> ## Documentation Index
> Fetch the complete documentation index at: https://docs.validio.io/llms.txt
> Use this file to discover all available pages before exploring further.

# VPC Deployment Installation

> Install Validio on customer VPC.

The Validio application is distributed as a [Helm](https://helm.sh) chart. The Helm chart is installable on managed [Kubernetes](https://kubernetes.io/) clusters.

Validio is available for the following cloud providers:

* Google Cloud Platform (GCP): [GKE](https://cloud.google.com/kubernetes-engine).
* Amazon Web Services (AWS): [EKS](https://aws.amazon.com/eks/).
* Microsoft Azure: [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service).

## Prerequisites

> [!NOTE]
>
> Installing Validio on Customer VPC requires knowledge of:
>
> * [Kubernetes](https://kubernetes.io/): how to install, configure, and monitor resources on AWS, GCP or Azure.
> * [Helm](https://helm.sh): how to install and configure helm charts on Kubernetes.

**1. Access to docker images using a JSON file provided by Validio. For more information, [contact us](https://docs.validio.io/v10.1/docs/other/support.md).**

**2. Configure a Kubernetes cluster on GCP, AWS or Azure. Considering the following:**

1. All nodes must be in the same AWS availability zone, GCP zone or Azure zone.
2. Persistent volume provisioning enabled, to create Kubernetes PVC resources.
3. We also recommend a configured load balancer or ingress controller, such as:
   1. [GCP Ingress Controller](https://cloud.google.com/kubernetes-engine/docs/concepts/ingress)
   2. [AWS Load Balancer Controller](https://kubernetes-sigs.github.io/aws-load-balancer-controller/)
   3. [AKS Application routing add-on](https://learn.microsoft.com/en-us/azure/aks/app-routing)

**3. Install the following:**

* [kubectl](https://kubernetes.io/docs/reference/kubectl/) CLI tool and set the `kubectl` context to the destination cluster.
* [Helm](https://helm.sh) version 3.8.0 or later with [Helm OCI support](https://helm.sh/docs/topics/registries/#oci-support-prior-to-v380).

## Installation

Complete the following steps to install your VPC deployment. Also, you can refer to [VPC Deployment Examples](https://docs.validio.io/v10.1/docs/deployment/virtual-private-cloud/vpc-deployment-examples.md).

### 1. Create namespace

Create the namespace you want to use for your configuration. In our examples, we use `validio`.

```bash title="Bash" theme={null}
kubectl create namespace validio
```

### 2. Add the docker-registry secret

Create a `Kubernetes Secret` to pull the docker images required by the helm chart. This requires the JSON file provided by Validio.

First, set the `VALIDIO_SECRET` environment variable to point to your JSON file:

```bash title="Bash" theme={null}
export VALIDIO_SECRET=/home/user/Downloads/validio-secret.json
```

Then, add the `Kubernetes Secret`:

```bash title="Bash" theme={null}
kubectl -n validio create secret docker-registry artifact-registry --docker-server=https://europe-docker.pkg.dev --docker-username=_json_key --docker-password="$(cat ${VALIDIO_SECRET})"
```

### 3. Install the helm chart

> [!NOTE]
>
> The helm chart installation requires the `validio-values.yaml` file. For details, refer to [configuration](#4-configure-the-validio-values-yaml-file) and [examples](https://docs.validio.io/v10.1/docs/deployment/virtual-private-cloud/vpc-deployment-examples.md).

```bash title="Bash" theme={null}
helm install validio oci://europe-docker.pkg.dev/validio-platform-prod/charts/validio --version [your-validio-version] --namespace validio --values validio-values.yaml
```

### 4. Configure the `validio-values.yaml` file

The Helm chart supports the following keys in the `validio-values.yaml` file:

| Key | Default value | Description |
| - | - | - |
| `postgres.resources.*` | `nil` | Resources for [Postgres service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md) . Suggested values: memory limit `4000Mi`, CPU request `200m`. |
| `postgres.storage.capacity` | `nil` | Storage capacity for [Postgres service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). Suggested value: `50Gi`. |
| `postgres.storage.class` | `nil` | Storage class for [Postgres service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). For example, `premium-rwo` for GCP and `gp2` for AWS. Leave empty to use cloud provider default. |
| `redis.resources.*` | `nil` | Resources for [Redis service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). Suggested values: memory limit `250Mi`, CPU request `50m`. Redis is only lightly used unless streaming sources are enabled; increase the memory limit if you use streaming. |
| `redis.storage.capacity` | `nil` | Storage capacity for [Redis service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). Suggested values: `20Gi`. |
| `redis.storage.class` | `nil` | Storage class for [Redis service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). For example, `premium-rwo` for GCP and `gp2` for AWS. Leave empty to use cloud provider default. |
| `surface.env.http_proxy` | `nil` | Set proxy for`HTTP` requests, will be used by Sentry |
| `surface.env.https_proxy` | `nil` | Set proxy for`HTTPS` requests, will be used by Sentry |
| `surface.ingress.enabled` | `false` | Set to `true` to enable Kubernetes ingress. Note: This requires an ingress controller and that all ingress parameters are set accordingly. |
| `surface.ingress.host` | `nil` | The ingress hostname. Note: You must also set a DNS name. |
| `surface.ingress.path` | `/` | Set the ingress path. |
| `surface.ingress.pathType` | `Prefix` | Set the Ingress path type. |
| `surface.ingress.annotations` | `nil` | Set the ingress annotations. |
| `surface.ingress.managedCert` | `false` | Create a `ManagedCertificate` resource for the ingress. Note: For GCP only. |
| `surface.ingress.tls.enable` | `false` | Enable Ingress TLS, required for use in Azure with cert-manager |
| `surface.probes.*` | `nil` | Control the Kubernetes Readiness and Liveness probes. |
| `surface.resources.*` | `nil` | Resources for [Surface service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). Suggested values: memory limit `1000Mi`, CPU request `200m`. |
| `ve.diver.certificate.enabled` | `false` | Set to `true` to enable custom self signed certificates for outbound communication |
| `ve.diver.certificate.content` | `nil` | [Self-signed certificate content](https://docs.validio.io/v10.1/docs/deployment/virtual-private-cloud/vpc-communication-and-services.md#self-signed-certificate-for-http-proxy), including header and footer. |
| `ve.diver.env.http_proxy` | `nil` | Set proxy for HTTP requests when sending notifications to Slack, Microsoft Teams, and Webhook. |
| `ve.diver.env.https_proxy` | `nil` | Set proxy for HTTPS requests when sending notifications to Slack, Microsoft Teams, and Webhook. |
| `ve.diver.probes.*` | `nil` | Control the Kubernetes Readiness and Liveness probes. |
| `ve.diver.resources.*` | `nil` | Resources for [Diver service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). Suggested values: memory limit `500Mi`, CPU request `200m`. |
| `ve.ingress.probes.*` | `nil` | Control the Kubernetes Readiness and Liveness probes. |
| `ve.ingress.resources.*` | `nil` | Resources for [Ingress service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). Suggested values: memory limit `1000Mi`, CPU request `200m`. Note: This is **not** a Kubernetes ingress parameter. |
| `ve.ingress.cache.size` | `1Gi` | Local disk cache for [Ingress service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). Will be allocated on the host where the pod runs. |
| `ve.pipelines.probes.*` | `nil` | Control the Kubernetes Readiness and Liveness probes. |
| `ve.pipelines.resources.*` | `nil` | Resources for [Pipelines service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). Suggested values: memory limit `1000Mi`, CPU request `100m`. |
| `ve.pipelines.cache.size` | `1Gi` | Local disk cache for [Pipelines service](https://docs.validio.io/v10.1/docs/deployment/validio-services.md). Will be allocated on the host where the pod runs. |

> [!NOTE]
>
> If the default value is `false` or `true`, the value type is `bool`. For all others, the value type is `String`.

All `<service>.resources.*` keys supports both CPU and Memory resources, specified only as `<service>.resource.*`.

Available keys for each service:

```yaml title="YAML" theme={null}
<service>:
  resources:
    limits:
      cpu: <value>
      memory: <value>
    requests:
      cpu: <value>
      memory: <value>
```

> [!NOTE]
>
> The following are memory and CPU recommendations:
>
> * **Memory**: set a limit with `<service>.resources.limits.memory`. Kubernetes terminates a container that exceeds its memory limit, so the limit caps how much a service can consume.
> * **CPU**: set a request with `<service>.resources.requests.cpu` and leave the limit unset. The request reserves capacity when the pod is scheduled, and with no limit in place a service can use spare CPU on the node instead of being throttled.
> * **CPU limits**: if your platform policy requires one, set `<service>.resources.limits.cpu` to `1000m`. That is five times the suggested request, so it bounds worst-case use without throttling normal load.
>
> For more information, refer to [Kubernetes resources documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).

If you have special requirements for Kubernetes pod placements, like using `affinity`, `tolerations` or `nodeSelector` that is possible on all our services. Here is an example of how it would be done:

```yaml title="YAML" theme={null}
<service>:
  nodeSelector:
    <label>: "<value>"
  tolerations:
    - key: <key>
      operator: Equal
      value: "<value>"
      effect: NoSchedule
```

Most services also supports controlling the Kubernetes Liveness and Readiness probes. They are specified above in the table as `<service>.probes.*`. Available keys are listed below, note that they are enabled by default and the commented values are the default values, so no need to make any changes if you are happy with the default values.

```yaml title="YAML" theme={null}
<service>:
  probes:
    liveness:
      enabled: true
      # failureThreshold: 3
      # initialDelaySeconds: 0
      # periodSeconds: 10
      # successThreshold: 1
      # terminationGracePeriodSeconds: 30
      # timeoutSeconds: 1
    readiness:
      enabled: true
      # failureThreshold: 3
      # initialDelaySeconds: 0
      # periodSeconds: 10
      # successThreshold: 1
      # terminationGracePeriodSeconds: 30
      # timeoutSeconds: 1
```

## Sign in to the Validio platform

The first time you sign in to the Validio platform, you must use the admin credentials created in the Kubernetes Secret.

> [!WARNING]
>
> **Caution**
>
> Do not change or update anything in the Kubernetes Secret. You can change the password in the Validio platform.

```bash title="Bash" theme={null}
kubectl -n validio get secrets validio-postgres -o=jsonpath='{.data.validio_app_auth_password}' | base64 -d ; echo
```

**Access your Validio platform:**

In your browser, navigate to the hostname specified in the `surface.ingress.host` key. For example, [https://validio.example.com/](https://validio.example.com/)

If you did not configure an ingress, use port-forward to forward the Validio platform to your localhost:

```bash title="Bash" theme={null}
kubectl -n validio port-forward svc/validio-surface 8889
```

Then, you can find it on [http://localhost:8889/](http://localhost:8889/)