
  ███████╗██████╗ ██████╗ ██╗
  ██╔════╝██╔══██╗██╔══██╗██║
  █████╗  ██║  ██║██║  ██║██║
  ██╔══╝  ██║  ██║██║  ██║██║
  ███████╗██████╔╝██████╔╝██║
  ╚══════╝╚═════╝ ╚═════╝ ╚═╝
  Multi-Agent AI Orchestration Middleware

{{- if .Values.eddi.existingSecret }}
  🔑 EDDI reads its secrets from YOUR Secret `{{ .Values.eddi.existingSecret }}`
     (eddi.existingSecret): the chart rendered none. It must hold the key
     application-secrets.properties with eddi.vault.master-key=… and the
     datastore connection line — the pod stays in ContainerCreating until it
     exists. ⚠️  Keep the vault master key safe: if lost, encrypted secrets
     are UNRECOVERABLE.
{{- else }}
  ✅ Vault master key is configured.
     (The chart cannot render without it — see eddi.vaultMasterKey.)
     ⚠️  Save it! If lost, encrypted secrets are UNRECOVERABLE.
     It reaches the pod as a FILE at
     /etc/eddi/secrets/application-secrets.properties, never as an env var.
{{- end }}

  🔏 Verify the image you just deployed

     Images are cosign-signed (keyless OIDC) and carry a SLSA provenance
     attestation. Verify before trusting a rollout:

       cosign verify \
         --certificate-oidc-issuer https://token.actions.githubusercontent.com \
         --certificate-identity-regexp '^https://github\.com/labsai/EDDI/\.github/workflows/ci\.yml@refs/(heads/main|tags/[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?)$' \
         {{ .Values.eddi.image.repository }}:{{ include "eddi.imageTag" . }}
{{- if not .Values.eddi.image.digest }}

     Then pin the digest, so the kubelet can never pull different bits under
     the same tag:

       crane digest {{ .Values.eddi.image.repository }}:{{ include "eddi.imageTag" . }}
       helm upgrade {{ .Release.Name }} ./helm/eddi \
         --set eddi.image.digest="sha256:..." \
         --namespace {{ .Release.Namespace }}
{{- else }}

     Deployed digest: {{ .Values.eddi.image.digest }}
{{- end }}

  📡 Access EDDI:

    kubectl port-forward svc/{{ include "eddi.fullname" . }} {{ .Values.eddi.service.port }}:{{ .Values.eddi.service.port }} -n {{ .Release.Namespace }}
    open http://localhost:{{ .Values.eddi.service.port }}

  🖥️  The Manager UI is served by EDDI itself:

    open http://localhost:{{ .Values.eddi.service.port }}/manage

{{- if .Values.keycloak.enabled }}

  🔐 Access Keycloak:

    kubectl port-forward svc/{{ include "eddi.fullname" . }}-keycloak 8080:8080 -n {{ .Release.Namespace }}
    open http://localhost:8080
    Username: {{ .Values.keycloak.adminUsername }}
{{- if .Values.keycloak.existingSecret }}
    Password: key `password` of your Secret `{{ .Values.keycloak.existingSecret }}`
              (keycloak.existingSecret).
{{- else }}
    Password: the value you passed as keycloak.adminPassword — deliberately not
              echoed here, since install output lands in shell history, CI logs
              and terminal scrollback. It is stored in the Secret
              {{ include "eddi.fullname" . }}-keycloak (key `password`) and
              reaches the pod through secretKeyRef, not as a pod-spec value.
{{- end }}

  ⚠️  This Keycloak runs `start-dev`: development mode, embedded H2 on one
     PVC, no HA. It suits the port-forward flow above and a demo cluster;
     for anything reachable by name run your own Keycloak with `start`
     (eddi.oidc.authServerUrl, keycloak.enabled=false).
{{- if .Values.keycloak.devModeAcknowledged }}
     keycloak.devModeAcknowledged=true: you have published this dev-mode
     Keycloak behind the Ingress on purpose.
{{- end }}

  👤 Give the EDDI administrator a password — no account ships with one:

    The realm seeds `eddi` with the eddi-admin, eddi-editor and eddi-viewer
    roles and NO credential, so nobody can log in to /manage until you set one. It used to
    ship as eddi/eddi, which the Keycloak Service made a guessable EDDI
    administrator for every pod in the cluster.

      Keycloak admin console → Users → eddi → Credentials → Set password

    Or grant all three realm roles to an account of your own — eddi-viewer
    included, because EDDI has no role hierarchy and an administrator without
    it is refused every read tool over MCP.

    The unprivileged fixtures `viewer` (eddi-viewer) and `user` (eddi-user)
    are opt-in the same way: they ship with their roles and no password, and
    stay unusable until you set one. They used to ship as viewer/viewer and
    user/user, and the SPA client allowed the password grant, so one curl
    against a reachable Keycloak returned a token that could run LLM turns.

{{- end }}

{{- if and .Values.ingress.enabled (empty .Values.ingress.tls) }}

  ⚠️  Ingress is enabled but ingress.tls is empty.

     EDDI is being published over plain HTTP. Every request — including bearer
     tokens and, without OIDC, unauthenticated API calls — crosses the network in
     cleartext. Configure ingress.tls (a cert-manager Certificate or an existing
     TLS Secret) before exposing this to anything but a trusted LAN.
{{- end }}

  📊 Components:
    Database:      {{ if .Values.mongodb.enabled }}MongoDB (in-chart){{ else if .Values.postgres.enabled }}PostgreSQL (in-chart){{ else if .Values.eddi.datastore.externalConnectionString }}MongoDB (external){{ else }}PostgreSQL (external){{ end }}
    Messaging:     {{ include "eddi.messagingType" . }}
    Auth (OIDC):   {{ if .Values.eddi.oidc.enabled }}Enabled{{ else }}Disabled{{ end }}
    Replicas:      {{ if .Values.autoscaling.enabled }}{{ .Values.autoscaling.minReplicas }}–{{ .Values.autoscaling.maxReplicas }} (autoscaled){{ else }}{{ .Values.eddi.replicas }}{{ end }}{{ if eq (include "eddi.messagingType" .) "nats" }} (cluster mode — see docs/clustering.md){{ end }}
    Updates:       {{ include "eddi.updateStrategy" . }}
    NetworkPolicy: {{ if .Values.networkPolicy.enabled }}Enabled{{ else }}Disabled{{ end }}

  📖 Full docs: https://github.com/labsai/EDDI/blob/main/docs/kubernetes.md
{{- if .Values.nats.buildProfileImage }}

  ⚠️  nats.buildProfileImage is deprecated and ignored: since chart 2.7.0 the
     published image selects cluster mode at runtime (eddi.messagingType=nats).
{{- end }}
