Configuration and Installation

1. Prerequisites

Before installing the Helm charts, ensure your Kubernetes environment meets the following requirements.

Note: Ensure that your VPC environment has network access to pull the required container images for the Enkrypt AI stack.

Namespaces

Create the following namespaces to isolate the application components:

kubectl create namespace enkryptai-stack
kubectl create namespace redteam-jobs

Kubernetes Secrets

The following secrets must be created before installation. The Enkrypt AI team will provide the necessary secret values.

Namespace	Secret Name	Used By
`enkryptai-stack`	`elastic-env-secret`	`gateway-kong`, `opensearch`
`enkryptai-stack`	`frontend-env-secret`	`frontend`
`enkryptai-stack`	`gateway-env-secret`	`gateway-kong`
`enkryptai-stack`	`gateway-migration-env-secret`	`gateway-kong`
`enkryptai-stack`	`guardrails-env-secret`	`guardrails`
`enkryptai-stack`	`onprem`	Supabase (on-prem database)
`enkryptai-stack`	`openfga-env-secret`	`openfga`
`enkryptai-stack`	`opensearch-cred`	`opensearch`
`enkryptai-stack`	`opensearch-securityconfig`	`opensearch`
`enkryptai-stack`	`postgres-superuser-secret`	Supabase (on-prem)
`enkryptai-stack`	`redteam-proxy-env-secret`	`redteaming`
`enkryptai-stack`	`s3-cred`	`redteaming`, Supabase (MinIO)
`enkryptai-stack`	`superuser-secret`	Postgres (CloudNativePG)
`enkryptai-stack`	`litellm-gateway-env-secret`	`litellm`
`enkryptai-stack`	`guardrails-model-secret`	`guardrails-model`
`redteam-jobs`	`redteam-proxy-env-secret`	`redteam-jobs`

We support three different methods to create and manage secrets.

1. Static Kubernetes Secret (`secret.yaml`)

This is the most basic approach — define secrets directly in YAML. and apply it via kubectl

2. Helm Values-based Secrets

Secrets are injected via values.yaml and templated into Kubernetes Secrets

3. External Secrets

Currently, we support two external secret providers: AWS Secrets Manager and Azure Key Vault.

For deployments using External Secrets the Enkrypt AI team will provide the required configuration details during installation. This includes:

Secret naming conventions
Key/property mappings json file
Cloud-specific setup (IAM roles,IRSA, Workload Identity, etc.)

Do not attempt to create or map secrets manually. Incorrect structure or naming will result in deployment failures.

SMTP Requirements

We require SMTP to enable login. Right now, on-prem deployments only support SMTP based sign-in. If you want to use your own SMTP provider, update the relevant environment variables in your on-prem secret 6-onprem.yaml and re-apply it. Enkryptai can also supply an SMTP service (powered by Resend). If you choose that option, make sure smtp.resend.com is whitelisted in your environment. To configure any SMTP provider, update the environment variables shown below and re-apply the secret.

GOTRUE_MAILER_EXTERNAL_HOSTS: smtp.resend.com

GOTRUE_SMTP_ADMIN_EMAIL: no-reply@example.com                                                                                                                    
GOTRUE_SMTP_HOST: smtp.resend.com                                                                                                                                     
GOTRUE_SMTP_PORT: "587"                                                                                                                                               
GOTRUE_SMTP_SENDER_NAME: no-reply@example.com 

smtppassword: your_password

smtpusername: your_username 

Ingress and DNS Configuration

The Enkrypt AI stack requires three fully qualified domain names (FQDNs), each secured with a valid SSL/TLS certificate.

Component	Example FQDN	Purpose
Frontend UI	`app.example.com`	Enkrypt AI Web UI - Frontend
API Gateway	`api.example.com`	Backend API traffic routing - Gateway-Kong
Auth Service	`auth.example.com`	Authentication and DB APIs - Supabase

You can configure ingress using either Traefik with Cert Manager or the AWS Load Balancer (ALB) Controller with ACM.

Option A: Traefik Ingress Controller

If using Traefik, configure your values.yaml to use cert-manager for TLS.

# values.yaml for enkryptai-stack chart
ingress:
  enabled: true
  className: traefik
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod" # Or your preferred issuer
  hosts:
    - host: app.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: frontend-tls
      hosts:
        - app.example.com

Option B: AWS ALB Ingress Controller

If using the AWS ALB Controller, specify the ACM certificate ARN directly in the annotations.

# values.yaml for enkryptai-stack chart
ingress:
  enabled: true
  className: alb
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:REGION:ACCOUNT_ID:certificate/CERT_ID
    alb.ingress.kubernetes.io/ssl-redirect: '443'
  hosts:
    - host: app.example.com
      paths:
        - path: /
          pathType: Prefix

Option C: Azure AGIC Ingress Controller

If using Azure Kubernetes Service (AKS) with Application Gateway Ingress Controller (AGIC), configure TLS with Azure Key Vault or managed certificates:

# values.yaml for enkryptai-stack chart
ingress:
  enabled: true
  className: azure/application-gateway
  annotations:
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    appgw.ingress.kubernetes.io/backend-protocol: "https"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    cert-manager.io/acme-challenge-type: "http01"
  hosts:
    - host: app.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: frontend-tls
      hosts:
        - app.example.com

Get Started for Guardrails

Get Started for Red Team

Get Started with AI Proxy

Get Started with MCP

On-Prem Installation

Configuration and Installation

1. Prerequisites

Namespaces

Kubernetes Secrets

1. Static Kubernetes Secret (`secret.yaml`)

2. Helm Values-based Secrets

3. External Secrets

SMTP Requirements

Ingress and DNS Configuration

Option A: Traefik Ingress Controller

Option B: AWS ALB Ingress Controller

Option C: Azure AGIC Ingress Controller

​1. Prerequisites

​Namespaces

​Kubernetes Secrets

​1. Static Kubernetes Secret (secret.yaml)

​2. Helm Values-based Secrets

​3. External Secrets

​SMTP Requirements

​Ingress and DNS Configuration

​Option A: Traefik Ingress Controller

​Option B: AWS ALB Ingress Controller

​Option C: Azure AGIC Ingress Controller

1. Prerequisites

Namespaces

Kubernetes Secrets

1. Static Kubernetes Secret (`secret.yaml`)

2. Helm Values-based Secrets

3. External Secrets

SMTP Requirements

Ingress and DNS Configuration

Option A: Traefik Ingress Controller

Option B: AWS ALB Ingress Controller

Option C: Azure AGIC Ingress Controller