca:
    background: false
    rules:
      - name: inject-ca
        match:
          any:
            - resources:
                kinds:
                  - Pod
        preconditions:
          all:
            - key: "{{ request.namespace }}"
              operator: AnyIn
              value:
                - "bud"
                - "bud-*"
        mutate:
          foreach:
            - list: request.object.spec.containers
              patchStrategicMerge:
                spec:
                  volumes:
                    - name: ca-pemstore
                      configMap:
                        name: ca-pemstore
                  containers:
                    - name: "{{ element.name }}"
                      volumeMounts:
                        - name: ca-pemstore
                          mountPath: /etc/ssl/certs/cafebabe-ca.pem
                          subPath: cafebabe-ca.pem
                          readOnly: true
                      env:
                        - name: SSL_CERT_FILE
                          value: /etc/ssl/certs/cafebabe-ca.pem
                        - name: NODE_EXTRA_CA_CERTS
                          value: /etc/ssl/certs/cafebabe-ca.pem
                        - name: REQUESTS_CA_BUNDLE
                          value: /etc/ssl/certs/cafebabe-ca.pem
                        - name: PIP_CERT
                          value: /etc/ssl/certs/cafebabe-ca.pem
                        - name: CURL_CA_BUNDLE
                          value: /etc/ssl/certs/cafebabe-ca.pem
                        - name: GIT_SSL_CAINFO
                          value: /etc/ssl/certs/cafebabe-ca.pem

Because the policy runs at pod admission, it only affects pods created after it is in place. Sync kyverno before the bud chart, or restart the platform’s workloads once the policy is active. The bundle also ships a PKCS#12 copy (cafebabe-ca.p12) for JVM trust stores. Also trusting an existing internal CA? Add its certificate to the bundle’s sources in a values/cert-manager/values.production.yaml, and list that file after values.selfsigned-ca.yaml in the cert-manager element of the ApplicationSet:

bundles:
  ca-pemstore:
    sources:
      - useDefaultCAs: true
      - secret:
          name: "selfsigned-ca-root"
          key: "tls.crt"
      - inLine: |                      # ← your internal CA, pasted verbatim
          -----BEGIN CERTIFICATE-----
          ...
          -----END CERTIFICATE-----

sources is a list, and Helm replaces lists rather than merging them, so the overlay restates the two entries from values.selfsigned-ca.yaml and appends the third. This only adds the internal CA to what the cluster trusts. To have that CA issue the certificates as well, store its certificate and key in a secret (in secrets.production.yaml), point an issuer at it (issuers.<name>.ca.secretName, the same shape as selfsigned-ca), and set cert-manager.ingressShim.defaultIssuerName to that issuer.

Public ACME instead. Drop values.selfsigned-ca.yaml and the kyverno element, define an ACME issuer under issuers: in values/cert-manager/values.production.yaml, and set cert-manager.ingressShim.defaultIssuerName to it. With an HTTP-01 issuer every ingress host must be publicly resolvable and reachable on port 80; a DNS-01 issuer needs a DNS-provider API token in secrets.production.yaml. If certs stay Ready=False, check kubectl -n bud describe certificate <name> and kubectl -n bud get challenge.

Commit and push everything to your repo.

Step 5, Bootstrap ArgoCD

The ApplicationSet manages ArgoCD itself (the production-argocd Application), but the very first install must come from your machine: ArgoCD cannot decrypt your secrets until the chart has delivered the age key. Install the argocd chart with the same value files its ApplicationSet element references. The release name must be argocd so the Application adopts it afterwards:

sops decrypt values/argocd/secrets.production.yaml > /tmp/argocd-secrets.yaml
helm install argocd oci://registry.bud.studio/charts/argocd --version 0.1.1 \
  --namespace argocd --create-namespace \
  -f /tmp/argocd-secrets.yaml \
  -f values/argocd/values.budruntime.yaml \
  -f values/argocd/values.production.yaml
rm /tmp/argocd-secrets.yaml

Then register the OCI registry as a Helm repository credential so ArgoCD can pull the charts:

kubectl apply -n argocd -f - <<'EOF'
apiVersion: v1
kind: Secret
metadata:
  name: bud-charts-repo
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  type: helm
  url: registry.bud.studio/charts
  enableOCI: "true"
  username: robot$yourname
  password: <token>
EOF

Once the first sync of production-argocd completes (Step 6), ArgoCD is self-managed: future ArgoCD upgrades are a targetRevision bump in your ApplicationSet.

Step 6, Apply the bootstrap Application and sync

kubectl apply -n argocd -f apps/production.yaml

Open the ArgoCD UI (or use the argocd CLI) and sync:

bootstrap, applies appsets/production.yaml, which generates the production-* Applications.
production-argocd, adopts the Helm install from Step 5.
The addons (production-dapr, production-cert-manager, production-kyverno, production-postgres, production-clickhouse, production-kafka, production-mongodb, production-seaweedfs, production-valkey), a few may show Degraded until their operators’ CRDs establish; re-sync and they converge.
production-keycloak, then production-bud and production-opensandbox last, once the databases are up.

Syncs stay manual unless you enable automated (see How it works).

Verify

# Every Application should reach Synced / Healthy
kubectl get applications -n argocd

# Once healthy, check the platform pods
kubectl -n bud get pods
kubectl -n bud get ingress

All pods should reach Running within ~5–10 minutes of the Applications going Healthy. Backend pods run a Dapr sidecar, so expect 2/2 READY for most of them.

Optional add-ons

Add one to your environment by appending an element to appsets/<environment>.yaml (name, namespace, repoURL registry.bud.studio/charts, chart, targetRevision, valueFiles), exactly like the required ones.

Add-on	What it provides	When you need it
`bud-studio`	Bud Studio (`budagent` chart)	Enable through `budctl`, which adds it with `values/bud-studio/values.<environment>.yaml` and `secrets.<environment>.yaml`.
`openebs`	A storage provisioner / `StorageClass` (Mayastor, LVM, ZFS, hostpath)	Only if your cluster has no `StorageClass`, e.g. bare metal with raw disks. Managed clusters (EKS/AKS/GKE) already provide one; skip it.
`otel`	OpenTelemetry operator + a node-level collector for cluster/infra metrics	Infra-level observability only. The platform ships its own app-telemetry collector (traces/metrics → ClickHouse), so the application works without this.
`signoz`	Observability dashboards UI (traces, logs, metrics)	A console for viewing telemetry. Nothing in the platform depends on it.
`velero`	Cluster backup/restore	Disaster recovery for cluster state and PVs.
`harbor`	A private OCI registry	Only if you mirror images/charts in-cluster.

Storage is still required, just not from openebs. The databases need a working StorageClass either way. openebs is one way to provide it; a cloud CSI driver is another. Set storage.budmodelRegistry.className (Step 3) to whichever your cluster offers.

Post-installation

Open https://admin.<your-domain> (e.g. https://admin.bud.example.com) and log in with the SUPER_USER_EMAIL / SUPER_USER_PASSWORD from values/bud/secrets.<environment>.yaml (with budctl, the email is the --admin-email you passed). With the self-signed TLS profile, browsers will not trust the certificates until you import the root from the selfsigned-ca-root secret in the cert-manager namespace.

Upgrading

Bump the element’s targetRevision in appsets/<environment>.yaml (e.g. bud to a new chart version), commit, and sync.

Uninstalling

kubectl delete -n argocd -f apps/<environment>.yaml
kubectl delete appset -n argocd <environment>
# Optionally remove namespaces and PVCs
kubectl delete namespace bud keycloak postgres clickhouse kafka mongodb valkey \
  seaweedfs opensandbox-system dapr-system cert-manager kyverno
# plus any optional add-on namespaces you enabled: bud-studio openebs otel signoz velero harbor

Common pitfalls

An Application errors with Error decrypting / helm-secrets failures, the age key in values/argocd/secrets.<environment>.yaml (sopsAgeKeys) does not match the recipients your secrets.*.yaml files were encrypted to. Re-check .sops.yaml and re-encrypt (sops updatekeys <file>).
Addon Applications stuck Degraded on first sync, usually the operator CRDs not yet established. Re-sync after a minute; the ApplicationSet uses ServerSideApply=true so large CRDs apply cleanly.
Backend pods crash-loop on DB connection, almost always a password mismatch between a datastore’s secrets and values/bud/secrets.<environment>.yaml (see the warning in Step 4).
Service-to-service calls fail certificate verification with a self-signed or internal CA, the Kyverno policy only mutates pods created after it is active. Sync kyverno first, then restart the bud workloads.
registries.registry.bud.studio credentials are required even on clusters that mirror images locally, the chart still creates the imagePullSecret referenced by every Deployment.
budmetrics ClickHouse database name must be metrics, it is hardcoded. See the Deployment Guide.

Self-Hosting

Features

Release Notes

How it works

Components

How value files are layered

TLS profiles

Prerequisites

Option A, Install with `budctl` (recommended)

Option B, Install manually

Step 1, Create your config repo

Step 2, Generate an age key and wire up SOPS

Step 3, Environment values

Step 4, Secrets

Self-signed or internal-CA TLS

Step 5, Bootstrap ArgoCD

Step 6, Apply the bootstrap Application and sync

Verify

Optional add-ons

Post-installation

Upgrading

Uninstalling

Common pitfalls

Next steps

Deployment Guide

Helm Configuration

​How it works

​Components

​How value files are layered

​TLS profiles

​Prerequisites

​Option A, Install with budctl (recommended)

​Option B, Install manually

​Step 1, Create your config repo

​Step 2, Generate an age key and wire up SOPS

​Step 3, Environment values

​Step 4, Secrets

​Self-signed or internal-CA TLS

​Step 5, Bootstrap ArgoCD

​Step 6, Apply the bootstrap Application and sync

​Verify

​Optional add-ons

​Post-installation

​Upgrading

​Uninstalling

​Common pitfalls

​Next steps

Deployment Guide

Helm Configuration

How it works

Components

How value files are layered

TLS profiles

Prerequisites

Option A, Install with `budctl` (recommended)

Option B, Install manually

Step 1, Create your config repo

Step 2, Generate an age key and wire up SOPS

Step 3, Environment values

Step 4, Secrets

Self-signed or internal-CA TLS

Step 5, Bootstrap ArgoCD

Step 6, Apply the bootstrap Application and sync

Verify

Optional add-ons

Post-installation

Upgrading

Uninstalling

Common pitfalls

Next steps